* [gentoo-commits] linux-patches r2311 - in genpatches-2.6/trunk: 3.0 3.4 3.8
@ 2013-03-15 20:43 Tom Wijsman (tomwij)
0 siblings, 0 replies; only message in thread
From: Tom Wijsman (tomwij) @ 2013-03-15 20:43 UTC (permalink / raw
To: gentoo-commits
Author: tomwij
Date: 2013-03-15 20:43:37 +0000 (Fri, 15 Mar 2013)
New Revision: 2311
Added:
genpatches-2.6/trunk/3.0/1068_linux-3.0.69.patch
genpatches-2.6/trunk/3.4/1035_linux-3.4.36.patch
genpatches-2.6/trunk/3.8/1002_linux-3.8.3.patch
Modified:
genpatches-2.6/trunk/3.0/0000_README
genpatches-2.6/trunk/3.4/0000_README
genpatches-2.6/trunk/3.8/0000_README
Log:
Linux patches 3.0.69, 3.4.36 and 3.8.3.
Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README 2013-03-09 10:14:40 UTC (rev 2310)
+++ genpatches-2.6/trunk/3.0/0000_README 2013-03-15 20:43:37 UTC (rev 2311)
@@ -307,6 +307,10 @@
From: http://www.kernel.org
Desc: Linux 3.0.68
+Patch: 1068_linux-3.0.69.patch
+From: http://www.kernel.org
+Desc: Linux 3.0.69
+
Patch: 1800_fix-zcache-build.patch
From: http://bugs.gentoo.org/show_bug.cgi?id=376325
Desc: Fix zcache build error
Added: genpatches-2.6/trunk/3.0/1068_linux-3.0.69.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1068_linux-3.0.69.patch (rev 0)
+++ genpatches-2.6/trunk/3.0/1068_linux-3.0.69.patch 2013-03-15 20:43:37 UTC (rev 2311)
@@ -0,0 +1,495 @@
+diff --git a/Makefile b/Makefile
+index 8f3b7a8..534f7de 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 68
++SUBLEVEL = 69
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index 724ba3b..1aa3a70 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -721,7 +721,6 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- mm_segment_t fs;
+ unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+@@ -729,16 +728,15 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ instrptr = instruction_pointer(regs);
+
+- fs = get_fs();
+- set_fs(KERNEL_DS);
+ if (thumb_mode(regs)) {
+- fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
++ u16 *ptr = (u16 *)(instrptr & ~1);
++ fault = probe_kernel_address(ptr, tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+ u16 tinst2 = 0;
+- fault = __get_user(tinst2, (u16 *)(instrptr+2));
++ fault = probe_kernel_address(ptr + 1, tinst2);
+ instr = (tinstr << 16) | tinst2;
+ thumb2_32b = 1;
+ } else {
+@@ -747,8 +745,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ }
+ }
+ } else
+- fault = __get_user(instr, (u32 *)instrptr);
+- set_fs(fs);
++ fault = probe_kernel_address(instrptr, instr);
+
+ if (fault) {
+ type = TYPE_FAULT;
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index ce18802..e9c8f53 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -369,7 +369,7 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
+ * If there isn't a second FP instruction, exit now. Note that
+ * the FPEXC.FP2V bit is valid only if FPEXC.EX is 1.
+ */
+- if (fpexc ^ (FPEXC_EX | FPEXC_FP2V))
++ if ((fpexc & (FPEXC_EX | FPEXC_FP2V)) != (FPEXC_EX | FPEXC_FP2V))
+ goto exit;
+
+ /*
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index 2016aad..564f6c4 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -40,6 +40,7 @@
+ #include <linux/init.h>
+ #include <linux/miscdevice.h>
+ #include <linux/delay.h>
++#include <linux/slab.h>
+ #include <asm/uaccess.h>
+
+
+@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
+ static LIST_HEAD(rng_list);
+ static DEFINE_MUTEX(rng_mutex);
+ static int data_avail;
+-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
+- __cacheline_aligned;
++static u8 *rng_buffer;
++
++static size_t rng_buffer_size(void)
++{
++ return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
++}
+
+ static inline int hwrng_init(struct hwrng *rng)
+ {
+@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
+
+ if (!data_avail) {
+ bytes_read = rng_get_data(current_rng, rng_buffer,
+- sizeof(rng_buffer),
++ rng_buffer_size(),
+ !(filp->f_flags & O_NONBLOCK));
+ if (bytes_read < 0) {
+ err = bytes_read;
+@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
+
+ mutex_lock(&rng_mutex);
+
++ /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
++ err = -ENOMEM;
++ if (!rng_buffer) {
++ rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
++ if (!rng_buffer)
++ goto out_unlock;
++ }
++
+ /* Must not register two RNGs with the same name. */
+ err = -EEXIST;
+ list_for_each_entry(tmp, &rng_list, list) {
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index faf7c52..df41080 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -329,6 +329,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
+ cpufreq_update_policy(cpu);
+ break;
+ case CPU_DOWN_PREPARE:
++ case CPU_DOWN_PREPARE_FROZEN:
+ cpufreq_stats_free_sysfs(cpu);
+ break;
+ case CPU_DEAD:
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 66b6315..03ab4e8 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -442,7 +442,6 @@ static int __init dmi_present(const char __iomem *p)
+ static int __init smbios_present(const char __iomem *p)
+ {
+ u8 buf[32];
+- int offset = 0;
+
+ memcpy_fromio(buf, p, 32);
+ if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+@@ -461,9 +460,9 @@ static int __init smbios_present(const char __iomem *p)
+ dmi_ver = 0x0206;
+ break;
+ }
+- offset = 16;
++ return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+ }
+- return dmi_present(buf + offset);
++ return 1;
+ }
+
+ void __init dmi_scan_machine(void)
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 2157e77..98fb3d7 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -958,6 +958,15 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ found = 1;
+ }
+
++ /* quirks */
++ /* Radeon 9100 (R200) */
++ if ((dev->pdev->device == 0x514D) &&
++ (dev->pdev->subsystem_vendor == 0x174B) &&
++ (dev->pdev->subsystem_device == 0x7149)) {
++ /* vbios value is bad, use the default */
++ found = 0;
++ }
++
+ if (!found) /* fallback to defaults */
+ radeon_legacy_get_primary_dac_info_from_table(rdev, p_dac);
+
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index 9594cdb..bbfa1e3 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -926,7 +926,13 @@ static int __devinit sht15_probe(struct platform_device *pdev)
+ if (voltage)
+ data->supply_uV = voltage;
+
+- regulator_enable(data->reg);
++ ret = regulator_enable(data->reg);
++ if (ret != 0) {
++ dev_err(&pdev->dev,
++ "failed to enable regulator: %d\n", ret);
++ return ret;
++ }
++
+ /*
+ * Setup a notifier block to update this if another device
+ * causes the voltage to change
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index e86bf36..0e5084b 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -283,7 +283,7 @@ abort:
+ kfree(conf->strip_zone);
+ kfree(conf->devlist);
+ kfree(conf);
+- *private_conf = NULL;
++ *private_conf = ERR_PTR(err);
+ return err;
+ }
+
+diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
+index 5430a9a..4ef2552 100644
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -5330,7 +5330,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ */
+ e1000e_release_hw_control(adapter);
+
+- pci_disable_device(pdev);
++ pci_clear_master(pdev);
+
+ return 0;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
+index 77ec288..247f7f8 100644
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -35,7 +35,7 @@
+ #define WME_AC_BK 3
+ #define WME_NUM_AC 4
+
+-#define ATH_RSSI_DUMMY_MARKER 0x127
++#define ATH_RSSI_DUMMY_MARKER 127
+ #define ATH_RSSI_LPF_LEN 10
+ #define RSSI_LPF_THRESHOLD -20
+ #define ATH_RSSI_EP_MULTIPLIER (1<<7)
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index f5b718d..aed7756 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -3747,13 +3747,13 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
+ dcb->max_command = 1;
+ dcb->target_id = target;
+ dcb->target_lun = lun;
++ dcb->dev_mode = eeprom->target[target].cfg0;
+ #ifndef DC395x_NO_DISCONNECT
+ dcb->identify_msg =
+ IDENTIFY(dcb->dev_mode & NTC_DO_DISCONNECT, lun);
+ #else
+ dcb->identify_msg = IDENTIFY(0, lun);
+ #endif
+- dcb->dev_mode = eeprom->target[target].cfg0;
+ dcb->inquiry7 = 0;
+ dcb->sync_mode = 0;
+ dcb->min_nego_period = clock_period[period_index];
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 331d423..af0c500 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -1210,7 +1210,6 @@ static int __pscsi_map_task_SG(
+ bio = NULL;
+ }
+
+- page++;
+ len -= bytes;
+ data_len -= bytes;
+ off = 0;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 43baaf0..06c8ced 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -512,6 +512,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
+ new_device->writeable = 0;
+ new_device->in_fs_metadata = 0;
+ new_device->can_discard = 0;
++ spin_lock_init(&new_device->io_lock);
+ list_replace_rcu(&device->dev_list, &new_device->dev_list);
+
+ call_rcu(&device->rcu, free_device);
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 53e7d72..bf6aa8c 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -571,6 +571,11 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ dentry = ERR_PTR(-ENOENT);
+ break;
+ }
++ if (!S_ISDIR(dir->i_mode)) {
++ dput(dentry);
++ dentry = ERR_PTR(-ENOTDIR);
++ break;
++ }
+
+ /* skip separators */
+ while (*s == sep)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 0499a96..342aa86 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -859,6 +859,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ int ret = -ENOENT;
+
++ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
++ return -EINVAL;
++
+ mutex_lock(&inode->i_mutex);
+
+ if (inode->i_pipe) {
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index 2ad39e5..57c92f2 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -386,24 +386,28 @@ config KPROBE_EVENT
+ If you want to use perf tools, this option is strongly recommended.
+
+ config DYNAMIC_FTRACE
+- bool "enable/disable ftrace tracepoints dynamically"
++ bool "enable/disable function tracing dynamically"
+ depends on FUNCTION_TRACER
+ depends on HAVE_DYNAMIC_FTRACE
+ default y
+ help
+- This option will modify all the calls to ftrace dynamically
+- (will patch them out of the binary image and replace them
+- with a No-Op instruction) as they are called. A table is
+- created to dynamically enable them again.
++ This option will modify all the calls to function tracing
++ dynamically (will patch them out of the binary image and
++ replace them with a No-Op instruction) on boot up. During
++ compile time, a table is made of all the locations that ftrace
++ can function trace, and this table is linked into the kernel
++ image. When this is enabled, functions can be individually
++ enabled, and the functions not enabled will not affect
++ performance of the system.
++
++ See the files in /sys/kernel/debug/tracing:
++ available_filter_functions
++ set_ftrace_filter
++ set_ftrace_notrace
+
+ This way a CONFIG_FUNCTION_TRACER kernel is slightly larger, but
+ otherwise has native performance as long as no tracing is active.
+
+- The changes to the code are done by a kernel thread that
+- wakes up once a second and checks to see if any ftrace calls
+- were made. If so, it runs stop_machine (stops all CPUS)
+- and modifies the code to jump over the call to ftrace.
+-
+ config FUNCTION_PROFILER
+ bool "Kernel function profiler"
+ depends on FUNCTION_TRACER
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index ea3b6ee..d71f0d2 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -2355,6 +2355,8 @@ static const struct proto_ops dn_proto_ops = {
+ .sendpage = sock_no_sendpage,
+ };
+
++void dn_register_sysctl_skeleton(void);
++void dn_unregister_sysctl_skeleton(void);
+ void dn_register_sysctl(void);
+ void dn_unregister_sysctl(void);
+
+@@ -2375,6 +2377,7 @@ static int __init decnet_init(void)
+ if (rc != 0)
+ goto out;
+
++ dn_register_sysctl_skeleton();
+ dn_neigh_init();
+ dn_dev_init();
+ dn_route_init();
+@@ -2414,6 +2417,7 @@ static void __exit decnet_exit(void)
+ dn_fib_cleanup();
+
+ proc_net_remove(&init_net, "decnet");
++ dn_unregister_sysctl_skeleton();
+
+ proto_unregister(&dn_proto);
+
+diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
+index 28f8b5e..d1cc2fd 100644
+--- a/net/decnet/sysctl_net_decnet.c
++++ b/net/decnet/sysctl_net_decnet.c
+@@ -55,6 +55,7 @@ static int max_decnet_no_fc_max_cwnd[] = { NSP_MAX_WINDOW };
+ static char node_name[7] = "???";
+
+ static struct ctl_table_header *dn_table_header = NULL;
++static struct ctl_table_header *dn_skeleton_table_header = NULL;
+
+ /*
+ * ctype.h :-)
+@@ -356,6 +357,27 @@ static struct ctl_path dn_path[] = {
+ { }
+ };
+
++static struct ctl_table empty[1];
++
++static struct ctl_table dn_skeleton[] = {
++ {
++ .procname = "conf",
++ .mode = 0555,
++ .child = empty,
++ },
++ { }
++};
++
++void dn_register_sysctl_skeleton(void)
++{
++ dn_skeleton_table_header = register_sysctl_paths(dn_path, dn_skeleton);
++}
++
++void dn_unregister_sysctl_skeleton(void)
++{
++ unregister_sysctl_table(dn_skeleton_table_header);
++}
++
+ void dn_register_sysctl(void)
+ {
+ dn_table_header = register_sysctl_paths(dn_path, dn_table);
+@@ -367,6 +389,12 @@ void dn_unregister_sysctl(void)
+ }
+
+ #else /* CONFIG_SYSCTL */
++void dn_register_sysctl_skeleton(void)
++{
++}
++void dn_unregister_sysctl_skeleton(void)
++{
++}
+ void dn_unregister_sysctl(void)
+ {
+ }
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index ce5eb68..837ab44 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -471,13 +471,17 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
+ * xprt_wait_for_buffer_space - wait for transport output buffer to clear
+ * @task: task to be put to sleep
+ * @action: function pointer to be executed after wait
++ *
++ * Note that we only set the timer for the case of RPC_IS_SOFT(), since
++ * we don't in general want to force a socket disconnection due to
++ * an incomplete RPC call transmission.
+ */
+ void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
+ {
+ struct rpc_rqst *req = task->tk_rqstp;
+ struct rpc_xprt *xprt = req->rq_xprt;
+
+- task->tk_timeout = req->rq_timeout;
++ task->tk_timeout = RPC_IS_SOFT(task) ? req->rq_timeout : 0;
+ rpc_sleep_on(&xprt->pending, task, action);
+ }
+ EXPORT_SYMBOL_GPL(xprt_wait_for_buffer_space);
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index a3063eb..44a5100 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -54,7 +54,7 @@ int install_user_keyrings(void)
+
+ kenter("%p{%u}", user, user->uid);
+
+- if (user->uid_keyring) {
++ if (user->uid_keyring && user->session_keyring) {
+ kleave(" = 0 [exist]");
+ return 0;
+ }
+diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
+index a39d3d8..6058a37 100644
+--- a/sound/core/vmaster.c
++++ b/sound/core/vmaster.c
+@@ -207,7 +207,10 @@ static int slave_put(struct snd_kcontrol *kcontrol,
+ }
+ if (!changed)
+ return 0;
+- return slave_put_val(slave, ucontrol);
++ err = slave_put_val(slave, ucontrol);
++ if (err < 0)
++ return err;
++ return 1;
+ }
+
+ static int slave_tlv_cmd(struct snd_kcontrol *kcontrol,
+diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
+index f4594d7..3ec8fed 100644
+--- a/sound/pci/ice1712/ice1712.c
++++ b/sound/pci/ice1712/ice1712.c
+@@ -2595,6 +2595,8 @@ static int __devinit snd_ice1712_create(struct snd_card *card,
+ snd_ice1712_proc_init(ice);
+ synchronize_irq(pci->irq);
+
++ card->private_data = ice;
++
+ err = pci_request_regions(pci, "ICE1712");
+ if (err < 0) {
+ kfree(ice);
Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README 2013-03-09 10:14:40 UTC (rev 2310)
+++ genpatches-2.6/trunk/3.4/0000_README 2013-03-15 20:43:37 UTC (rev 2311)
@@ -179,6 +179,10 @@
From: http://www.kernel.org
Desc: Linux 3.4.35
+Patch: 1035_linux-3.4.36.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.36
+
Patch: 1700_correct-bnx2-firware-ver-mips.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=424609
Desc: Correct firmware version for bnx2 on mips
Added: genpatches-2.6/trunk/3.4/1035_linux-3.4.36.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1035_linux-3.4.36.patch (rev 0)
+++ genpatches-2.6/trunk/3.4/1035_linux-3.4.36.patch 2013-03-15 20:43:37 UTC (rev 2311)
@@ -0,0 +1,1311 @@
+diff --git a/Makefile b/Makefile
+index 282e8da..2659987 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 35
++SUBLEVEL = 36
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
+index 00755d8..7deaa7f 100644
+--- a/arch/arm/kernel/perf_event_v7.c
++++ b/arch/arm/kernel/perf_event_v7.c
+@@ -775,7 +775,7 @@ static const unsigned armv7_a7_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+ * PMXEVTYPER: Event selection reg
+ */
+-#define ARMV7_EVTYPE_MASK 0xc00000ff /* Mask for writable bits */
++#define ARMV7_EVTYPE_MASK 0xc80000ff /* Mask for writable bits */
+ #define ARMV7_EVTYPE_EVENT 0xff /* Mask for EVENT bits */
+
+ /*
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index 9107231..fc000e3 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -750,7 +750,6 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- mm_segment_t fs;
+ unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+@@ -761,16 +760,15 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ instrptr = instruction_pointer(regs);
+
+- fs = get_fs();
+- set_fs(KERNEL_DS);
+ if (thumb_mode(regs)) {
+- fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
++ u16 *ptr = (u16 *)(instrptr & ~1);
++ fault = probe_kernel_address(ptr, tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+ u16 tinst2 = 0;
+- fault = __get_user(tinst2, (u16 *)(instrptr+2));
++ fault = probe_kernel_address(ptr + 1, tinst2);
+ instr = (tinstr << 16) | tinst2;
+ thumb2_32b = 1;
+ } else {
+@@ -779,8 +777,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ }
+ }
+ } else
+- fault = __get_user(instr, (u32 *)instrptr);
+- set_fs(fs);
++ fault = probe_kernel_address(instrptr, instr);
+
+ if (fault) {
+ type = TYPE_FAULT;
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 3b36062..eede545 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -413,7 +413,7 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
+ * If there isn't a second FP instruction, exit now. Note that
+ * the FPEXC.FP2V bit is valid only if FPEXC.EX is 1.
+ */
+- if (fpexc ^ (FPEXC_EX | FPEXC_FP2V))
++ if ((fpexc & (FPEXC_EX | FPEXC_FP2V)) != (FPEXC_EX | FPEXC_FP2V))
+ goto exit;
+
+ /*
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 56ab749..94e7662 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -162,6 +162,9 @@ static int xen_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ struct msi_desc *msidesc;
+ int *v;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ v = kzalloc(sizeof(int) * max(1, nvec), GFP_KERNEL);
+ if (!v)
+ return -ENOMEM;
+@@ -220,6 +223,9 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ struct msi_desc *msidesc;
+ struct msi_msg msg;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ list_for_each_entry(msidesc, &dev->msi_list, list) {
+ __read_msi_msg(msidesc, &msg);
+ pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
+@@ -263,6 +269,9 @@ static int xen_initdom_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ int ret = 0;
+ struct msi_desc *msidesc;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ list_for_each_entry(msidesc, &dev->msi_list, list) {
+ struct physdev_map_pirq map_irq;
+ domid_t domid;
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 5910054..194dbcd 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -64,6 +64,7 @@
+ #include <asm/hypervisor.h>
+ #include <asm/mwait.h>
+ #include <asm/pci_x86.h>
++#include <asm/pat.h>
+
+ #ifdef CONFIG_ACPI
+ #include <linux/acpi.h>
+@@ -1355,7 +1356,14 @@ asmlinkage void __init xen_start_kernel(void)
+ */
+ acpi_numa = -1;
+ #endif
+-
++#ifdef CONFIG_X86_PAT
++ /*
++ * For right now disable the PAT. We should remove this once
++ * git commit 8eaffa67b43e99ae581622c5133e20b0f48bcef1
++ * (xen/pat: Disable PAT support for now) is reverted.
++ */
++ pat_enabled = 0;
++#endif
+ pgd = (pgd_t *)xen_start_info->pt_base;
+
+ /* Don't do the full vcpu_info placement stuff until we have a
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 8d3a056..45fe410 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -388,9 +388,9 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "ablkcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_ablkcipher.geniv ?: "<default>");
++ strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+@@ -469,9 +469,9 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "givcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_ablkcipher.geniv ?: "<built-in>");
++ strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+diff --git a/crypto/aead.c b/crypto/aead.c
+index e4cb351..c706d74 100644
+--- a/crypto/aead.c
++++ b/crypto/aead.c
+@@ -117,9 +117,8 @@ static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_aead raead;
+ struct aead_alg *aead = &alg->cra_aead;
+
+- snprintf(raead.type, CRYPTO_MAX_ALG_NAME, "%s", "aead");
+- snprintf(raead.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- aead->geniv ?: "<built-in>");
++ strncpy(raead.type, "aead", sizeof(raead.type));
++ strncpy(raead.geniv, aead->geniv ?: "<built-in>", sizeof(raead.geniv));
+
+ raead.blocksize = alg->cra_blocksize;
+ raead.maxauthsize = aead->maxauthsize;
+@@ -203,8 +202,8 @@ static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_aead raead;
+ struct aead_alg *aead = &alg->cra_aead;
+
+- snprintf(raead.type, CRYPTO_MAX_ALG_NAME, "%s", "nivaead");
+- snprintf(raead.geniv, CRYPTO_MAX_ALG_NAME, "%s", aead->geniv);
++ strncpy(raead.type, "nivaead", sizeof(raead.type));
++ strncpy(raead.geniv, aead->geniv, sizeof(raead.geniv));
+
+ raead.blocksize = alg->cra_blocksize;
+ raead.maxauthsize = aead->maxauthsize;
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 33bc9b6..0ec05fe 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -404,7 +404,7 @@ static int crypto_ahash_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_hash rhash;
+
+- snprintf(rhash.type, CRYPTO_MAX_ALG_NAME, "%s", "ahash");
++ strncpy(rhash.type, "ahash", sizeof(rhash.type));
+
+ rhash.blocksize = alg->cra_blocksize;
+ rhash.digestsize = __crypto_hash_alg_common(alg)->digestsize;
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 4dd80c7..0a1ebea 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -499,9 +499,9 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "blkcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_blkcipher.geniv ?: "<default>");
++ strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index f1ea0a0..910497b 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -75,7 +75,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_cipher rcipher;
+
+- snprintf(rcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "cipher");
++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
+
+ rcipher.blocksize = alg->cra_blocksize;
+ rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
+@@ -94,8 +94,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rcomp;
+
+- snprintf(rcomp.type, CRYPTO_MAX_ALG_NAME, "%s", "compression");
+-
++ strncpy(rcomp.type, "compression", sizeof(rcomp.type));
+ NLA_PUT(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rcomp);
+
+@@ -108,12 +107,14 @@ nla_put_failure:
+ static int crypto_report_one(struct crypto_alg *alg,
+ struct crypto_user_alg *ualg, struct sk_buff *skb)
+ {
+- memcpy(&ualg->cru_name, &alg->cra_name, sizeof(ualg->cru_name));
+- memcpy(&ualg->cru_driver_name, &alg->cra_driver_name,
+- sizeof(ualg->cru_driver_name));
+- memcpy(&ualg->cru_module_name, module_name(alg->cra_module),
+- CRYPTO_MAX_ALG_NAME);
+-
++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
++ strncpy(ualg->cru_driver_name, alg->cra_driver_name,
++ sizeof(ualg->cru_driver_name));
++ strncpy(ualg->cru_module_name, module_name(alg->cra_module),
++ sizeof(ualg->cru_module_name));
++
++ ualg->cru_type = 0;
++ ualg->cru_mask = 0;
+ ualg->cru_flags = alg->cra_flags;
+ ualg->cru_refcnt = atomic_read(&alg->cra_refcnt);
+
+@@ -122,8 +123,7 @@ static int crypto_report_one(struct crypto_alg *alg,
+ if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
+ struct crypto_report_larval rl;
+
+- snprintf(rl.type, CRYPTO_MAX_ALG_NAME, "%s", "larval");
+-
++ strncpy(rl.type, "larval", sizeof(rl.type));
+ NLA_PUT(skb, CRYPTOCFGA_REPORT_LARVAL,
+ sizeof(struct crypto_report_larval), &rl);
+
+diff --git a/crypto/pcompress.c b/crypto/pcompress.c
+index 2e458e5..6f2a361 100644
+--- a/crypto/pcompress.c
++++ b/crypto/pcompress.c
+@@ -53,8 +53,7 @@ static int crypto_pcomp_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rpcomp;
+
+- snprintf(rpcomp.type, CRYPTO_MAX_ALG_NAME, "%s", "pcomp");
+-
++ strncpy(rpcomp.type, "pcomp", sizeof(rpcomp.type));
+ NLA_PUT(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rpcomp);
+
+diff --git a/crypto/rng.c b/crypto/rng.c
+index 64f864f..1966c1d 100644
+--- a/crypto/rng.c
++++ b/crypto/rng.c
+@@ -65,7 +65,7 @@ static int crypto_rng_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_rng rrng;
+
+- snprintf(rrng.type, CRYPTO_MAX_ALG_NAME, "%s", "rng");
++ strncpy(rrng.type, "rng", sizeof(rrng.type));
+
+ rrng.seedsize = alg->cra_rng.seedsize;
+
+diff --git a/crypto/shash.c b/crypto/shash.c
+index 21fc12e..3b2a71f 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -530,7 +530,8 @@ static int crypto_shash_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_hash rhash;
+ struct shash_alg *salg = __crypto_shash_alg(alg);
+
+- snprintf(rhash.type, CRYPTO_MAX_ALG_NAME, "%s", "shash");
++ strncpy(rhash.type, "shash", sizeof(rhash.type));
++
+ rhash.blocksize = alg->cra_blocksize;
+ rhash.digestsize = salg->digestsize;
+
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 88f6908..47bd6ab 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -1594,12 +1594,31 @@ static void piix_ignore_devices_quirk(struct ata_host *host)
+ },
+ { } /* terminate list */
+ };
+- const struct dmi_system_id *dmi = dmi_first_match(ignore_hyperv);
++ static const struct dmi_system_id allow_virtual_pc[] = {
++ {
++ /* In MS Virtual PC guests the DMI ident is nearly
++ * identical to a Hyper-V guest. One difference is the
++ * product version which is used here to identify
++ * a Virtual PC guest. This entry allows ata_piix to
++ * drive the emulated hardware.
++ */
++ .ident = "MS Virtual PC 2007",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR,
++ "Microsoft Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "VS2005R2"),
++ },
++ },
++ { } /* terminate list */
++ };
++ const struct dmi_system_id *ignore = dmi_first_match(ignore_hyperv);
++ const struct dmi_system_id *allow = dmi_first_match(allow_virtual_pc);
+
+- if (dmi && prefer_ms_hyperv) {
++ if (ignore && !allow && prefer_ms_hyperv) {
+ host->flags |= ATA_HOST_IGNORE_ATA;
+ dev_info(host->dev, "%s detected, ATA device ignore set\n",
+- dmi->ident);
++ ignore->ident);
+ }
+ #endif
+ }
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index 1bafb40..69ae597 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -40,6 +40,7 @@
+ #include <linux/init.h>
+ #include <linux/miscdevice.h>
+ #include <linux/delay.h>
++#include <linux/slab.h>
+ #include <asm/uaccess.h>
+
+
+@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
+ static LIST_HEAD(rng_list);
+ static DEFINE_MUTEX(rng_mutex);
+ static int data_avail;
+-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
+- __cacheline_aligned;
++static u8 *rng_buffer;
++
++static size_t rng_buffer_size(void)
++{
++ return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
++}
+
+ static inline int hwrng_init(struct hwrng *rng)
+ {
+@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
+
+ if (!data_avail) {
+ bytes_read = rng_get_data(current_rng, rng_buffer,
+- sizeof(rng_buffer),
++ rng_buffer_size(),
+ !(filp->f_flags & O_NONBLOCK));
+ if (bytes_read < 0) {
+ err = bytes_read;
+@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
+
+ mutex_lock(&rng_mutex);
+
++ /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
++ err = -ENOMEM;
++ if (!rng_buffer) {
++ rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
++ if (!rng_buffer)
++ goto out_unlock;
++ }
++
+ /* Must not register two RNGs with the same name. */
+ err = -EEXIST;
+ list_for_each_entry(tmp, &rng_list, list) {
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index b40ee14..3998316 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -328,6 +328,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
+ cpufreq_update_policy(cpu);
+ break;
+ case CPU_DOWN_PREPARE:
++ case CPU_DOWN_PREPARE_FROZEN:
+ cpufreq_stats_free_sysfs(cpu);
+ break;
+ case CPU_DEAD:
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 982f1f5..4cd392d 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -442,7 +442,6 @@ static int __init dmi_present(const char __iomem *p)
+ static int __init smbios_present(const char __iomem *p)
+ {
+ u8 buf[32];
+- int offset = 0;
+
+ memcpy_fromio(buf, p, 32);
+ if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+@@ -461,9 +460,9 @@ static int __init smbios_present(const char __iomem *p)
+ dmi_ver = 0x0206;
+ break;
+ }
+- offset = 16;
++ return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+ }
+- return dmi_present(buf + offset);
++ return 1;
+ }
+
+ void __init dmi_scan_machine(void)
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index a2470d9..2b2c557 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -958,6 +958,15 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ found = 1;
+ }
+
++ /* quirks */
++ /* Radeon 9100 (R200) */
++ if ((dev->pdev->device == 0x514D) &&
++ (dev->pdev->subsystem_vendor == 0x174B) &&
++ (dev->pdev->subsystem_device == 0x7149)) {
++ /* vbios value is bad, use the default */
++ found = 0;
++ }
++
+ if (!found) /* fallback to defaults */
+ radeon_legacy_get_primary_dac_info_from_table(rdev, p_dac);
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 88d2010..73b67ab 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -451,19 +451,25 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
+ struct dj_report *dj_report)
+ {
+ struct hid_device *hdev = djrcv_dev->hdev;
+- int sent_bytes;
++ struct hid_report *report;
++ struct hid_report_enum *output_report_enum;
++ u8 *data = (u8 *)(&dj_report->device_index);
++ int i;
+
+- if (!hdev->hid_output_raw_report) {
+- dev_err(&hdev->dev, "%s:"
+- "hid_output_raw_report is null\n", __func__);
++ output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
++ report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
++
++ if (!report) {
++ dev_err(&hdev->dev, "%s: unable to find dj report\n", __func__);
+ return -ENODEV;
+ }
+
+- sent_bytes = hdev->hid_output_raw_report(hdev, (u8 *) dj_report,
+- sizeof(struct dj_report),
+- HID_OUTPUT_REPORT);
++ for (i = 0; i < report->field[0]->report_count; i++)
++ report->field[0]->value[i] = data[i];
++
++ usbhid_submit_report(hdev, report, USB_DIR_OUT);
+
+- return (sent_bytes < 0) ? sent_bytes : 0;
++ return 0;
+ }
+
+ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
+diff --git a/drivers/hwmon/pmbus/ltc2978.c b/drivers/hwmon/pmbus/ltc2978.c
+index 9652a2c..a58de38 100644
+--- a/drivers/hwmon/pmbus/ltc2978.c
++++ b/drivers/hwmon/pmbus/ltc2978.c
+@@ -62,7 +62,7 @@ struct ltc2978_data {
+ int temp_min, temp_max;
+ int vout_min[8], vout_max[8];
+ int iout_max[2];
+- int temp2_max[2];
++ int temp2_max;
+ struct pmbus_driver_info info;
+ };
+
+@@ -204,10 +204,9 @@ static int ltc3880_read_word_data(struct i2c_client *client, int page, int reg)
+ ret = pmbus_read_word_data(client, page,
+ LTC3880_MFR_TEMPERATURE2_PEAK);
+ if (ret >= 0) {
+- if (lin11_to_val(ret)
+- > lin11_to_val(data->temp2_max[page]))
+- data->temp2_max[page] = ret;
+- ret = data->temp2_max[page];
++ if (lin11_to_val(ret) > lin11_to_val(data->temp2_max))
++ data->temp2_max = ret;
++ ret = data->temp2_max;
+ }
+ break;
+ case PMBUS_VIRT_READ_VIN_MIN:
+@@ -248,11 +247,11 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
+
+ switch (reg) {
+ case PMBUS_VIRT_RESET_IOUT_HISTORY:
+- data->iout_max[page] = 0x7fff;
++ data->iout_max[page] = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_TEMP2_HISTORY:
+- data->temp2_max[page] = 0x7fff;
++ data->temp2_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_VOUT_HISTORY:
+@@ -262,12 +261,12 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
+ break;
+ case PMBUS_VIRT_RESET_VIN_HISTORY:
+ data->vin_min = 0x7bff;
+- data->vin_max = 0;
++ data->vin_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_TEMP_HISTORY:
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7fff;
++ data->temp_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ default:
+@@ -321,12 +320,13 @@ static int ltc2978_probe(struct i2c_client *client,
+ info = &data->info;
+ info->write_word_data = ltc2978_write_word_data;
+
+- data->vout_min[0] = 0xffff;
+ data->vin_min = 0x7bff;
++ data->vin_max = 0x7c00;
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7fff;
++ data->temp_max = 0x7c00;
++ data->temp2_max = 0x7c00;
+
+- switch (id->driver_data) {
++ switch (data->id) {
+ case ltc2978:
+ info->read_word_data = ltc2978_read_word_data;
+ info->pages = 8;
+@@ -336,7 +336,6 @@ static int ltc2978_probe(struct i2c_client *client,
+ for (i = 1; i < 8; i++) {
+ info->func[i] = PMBUS_HAVE_VOUT
+ | PMBUS_HAVE_STATUS_VOUT;
+- data->vout_min[i] = 0xffff;
+ }
+ break;
+ case ltc3880:
+@@ -352,11 +351,14 @@ static int ltc2978_probe(struct i2c_client *client,
+ | PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT
+ | PMBUS_HAVE_POUT
+ | PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
+- data->vout_min[1] = 0xffff;
++ data->iout_max[0] = 0x7c00;
++ data->iout_max[1] = 0x7c00;
+ break;
+ default:
+ return -ENODEV;
+ }
++ for (i = 0; i < info->pages; i++)
++ data->vout_min[i] = 0xffff;
+
+ return pmbus_do_probe(client, id, info);
+ }
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index 8b011d0..eb01802 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -926,7 +926,13 @@ static int __devinit sht15_probe(struct platform_device *pdev)
+ if (voltage)
+ data->supply_uV = voltage;
+
+- regulator_enable(data->reg);
++ ret = regulator_enable(data->reg);
++ if (ret != 0) {
++ dev_err(&pdev->dev,
++ "failed to enable regulator: %d\n", ret);
++ return ret;
++ }
++
+ /*
+ * Setup a notifier block to update this if another device
+ * causes the voltage to change
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 0a447a1..e0930bb 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -344,6 +344,10 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
+ bio_io_error(bio);
+ return;
+ }
++ if (mddev->ro == 1 && unlikely(rw == WRITE)) {
++ bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
++ return;
++ }
+ smp_rmb(); /* Ensure implications of 'active' are visible */
+ rcu_read_lock();
+ if (mddev->suspended) {
+@@ -2882,6 +2886,9 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+ } else if (!sectors)
+ sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
+ rdev->data_offset;
++ if (!my_mddev->pers->resize)
++ /* Cannot change size for RAID0 or Linear etc */
++ return -EINVAL;
+ }
+ if (sectors < my_mddev->dev_sectors)
+ return -EINVAL; /* component must fit device */
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index de63a1f..06a0257 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -280,7 +280,7 @@ abort:
+ kfree(conf->strip_zone);
+ kfree(conf->devlist);
+ kfree(conf);
+- *private_conf = NULL;
++ *private_conf = ERR_PTR(err);
+ return err;
+ }
+
+@@ -402,7 +402,8 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks
+ "%s does not support generic reshape\n", __func__);
+
+ rdev_for_each(rdev, mddev)
+- array_sectors += rdev->sectors;
++ array_sectors += (rdev->sectors &
++ ~(sector_t)(mddev->chunk_sectors-1));
+
+ return array_sectors;
+ }
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 7e88aaf..c80b4b4 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5535,7 +5535,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ */
+ e1000e_release_hw_control(adapter);
+
+- pci_disable_device(pdev);
++ pci_clear_master(pdev);
+
+ return 0;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
+index ad14fec..f1c32a5 100644
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -35,7 +35,7 @@
+ #define WME_AC_BK 3
+ #define WME_NUM_AC 4
+
+-#define ATH_RSSI_DUMMY_MARKER 0x127
++#define ATH_RSSI_DUMMY_MARKER 127
+ #define ATH_RSSI_LPF_LEN 10
+ #define RSSI_LPF_THRESHOLD -20
+ #define ATH_RSSI_EP_MULTIPLIER (1<<7)
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 28a0edd..20baf70 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1404,7 +1404,9 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
+ reset_type = ATH9K_RESET_POWER_ON;
+ else
+ reset_type = ATH9K_RESET_COLD;
+- }
++ } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
++ (REG_READ(ah, AR_CR) & AR_CR_RXE))
++ reset_type = ATH9K_RESET_COLD;
+
+ if (!ath9k_hw_set_reset_reg(ah, reset_type))
+ return false;
+diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
+index 6ca3d8a..9abb8f5 100644
+--- a/drivers/net/wireless/mwifiex/pcie.c
++++ b/drivers/net/wireless/mwifiex/pcie.c
+@@ -288,7 +288,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
+ i++;
+ usleep_range(10, 20);
+ /* 50ms max wait */
+- if (i == 50000)
++ if (i == 5000)
+ break;
+ }
+
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 13aeca3..48105fc 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -3747,13 +3747,13 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
+ dcb->max_command = 1;
+ dcb->target_id = target;
+ dcb->target_lun = lun;
++ dcb->dev_mode = eeprom->target[target].cfg0;
+ #ifndef DC395x_NO_DISCONNECT
+ dcb->identify_msg =
+ IDENTIFY(dcb->dev_mode & NTC_DO_DISCONNECT, lun);
+ #else
+ dcb->identify_msg = IDENTIFY(0, lun);
+ #endif
+- dcb->dev_mode = eeprom->target[target].cfg0;
+ dcb->inquiry7 = 0;
+ dcb->sync_mode = 0;
+ dcb->min_nego_period = clock_period[period_index];
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 40a4570..f9986cc 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -467,6 +467,7 @@ static struct scatterlist *create_bounce_buffer(struct scatterlist *sgl,
+ if (!bounce_sgl)
+ return NULL;
+
++ sg_init_table(bounce_sgl, num_pages);
+ for (i = 0; i < num_pages; i++) {
+ page_buf = alloc_page(GFP_ATOMIC);
+ if (!page_buf)
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 94c905f..d084ba3 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -1042,7 +1042,6 @@ static int pscsi_map_sg(struct se_task *task, struct scatterlist *task_sg,
+ bio = NULL;
+ }
+
+- page++;
+ len -= bytes;
+ data_len -= bytes;
+ off = 0;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 67dda0d..49b139c 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2207,70 +2207,35 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ if ((portstatus & USB_PORT_STAT_RESET))
+ goto delay;
+
+- /*
+- * Some buggy devices require a warm reset to be issued even
+- * when the port appears not to be connected.
++ if (hub_port_warm_reset_required(hub, portstatus))
++ return -ENOTCONN;
++
++ /* Device went away? */
++ if (!(portstatus & USB_PORT_STAT_CONNECTION))
++ return -ENOTCONN;
++
++ /* bomb out completely if the connection bounced. A USB 3.0
++ * connection may bounce if multiple warm resets were issued,
++ * but the device may have successfully re-connected. Ignore it.
+ */
+- if (!warm) {
+- /*
+- * Some buggy devices can cause an NEC host controller
+- * to transition to the "Error" state after a hot port
+- * reset. This will show up as the port state in
+- * "Inactive", and the port may also report a
+- * disconnect. Forcing a warm port reset seems to make
+- * the device work.
+- *
+- * See https://bugzilla.kernel.org/show_bug.cgi?id=41752
+- */
+- if (hub_port_warm_reset_required(hub, portstatus)) {
+- int ret;
+-
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- if (portchange & USB_PORT_STAT_C_LINK_STATE)
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_PORT_LINK_STATE);
+- if (portchange & USB_PORT_STAT_C_RESET)
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_RESET);
+- dev_dbg(hub->intfdev, "hot reset failed, warm reset port %d\n",
+- port1);
+- ret = hub_port_reset(hub, port1,
+- udev, HUB_BH_RESET_TIME,
+- true);
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- return ret;
+- }
+- /* Device went away? */
+- if (!(portstatus & USB_PORT_STAT_CONNECTION))
+- return -ENOTCONN;
+-
+- /* bomb out completely if the connection bounced */
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- return -ENOTCONN;
+-
+- if ((portstatus & USB_PORT_STAT_ENABLE)) {
+- if (hub_is_wusb(hub))
+- udev->speed = USB_SPEED_WIRELESS;
+- else if (hub_is_superspeed(hub->hdev))
+- udev->speed = USB_SPEED_SUPER;
+- else if (portstatus & USB_PORT_STAT_HIGH_SPEED)
+- udev->speed = USB_SPEED_HIGH;
+- else if (portstatus & USB_PORT_STAT_LOW_SPEED)
+- udev->speed = USB_SPEED_LOW;
+- else
+- udev->speed = USB_SPEED_FULL;
++ if (!hub_is_superspeed(hub->hdev) &&
++ (portchange & USB_PORT_STAT_C_CONNECTION))
++ return -ENOTCONN;
++
++ if ((portstatus & USB_PORT_STAT_ENABLE)) {
++ if (!udev)
+ return 0;
+- }
+- } else {
+- if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+- hub_port_warm_reset_required(hub,
+- portstatus))
+- return -ENOTCONN;
+
++ if (hub_is_wusb(hub))
++ udev->speed = USB_SPEED_WIRELESS;
++ else if (hub_is_superspeed(hub->hdev))
++ udev->speed = USB_SPEED_SUPER;
++ else if (portstatus & USB_PORT_STAT_HIGH_SPEED)
++ udev->speed = USB_SPEED_HIGH;
++ else if (portstatus & USB_PORT_STAT_LOW_SPEED)
++ udev->speed = USB_SPEED_LOW;
++ else
++ udev->speed = USB_SPEED_FULL;
+ return 0;
+ }
+
+@@ -2288,16 +2253,16 @@ delay:
+ }
+
+ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, int *status, bool warm)
++ struct usb_device *udev, int *status)
+ {
+ switch (*status) {
+ case 0:
+- if (!warm) {
+- struct usb_hcd *hcd;
+- /* TRSTRCY = 10 ms; plus some extra */
+- msleep(10 + 40);
++ /* TRSTRCY = 10 ms; plus some extra */
++ msleep(10 + 40);
++ if (udev) {
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
+ update_devnum(udev, 0);
+- hcd = bus_to_hcd(udev->bus);
+ /* The xHC may think the device is already reset,
+ * so ignore the status.
+ */
+@@ -2309,14 +2274,15 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+ case -ENODEV:
+ clear_port_feature(hub->hdev,
+ port1, USB_PORT_FEAT_C_RESET);
+- /* FIXME need disconnect() for NOTATTACHED device */
+ if (hub_is_superspeed(hub->hdev)) {
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
+ }
+- if (!warm)
++ if (udev)
+ usb_set_device_state(udev, *status
+ ? USB_STATE_NOTATTACHED
+ : USB_STATE_DEFAULT);
+@@ -2329,18 +2295,30 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ struct usb_device *udev, unsigned int delay, bool warm)
+ {
+ int i, status;
++ u16 portchange, portstatus;
+
+- if (!warm) {
+- /* Block EHCI CF initialization during the port reset.
+- * Some companion controllers don't like it when they mix.
+- */
+- down_read(&ehci_cf_port_reset_rwsem);
+- } else {
+- if (!hub_is_superspeed(hub->hdev)) {
++ if (!hub_is_superspeed(hub->hdev)) {
++ if (warm) {
+ dev_err(hub->intfdev, "only USB3 hub support "
+ "warm reset\n");
+ return -EINVAL;
+ }
++ /* Block EHCI CF initialization during the port reset.
++ * Some companion controllers don't like it when they mix.
++ */
++ down_read(&ehci_cf_port_reset_rwsem);
++ } else if (!warm) {
++ /*
++ * If the caller hasn't explicitly requested a warm reset,
++ * double check and see if one is needed.
++ */
++ status = hub_port_status(hub, port1,
++ &portstatus, &portchange);
++ if (status < 0)
++ goto done;
++
++ if (hub_port_warm_reset_required(hub, portstatus))
++ warm = true;
+ }
+
+ /* Reset the port */
+@@ -2361,10 +2339,33 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ status);
+ }
+
+- /* return on disconnect or reset */
++ /* Check for disconnect or reset */
+ if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
+- hub_port_finish_reset(hub, port1, udev, &status, warm);
+- goto done;
++ hub_port_finish_reset(hub, port1, udev, &status);
++
++ if (!hub_is_superspeed(hub->hdev))
++ goto done;
++
++ /*
++ * If a USB 3.0 device migrates from reset to an error
++ * state, re-issue the warm reset.
++ */
++ if (hub_port_status(hub, port1,
++ &portstatus, &portchange) < 0)
++ goto done;
++
++ if (!hub_port_warm_reset_required(hub, portstatus))
++ goto done;
++
++ /*
++ * If the port is in SS.Inactive or Compliance Mode, the
++ * hot or warm reset failed. Try another warm reset.
++ */
++ if (!warm) {
++ dev_dbg(hub->intfdev, "hot reset failed, warm reset port %d\n",
++ port1);
++ warm = true;
++ }
+ }
+
+ dev_dbg (hub->intfdev,
+@@ -2378,7 +2379,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ port1);
+
+ done:
+- if (!warm)
++ if (!hub_is_superspeed(hub->hdev))
+ up_read(&ehci_cf_port_reset_rwsem);
+
+ return status;
+@@ -3876,12 +3877,21 @@ static void hub_events(void)
+ */
+ if (hub_port_warm_reset_required(hub, portstatus)) {
+ int status;
++ struct usb_device *udev =
++ hub->hdev->children[i - 1];
+
+ dev_dbg(hub_dev, "warm reset port %d\n", i);
+- status = hub_port_reset(hub, i, NULL,
+- HUB_BH_RESET_TIME, true);
+- if (status < 0)
+- hub_port_disable(hub, i, 1);
++ if (!udev) {
++ status = hub_port_reset(hub, i,
++ NULL, HUB_BH_RESET_TIME,
++ true);
++ if (status < 0)
++ hub_port_disable(hub, i, 1);
++ } else {
++ usb_lock_device(udev);
++ status = usb_reset_device(udev);
++ usb_unlock_device(udev);
++ }
+ connect_change = 0;
+ }
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 1411b99..3ad7ee9 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -557,6 +557,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
+ new_device->writeable = 0;
+ new_device->in_fs_metadata = 0;
+ new_device->can_discard = 0;
++ spin_lock_init(&new_device->io_lock);
+ list_replace_rcu(&device->dev_list, &new_device->dev_list);
+
+ call_rcu(&device->rcu, free_device);
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 541ef81..d7561e0 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -557,6 +557,11 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ dentry = ERR_PTR(-ENOENT);
+ break;
+ }
++ if (!S_ISDIR(dir->i_mode)) {
++ dput(dentry);
++ dentry = ERR_PTR(-ENOTDIR);
++ break;
++ }
+
+ /* skip separators */
+ while (*s == sep)
+diff --git a/fs/compat.c b/fs/compat.c
+index 2b371b3..56acdcb 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -558,6 +558,10 @@ ssize_t compat_rw_copy_check_uvector(int type,
+ }
+ *ret_pointer = iov;
+
++ ret = -EFAULT;
++ if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
++ goto out;
++
+ /*
+ * Single unix specification:
+ * We should -EINVAL if an element length is not >= 0 and fitting an
+@@ -1089,17 +1093,12 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
+ if (!file->f_op)
+ goto out;
+
+- ret = -EFAULT;
+- if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
+- goto out;
+-
+- tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs,
++ ret = compat_rw_copy_check_uvector(type, uvector, nr_segs,
+ UIO_FASTIOV, iovstack, &iov, 1);
+- if (tot_len == 0) {
+- ret = 0;
++ if (ret <= 0)
+ goto out;
+- }
+
++ tot_len = ret;
+ ret = rw_verify_area(type, file, pos, tot_len);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
+index 3210a03..2781563 100644
+--- a/fs/nfs/unlink.c
++++ b/fs/nfs/unlink.c
+@@ -336,20 +336,14 @@ static void nfs_async_rename_done(struct rpc_task *task, void *calldata)
+ struct inode *old_dir = data->old_dir;
+ struct inode *new_dir = data->new_dir;
+ struct dentry *old_dentry = data->old_dentry;
+- struct dentry *new_dentry = data->new_dentry;
+
+ if (!NFS_PROTO(old_dir)->rename_done(task, old_dir, new_dir)) {
+ rpc_restart_call_prepare(task);
+ return;
+ }
+
+- if (task->tk_status != 0) {
++ if (task->tk_status != 0)
+ nfs_cancel_async_unlink(old_dentry);
+- return;
+- }
+-
+- d_drop(old_dentry);
+- d_drop(new_dentry);
+ }
+
+ /**
+@@ -550,6 +544,18 @@ nfs_sillyrename(struct inode *dir, struct dentry *dentry)
+ error = rpc_wait_for_completion_task(task);
+ if (error == 0)
+ error = task->tk_status;
++ switch (error) {
++ case 0:
++ /* The rename succeeded */
++ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
++ d_move(dentry, sdentry);
++ break;
++ case -ERESTARTSYS:
++ /* The result of the rename is unknown. Play it safe by
++ * forcing a new lookup */
++ d_drop(dentry);
++ d_drop(sdentry);
++ }
+ rpc_put_task(task);
+ out_dput:
+ dput(sdentry);
+diff --git a/fs/pipe.c b/fs/pipe.c
+index fec5e4a..1667e6f 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -860,6 +860,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ int ret = -ENOENT;
+
++ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
++ return -EINVAL;
++
+ mutex_lock(&inode->i_mutex);
+
+ if (inode->i_pipe) {
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index a1d2849..b659cd6 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -386,24 +386,28 @@ config KPROBE_EVENT
+ If you want to use perf tools, this option is strongly recommended.
+
+ config DYNAMIC_FTRACE
+- bool "enable/disable ftrace tracepoints dynamically"
++ bool "enable/disable function tracing dynamically"
+ depends on FUNCTION_TRACER
+ depends on HAVE_DYNAMIC_FTRACE
+ default y
+ help
+- This option will modify all the calls to ftrace dynamically
+- (will patch them out of the binary image and replace them
+- with a No-Op instruction) as they are called. A table is
+- created to dynamically enable them again.
++ This option will modify all the calls to function tracing
++ dynamically (will patch them out of the binary image and
++ replace them with a No-Op instruction) on boot up. During
++ compile time, a table is made of all the locations that ftrace
++ can function trace, and this table is linked into the kernel
++ image. When this is enabled, functions can be individually
++ enabled, and the functions not enabled will not affect
++ performance of the system.
++
++ See the files in /sys/kernel/debug/tracing:
++ available_filter_functions
++ set_ftrace_filter
++ set_ftrace_notrace
+
+ This way a CONFIG_FUNCTION_TRACER kernel is slightly larger, but
+ otherwise has native performance as long as no tracing is active.
+
+- The changes to the code are done by a kernel thread that
+- wakes up once a second and checks to see if any ftrace calls
+- were made. If so, it runs stop_machine (stops all CPUS)
+- and modifies the code to jump over the call to ftrace.
+-
+ config FUNCTION_PROFILER
+ bool "Kernel function profiler"
+ depends on FUNCTION_TRACER
+diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
+index c20ff48..b63e84a 100644
+--- a/mm/process_vm_access.c
++++ b/mm/process_vm_access.c
+@@ -429,12 +429,6 @@ compat_process_vm_rw(compat_pid_t pid,
+ if (flags != 0)
+ return -EINVAL;
+
+- if (!access_ok(VERIFY_READ, lvec, liovcnt * sizeof(*lvec)))
+- goto out;
+-
+- if (!access_ok(VERIFY_READ, rvec, riovcnt * sizeof(*rvec)))
+- goto out;
+-
+ if (vm_write)
+ rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
+ UIO_FASTIOV, iovstack_l,
+@@ -459,8 +453,6 @@ free_iovecs:
+ kfree(iov_r);
+ if (iov_l != iovstack_l)
+ kfree(iov_l);
+-
+-out:
+ return rc;
+ }
+
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index feea474..f1a63c1 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -485,13 +485,17 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
+ * xprt_wait_for_buffer_space - wait for transport output buffer to clear
+ * @task: task to be put to sleep
+ * @action: function pointer to be executed after wait
++ *
++ * Note that we only set the timer for the case of RPC_IS_SOFT(), since
++ * we don't in general want to force a socket disconnection due to
++ * an incomplete RPC call transmission.
+ */
+ void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
+ {
+ struct rpc_rqst *req = task->tk_rqstp;
+ struct rpc_xprt *xprt = req->rq_xprt;
+
+- task->tk_timeout = req->rq_timeout;
++ task->tk_timeout = RPC_IS_SOFT(task) ? req->rq_timeout : 0;
+ rpc_sleep_on(&xprt->pending, task, action);
+ }
+ EXPORT_SYMBOL_GPL(xprt_wait_for_buffer_space);
+diff --git a/security/keys/compat.c b/security/keys/compat.c
+index 4c48e13..1b0b7bf 100644
+--- a/security/keys/compat.c
++++ b/security/keys/compat.c
+@@ -40,12 +40,12 @@ long compat_keyctl_instantiate_key_iov(
+ ARRAY_SIZE(iovstack),
+ iovstack, &iov, 1);
+ if (ret < 0)
+- return ret;
++ goto err;
+ if (ret == 0)
+ goto no_payload_free;
+
+ ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ if (iov != iovstack)
+ kfree(iov);
+ return ret;
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index be7ecb2..adbfddd 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -54,7 +54,7 @@ int install_user_keyrings(void)
+
+ kenter("%p{%u}", user, user->uid);
+
+- if (user->uid_keyring) {
++ if (user->uid_keyring && user->session_keyring) {
+ kleave(" = 0 [exist]");
+ return 0;
+ }
+diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
+index 8575861..0097f36 100644
+--- a/sound/core/vmaster.c
++++ b/sound/core/vmaster.c
+@@ -213,7 +213,10 @@ static int slave_put(struct snd_kcontrol *kcontrol,
+ }
+ if (!changed)
+ return 0;
+- return slave_put_val(slave, ucontrol);
++ err = slave_put_val(slave, ucontrol);
++ if (err < 0)
++ return err;
++ return 1;
+ }
+
+ static int slave_tlv_cmd(struct snd_kcontrol *kcontrol,
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index fa2ce0c..02a6e3f 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1244,9 +1244,6 @@ static int generic_hdmi_build_jack(struct hda_codec *codec, int pin_idx)
+
+ if (pcmdev > 0)
+ sprintf(hdmi_str + strlen(hdmi_str), ",pcm=%d", pcmdev);
+- if (!is_jack_detectable(codec, per_pin->pin_nid))
+- strncat(hdmi_str, " Phantom",
+- sizeof(hdmi_str) - strlen(hdmi_str) - 1);
+
+ return snd_hda_jack_add_kctl(codec, per_pin->pin_nid, hdmi_str, 0);
+ }
+diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
+index 132a86e..08c7f3a 100644
+--- a/sound/pci/ice1712/ice1712.c
++++ b/sound/pci/ice1712/ice1712.c
+@@ -2595,6 +2595,8 @@ static int __devinit snd_ice1712_create(struct snd_card *card,
+ snd_ice1712_proc_init(ice);
+ synchronize_irq(pci->irq);
+
++ card->private_data = ice;
++
+ err = pci_request_regions(pci, "ICE1712");
+ if (err < 0) {
+ kfree(ice);
Modified: genpatches-2.6/trunk/3.8/0000_README
===================================================================
--- genpatches-2.6/trunk/3.8/0000_README 2013-03-09 10:14:40 UTC (rev 2310)
+++ genpatches-2.6/trunk/3.8/0000_README 2013-03-15 20:43:37 UTC (rev 2311)
@@ -47,6 +47,10 @@
From: http://www.kernel.org
Desc: Linux 3.8.2
+Patch: 1002_linux-3.8.3.patch
+From: http://www.kernel.org
+Desc: Linux 3.8.3
+
Patch: 1700_enable-thinkpad-micled.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=449248
Desc: Enable mic mute led in thinkpads
Added: genpatches-2.6/trunk/3.8/1002_linux-3.8.3.patch
===================================================================
--- genpatches-2.6/trunk/3.8/1002_linux-3.8.3.patch (rev 0)
+++ genpatches-2.6/trunk/3.8/1002_linux-3.8.3.patch 2013-03-15 20:43:37 UTC (rev 2311)
@@ -0,0 +1,4814 @@
+diff --git a/Makefile b/Makefile
+index 20d5318..8c49fc9b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+
+diff --git a/arch/arm/boot/dts/kirkwood-dns320.dts b/arch/arm/boot/dts/kirkwood-dns320.dts
+index 5bb0bf3..c9c44b2 100644
+--- a/arch/arm/boot/dts/kirkwood-dns320.dts
++++ b/arch/arm/boot/dts/kirkwood-dns320.dts
+@@ -42,12 +42,10 @@
+
+ ocp@f1000000 {
+ serial@12000 {
+- clock-frequency = <166666667>;
+ status = "okay";
+ };
+
+ serial@12100 {
+- clock-frequency = <166666667>;
+ status = "okay";
+ };
+ };
+diff --git a/arch/arm/boot/dts/kirkwood-dns325.dts b/arch/arm/boot/dts/kirkwood-dns325.dts
+index d430713..e4e4930 100644
+--- a/arch/arm/boot/dts/kirkwood-dns325.dts
++++ b/arch/arm/boot/dts/kirkwood-dns325.dts
+@@ -50,7 +50,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "okay";
+ };
+ };
+diff --git a/arch/arm/boot/dts/kirkwood-dockstar.dts b/arch/arm/boot/dts/kirkwood-dockstar.dts
+index 2e3dd34..0196cf6 100644
+--- a/arch/arm/boot/dts/kirkwood-dockstar.dts
++++ b/arch/arm/boot/dts/kirkwood-dockstar.dts
+@@ -37,7 +37,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-dreamplug.dts b/arch/arm/boot/dts/kirkwood-dreamplug.dts
+index f2d386c..e21ae48 100644
+--- a/arch/arm/boot/dts/kirkwood-dreamplug.dts
++++ b/arch/arm/boot/dts/kirkwood-dreamplug.dts
+@@ -38,7 +38,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-goflexnet.dts b/arch/arm/boot/dts/kirkwood-goflexnet.dts
+index 1b133e0..bd83b8f 100644
+--- a/arch/arm/boot/dts/kirkwood-goflexnet.dts
++++ b/arch/arm/boot/dts/kirkwood-goflexnet.dts
+@@ -73,7 +73,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+index 71902da..5335b1a 100644
+--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
++++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+@@ -51,7 +51,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-iconnect.dts b/arch/arm/boot/dts/kirkwood-iconnect.dts
+index 504f16b..12ccf74 100644
+--- a/arch/arm/boot/dts/kirkwood-iconnect.dts
++++ b/arch/arm/boot/dts/kirkwood-iconnect.dts
+@@ -78,7 +78,6 @@
+ };
+ };
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
+index 6cae459..93c3afb 100644
+--- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
++++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
+@@ -115,7 +115,6 @@
+ };
+
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-km_kirkwood.dts b/arch/arm/boot/dts/kirkwood-km_kirkwood.dts
+index 8db3123..5bbd054 100644
+--- a/arch/arm/boot/dts/kirkwood-km_kirkwood.dts
++++ b/arch/arm/boot/dts/kirkwood-km_kirkwood.dts
+@@ -34,7 +34,6 @@
+ };
+
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-lschlv2.dts b/arch/arm/boot/dts/kirkwood-lschlv2.dts
+index 9510c9e..9f55d95 100644
+--- a/arch/arm/boot/dts/kirkwood-lschlv2.dts
++++ b/arch/arm/boot/dts/kirkwood-lschlv2.dts
+@@ -13,7 +13,6 @@
+
+ ocp@f1000000 {
+ serial@12000 {
+- clock-frequency = <166666667>;
+ status = "okay";
+ };
+ };
+diff --git a/arch/arm/boot/dts/kirkwood-lsxhl.dts b/arch/arm/boot/dts/kirkwood-lsxhl.dts
+index 739019c..5c84c11 100644
+--- a/arch/arm/boot/dts/kirkwood-lsxhl.dts
++++ b/arch/arm/boot/dts/kirkwood-lsxhl.dts
+@@ -13,7 +13,6 @@
+
+ ocp@f1000000 {
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "okay";
+ };
+ };
+diff --git a/arch/arm/boot/dts/kirkwood-mplcec4.dts b/arch/arm/boot/dts/kirkwood-mplcec4.dts
+index 262c654..07be213 100644
+--- a/arch/arm/boot/dts/kirkwood-mplcec4.dts
++++ b/arch/arm/boot/dts/kirkwood-mplcec4.dts
+@@ -91,7 +91,6 @@
+ };
+
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-ns2-common.dtsi b/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
+index 77d21ab..f0245c1 100644
+--- a/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
++++ b/arch/arm/boot/dts/kirkwood-ns2-common.dtsi
+@@ -23,7 +23,6 @@
+ };
+
+ serial@12000 {
+- clock-frequency = <166666667>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-nsa310.dts b/arch/arm/boot/dts/kirkwood-nsa310.dts
+index 5509f96..28d05e4 100644
+--- a/arch/arm/boot/dts/kirkwood-nsa310.dts
++++ b/arch/arm/boot/dts/kirkwood-nsa310.dts
+@@ -18,7 +18,6 @@
+ ocp@f1000000 {
+
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a6.dts b/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
+index 49d3d74..f3cc7c4 100644
+--- a/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
++++ b/arch/arm/boot/dts/kirkwood-openblocks_a6.dts
+@@ -18,12 +18,10 @@
+
+ ocp@f1000000 {
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+ serial@12100 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-topkick.dts b/arch/arm/boot/dts/kirkwood-topkick.dts
+index cd15452..7dd19ff 100644
+--- a/arch/arm/boot/dts/kirkwood-topkick.dts
++++ b/arch/arm/boot/dts/kirkwood-topkick.dts
+@@ -17,7 +17,6 @@
+
+ ocp@f1000000 {
+ serial@12000 {
+- clock-frequency = <200000000>;
+ status = "ok";
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood.dtsi b/arch/arm/boot/dts/kirkwood.dtsi
+index d6ab442..ad26d92 100644
+--- a/arch/arm/boot/dts/kirkwood.dtsi
++++ b/arch/arm/boot/dts/kirkwood.dtsi
+@@ -38,6 +38,7 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ interrupts = <35>, <36>, <37>, <38>;
++ clocks = <&gate_clk 7>;
+ };
+
+ gpio1: gpio@10140 {
+@@ -49,6 +50,7 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ interrupts = <39>, <40>, <41>;
++ clocks = <&gate_clk 7>;
+ };
+
+ serial@12000 {
+@@ -57,7 +59,6 @@
+ reg-shift = <2>;
+ interrupts = <33>;
+ clocks = <&gate_clk 7>;
+- /* set clock-frequency in board dts */
+ status = "disabled";
+ };
+
+@@ -67,7 +68,6 @@
+ reg-shift = <2>;
+ interrupts = <34>;
+ clocks = <&gate_clk 7>;
+- /* set clock-frequency in board dts */
+ status = "disabled";
+ };
+
+@@ -75,6 +75,7 @@
+ compatible = "marvell,kirkwood-rtc", "marvell,orion-rtc";
+ reg = <0x10300 0x20>;
+ interrupts = <53>;
++ clocks = <&gate_clk 7>;
+ };
+
+ spi@10600 {
+diff --git a/arch/arm/configs/mxs_defconfig b/arch/arm/configs/mxs_defconfig
+index 7bf5351..a55b206 100644
+--- a/arch/arm/configs/mxs_defconfig
++++ b/arch/arm/configs/mxs_defconfig
+@@ -118,6 +118,7 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_FONTS=y
+ CONFIG_LOGO=y
+ CONFIG_USB=y
++CONFIG_USB_EHCI_HCD=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_HOST=y
+ CONFIG_USB_STORAGE=y
+diff --git a/arch/arm/include/asm/delay.h b/arch/arm/include/asm/delay.h
+index ab98fdd..720799f 100644
+--- a/arch/arm/include/asm/delay.h
++++ b/arch/arm/include/asm/delay.h
+@@ -24,6 +24,7 @@ extern struct arm_delay_ops {
+ void (*delay)(unsigned long);
+ void (*const_udelay)(unsigned long);
+ void (*udelay)(unsigned long);
++ bool const_clock;
+ } arm_delay_ops;
+
+ #define __delay(n) arm_delay_ops.delay(n)
+diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
+index 9f77e78..e3d5554 100644
+--- a/arch/arm/include/asm/mmu.h
++++ b/arch/arm/include/asm/mmu.h
+@@ -5,15 +5,15 @@
+
+ typedef struct {
+ #ifdef CONFIG_CPU_HAS_ASID
+- u64 id;
++ atomic64_t id;
+ #endif
+- unsigned int vmalloc_seq;
++ unsigned int vmalloc_seq;
+ } mm_context_t;
+
+ #ifdef CONFIG_CPU_HAS_ASID
+ #define ASID_BITS 8
+ #define ASID_MASK ((~0ULL) << ASID_BITS)
+-#define ASID(mm) ((mm)->context.id & ~ASID_MASK)
++#define ASID(mm) ((mm)->context.id.counter & ~ASID_MASK)
+ #else
+ #define ASID(mm) (0)
+ #endif
+@@ -26,7 +26,7 @@ typedef struct {
+ * modified for 2.6 by Hyok S. Choi <hyok.choi@samsung.com>
+ */
+ typedef struct {
+- unsigned long end_brk;
++ unsigned long end_brk;
+ } mm_context_t;
+
+ #endif
+diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
+index e1f644b..863a661 100644
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -25,7 +25,7 @@ void __check_vmalloc_seq(struct mm_struct *mm);
+ #ifdef CONFIG_CPU_HAS_ASID
+
+ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
+-#define init_new_context(tsk,mm) ({ mm->context.id = 0; })
++#define init_new_context(tsk,mm) ({ atomic64_set(&mm->context.id, 0); 0; })
+
+ #else /* !CONFIG_CPU_HAS_ASID */
+
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index 9c82f988..c094749 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -240,7 +240,8 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
+
+ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
+ {
+- const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER | L_PTE_NONE;
++ const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
++ L_PTE_NONE | L_PTE_VALID;
+ pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
+ return pte;
+ }
+diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
+index c985b48..cf10d18 100644
+--- a/arch/arm/kernel/asm-offsets.c
++++ b/arch/arm/kernel/asm-offsets.c
+@@ -107,7 +107,7 @@ int main(void)
+ BLANK();
+ #endif
+ #ifdef CONFIG_CPU_HAS_ASID
+- DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id));
++ DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id.counter));
+ BLANK();
+ #endif
+ DEFINE(VMA_VM_MM, offsetof(struct vm_area_struct, vm_mm));
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index 486a15a..e0eb9a1 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -184,13 +184,22 @@ __create_page_tables:
+ orr r3, r3, #3 @ PGD block type
+ mov r6, #4 @ PTRS_PER_PGD
+ mov r7, #1 << (55 - 32) @ L_PGD_SWAPPER
+-1: str r3, [r0], #4 @ set bottom PGD entry bits
++1:
++#ifdef CONFIG_CPU_ENDIAN_BE8
+ str r7, [r0], #4 @ set top PGD entry bits
++ str r3, [r0], #4 @ set bottom PGD entry bits
++#else
++ str r3, [r0], #4 @ set bottom PGD entry bits
++ str r7, [r0], #4 @ set top PGD entry bits
++#endif
+ add r3, r3, #0x1000 @ next PMD table
+ subs r6, r6, #1
+ bne 1b
+
+ add r4, r4, #0x1000 @ point to the PMD tables
++#ifdef CONFIG_CPU_ENDIAN_BE8
++ add r4, r4, #4 @ we only write the bottom word
++#endif
+ #endif
+
+ ldr r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags
+@@ -258,6 +267,11 @@ __create_page_tables:
+ addne r6, r6, #1 << SECTION_SHIFT
+ strne r6, [r3]
+
++#if defined(CONFIG_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8)
++ sub r4, r4, #4 @ Fixup page table pointer
++ @ for 64-bit descriptors
++#endif
++
+ #ifdef CONFIG_DEBUG_LL
+ #if !defined(CONFIG_DEBUG_ICEDCC) && !defined(CONFIG_DEBUG_SEMIHOSTING)
+ /*
+@@ -276,13 +290,17 @@ __create_page_tables:
+ orr r3, r7, r3, lsl #SECTION_SHIFT
+ #ifdef CONFIG_ARM_LPAE
+ mov r7, #1 << (54 - 32) @ XN
++#ifdef CONFIG_CPU_ENDIAN_BE8
++ str r7, [r0], #4
++ str r3, [r0], #4
+ #else
+- orr r3, r3, #PMD_SECT_XN
+-#endif
+ str r3, [r0], #4
+-#ifdef CONFIG_ARM_LPAE
+ str r7, [r0], #4
+ #endif
++#else
++ orr r3, r3, #PMD_SECT_XN
++ str r3, [r0], #4
++#endif
+
+ #else /* CONFIG_DEBUG_ICEDCC || CONFIG_DEBUG_SEMIHOSTING */
+ /* we don't need any serial debugging mappings */
+diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
+index 4fbc757..89ede24 100644
+--- a/arch/arm/kernel/perf_event_v7.c
++++ b/arch/arm/kernel/perf_event_v7.c
+@@ -774,7 +774,7 @@ static const unsigned armv7_a7_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+ * PMXEVTYPER: Event selection reg
+ */
+-#define ARMV7_EVTYPE_MASK 0xc00000ff /* Mask for writable bits */
++#define ARMV7_EVTYPE_MASK 0xc80000ff /* Mask for writable bits */
+ #define ARMV7_EVTYPE_EVENT 0xff /* Mask for EVENT bits */
+
+ /*
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 84f4cbf..58af91c 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -693,6 +693,9 @@ static int cpufreq_callback(struct notifier_block *nb,
+ if (freq->flags & CPUFREQ_CONST_LOOPS)
+ return NOTIFY_OK;
+
++ if (arm_delay_ops.const_clock)
++ return NOTIFY_OK;
++
+ if (!per_cpu(l_p_j_ref, cpu)) {
+ per_cpu(l_p_j_ref, cpu) =
+ per_cpu(cpu_data, cpu).loops_per_jiffy;
+diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
+index 0dc5385..6b93f6a 100644
+--- a/arch/arm/lib/delay.c
++++ b/arch/arm/lib/delay.c
+@@ -77,6 +77,7 @@ void __init register_current_timer_delay(const struct delay_timer *timer)
+ arm_delay_ops.delay = __timer_delay;
+ arm_delay_ops.const_udelay = __timer_const_udelay;
+ arm_delay_ops.udelay = __timer_udelay;
++ arm_delay_ops.const_clock = true;
+ delay_calibrated = true;
+ } else {
+ pr_info("Ignoring duplicate/late registration of read_current_timer delay\n");
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index b820eda..db26e2e 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -749,7 +749,6 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- mm_segment_t fs;
+ unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+@@ -760,16 +759,15 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ instrptr = instruction_pointer(regs);
+
+- fs = get_fs();
+- set_fs(KERNEL_DS);
+ if (thumb_mode(regs)) {
+- fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
++ u16 *ptr = (u16 *)(instrptr & ~1);
++ fault = probe_kernel_address(ptr, tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+ u16 tinst2 = 0;
+- fault = __get_user(tinst2, (u16 *)(instrptr+2));
++ fault = probe_kernel_address(ptr + 1, tinst2);
+ instr = (tinstr << 16) | tinst2;
+ thumb2_32b = 1;
+ } else {
+@@ -778,8 +776,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ }
+ }
+ } else
+- fault = __get_user(instr, (u32 *)instrptr);
+- set_fs(fs);
++ fault = probe_kernel_address(instrptr, instr);
+
+ if (fault) {
+ type = TYPE_FAULT;
+diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
+index bc4a5e9..d07df17 100644
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -149,9 +149,9 @@ static int is_reserved_asid(u64 asid)
+ return 0;
+ }
+
+-static void new_context(struct mm_struct *mm, unsigned int cpu)
++static u64 new_context(struct mm_struct *mm, unsigned int cpu)
+ {
+- u64 asid = mm->context.id;
++ u64 asid = atomic64_read(&mm->context.id);
+ u64 generation = atomic64_read(&asid_generation);
+
+ if (asid != 0 && is_reserved_asid(asid)) {
+@@ -178,13 +178,14 @@ static void new_context(struct mm_struct *mm, unsigned int cpu)
+ cpumask_clear(mm_cpumask(mm));
+ }
+
+- mm->context.id = asid;
++ return asid;
+ }
+
+ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
+ {
+ unsigned long flags;
+ unsigned int cpu = smp_processor_id();
++ u64 asid;
+
+ if (unlikely(mm->context.vmalloc_seq != init_mm.context.vmalloc_seq))
+ __check_vmalloc_seq(mm);
+@@ -195,20 +196,24 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
+ */
+ cpu_set_reserved_ttbr0();
+
+- if (!((mm->context.id ^ atomic64_read(&asid_generation)) >> ASID_BITS)
+- && atomic64_xchg(&per_cpu(active_asids, cpu), mm->context.id))
++ asid = atomic64_read(&mm->context.id);
++ if (!((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS)
++ && atomic64_xchg(&per_cpu(active_asids, cpu), asid))
+ goto switch_mm_fastpath;
+
+ raw_spin_lock_irqsave(&cpu_asid_lock, flags);
+ /* Check that our ASID belongs to the current generation. */
+- if ((mm->context.id ^ atomic64_read(&asid_generation)) >> ASID_BITS)
+- new_context(mm, cpu);
+-
+- atomic64_set(&per_cpu(active_asids, cpu), mm->context.id);
+- cpumask_set_cpu(cpu, mm_cpumask(mm));
++ asid = atomic64_read(&mm->context.id);
++ if ((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS) {
++ asid = new_context(mm, cpu);
++ atomic64_set(&mm->context.id, asid);
++ }
+
+ if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending))
+ local_flush_tlb_all();
++
++ atomic64_set(&per_cpu(active_asids, cpu), asid);
++ cpumask_set_cpu(cpu, mm_cpumask(mm));
+ raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
+
+ switch_mm_fastpath:
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 3b44e0d..5dfbb0b 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -413,7 +413,7 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
+ * If there isn't a second FP instruction, exit now. Note that
+ * the FPEXC.FP2V bit is valid only if FPEXC.EX is 1.
+ */
+- if (fpexc ^ (FPEXC_EX | FPEXC_FP2V))
++ if ((fpexc & (FPEXC_EX | FPEXC_FP2V)) != (FPEXC_EX | FPEXC_FP2V))
+ goto exit;
+
+ /*
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 6da881b..8d97eb4 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -156,6 +156,15 @@ early_param("smt-enabled", early_smt_enabled);
+ #define check_smt_enabled()
+ #endif /* CONFIG_SMP */
+
++/** Fix up paca fields required for the boot cpu */
++static void fixup_boot_paca(void)
++{
++ /* The boot cpu is started */
++ get_paca()->cpu_start = 1;
++ /* Allow percpu accesses to work until we setup percpu data */
++ get_paca()->data_offset = 0;
++}
++
+ /*
+ * Early initialization entry point. This is called by head.S
+ * with MMU translation disabled. We rely on the "feature" of
+@@ -185,6 +194,7 @@ void __init early_setup(unsigned long dt_ptr)
+ /* Assume we're on cpu 0 for now. Don't write to the paca yet! */
+ initialise_paca(&boot_paca, 0);
+ setup_paca(&boot_paca);
++ fixup_boot_paca();
+
+ /* Initialize lockdep early or else spinlocks will blow */
+ lockdep_init();
+@@ -205,11 +215,7 @@ void __init early_setup(unsigned long dt_ptr)
+
+ /* Now we know the logical id of our boot cpu, setup the paca. */
+ setup_paca(&paca[boot_cpuid]);
+-
+- /* Fix up paca fields required for the boot cpu */
+- get_paca()->cpu_start = 1;
+- /* Allow percpu accesses to "work" until we setup percpu data */
+- get_paca()->data_offset = 0;
++ fixup_boot_paca();
+
+ /* Probe the machine type */
+ probe_machine();
+diff --git a/arch/tile/include/asm/compat.h b/arch/tile/include/asm/compat.h
+index 88f3c22..59e3574 100644
+--- a/arch/tile/include/asm/compat.h
++++ b/arch/tile/include/asm/compat.h
+@@ -296,6 +296,9 @@ long compat_sys_sync_file_range2(int fd, unsigned int flags,
+ long compat_sys_fallocate(int fd, int mode,
+ u32 offset_lo, u32 offset_hi,
+ u32 len_lo, u32 len_hi);
++long compat_sys_llseek(unsigned int fd, unsigned int offset_high,
++ unsigned int offset_low, loff_t __user * result,
++ unsigned int origin);
+
+ /* Assembly trampoline to avoid clobbering r0. */
+ long _compat_sys_rt_sigreturn(void);
+diff --git a/arch/tile/kernel/compat.c b/arch/tile/kernel/compat.c
+index 7f72401..d8e3b7e 100644
+--- a/arch/tile/kernel/compat.c
++++ b/arch/tile/kernel/compat.c
+@@ -76,6 +76,18 @@ long compat_sys_fallocate(int fd, int mode,
+ ((loff_t)len_hi << 32) | len_lo);
+ }
+
++/*
++ * Avoid bug in generic sys_llseek() that specifies offset_high and
++ * offset_low as "unsigned long", thus making it possible to pass
++ * a sign-extended high 32 bits in offset_low.
++ */
++long compat_sys_llseek(unsigned int fd, unsigned int offset_high,
++ unsigned int offset_low, loff_t __user * result,
++ unsigned int origin)
++{
++ return sys_llseek(fd, offset_high, offset_low, result, origin);
++}
++
+ /* Provide the compat syscall number to call mapping. */
+ #undef __SYSCALL
+ #define __SYSCALL(nr, call) [nr] = (call),
+@@ -83,6 +95,7 @@ long compat_sys_fallocate(int fd, int mode,
+ /* See comments in sys.c */
+ #define compat_sys_fadvise64_64 sys32_fadvise64_64
+ #define compat_sys_readahead sys32_readahead
++#define sys_llseek compat_sys_llseek
+
+ /* Call the assembly trampolines where necessary. */
+ #define compat_sys_rt_sigreturn _compat_sys_rt_sigreturn
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 220a360..5bedbdd 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -218,6 +218,9 @@ static void kvm_shutdown(void)
+ void __init kvmclock_init(void)
+ {
+ unsigned long mem;
++ int size;
++
++ size = PAGE_ALIGN(sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS);
+
+ if (!kvm_para_available())
+ return;
+@@ -231,16 +234,14 @@ void __init kvmclock_init(void)
+ printk(KERN_INFO "kvm-clock: Using msrs %x and %x",
+ msr_kvm_system_time, msr_kvm_wall_clock);
+
+- mem = memblock_alloc(sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS,
+- PAGE_SIZE);
++ mem = memblock_alloc(size, PAGE_SIZE);
+ if (!mem)
+ return;
+ hv_clock = __va(mem);
+
+ if (kvm_register_clock("boot clock")) {
+ hv_clock = NULL;
+- memblock_free(mem,
+- sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS);
++ memblock_free(mem, size);
+ return;
+ }
+ pv_time_ops.sched_clock = kvm_clock_read;
+@@ -275,7 +276,7 @@ int __init kvm_setup_vsyscall_timeinfo(void)
+ struct pvclock_vcpu_time_info *vcpu_time;
+ unsigned int size;
+
+- size = sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS;
++ size = PAGE_ALIGN(sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS);
+
+ preempt_disable();
+ cpu = smp_processor_id();
+diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
+index 85c3959..2cb9470 100644
+--- a/arch/x86/kernel/pvclock.c
++++ b/arch/x86/kernel/pvclock.c
+@@ -185,7 +185,7 @@ int __init pvclock_init_vsyscall(struct pvclock_vsyscall_time_info *i,
+
+ for (idx = 0; idx <= (PVCLOCK_FIXMAP_END-PVCLOCK_FIXMAP_BEGIN); idx++) {
+ __set_fixmap(PVCLOCK_FIXMAP_BEGIN + idx,
+- __pa_symbol(i) + (idx*PAGE_SIZE),
++ __pa(i) + (idx*PAGE_SIZE),
+ PAGE_KERNEL_VVAR);
+ }
+
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 56ab749..94e7662 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -162,6 +162,9 @@ static int xen_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ struct msi_desc *msidesc;
+ int *v;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ v = kzalloc(sizeof(int) * max(1, nvec), GFP_KERNEL);
+ if (!v)
+ return -ENOMEM;
+@@ -220,6 +223,9 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ struct msi_desc *msidesc;
+ struct msi_msg msg;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ list_for_each_entry(msidesc, &dev->msi_list, list) {
+ __read_msi_msg(msidesc, &msg);
+ pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
+@@ -263,6 +269,9 @@ static int xen_initdom_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ int ret = 0;
+ struct msi_desc *msidesc;
+
++ if (type == PCI_CAP_ID_MSI && nvec > 1)
++ return 1;
++
+ list_for_each_entry(msidesc, &dev->msi_list, list) {
+ struct physdev_map_pirq map_irq;
+ domid_t domid;
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index e014092..2262003 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -67,6 +67,7 @@
+ #include <asm/hypervisor.h>
+ #include <asm/mwait.h>
+ #include <asm/pci_x86.h>
++#include <asm/pat.h>
+
+ #ifdef CONFIG_ACPI
+ #include <linux/acpi.h>
+@@ -1417,7 +1418,14 @@ asmlinkage void __init xen_start_kernel(void)
+ */
+ acpi_numa = -1;
+ #endif
+-
++#ifdef CONFIG_X86_PAT
++ /*
++ * For right now disable the PAT. We should remove this once
++ * git commit 8eaffa67b43e99ae581622c5133e20b0f48bcef1
++ * (xen/pat: Disable PAT support for now) is reverted.
++ */
++ pat_enabled = 0;
++#endif
+ /* Don't do the full vcpu_info placement stuff until we have a
+ possible map and a non-dummy shared_info. */
+ per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 533de95..7d4a8d2 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -388,9 +388,9 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "ablkcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_ablkcipher.geniv ?: "<default>");
++ strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+@@ -469,9 +469,9 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "givcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_ablkcipher.geniv ?: "<built-in>");
++ strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+diff --git a/crypto/aead.c b/crypto/aead.c
+index 0b8121e..27bc487 100644
+--- a/crypto/aead.c
++++ b/crypto/aead.c
+@@ -117,9 +117,8 @@ static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_aead raead;
+ struct aead_alg *aead = &alg->cra_aead;
+
+- snprintf(raead.type, CRYPTO_MAX_ALG_NAME, "%s", "aead");
+- snprintf(raead.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- aead->geniv ?: "<built-in>");
++ strncpy(raead.type, "aead", sizeof(raead.type));
++ strncpy(raead.geniv, aead->geniv ?: "<built-in>", sizeof(raead.geniv));
+
+ raead.blocksize = alg->cra_blocksize;
+ raead.maxauthsize = aead->maxauthsize;
+@@ -203,8 +202,8 @@ static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_aead raead;
+ struct aead_alg *aead = &alg->cra_aead;
+
+- snprintf(raead.type, CRYPTO_MAX_ALG_NAME, "%s", "nivaead");
+- snprintf(raead.geniv, CRYPTO_MAX_ALG_NAME, "%s", aead->geniv);
++ strncpy(raead.type, "nivaead", sizeof(raead.type));
++ strncpy(raead.geniv, aead->geniv, sizeof(raead.geniv));
+
+ raead.blocksize = alg->cra_blocksize;
+ raead.maxauthsize = aead->maxauthsize;
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 3887856..793a27f 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -404,7 +404,7 @@ static int crypto_ahash_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_hash rhash;
+
+- snprintf(rhash.type, CRYPTO_MAX_ALG_NAME, "%s", "ahash");
++ strncpy(rhash.type, "ahash", sizeof(rhash.type));
+
+ rhash.blocksize = alg->cra_blocksize;
+ rhash.digestsize = __crypto_hash_alg_common(alg)->digestsize;
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index a8d85a1..c44e014 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -499,9 +499,9 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_blkcipher rblkcipher;
+
+- snprintf(rblkcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "blkcipher");
+- snprintf(rblkcipher.geniv, CRYPTO_MAX_ALG_NAME, "%s",
+- alg->cra_blkcipher.geniv ?: "<default>");
++ strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
++ strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
++ sizeof(rblkcipher.geniv));
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 35d700a..f6d9baf 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -75,7 +75,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_cipher rcipher;
+
+- snprintf(rcipher.type, CRYPTO_MAX_ALG_NAME, "%s", "cipher");
++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
+
+ rcipher.blocksize = alg->cra_blocksize;
+ rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
+@@ -94,8 +94,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rcomp;
+
+- snprintf(rcomp.type, CRYPTO_MAX_ALG_NAME, "%s", "compression");
+-
++ strncpy(rcomp.type, "compression", sizeof(rcomp.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rcomp))
+ goto nla_put_failure;
+@@ -108,12 +107,14 @@ nla_put_failure:
+ static int crypto_report_one(struct crypto_alg *alg,
+ struct crypto_user_alg *ualg, struct sk_buff *skb)
+ {
+- memcpy(&ualg->cru_name, &alg->cra_name, sizeof(ualg->cru_name));
+- memcpy(&ualg->cru_driver_name, &alg->cra_driver_name,
+- sizeof(ualg->cru_driver_name));
+- memcpy(&ualg->cru_module_name, module_name(alg->cra_module),
+- CRYPTO_MAX_ALG_NAME);
+-
++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
++ strncpy(ualg->cru_driver_name, alg->cra_driver_name,
++ sizeof(ualg->cru_driver_name));
++ strncpy(ualg->cru_module_name, module_name(alg->cra_module),
++ sizeof(ualg->cru_module_name));
++
++ ualg->cru_type = 0;
++ ualg->cru_mask = 0;
+ ualg->cru_flags = alg->cra_flags;
+ ualg->cru_refcnt = atomic_read(&alg->cra_refcnt);
+
+@@ -122,8 +123,7 @@ static int crypto_report_one(struct crypto_alg *alg,
+ if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
+ struct crypto_report_larval rl;
+
+- snprintf(rl.type, CRYPTO_MAX_ALG_NAME, "%s", "larval");
+-
++ strncpy(rl.type, "larval", sizeof(rl.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL,
+ sizeof(struct crypto_report_larval), &rl))
+ goto nla_put_failure;
+diff --git a/crypto/pcompress.c b/crypto/pcompress.c
+index 04e083f..7140fe7 100644
+--- a/crypto/pcompress.c
++++ b/crypto/pcompress.c
+@@ -53,8 +53,7 @@ static int crypto_pcomp_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rpcomp;
+
+- snprintf(rpcomp.type, CRYPTO_MAX_ALG_NAME, "%s", "pcomp");
+-
++ strncpy(rpcomp.type, "pcomp", sizeof(rpcomp.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rpcomp))
+ goto nla_put_failure;
+diff --git a/crypto/rng.c b/crypto/rng.c
+index f3b7894..e0a25c2 100644
+--- a/crypto/rng.c
++++ b/crypto/rng.c
+@@ -65,7 +65,7 @@ static int crypto_rng_report(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_rng rrng;
+
+- snprintf(rrng.type, CRYPTO_MAX_ALG_NAME, "%s", "rng");
++ strncpy(rrng.type, "rng", sizeof(rrng.type));
+
+ rrng.seedsize = alg->cra_rng.seedsize;
+
+diff --git a/crypto/shash.c b/crypto/shash.c
+index f426330f..929058a 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -530,7 +530,8 @@ static int crypto_shash_report(struct sk_buff *skb, struct crypto_alg *alg)
+ struct crypto_report_hash rhash;
+ struct shash_alg *salg = __crypto_shash_alg(alg);
+
+- snprintf(rhash.type, CRYPTO_MAX_ALG_NAME, "%s", "shash");
++ strncpy(rhash.type, "shash", sizeof(rhash.type));
++
+ rhash.blocksize = alg->cra_blocksize;
+ rhash.digestsize = salg->digestsize;
+
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index de1f319..e34a7b4 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -881,6 +881,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
+ goto fail_response;
+ }
+
++ preq.dev = req->u.rw.handle;
+ preq.sector_number = req->u.rw.sector_number;
+ preq.nr_sects = 0;
+
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index 1bafb40..69ae597 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -40,6 +40,7 @@
+ #include <linux/init.h>
+ #include <linux/miscdevice.h>
+ #include <linux/delay.h>
++#include <linux/slab.h>
+ #include <asm/uaccess.h>
+
+
+@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
+ static LIST_HEAD(rng_list);
+ static DEFINE_MUTEX(rng_mutex);
+ static int data_avail;
+-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
+- __cacheline_aligned;
++static u8 *rng_buffer;
++
++static size_t rng_buffer_size(void)
++{
++ return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
++}
+
+ static inline int hwrng_init(struct hwrng *rng)
+ {
+@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
+
+ if (!data_avail) {
+ bytes_read = rng_get_data(current_rng, rng_buffer,
+- sizeof(rng_buffer),
++ rng_buffer_size(),
+ !(filp->f_flags & O_NONBLOCK));
+ if (bytes_read < 0) {
+ err = bytes_read;
+@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
+
+ mutex_lock(&rng_mutex);
+
++ /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
++ err = -ENOMEM;
++ if (!rng_buffer) {
++ rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
++ if (!rng_buffer)
++ goto out_unlock;
++ }
++
+ /* Must not register two RNGs with the same name. */
+ err = -EEXIST;
+ list_for_each_entry(tmp, &rng_list, list) {
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 85e81ec..57d4b15 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -852,6 +852,7 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+ int reserved)
+ {
+ unsigned long flags;
++ int wakeup_write = 0;
+
+ /* Hold lock while accounting */
+ spin_lock_irqsave(&r->lock, flags);
+@@ -873,10 +874,8 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+ else
+ r->entropy_count = reserved;
+
+- if (r->entropy_count < random_write_wakeup_thresh) {
+- wake_up_interruptible(&random_write_wait);
+- kill_fasync(&fasync, SIGIO, POLL_OUT);
+- }
++ if (r->entropy_count < random_write_wakeup_thresh)
++ wakeup_write = 1;
+ }
+
+ DEBUG_ENT("debiting %zu entropy credits from %s%s\n",
+@@ -884,6 +883,11 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+
+ spin_unlock_irqrestore(&r->lock, flags);
+
++ if (wakeup_write) {
++ wake_up_interruptible(&random_write_wait);
++ kill_fasync(&fasync, SIGIO, POLL_OUT);
++ }
++
+ return nbytes;
+ }
+
+diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
+index fce2000..1110478 100644
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
+ (task_active_pid_ns(current) != &init_pid_ns))
+ return;
+
++ /* Can only change if privileged. */
++ if (!capable(CAP_NET_ADMIN)) {
++ err = EPERM;
++ goto out;
++ }
++
+ mc_op = (enum proc_cn_mcast_op *)msg->data;
+ switch (*mc_op) {
+ case PROC_CN_MCAST_LISTEN:
+@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
+ err = EINVAL;
+ break;
+ }
++
++out:
+ cn_proc_ack(err, msg->seq, msg->ack);
+ }
+
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 982f1f5..4cd392d 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -442,7 +442,6 @@ static int __init dmi_present(const char __iomem *p)
+ static int __init smbios_present(const char __iomem *p)
+ {
+ u8 buf[32];
+- int offset = 0;
+
+ memcpy_fromio(buf, p, 32);
+ if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+@@ -461,9 +460,9 @@ static int __init smbios_present(const char __iomem *p)
+ dmi_ver = 0x0206;
+ break;
+ }
+- offset = 16;
++ return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+ }
+- return dmi_present(buf + offset);
++ return 1;
+ }
+
+ void __init dmi_scan_machine(void)
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index bcb201c..2a2e145 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -406,10 +406,11 @@ static efi_status_t
+ get_var_data(struct efivars *efivars, struct efi_variable *var)
+ {
+ efi_status_t status;
++ unsigned long flags;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irqsave(&efivars->lock, flags);
+ status = get_var_data_locked(efivars, var);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irqrestore(&efivars->lock, flags);
+
+ if (status != EFI_SUCCESS) {
+ printk(KERN_WARNING "efivars: get_variable() failed 0x%lx!\n",
+@@ -418,6 +419,44 @@ get_var_data(struct efivars *efivars, struct efi_variable *var)
+ return status;
+ }
+
++static efi_status_t
++check_var_size_locked(struct efivars *efivars, u32 attributes,
++ unsigned long size)
++{
++ u64 storage_size, remaining_size, max_size;
++ efi_status_t status;
++ const struct efivar_operations *fops = efivars->ops;
++
++ if (!efivars->ops->query_variable_info)
++ return EFI_UNSUPPORTED;
++
++ status = fops->query_variable_info(attributes, &storage_size,
++ &remaining_size, &max_size);
++
++ if (status != EFI_SUCCESS)
++ return status;
++
++ if (!storage_size || size > remaining_size || size > max_size ||
++ (remaining_size - size) < (storage_size / 2))
++ return EFI_OUT_OF_RESOURCES;
++
++ return status;
++}
++
++
++static efi_status_t
++check_var_size(struct efivars *efivars, u32 attributes, unsigned long size)
++{
++ efi_status_t status;
++ unsigned long flags;
++
++ spin_lock_irqsave(&efivars->lock, flags);
++ status = check_var_size_locked(efivars, attributes, size);
++ spin_unlock_irqrestore(&efivars->lock, flags);
++
++ return status;
++}
++
+ static ssize_t
+ efivar_guid_read(struct efivar_entry *entry, char *buf)
+ {
+@@ -538,14 +577,19 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
+ return -EINVAL;
+ }
+
+- spin_lock(&efivars->lock);
+- status = efivars->ops->set_variable(new_var->VariableName,
+- &new_var->VendorGuid,
+- new_var->Attributes,
+- new_var->DataSize,
+- new_var->Data);
++ spin_lock_irq(&efivars->lock);
++
++ status = check_var_size_locked(efivars, new_var->Attributes,
++ new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+
+- spin_unlock(&efivars->lock);
++ if (status == EFI_SUCCESS || status == EFI_UNSUPPORTED)
++ status = efivars->ops->set_variable(new_var->VariableName,
++ &new_var->VendorGuid,
++ new_var->Attributes,
++ new_var->DataSize,
++ new_var->Data);
++
++ spin_unlock_irq(&efivars->lock);
+
+ if (status != EFI_SUCCESS) {
+ printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+@@ -694,8 +738,7 @@ static ssize_t efivarfs_file_write(struct file *file,
+ u32 attributes;
+ struct inode *inode = file->f_mapping->host;
+ unsigned long datasize = count - sizeof(attributes);
+- unsigned long newdatasize;
+- u64 storage_size, remaining_size, max_size;
++ unsigned long newdatasize, varsize;
+ ssize_t bytes = 0;
+
+ if (count < sizeof(attributes))
+@@ -714,28 +757,18 @@ static ssize_t efivarfs_file_write(struct file *file,
+ * amounts of memory. Pick a default size of 64K if
+ * QueryVariableInfo() isn't supported by the firmware.
+ */
+- spin_lock(&efivars->lock);
+
+- if (!efivars->ops->query_variable_info)
+- status = EFI_UNSUPPORTED;
+- else {
+- const struct efivar_operations *fops = efivars->ops;
+- status = fops->query_variable_info(attributes, &storage_size,
+- &remaining_size, &max_size);
+- }
+-
+- spin_unlock(&efivars->lock);
++ varsize = datasize + utf16_strsize(var->var.VariableName, 1024);
++ status = check_var_size(efivars, attributes, varsize);
+
+ if (status != EFI_SUCCESS) {
+ if (status != EFI_UNSUPPORTED)
+ return efi_status_to_err(status);
+
+- remaining_size = 65536;
++ if (datasize > 65536)
++ return -ENOSPC;
+ }
+
+- if (datasize > remaining_size)
+- return -ENOSPC;
+-
+ data = kmalloc(datasize, GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+@@ -755,7 +788,20 @@ static ssize_t efivarfs_file_write(struct file *file,
+ * set_variable call, and removal of the variable from the efivars
+ * list (in the case of an authenticated delete).
+ */
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
++
++ /*
++ * Ensure that the available space hasn't shrunk below the safe level
++ */
++
++ status = check_var_size_locked(efivars, attributes, varsize);
++
++ if (status != EFI_SUCCESS && status != EFI_UNSUPPORTED) {
++ spin_unlock_irq(&efivars->lock);
++ kfree(data);
++
++ return efi_status_to_err(status);
++ }
+
+ status = efivars->ops->set_variable(var->var.VariableName,
+ &var->var.VendorGuid,
+@@ -763,7 +809,7 @@ static ssize_t efivarfs_file_write(struct file *file,
+ data);
+
+ if (status != EFI_SUCCESS) {
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ kfree(data);
+
+ return efi_status_to_err(status);
+@@ -784,21 +830,21 @@ static ssize_t efivarfs_file_write(struct file *file,
+ NULL);
+
+ if (status == EFI_BUFFER_TOO_SMALL) {
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ mutex_lock(&inode->i_mutex);
+ i_size_write(inode, newdatasize + sizeof(attributes));
+ mutex_unlock(&inode->i_mutex);
+
+ } else if (status == EFI_NOT_FOUND) {
+ list_del(&var->list);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ efivar_unregister(var);
+ drop_nlink(inode);
+ d_delete(file->f_dentry);
+ dput(file->f_dentry);
+
+ } else {
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ pr_warn("efivarfs: inconsistent EFI variable implementation? "
+ "status = %lx\n", status);
+ }
+@@ -820,11 +866,11 @@ static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,
+ void *data;
+ ssize_t size = 0;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ status = efivars->ops->get_variable(var->var.VariableName,
+ &var->var.VendorGuid,
+ &attributes, &datasize, NULL);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ if (status != EFI_BUFFER_TOO_SMALL)
+ return efi_status_to_err(status);
+@@ -834,12 +880,12 @@ static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,
+ if (!data)
+ return -ENOMEM;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ status = efivars->ops->get_variable(var->var.VariableName,
+ &var->var.VendorGuid,
+ &attributes, &datasize,
+ (data + sizeof(attributes)));
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ if (status != EFI_SUCCESS) {
+ size = efi_status_to_err(status);
+@@ -921,8 +967,8 @@ static bool efivarfs_valid_name(const char *str, int len)
+ if (len < GUID_LEN + 2)
+ return false;
+
+- /* GUID should be right after the first '-' */
+- if (s - 1 != strchr(str, '-'))
++ /* GUID must be preceded by a '-' */
++ if (*(s - 1) != '-')
+ return false;
+
+ /*
+@@ -1005,9 +1051,9 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ goto out;
+
+ kobject_uevent(&var->kobj, KOBJ_ADD);
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ list_add(&var->list, &efivars->list);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ d_instantiate(dentry, inode);
+ dget(dentry);
+ out:
+@@ -1024,7 +1070,7 @@ static int efivarfs_unlink(struct inode *dir, struct dentry *dentry)
+ struct efivars *efivars = var->efivars;
+ efi_status_t status;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+
+ status = efivars->ops->set_variable(var->var.VariableName,
+ &var->var.VendorGuid,
+@@ -1032,14 +1078,14 @@ static int efivarfs_unlink(struct inode *dir, struct dentry *dentry)
+
+ if (status == EFI_SUCCESS || status == EFI_NOT_FOUND) {
+ list_del(&var->list);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ efivar_unregister(var);
+ drop_nlink(dentry->d_inode);
+ dput(dentry);
+ return 0;
+ }
+
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return -EINVAL;
+ };
+
+@@ -1110,15 +1156,22 @@ static struct dentry_operations efivarfs_d_ops = {
+
+ static struct dentry *efivarfs_alloc_dentry(struct dentry *parent, char *name)
+ {
++ struct dentry *d;
+ struct qstr q;
++ int err;
+
+ q.name = name;
+ q.len = strlen(name);
+
+- if (efivarfs_d_hash(NULL, NULL, &q))
+- return NULL;
++ err = efivarfs_d_hash(NULL, NULL, &q);
++ if (err)
++ return ERR_PTR(err);
+
+- return d_alloc(parent, &q);
++ d = d_alloc(parent, &q);
++ if (d)
++ return d;
++
++ return ERR_PTR(-ENOMEM);
+ }
+
+ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
+@@ -1128,6 +1181,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
+ struct efivar_entry *entry, *n;
+ struct efivars *efivars = &__efivars;
+ char *name;
++ int err = -ENOMEM;
+
+ efivarfs_sb = sb;
+
+@@ -1178,19 +1232,21 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
+ goto fail_name;
+
+ dentry = efivarfs_alloc_dentry(root, name);
+- if (!dentry)
++ if (IS_ERR(dentry)) {
++ err = PTR_ERR(dentry);
+ goto fail_inode;
++ }
+
+ /* copied by the above to local storage in the dentry. */
+ kfree(name);
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ efivars->ops->get_variable(entry->var.VariableName,
+ &entry->var.VendorGuid,
+ &entry->var.Attributes,
+ &size,
+ NULL);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ mutex_lock(&inode->i_mutex);
+ inode->i_private = entry;
+@@ -1206,7 +1262,7 @@ fail_inode:
+ fail_name:
+ kfree(name);
+ fail:
+- return -ENOMEM;
++ return err;
+ }
+
+ static struct dentry *efivarfs_mount(struct file_system_type *fs_type,
+@@ -1253,7 +1309,7 @@ static int efi_pstore_open(struct pstore_info *psi)
+ {
+ struct efivars *efivars = psi->data;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ efivars->walk_entry = list_first_entry(&efivars->list,
+ struct efivar_entry, list);
+ return 0;
+@@ -1263,7 +1319,7 @@ static int efi_pstore_close(struct pstore_info *psi)
+ {
+ struct efivars *efivars = psi->data;
+
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return 0;
+ }
+
+@@ -1337,22 +1393,22 @@ static int efi_pstore_write(enum pstore_type_id type,
+ efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
+ struct efivars *efivars = psi->data;
+ int i, ret = 0;
+- u64 storage_space, remaining_space, max_variable_size;
+ efi_status_t status = EFI_NOT_FOUND;
++ unsigned long flags;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irqsave(&efivars->lock, flags);
+
+ /*
+ * Check if there is a space enough to log.
+ * size: a size of logging data
+ * DUMP_NAME_LEN * 2: a maximum size of variable name
+ */
+- status = efivars->ops->query_variable_info(PSTORE_EFI_ATTRIBUTES,
+- &storage_space,
+- &remaining_space,
+- &max_variable_size);
+- if (status || remaining_space < size + DUMP_NAME_LEN * 2) {
+- spin_unlock(&efivars->lock);
++
++ status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
++ size + DUMP_NAME_LEN * 2);
++
++ if (status) {
++ spin_unlock_irqrestore(&efivars->lock, flags);
+ *id = part;
+ return -ENOSPC;
+ }
+@@ -1366,7 +1422,7 @@ static int efi_pstore_write(enum pstore_type_id type,
+ efivars->ops->set_variable(efi_name, &vendor, PSTORE_EFI_ATTRIBUTES,
+ size, psi->buf);
+
+- spin_unlock(&efivars->lock);
++ spin_unlock_irqrestore(&efivars->lock, flags);
+
+ if (size)
+ ret = efivar_create_sysfs_entry(efivars,
+@@ -1393,7 +1449,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
+ sprintf(name, "dump-type%u-%u-%d-%lu", type, (unsigned int)id, count,
+ time.tv_sec);
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+
+ for (i = 0; i < DUMP_NAME_LEN; i++)
+ efi_name[i] = name[i];
+@@ -1437,7 +1493,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
+ if (found)
+ list_del(&found->list);
+
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ if (found)
+ efivar_unregister(found);
+@@ -1507,7 +1563,7 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+ }
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+
+ /*
+ * Does this variable already exist?
+@@ -1525,10 +1581,18 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ }
+ }
+ if (found) {
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return -EINVAL;
+ }
+
++ status = check_var_size_locked(efivars, new_var->Attributes,
++ new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
++
++ if (status && status != EFI_UNSUPPORTED) {
++ spin_unlock_irq(&efivars->lock);
++ return efi_status_to_err(status);
++ }
++
+ /* now *really* create the variable via EFI */
+ status = efivars->ops->set_variable(new_var->VariableName,
+ &new_var->VendorGuid,
+@@ -1539,10 +1603,10 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ if (status != EFI_SUCCESS) {
+ printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+ status);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return -EIO;
+ }
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ /* Create the entry in sysfs. Locking is not required here */
+ status = efivar_create_sysfs_entry(efivars,
+@@ -1570,7 +1634,7 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+
+ /*
+ * Does this variable already exist?
+@@ -1588,7 +1652,7 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ }
+ }
+ if (!found) {
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return -EINVAL;
+ }
+ /* force the Attributes/DataSize to 0 to ensure deletion */
+@@ -1604,12 +1668,12 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ if (status != EFI_SUCCESS) {
+ printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+ status);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ return -EIO;
+ }
+ list_del(&search_efivar->list);
+ /* We need to release this lock before unregistering. */
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ efivar_unregister(search_efivar);
+
+ /* It's dead Jim.... */
+@@ -1724,9 +1788,9 @@ efivar_create_sysfs_entry(struct efivars *efivars,
+ kfree(short_name);
+ short_name = NULL;
+
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ list_add(&new_efivar->list, &efivars->list);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+
+ return 0;
+ }
+@@ -1795,9 +1859,9 @@ void unregister_efivars(struct efivars *efivars)
+ struct efivar_entry *entry, *n;
+
+ list_for_each_entry_safe(entry, n, &efivars->list, list) {
+- spin_lock(&efivars->lock);
++ spin_lock_irq(&efivars->lock);
+ list_del(&entry->list);
+- spin_unlock(&efivars->lock);
++ spin_unlock_irq(&efivars->lock);
+ efivar_unregister(entry);
+ }
+ if (efivars->new_var)
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 6819d63..456663c 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -41,6 +41,7 @@
+ #include <linux/io.h>
+ #include <linux/of_irq.h>
+ #include <linux/of_device.h>
++#include <linux/clk.h>
+ #include <linux/pinctrl/consumer.h>
+
+ /*
+@@ -495,6 +496,7 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ struct resource *res;
+ struct irq_chip_generic *gc;
+ struct irq_chip_type *ct;
++ struct clk *clk;
+ unsigned int ngpios;
+ int soc_variant;
+ int i, cpu, id;
+@@ -528,6 +530,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ return id;
+ }
+
++ clk = devm_clk_get(&pdev->dev, NULL);
++ /* Not all SoCs require a clock.*/
++ if (!IS_ERR(clk))
++ clk_prepare_enable(clk);
++
+ mvchip->soc_variant = soc_variant;
+ mvchip->chip.label = dev_name(&pdev->dev);
+ mvchip->chip.dev = &pdev->dev;
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index 99daa89..5206f24 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1297,19 +1297,21 @@ static int i915_load_modeset_init(struct drm_device *dev)
+ if (ret)
+ goto cleanup_vga_switcheroo;
+
++ ret = drm_irq_install(dev);
++ if (ret)
++ goto cleanup_gem_stolen;
++
++ /* Important: The output setup functions called by modeset_init need
++ * working irqs for e.g. gmbus and dp aux transfers. */
+ intel_modeset_init(dev);
+
+ ret = i915_gem_init(dev);
+ if (ret)
+- goto cleanup_gem_stolen;
+-
+- intel_modeset_gem_init(dev);
++ goto cleanup_irq;
+
+ INIT_WORK(&dev_priv->console_resume_work, intel_console_resume);
+
+- ret = drm_irq_install(dev);
+- if (ret)
+- goto cleanup_gem;
++ intel_modeset_gem_init(dev);
+
+ /* Always safe in the mode setting case. */
+ /* FIXME: do pre/post-mode set stuff in core KMS code */
+@@ -1317,7 +1319,10 @@ static int i915_load_modeset_init(struct drm_device *dev)
+
+ ret = intel_fbdev_init(dev);
+ if (ret)
+- goto cleanup_irq;
++ goto cleanup_gem;
++
++ /* Only enable hotplug handling once the fbdev is fully set up. */
++ dev_priv->enable_hotplug_processing = true;
+
+ drm_kms_helper_poll_init(dev);
+
+@@ -1326,13 +1331,13 @@ static int i915_load_modeset_init(struct drm_device *dev)
+
+ return 0;
+
+-cleanup_irq:
+- drm_irq_uninstall(dev);
+ cleanup_gem:
+ mutex_lock(&dev->struct_mutex);
+ i915_gem_cleanup_ringbuffer(dev);
+ mutex_unlock(&dev->struct_mutex);
+ i915_gem_cleanup_aliasing_ppgtt(dev);
++cleanup_irq:
++ drm_irq_uninstall(dev);
+ cleanup_gem_stolen:
+ i915_gem_cleanup_stolen(dev);
+ cleanup_vga_switcheroo:
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 1172658..fb6454c 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -377,15 +377,15 @@ static const struct pci_device_id pciidlist[] = { /* aka */
+ INTEL_VGA_DEVICE(0x0A06, &intel_haswell_m_info), /* ULT GT1 mobile */
+ INTEL_VGA_DEVICE(0x0A16, &intel_haswell_m_info), /* ULT GT2 mobile */
+ INTEL_VGA_DEVICE(0x0A26, &intel_haswell_m_info), /* ULT GT2 mobile */
+- INTEL_VGA_DEVICE(0x0D12, &intel_haswell_d_info), /* CRW GT1 desktop */
++ INTEL_VGA_DEVICE(0x0D02, &intel_haswell_d_info), /* CRW GT1 desktop */
++ INTEL_VGA_DEVICE(0x0D12, &intel_haswell_d_info), /* CRW GT2 desktop */
+ INTEL_VGA_DEVICE(0x0D22, &intel_haswell_d_info), /* CRW GT2 desktop */
+- INTEL_VGA_DEVICE(0x0D32, &intel_haswell_d_info), /* CRW GT2 desktop */
+- INTEL_VGA_DEVICE(0x0D1A, &intel_haswell_d_info), /* CRW GT1 server */
++ INTEL_VGA_DEVICE(0x0D0A, &intel_haswell_d_info), /* CRW GT1 server */
++ INTEL_VGA_DEVICE(0x0D1A, &intel_haswell_d_info), /* CRW GT2 server */
+ INTEL_VGA_DEVICE(0x0D2A, &intel_haswell_d_info), /* CRW GT2 server */
+- INTEL_VGA_DEVICE(0x0D3A, &intel_haswell_d_info), /* CRW GT2 server */
+- INTEL_VGA_DEVICE(0x0D16, &intel_haswell_m_info), /* CRW GT1 mobile */
++ INTEL_VGA_DEVICE(0x0D06, &intel_haswell_m_info), /* CRW GT1 mobile */
++ INTEL_VGA_DEVICE(0x0D16, &intel_haswell_m_info), /* CRW GT2 mobile */
+ INTEL_VGA_DEVICE(0x0D26, &intel_haswell_m_info), /* CRW GT2 mobile */
+- INTEL_VGA_DEVICE(0x0D36, &intel_haswell_m_info), /* CRW GT2 mobile */
+ INTEL_VGA_DEVICE(0x0f30, &intel_valleyview_m_info),
+ INTEL_VGA_DEVICE(0x0157, &intel_valleyview_m_info),
+ INTEL_VGA_DEVICE(0x0155, &intel_valleyview_d_info),
+@@ -486,6 +486,7 @@ static int i915_drm_freeze(struct drm_device *dev)
+ intel_modeset_disable(dev);
+
+ drm_irq_uninstall(dev);
++ dev_priv->enable_hotplug_processing = false;
+ }
+
+ i915_save_state(dev);
+@@ -562,9 +563,19 @@ static int __i915_drm_thaw(struct drm_device *dev)
+ error = i915_gem_init_hw(dev);
+ mutex_unlock(&dev->struct_mutex);
+
++ /* We need working interrupts for modeset enabling ... */
++ drm_irq_install(dev);
++
+ intel_modeset_init_hw(dev);
+ intel_modeset_setup_hw_state(dev, false);
+- drm_irq_install(dev);
++
++ /*
++ * ... but also need to make sure that hotplug processing
++ * doesn't cause havoc. Like in the driver load code we don't
++ * bother with the tiny race here where we might loose hotplug
++ * notifications.
++ * */
++ dev_priv->enable_hotplug_processing = true;
+ }
+
+ intel_opregion_init(dev);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 7339a4b..66ad64f 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -672,6 +672,7 @@ typedef struct drm_i915_private {
+
+ u32 hotplug_supported_mask;
+ struct work_struct hotplug_work;
++ bool enable_hotplug_processing;
+
+ int num_pipe;
+ int num_pch_pll;
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index fe84338..3c00403 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -287,6 +287,10 @@ static void i915_hotplug_work_func(struct work_struct *work)
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct intel_encoder *encoder;
+
++ /* HPD irq before everything is fully set up. */
++ if (!dev_priv->enable_hotplug_processing)
++ return;
++
+ mutex_lock(&mode_config->mutex);
+ DRM_DEBUG_KMS("running encoder hotplug functions\n");
+
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index 06b1786..b52ed09 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -88,7 +88,7 @@ static void intel_disable_crt(struct intel_encoder *encoder)
+ u32 temp;
+
+ temp = I915_READ(crt->adpa_reg);
+- temp &= ~(ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE);
++ temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
+ temp &= ~ADPA_DAC_ENABLE;
+ I915_WRITE(crt->adpa_reg, temp);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 3280cff..dde0ded 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2572,7 +2572,7 @@ static void gen6_enable_rps(struct drm_device *dev)
+ I915_WRITE(GEN6_RC_SLEEP, 0);
+ I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
+ I915_WRITE(GEN6_RC6_THRESHOLD, 50000);
+- I915_WRITE(GEN6_RC6p_THRESHOLD, 100000);
++ I915_WRITE(GEN6_RC6p_THRESHOLD, 150000);
+ I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
+
+ /* Check if we are enabling RC6 */
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 3e403bd..78edadc 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -970,6 +970,15 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ found = 1;
+ }
+
++ /* quirks */
++ /* Radeon 9100 (R200) */
++ if ((dev->pdev->device == 0x514D) &&
++ (dev->pdev->subsystem_vendor == 0x174B) &&
++ (dev->pdev->subsystem_device == 0x7149)) {
++ /* vbios value is bad, use the default */
++ found = 0;
++ }
++
+ if (!found) /* fallback to defaults */
+ radeon_legacy_get_primary_dac_info_from_table(rdev, p_dac);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 90374dd..48f80cd 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -400,6 +400,9 @@ void radeon_irq_kms_enable_afmt(struct radeon_device *rdev, int block)
+ {
+ unsigned long irqflags;
+
++ if (!rdev->ddev->irq_enabled)
++ return;
++
+ spin_lock_irqsave(&rdev->irq.lock, irqflags);
+ rdev->irq.afmt[block] = true;
+ radeon_irq_set(rdev);
+@@ -419,6 +422,9 @@ void radeon_irq_kms_disable_afmt(struct radeon_device *rdev, int block)
+ {
+ unsigned long irqflags;
+
++ if (!rdev->ddev->irq_enabled)
++ return;
++
+ spin_lock_irqsave(&rdev->irq.lock, irqflags);
+ rdev->irq.afmt[block] = false;
+ radeon_irq_set(rdev);
+@@ -438,6 +444,9 @@ void radeon_irq_kms_enable_hpd(struct radeon_device *rdev, unsigned hpd_mask)
+ unsigned long irqflags;
+ int i;
+
++ if (!rdev->ddev->irq_enabled)
++ return;
++
+ spin_lock_irqsave(&rdev->irq.lock, irqflags);
+ for (i = 0; i < RADEON_MAX_HPD_PINS; ++i)
+ rdev->irq.hpd[i] |= !!(hpd_mask & (1 << i));
+@@ -458,6 +467,9 @@ void radeon_irq_kms_disable_hpd(struct radeon_device *rdev, unsigned hpd_mask)
+ unsigned long irqflags;
+ int i;
+
++ if (!rdev->ddev->irq_enabled)
++ return;
++
+ spin_lock_irqsave(&rdev->irq.lock, irqflags);
+ for (i = 0; i < RADEON_MAX_HPD_PINS; ++i)
+ rdev->irq.hpd[i] &= !(hpd_mask & (1 << i));
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 9500f2f..8758f38c 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -459,19 +459,25 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
+ struct dj_report *dj_report)
+ {
+ struct hid_device *hdev = djrcv_dev->hdev;
+- int sent_bytes;
++ struct hid_report *report;
++ struct hid_report_enum *output_report_enum;
++ u8 *data = (u8 *)(&dj_report->device_index);
++ int i;
+
+- if (!hdev->hid_output_raw_report) {
+- dev_err(&hdev->dev, "%s:"
+- "hid_output_raw_report is null\n", __func__);
++ output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
++ report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
++
++ if (!report) {
++ dev_err(&hdev->dev, "%s: unable to find dj report\n", __func__);
+ return -ENODEV;
+ }
+
+- sent_bytes = hdev->hid_output_raw_report(hdev, (u8 *) dj_report,
+- sizeof(struct dj_report),
+- HID_OUTPUT_REPORT);
++ for (i = 0; i < report->field[0]->report_count; i++)
++ report->field[0]->value[i] = data[i];
++
++ usbhid_submit_report(hdev, report, USB_DIR_OUT);
+
+- return (sent_bytes < 0) ? sent_bytes : 0;
++ return 0;
+ }
+
+ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
+diff --git a/drivers/hwmon/pmbus/ltc2978.c b/drivers/hwmon/pmbus/ltc2978.c
+index 9652a2c..a58de38 100644
+--- a/drivers/hwmon/pmbus/ltc2978.c
++++ b/drivers/hwmon/pmbus/ltc2978.c
+@@ -62,7 +62,7 @@ struct ltc2978_data {
+ int temp_min, temp_max;
+ int vout_min[8], vout_max[8];
+ int iout_max[2];
+- int temp2_max[2];
++ int temp2_max;
+ struct pmbus_driver_info info;
+ };
+
+@@ -204,10 +204,9 @@ static int ltc3880_read_word_data(struct i2c_client *client, int page, int reg)
+ ret = pmbus_read_word_data(client, page,
+ LTC3880_MFR_TEMPERATURE2_PEAK);
+ if (ret >= 0) {
+- if (lin11_to_val(ret)
+- > lin11_to_val(data->temp2_max[page]))
+- data->temp2_max[page] = ret;
+- ret = data->temp2_max[page];
++ if (lin11_to_val(ret) > lin11_to_val(data->temp2_max))
++ data->temp2_max = ret;
++ ret = data->temp2_max;
+ }
+ break;
+ case PMBUS_VIRT_READ_VIN_MIN:
+@@ -248,11 +247,11 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
+
+ switch (reg) {
+ case PMBUS_VIRT_RESET_IOUT_HISTORY:
+- data->iout_max[page] = 0x7fff;
++ data->iout_max[page] = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_TEMP2_HISTORY:
+- data->temp2_max[page] = 0x7fff;
++ data->temp2_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_VOUT_HISTORY:
+@@ -262,12 +261,12 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
+ break;
+ case PMBUS_VIRT_RESET_VIN_HISTORY:
+ data->vin_min = 0x7bff;
+- data->vin_max = 0;
++ data->vin_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ case PMBUS_VIRT_RESET_TEMP_HISTORY:
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7fff;
++ data->temp_max = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ default:
+@@ -321,12 +320,13 @@ static int ltc2978_probe(struct i2c_client *client,
+ info = &data->info;
+ info->write_word_data = ltc2978_write_word_data;
+
+- data->vout_min[0] = 0xffff;
+ data->vin_min = 0x7bff;
++ data->vin_max = 0x7c00;
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7fff;
++ data->temp_max = 0x7c00;
++ data->temp2_max = 0x7c00;
+
+- switch (id->driver_data) {
++ switch (data->id) {
+ case ltc2978:
+ info->read_word_data = ltc2978_read_word_data;
+ info->pages = 8;
+@@ -336,7 +336,6 @@ static int ltc2978_probe(struct i2c_client *client,
+ for (i = 1; i < 8; i++) {
+ info->func[i] = PMBUS_HAVE_VOUT
+ | PMBUS_HAVE_STATUS_VOUT;
+- data->vout_min[i] = 0xffff;
+ }
+ break;
+ case ltc3880:
+@@ -352,11 +351,14 @@ static int ltc2978_probe(struct i2c_client *client,
+ | PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT
+ | PMBUS_HAVE_POUT
+ | PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
+- data->vout_min[1] = 0xffff;
++ data->iout_max[0] = 0x7c00;
++ data->iout_max[1] = 0x7c00;
+ break;
+ default:
+ return -ENODEV;
+ }
++ for (i = 0; i < info->pages; i++)
++ data->vout_min[i] = 0xffff;
+
+ return pmbus_do_probe(client, id, info);
+ }
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index 1c85d39..8047fed 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -926,7 +926,13 @@ static int sht15_probe(struct platform_device *pdev)
+ if (voltage)
+ data->supply_uV = voltage;
+
+- regulator_enable(data->reg);
++ ret = regulator_enable(data->reg);
++ if (ret != 0) {
++ dev_err(&pdev->dev,
++ "failed to enable regulator: %d\n", ret);
++ return ret;
++ }
++
+ /*
+ * Setup a notifier block to update this if another device
+ * causes the voltage to change
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index f7369f9..2ae151e 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1234,20 +1234,6 @@ static int crypt_decode_key(u8 *key, char *hex, unsigned int size)
+ return 0;
+ }
+
+-/*
+- * Encode key into its hex representation
+- */
+-static void crypt_encode_key(char *hex, u8 *key, unsigned int size)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < size; i++) {
+- sprintf(hex, "%02x", *key);
+- hex += 2;
+- key++;
+- }
+-}
+-
+ static void crypt_free_tfms(struct crypt_config *cc)
+ {
+ unsigned i;
+@@ -1717,11 +1703,11 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_SUBMITTED;
+ }
+
+-static int crypt_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void crypt_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct crypt_config *cc = ti->private;
+- unsigned int sz = 0;
++ unsigned i, sz = 0;
+
+ switch (type) {
+ case STATUSTYPE_INFO:
+@@ -1731,17 +1717,11 @@ static int crypt_status(struct dm_target *ti, status_type_t type,
+ case STATUSTYPE_TABLE:
+ DMEMIT("%s ", cc->cipher_string);
+
+- if (cc->key_size > 0) {
+- if ((maxlen - sz) < ((cc->key_size << 1) + 1))
+- return -ENOMEM;
+-
+- crypt_encode_key(result + sz, cc->key, cc->key_size);
+- sz += cc->key_size << 1;
+- } else {
+- if (sz >= maxlen)
+- return -ENOMEM;
+- result[sz++] = '-';
+- }
++ if (cc->key_size > 0)
++ for (i = 0; i < cc->key_size; i++)
++ DMEMIT("%02x", cc->key[i]);
++ else
++ DMEMIT("-");
+
+ DMEMIT(" %llu %s %llu", (unsigned long long)cc->iv_offset,
+ cc->dev->name, (unsigned long long)cc->start);
+@@ -1751,7 +1731,6 @@ static int crypt_status(struct dm_target *ti, status_type_t type,
+
+ break;
+ }
+- return 0;
+ }
+
+ static void crypt_postsuspend(struct dm_target *ti)
+@@ -1845,7 +1824,7 @@ static int crypt_iterate_devices(struct dm_target *ti,
+
+ static struct target_type crypt_target = {
+ .name = "crypt",
+- .version = {1, 12, 0},
++ .version = {1, 12, 1},
+ .module = THIS_MODULE,
+ .ctr = crypt_ctr,
+ .dtr = crypt_dtr,
+diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
+index cc1bd04..c0d03b0 100644
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -293,8 +293,8 @@ static int delay_map(struct dm_target *ti, struct bio *bio)
+ return delay_bio(dc, dc->read_delay, bio);
+ }
+
+-static int delay_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void delay_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct delay_c *dc = ti->private;
+ int sz = 0;
+@@ -314,8 +314,6 @@ static int delay_status(struct dm_target *ti, status_type_t type,
+ dc->write_delay);
+ break;
+ }
+-
+- return 0;
+ }
+
+ static int delay_iterate_devices(struct dm_target *ti,
+@@ -337,7 +335,7 @@ out:
+
+ static struct target_type delay_target = {
+ .name = "delay",
+- .version = {1, 2, 0},
++ .version = {1, 2, 1},
+ .module = THIS_MODULE,
+ .ctr = delay_ctr,
+ .dtr = delay_dtr,
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 9721f2f..5d6c04c 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -337,8 +337,8 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
+ return error;
+ }
+
+-static int flakey_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void flakey_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ unsigned sz = 0;
+ struct flakey_c *fc = ti->private;
+@@ -368,7 +368,6 @@ static int flakey_status(struct dm_target *ti, status_type_t type,
+
+ break;
+ }
+- return 0;
+ }
+
+ static int flakey_ioctl(struct dm_target *ti, unsigned int cmd, unsigned long arg)
+@@ -411,7 +410,7 @@ static int flakey_iterate_devices(struct dm_target *ti, iterate_devices_callout_
+
+ static struct target_type flakey_target = {
+ .name = "flakey",
+- .version = {1, 3, 0},
++ .version = {1, 3, 1},
+ .module = THIS_MODULE,
+ .ctr = flakey_ctr,
+ .dtr = flakey_dtr,
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 0666b5d..eee353d 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1067,6 +1067,7 @@ static void retrieve_status(struct dm_table *table,
+ num_targets = dm_table_get_num_targets(table);
+ for (i = 0; i < num_targets; i++) {
+ struct dm_target *ti = dm_table_get_target(table, i);
++ size_t l;
+
+ remaining = len - (outptr - outbuf);
+ if (remaining <= sizeof(struct dm_target_spec)) {
+@@ -1093,14 +1094,17 @@ static void retrieve_status(struct dm_table *table,
+ if (ti->type->status) {
+ if (param->flags & DM_NOFLUSH_FLAG)
+ status_flags |= DM_STATUS_NOFLUSH_FLAG;
+- if (ti->type->status(ti, type, status_flags, outptr, remaining)) {
+- param->flags |= DM_BUFFER_FULL_FLAG;
+- break;
+- }
++ ti->type->status(ti, type, status_flags, outptr, remaining);
+ } else
+ outptr[0] = '\0';
+
+- outptr += strlen(outptr) + 1;
++ l = strlen(outptr) + 1;
++ if (l == remaining) {
++ param->flags |= DM_BUFFER_FULL_FLAG;
++ break;
++ }
++
++ outptr += l;
+ used = param->data_start + (outptr - outbuf);
+
+ outptr = align_ptr(outptr);
+diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
+index 328cad5..5be301c 100644
+--- a/drivers/md/dm-linear.c
++++ b/drivers/md/dm-linear.c
+@@ -95,8 +95,8 @@ static int linear_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_REMAPPED;
+ }
+
+-static int linear_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void linear_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct linear_c *lc = (struct linear_c *) ti->private;
+
+@@ -110,7 +110,6 @@ static int linear_status(struct dm_target *ti, status_type_t type,
+ (unsigned long long)lc->start);
+ break;
+ }
+- return 0;
+ }
+
+ static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
+@@ -155,7 +154,7 @@ static int linear_iterate_devices(struct dm_target *ti,
+
+ static struct target_type linear_target = {
+ .name = "linear",
+- .version = {1, 2, 0},
++ .version = {1, 2, 1},
+ .module = THIS_MODULE,
+ .ctr = linear_ctr,
+ .dtr = linear_dtr,
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 573bd04..d267bb5 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1378,8 +1378,8 @@ static void multipath_resume(struct dm_target *ti)
+ * [priority selector-name num_ps_args [ps_args]*
+ * num_paths num_selector_args [path_dev [selector_args]* ]+ ]+
+ */
+-static int multipath_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void multipath_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ int sz = 0;
+ unsigned long flags;
+@@ -1485,8 +1485,6 @@ static int multipath_status(struct dm_target *ti, status_type_t type,
+ }
+
+ spin_unlock_irqrestore(&m->lock, flags);
+-
+- return 0;
+ }
+
+ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv)
+@@ -1695,7 +1693,7 @@ out:
+ *---------------------------------------------------------------*/
+ static struct target_type multipath_target = {
+ .name = "multipath",
+- .version = {1, 5, 0},
++ .version = {1, 5, 1},
+ .module = THIS_MODULE,
+ .ctr = multipath_ctr,
+ .dtr = multipath_dtr,
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 9e58dbd..5a578d8 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -1201,8 +1201,8 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_SUBMITTED;
+ }
+
+-static int raid_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void raid_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct raid_set *rs = ti->private;
+ unsigned raid_param_cnt = 1; /* at least 1 for chunksize */
+@@ -1344,8 +1344,6 @@ static int raid_status(struct dm_target *ti, status_type_t type,
+ DMEMIT(" -");
+ }
+ }
+-
+- return 0;
+ }
+
+ static int raid_iterate_devices(struct dm_target *ti, iterate_devices_callout_fn fn, void *data)
+@@ -1405,7 +1403,7 @@ static void raid_resume(struct dm_target *ti)
+
+ static struct target_type raid_target = {
+ .name = "raid",
+- .version = {1, 4, 1},
++ .version = {1, 4, 2},
+ .module = THIS_MODULE,
+ .ctr = raid_ctr,
+ .dtr = raid_dtr,
+diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
+index fa51918..7f24190 100644
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -1347,8 +1347,8 @@ static char device_status_char(struct mirror *m)
+ }
+
+
+-static int mirror_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void mirror_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ unsigned int m, sz = 0;
+ struct mirror_set *ms = (struct mirror_set *) ti->private;
+@@ -1383,8 +1383,6 @@ static int mirror_status(struct dm_target *ti, status_type_t type,
+ if (ms->features & DM_RAID1_HANDLE_ERRORS)
+ DMEMIT(" 1 handle_errors");
+ }
+-
+- return 0;
+ }
+
+ static int mirror_iterate_devices(struct dm_target *ti,
+@@ -1403,7 +1401,7 @@ static int mirror_iterate_devices(struct dm_target *ti,
+
+ static struct target_type mirror_target = {
+ .name = "mirror",
+- .version = {1, 13, 1},
++ .version = {1, 13, 2},
+ .module = THIS_MODULE,
+ .ctr = mirror_ctr,
+ .dtr = mirror_dtr,
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 59fc18a..df74f9f 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1837,8 +1837,8 @@ static void snapshot_merge_resume(struct dm_target *ti)
+ start_merge(s);
+ }
+
+-static int snapshot_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void snapshot_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ unsigned sz = 0;
+ struct dm_snapshot *snap = ti->private;
+@@ -1884,8 +1884,6 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
+ maxlen - sz);
+ break;
+ }
+-
+- return 0;
+ }
+
+ static int snapshot_iterate_devices(struct dm_target *ti,
+@@ -2139,8 +2137,8 @@ static void origin_resume(struct dm_target *ti)
+ ti->max_io_len = get_origin_minimum_chunksize(dev->bdev);
+ }
+
+-static int origin_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void origin_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct dm_dev *dev = ti->private;
+
+@@ -2153,8 +2151,6 @@ static int origin_status(struct dm_target *ti, status_type_t type,
+ snprintf(result, maxlen, "%s", dev->name);
+ break;
+ }
+-
+- return 0;
+ }
+
+ static int origin_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+@@ -2181,7 +2177,7 @@ static int origin_iterate_devices(struct dm_target *ti,
+
+ static struct target_type origin_target = {
+ .name = "snapshot-origin",
+- .version = {1, 8, 0},
++ .version = {1, 8, 1},
+ .module = THIS_MODULE,
+ .ctr = origin_ctr,
+ .dtr = origin_dtr,
+@@ -2194,7 +2190,7 @@ static struct target_type origin_target = {
+
+ static struct target_type snapshot_target = {
+ .name = "snapshot",
+- .version = {1, 11, 0},
++ .version = {1, 11, 1},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
+@@ -2307,3 +2303,5 @@ module_exit(dm_snapshot_exit);
+ MODULE_DESCRIPTION(DM_NAME " snapshot target");
+ MODULE_AUTHOR("Joe Thornber");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("dm-snapshot-origin");
++MODULE_ALIAS("dm-snapshot-merge");
+diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
+index c89cde8..aaecefa 100644
+--- a/drivers/md/dm-stripe.c
++++ b/drivers/md/dm-stripe.c
+@@ -312,8 +312,8 @@ static int stripe_map(struct dm_target *ti, struct bio *bio)
+ *
+ */
+
+-static int stripe_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void stripe_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct stripe_c *sc = (struct stripe_c *) ti->private;
+ char buffer[sc->stripes + 1];
+@@ -340,7 +340,6 @@ static int stripe_status(struct dm_target *ti, status_type_t type,
+ (unsigned long long)sc->stripe[i].physical_start);
+ break;
+ }
+- return 0;
+ }
+
+ static int stripe_end_io(struct dm_target *ti, struct bio *bio, int error)
+@@ -428,7 +427,7 @@ static int stripe_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+
+ static struct target_type stripe_target = {
+ .name = "striped",
+- .version = {1, 5, 0},
++ .version = {1, 5, 1},
+ .module = THIS_MODULE,
+ .ctr = stripe_ctr,
+ .dtr = stripe_dtr,
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 5409607..7a66d73 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2299,8 +2299,8 @@ static void emit_flags(struct pool_features *pf, char *result,
+ * <transaction id> <used metadata sectors>/<total metadata sectors>
+ * <used data sectors>/<total data sectors> <held metadata root>
+ */
+-static int pool_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void pool_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ int r;
+ unsigned sz = 0;
+@@ -2326,32 +2326,41 @@ static int pool_status(struct dm_target *ti, status_type_t type,
+ if (!(status_flags & DM_STATUS_NOFLUSH_FLAG) && !dm_suspended(ti))
+ (void) commit_or_fallback(pool);
+
+- r = dm_pool_get_metadata_transaction_id(pool->pmd,
+- &transaction_id);
+- if (r)
+- return r;
++ r = dm_pool_get_metadata_transaction_id(pool->pmd, &transaction_id);
++ if (r) {
++ DMERR("dm_pool_get_metadata_transaction_id returned %d", r);
++ goto err;
++ }
+
+- r = dm_pool_get_free_metadata_block_count(pool->pmd,
+- &nr_free_blocks_metadata);
+- if (r)
+- return r;
++ r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free_blocks_metadata);
++ if (r) {
++ DMERR("dm_pool_get_free_metadata_block_count returned %d", r);
++ goto err;
++ }
+
+ r = dm_pool_get_metadata_dev_size(pool->pmd, &nr_blocks_metadata);
+- if (r)
+- return r;
++ if (r) {
++ DMERR("dm_pool_get_metadata_dev_size returned %d", r);
++ goto err;
++ }
+
+- r = dm_pool_get_free_block_count(pool->pmd,
+- &nr_free_blocks_data);
+- if (r)
+- return r;
++ r = dm_pool_get_free_block_count(pool->pmd, &nr_free_blocks_data);
++ if (r) {
++ DMERR("dm_pool_get_free_block_count returned %d", r);
++ goto err;
++ }
+
+ r = dm_pool_get_data_dev_size(pool->pmd, &nr_blocks_data);
+- if (r)
+- return r;
++ if (r) {
++ DMERR("dm_pool_get_data_dev_size returned %d", r);
++ goto err;
++ }
+
+ r = dm_pool_get_metadata_snap(pool->pmd, &held_root);
+- if (r)
+- return r;
++ if (r) {
++ DMERR("dm_pool_get_metadata_snap returned %d", r);
++ goto err;
++ }
+
+ DMEMIT("%llu %llu/%llu %llu/%llu ",
+ (unsigned long long)transaction_id,
+@@ -2388,8 +2397,10 @@ static int pool_status(struct dm_target *ti, status_type_t type,
+ emit_flags(&pt->requested_pf, result, sz, maxlen);
+ break;
+ }
++ return;
+
+- return 0;
++err:
++ DMEMIT("Error");
+ }
+
+ static int pool_iterate_devices(struct dm_target *ti,
+@@ -2468,7 +2479,7 @@ static struct target_type pool_target = {
+ .name = "thin-pool",
+ .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+ DM_TARGET_IMMUTABLE,
+- .version = {1, 6, 0},
++ .version = {1, 6, 1},
+ .module = THIS_MODULE,
+ .ctr = pool_ctr,
+ .dtr = pool_dtr,
+@@ -2676,8 +2687,8 @@ static void thin_postsuspend(struct dm_target *ti)
+ /*
+ * <nr mapped sectors> <highest mapped sector>
+ */
+-static int thin_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void thin_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ int r;
+ ssize_t sz = 0;
+@@ -2687,7 +2698,7 @@ static int thin_status(struct dm_target *ti, status_type_t type,
+
+ if (get_pool_mode(tc->pool) == PM_FAIL) {
+ DMEMIT("Fail");
+- return 0;
++ return;
+ }
+
+ if (!tc->td)
+@@ -2696,12 +2707,16 @@ static int thin_status(struct dm_target *ti, status_type_t type,
+ switch (type) {
+ case STATUSTYPE_INFO:
+ r = dm_thin_get_mapped_count(tc->td, &mapped);
+- if (r)
+- return r;
++ if (r) {
++ DMERR("dm_thin_get_mapped_count returned %d", r);
++ goto err;
++ }
+
+ r = dm_thin_get_highest_mapped_block(tc->td, &highest);
+- if (r < 0)
+- return r;
++ if (r < 0) {
++ DMERR("dm_thin_get_highest_mapped_block returned %d", r);
++ goto err;
++ }
+
+ DMEMIT("%llu ", mapped * tc->pool->sectors_per_block);
+ if (r)
+@@ -2721,7 +2736,10 @@ static int thin_status(struct dm_target *ti, status_type_t type,
+ }
+ }
+
+- return 0;
++ return;
++
++err:
++ DMEMIT("Error");
+ }
+
+ static int thin_iterate_devices(struct dm_target *ti,
+@@ -2748,7 +2766,7 @@ static int thin_iterate_devices(struct dm_target *ti,
+
+ static struct target_type thin_target = {
+ .name = "thin",
+- .version = {1, 7, 0},
++ .version = {1, 7, 1},
+ .module = THIS_MODULE,
+ .ctr = thin_ctr,
+ .dtr = thin_dtr,
+diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
+index 52cde98..6ad5383 100644
+--- a/drivers/md/dm-verity.c
++++ b/drivers/md/dm-verity.c
+@@ -508,8 +508,8 @@ static int verity_map(struct dm_target *ti, struct bio *bio)
+ /*
+ * Status: V (valid) or C (corruption found)
+ */
+-static int verity_status(struct dm_target *ti, status_type_t type,
+- unsigned status_flags, char *result, unsigned maxlen)
++static void verity_status(struct dm_target *ti, status_type_t type,
++ unsigned status_flags, char *result, unsigned maxlen)
+ {
+ struct dm_verity *v = ti->private;
+ unsigned sz = 0;
+@@ -540,8 +540,6 @@ static int verity_status(struct dm_target *ti, status_type_t type,
+ DMEMIT("%02x", v->salt[x]);
+ break;
+ }
+-
+- return 0;
+ }
+
+ static int verity_ioctl(struct dm_target *ti, unsigned cmd,
+@@ -860,7 +858,7 @@ bad:
+
+ static struct target_type verity_target = {
+ .name = "verity",
+- .version = {1, 1, 0},
++ .version = {1, 1, 1},
+ .module = THIS_MODULE,
+ .ctr = verity_ctr,
+ .dtr = verity_dtr,
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 314a0e2..0d8f086 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1973,15 +1973,27 @@ static void __bind_mempools(struct mapped_device *md, struct dm_table *t)
+ {
+ struct dm_md_mempools *p = dm_table_get_md_mempools(t);
+
+- if (md->io_pool && (md->tio_pool || dm_table_get_type(t) == DM_TYPE_BIO_BASED) && md->bs) {
+- /*
+- * The md already has necessary mempools. Reload just the
+- * bioset because front_pad may have changed because
+- * a different table was loaded.
+- */
+- bioset_free(md->bs);
+- md->bs = p->bs;
+- p->bs = NULL;
++ if (md->io_pool && md->bs) {
++ /* The md already has necessary mempools. */
++ if (dm_table_get_type(t) == DM_TYPE_BIO_BASED) {
++ /*
++ * Reload bioset because front_pad may have changed
++ * because a different table was loaded.
++ */
++ bioset_free(md->bs);
++ md->bs = p->bs;
++ p->bs = NULL;
++ } else if (dm_table_get_type(t) == DM_TYPE_REQUEST_BASED) {
++ BUG_ON(!md->tio_pool);
++ /*
++ * There's no need to reload with request-based dm
++ * because the size of front_pad doesn't change.
++ * Note for future: If you are to reload bioset,
++ * prep-ed requests in the queue may refer
++ * to bio from the old bioset, so you must walk
++ * through the queue to unprep.
++ */
++ }
+ goto out;
+ }
+
+@@ -2421,7 +2433,7 @@ static void dm_queue_flush(struct mapped_device *md)
+ */
+ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
+ {
+- struct dm_table *live_map, *map = ERR_PTR(-EINVAL);
++ struct dm_table *live_map = NULL, *map = ERR_PTR(-EINVAL);
+ struct queue_limits limits;
+ int r;
+
+@@ -2444,10 +2456,12 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
+ dm_table_put(live_map);
+ }
+
+- r = dm_calculate_queue_limits(table, &limits);
+- if (r) {
+- map = ERR_PTR(r);
+- goto out;
++ if (!live_map) {
++ r = dm_calculate_queue_limits(table, &limits);
++ if (r) {
++ map = ERR_PTR(r);
++ goto out;
++ }
+ }
+
+ map = __bind(md, table, &limits);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 3db3d1b..f363135 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -307,6 +307,10 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
+ bio_io_error(bio);
+ return;
+ }
++ if (mddev->ro == 1 && unlikely(rw == WRITE)) {
++ bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
++ return;
++ }
+ smp_rmb(); /* Ensure implications of 'active' are visible */
+ rcu_read_lock();
+ if (mddev->suspended) {
+@@ -2994,6 +2998,9 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+ } else if (!sectors)
+ sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
+ rdev->data_offset;
++ if (!my_mddev->pers->resize)
++ /* Cannot change size for RAID0 or Linear etc */
++ return -EINVAL;
+ }
+ if (sectors < my_mddev->dev_sectors)
+ return -EINVAL; /* component must fit device */
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 24b3597..d9babda 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -289,7 +289,7 @@ abort:
+ kfree(conf->strip_zone);
+ kfree(conf->devlist);
+ kfree(conf);
+- *private_conf = NULL;
++ *private_conf = ERR_PTR(err);
+ return err;
+ }
+
+@@ -411,7 +411,8 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks
+ "%s does not support generic reshape\n", __func__);
+
+ rdev_for_each(rdev, mddev)
+- array_sectors += rdev->sectors;
++ array_sectors += (rdev->sectors &
++ ~(sector_t)(mddev->chunk_sectors-1));
+
+ return array_sectors;
+ }
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index d5bddfc..75b1f89 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -967,6 +967,7 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ bio_list_merge(&conf->pending_bio_list, &plug->pending);
+ conf->pending_count += plug->pending_cnt;
+ spin_unlock_irq(&conf->device_lock);
++ wake_up(&conf->wait_barrier);
+ md_wakeup_thread(mddev->thread);
+ kfree(plug);
+ return;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 64d4824..8d925dc 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1073,6 +1073,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ bio_list_merge(&conf->pending_bio_list, &plug->pending);
+ conf->pending_count += plug->pending_cnt;
+ spin_unlock_irq(&conf->device_lock);
++ wake_up(&conf->wait_barrier);
+ md_wakeup_thread(mddev->thread);
+ kfree(plug);
+ return;
+diff --git a/drivers/memstick/host/rtsx_pci_ms.c b/drivers/memstick/host/rtsx_pci_ms.c
+index f5ddb82..64a779c 100644
+--- a/drivers/memstick/host/rtsx_pci_ms.c
++++ b/drivers/memstick/host/rtsx_pci_ms.c
+@@ -426,6 +426,9 @@ static void rtsx_pci_ms_request(struct memstick_host *msh)
+
+ dev_dbg(ms_dev(host), "--> %s\n", __func__);
+
++ if (rtsx_pci_card_exclusive_check(host->pcr, RTSX_MS_CARD))
++ return;
++
+ schedule_work(&host->handle_req);
+ }
+
+@@ -441,6 +444,10 @@ static int rtsx_pci_ms_set_param(struct memstick_host *msh,
+ dev_dbg(ms_dev(host), "%s: param = %d, value = %d\n",
+ __func__, param, value);
+
++ err = rtsx_pci_card_exclusive_check(host->pcr, RTSX_MS_CARD);
++ if (err)
++ return err;
++
+ switch (param) {
+ case MEMSTICK_POWER:
+ if (value == MEMSTICK_POWER_ON)
+diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
+index 9fc5700..1e2d120 100644
+--- a/drivers/mfd/rtsx_pcr.c
++++ b/drivers/mfd/rtsx_pcr.c
+@@ -713,6 +713,25 @@ int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card)
+ }
+ EXPORT_SYMBOL_GPL(rtsx_pci_card_power_off);
+
++int rtsx_pci_card_exclusive_check(struct rtsx_pcr *pcr, int card)
++{
++ unsigned int cd_mask[] = {
++ [RTSX_SD_CARD] = SD_EXIST,
++ [RTSX_MS_CARD] = MS_EXIST
++ };
++
++ if (!pcr->ms_pmos) {
++ /* When using single PMOS, accessing card is not permitted
++ * if the existing card is not the designated one.
++ */
++ if (pcr->card_exist & (~cd_mask[card]))
++ return -EIO;
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(rtsx_pci_card_exclusive_check);
++
+ int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+ {
+ if (pcr->ops->switch_output_voltage)
+@@ -758,7 +777,7 @@ static void rtsx_pci_card_detect(struct work_struct *work)
+ struct delayed_work *dwork;
+ struct rtsx_pcr *pcr;
+ unsigned long flags;
+- unsigned int card_detect = 0;
++ unsigned int card_detect = 0, card_inserted, card_removed;
+ u32 irq_status;
+
+ dwork = to_delayed_work(work);
+@@ -766,25 +785,35 @@ static void rtsx_pci_card_detect(struct work_struct *work)
+
+ dev_dbg(&(pcr->pci->dev), "--> %s\n", __func__);
+
++ mutex_lock(&pcr->pcr_mutex);
+ spin_lock_irqsave(&pcr->lock, flags);
+
+ irq_status = rtsx_pci_readl(pcr, RTSX_BIPR);
+ dev_dbg(&(pcr->pci->dev), "irq_status: 0x%08x\n", irq_status);
+
+- if (pcr->card_inserted || pcr->card_removed) {
++ irq_status &= CARD_EXIST;
++ card_inserted = pcr->card_inserted & irq_status;
++ card_removed = pcr->card_removed;
++ pcr->card_inserted = 0;
++ pcr->card_removed = 0;
++
++ spin_unlock_irqrestore(&pcr->lock, flags);
++
++ if (card_inserted || card_removed) {
+ dev_dbg(&(pcr->pci->dev),
+ "card_inserted: 0x%x, card_removed: 0x%x\n",
+- pcr->card_inserted, pcr->card_removed);
++ card_inserted, card_removed);
+
+ if (pcr->ops->cd_deglitch)
+- pcr->card_inserted = pcr->ops->cd_deglitch(pcr);
++ card_inserted = pcr->ops->cd_deglitch(pcr);
++
++ card_detect = card_inserted | card_removed;
+
+- card_detect = pcr->card_inserted | pcr->card_removed;
+- pcr->card_inserted = 0;
+- pcr->card_removed = 0;
++ pcr->card_exist |= card_inserted;
++ pcr->card_exist &= ~card_removed;
+ }
+
+- spin_unlock_irqrestore(&pcr->lock, flags);
++ mutex_unlock(&pcr->pcr_mutex);
+
+ if ((card_detect & SD_EXIST) && pcr->slots[RTSX_SD_CARD].card_event)
+ pcr->slots[RTSX_SD_CARD].card_event(
+@@ -836,10 +865,6 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
+ }
+ }
+
+- if (pcr->card_inserted || pcr->card_removed)
+- schedule_delayed_work(&pcr->carddet_work,
+- msecs_to_jiffies(200));
+-
+ if (int_reg & (NEED_COMPLETE_INT | DELINK_INT)) {
+ if (int_reg & (TRANS_FAIL_INT | DELINK_INT)) {
+ pcr->trans_result = TRANS_RESULT_FAIL;
+@@ -852,6 +877,10 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
+ }
+ }
+
++ if (pcr->card_inserted || pcr->card_removed)
++ schedule_delayed_work(&pcr->carddet_work,
++ msecs_to_jiffies(200));
++
+ spin_unlock(&pcr->lock);
+ return IRQ_HANDLED;
+ }
+@@ -974,6 +1003,14 @@ static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)
+ return err;
+ }
+
++ /* No CD interrupt if probing driver with card inserted.
++ * So we need to initialize pcr->card_exist here.
++ */
++ if (pcr->ops->cd_deglitch)
++ pcr->card_exist = pcr->ops->cd_deglitch(pcr);
++ else
++ pcr->card_exist = rtsx_pci_readl(pcr, RTSX_BIPR) & CARD_EXIST;
++
+ return 0;
+ }
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index f74b5ad..468c923 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -678,12 +678,19 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ struct mmc_command *cmd = mrq->cmd;
+ struct mmc_data *data = mrq->data;
+ unsigned int data_size = 0;
++ int err;
+
+ if (host->eject) {
+ cmd->error = -ENOMEDIUM;
+ goto finish;
+ }
+
++ err = rtsx_pci_card_exclusive_check(host->pcr, RTSX_SD_CARD);
++ if (err) {
++ cmd->error = err;
++ goto finish;
++ }
++
+ mutex_lock(&pcr->pcr_mutex);
+
+ rtsx_pci_start_run(pcr);
+@@ -901,6 +908,9 @@ static void sdmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ if (host->eject)
+ return;
+
++ if (rtsx_pci_card_exclusive_check(host->pcr, RTSX_SD_CARD))
++ return;
++
+ mutex_lock(&pcr->pcr_mutex);
+
+ rtsx_pci_start_run(pcr);
+@@ -1073,6 +1083,10 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
+ if (host->eject)
+ return -ENOMEDIUM;
+
++ err = rtsx_pci_card_exclusive_check(host->pcr, RTSX_SD_CARD);
++ if (err)
++ return err;
++
+ mutex_lock(&pcr->pcr_mutex);
+
+ rtsx_pci_start_run(pcr);
+@@ -1122,6 +1136,10 @@ static int sdmmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ if (host->eject)
+ return -ENOMEDIUM;
+
++ err = rtsx_pci_card_exclusive_check(host->pcr, RTSX_SD_CARD);
++ if (err)
++ return err;
++
+ mutex_lock(&pcr->pcr_mutex);
+
+ rtsx_pci_start_run(pcr);
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index bdb0869..f0b38fa 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -1843,6 +1843,8 @@ static void tg3_link_report(struct tg3 *tp)
+
+ tg3_ump_link_report(tp);
+ }
++
++ tp->link_up = netif_carrier_ok(tp->dev);
+ }
+
+ static u16 tg3_advert_flowctrl_1000X(u8 flow_ctrl)
+@@ -2496,12 +2498,6 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
+ return err;
+ }
+
+-static void tg3_carrier_on(struct tg3 *tp)
+-{
+- netif_carrier_on(tp->dev);
+- tp->link_up = true;
+-}
+-
+ static void tg3_carrier_off(struct tg3 *tp)
+ {
+ netif_carrier_off(tp->dev);
+@@ -2527,7 +2523,7 @@ static int tg3_phy_reset(struct tg3 *tp)
+ return -EBUSY;
+
+ if (netif_running(tp->dev) && tp->link_up) {
+- tg3_carrier_off(tp);
++ netif_carrier_off(tp->dev);
+ tg3_link_report(tp);
+ }
+
+@@ -4225,9 +4221,9 @@ static bool tg3_test_and_report_link_chg(struct tg3 *tp, int curr_link_up)
+ {
+ if (curr_link_up != tp->link_up) {
+ if (curr_link_up) {
+- tg3_carrier_on(tp);
++ netif_carrier_on(tp->dev);
+ } else {
+- tg3_carrier_off(tp);
++ netif_carrier_off(tp->dev);
+ if (tp->phy_flags & TG3_PHYFLG_MII_SERDES)
+ tp->phy_flags &= ~TG3_PHYFLG_PARALLEL_DETECT;
+ }
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 643c883..1f93880 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5549,7 +5549,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ */
+ e1000e_release_hw_control(adapter);
+
+- pci_disable_device(pdev);
++ pci_clear_master(pdev);
+
+ return 0;
+ }
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 9b73670..6214181 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1340,6 +1340,8 @@ static int smsc95xx_enter_suspend0(struct usbnet *dev)
+ ret = smsc95xx_read_reg_nopm(dev, PM_CTRL, &val);
+ if (ret < 0)
+ netdev_warn(dev->net, "Error reading PM_CTRL\n");
++ else
++ ret = 0;
+
+ return ret;
+ }
+@@ -1392,6 +1394,8 @@ static int smsc95xx_enter_suspend1(struct usbnet *dev)
+ ret = smsc95xx_write_reg_nopm(dev, PM_CTRL, val);
+ if (ret < 0)
+ netdev_warn(dev->net, "Error writing PM_CTRL\n");
++ else
++ ret = 0;
+
+ return ret;
+ }
+@@ -1413,6 +1417,8 @@ static int smsc95xx_enter_suspend2(struct usbnet *dev)
+ ret = smsc95xx_write_reg_nopm(dev, PM_CTRL, val);
+ if (ret < 0)
+ netdev_warn(dev->net, "Error writing PM_CTRL\n");
++ else
++ ret = 0;
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
+index 5f845be..050ca4a 100644
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -27,7 +27,7 @@
+ #define WME_MAX_BA WME_BA_BMP_SIZE
+ #define ATH_TID_MAX_BUFS (2 * WME_MAX_BA)
+
+-#define ATH_RSSI_DUMMY_MARKER 0x127
++#define ATH_RSSI_DUMMY_MARKER 127
+ #define ATH_RSSI_LPF_LEN 10
+ #define RSSI_LPF_THRESHOLD -20
+ #define ATH_RSSI_EP_MULTIPLIER (1<<7)
+diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
+index 96bfb18..d3b099d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -22,6 +22,7 @@
+ #include <linux/firmware.h>
+ #include <linux/skbuff.h>
+ #include <linux/netdevice.h>
++#include <linux/etherdevice.h>
+ #include <linux/leds.h>
+ #include <linux/slab.h>
+ #include <net/mac80211.h>
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index b6a5a08..8788621 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+
+ last_rssi = priv->rx.last_rssi;
+
+- if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+- rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
+- ATH_RSSI_EP_MULTIPLIER);
++ if (ieee80211_is_beacon(hdr->frame_control) &&
++ !is_zero_ether_addr(common->curbssid) &&
++ ether_addr_equal(hdr->addr3, common->curbssid)) {
++ s8 rssi = rxbuf->rxstatus.rs_rssi;
+
+- if (rxbuf->rxstatus.rs_rssi < 0)
+- rxbuf->rxstatus.rs_rssi = 0;
++ if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
++ rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
+
+- if (ieee80211_is_beacon(fc))
+- priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
++ if (rssi < 0)
++ rssi = 0;
++
++ priv->ah->stats.avgbrssi = rssi;
++ }
+
+ rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
+ rx_status->band = hw->conf.channel->band;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 7cb7870..e26f92d 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1480,7 +1480,9 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
+ reset_type = ATH9K_RESET_POWER_ON;
+ else
+ reset_type = ATH9K_RESET_COLD;
+- }
++ } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
++ (REG_READ(ah, AR_CR) & AR_CR_RXE))
++ reset_type = ATH9K_RESET_COLD;
+
+ if (!ath9k_hw_set_reset_reg(ah, reset_type))
+ return false;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+index dc7e26b..c85eb37 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
++++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+@@ -349,25 +349,23 @@ TRACE_EVENT(iwlwifi_dev_rx_data,
+ TRACE_EVENT(iwlwifi_dev_hcmd,
+ TP_PROTO(const struct device *dev,
+ struct iwl_host_cmd *cmd, u16 total_size,
+- const void *hdr, size_t hdr_len),
+- TP_ARGS(dev, cmd, total_size, hdr, hdr_len),
++ struct iwl_cmd_header *hdr),
++ TP_ARGS(dev, cmd, total_size, hdr),
+ TP_STRUCT__entry(
+ DEV_ENTRY
+ __dynamic_array(u8, hcmd, total_size)
+ __field(u32, flags)
+ ),
+ TP_fast_assign(
+- int i, offset = hdr_len;
++ int i, offset = sizeof(*hdr);
+
+ DEV_ASSIGN;
+ __entry->flags = cmd->flags;
+- memcpy(__get_dynamic_array(hcmd), hdr, hdr_len);
++ memcpy(__get_dynamic_array(hcmd), hdr, sizeof(*hdr));
+
+ for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+ if (!cmd->len[i])
+ continue;
+- if (!(cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY))
+- continue;
+ memcpy((u8 *)__get_dynamic_array(hcmd) + offset,
+ cmd->data[i], cmd->len[i]);
+ offset += cmd->len[i];
+diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
+index d91d2e8..bc5e9ec 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
+@@ -182,6 +182,15 @@ struct iwl_queue {
+ #define TFD_TX_CMD_SLOTS 256
+ #define TFD_CMD_SLOTS 32
+
++/*
++ * The FH will write back to the first TB only, so we need
++ * to copy some data into the buffer regardless of whether
++ * it should be mapped or not. This indicates how much to
++ * copy, even for HCMDs it must be big enough to fit the
++ * DRAM scratch from the TX cmd, at least 16 bytes.
++ */
++#define IWL_HCMD_MIN_COPY_SIZE 16
++
+ struct iwl_pcie_txq_entry {
+ struct iwl_device_cmd *cmd;
+ struct iwl_device_cmd *copy_cmd;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index 6c5b867..c6cd922 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -1131,10 +1131,12 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ void *dup_buf = NULL;
+ dma_addr_t phys_addr;
+ int idx;
+- u16 copy_size, cmd_size;
++ u16 copy_size, cmd_size, dma_size;
+ bool had_nocopy = false;
+ int i;
+ u32 cmd_pos;
++ const u8 *cmddata[IWL_MAX_CMD_TFDS];
++ u16 cmdlen[IWL_MAX_CMD_TFDS];
+
+ copy_size = sizeof(out_cmd->hdr);
+ cmd_size = sizeof(out_cmd->hdr);
+@@ -1143,8 +1145,23 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ BUILD_BUG_ON(IWL_MAX_CMD_TFDS > IWL_NUM_OF_TBS - 1);
+
+ for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
++ cmddata[i] = cmd->data[i];
++ cmdlen[i] = cmd->len[i];
++
+ if (!cmd->len[i])
+ continue;
++
++ /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
++ if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
++ int copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
++
++ if (copy > cmdlen[i])
++ copy = cmdlen[i];
++ cmdlen[i] -= copy;
++ cmddata[i] += copy;
++ copy_size += copy;
++ }
++
+ if (cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY) {
+ had_nocopy = true;
+ if (WARN_ON(cmd->dataflags[i] & IWL_HCMD_DFL_DUP)) {
+@@ -1164,7 +1181,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ goto free_dup_buf;
+ }
+
+- dup_buf = kmemdup(cmd->data[i], cmd->len[i],
++ dup_buf = kmemdup(cmddata[i], cmdlen[i],
+ GFP_ATOMIC);
+ if (!dup_buf)
+ return -ENOMEM;
+@@ -1174,7 +1191,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ idx = -EINVAL;
+ goto free_dup_buf;
+ }
+- copy_size += cmd->len[i];
++ copy_size += cmdlen[i];
+ }
+ cmd_size += cmd->len[i];
+ }
+@@ -1221,14 +1238,31 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+
+ /* and copy the data that needs to be copied */
+ cmd_pos = offsetof(struct iwl_device_cmd, payload);
++ copy_size = sizeof(out_cmd->hdr);
+ for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+- if (!cmd->len[i])
++ int copy = 0;
++
++ if (!cmd->len)
+ continue;
+- if (cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
+- IWL_HCMD_DFL_DUP))
+- break;
+- memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], cmd->len[i]);
+- cmd_pos += cmd->len[i];
++
++ /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
++ if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
++ copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
++
++ if (copy > cmd->len[i])
++ copy = cmd->len[i];
++ }
++
++ /* copy everything if not nocopy/dup */
++ if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
++ IWL_HCMD_DFL_DUP)))
++ copy = cmd->len[i];
++
++ if (copy) {
++ memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
++ cmd_pos += copy;
++ copy_size += copy;
++ }
+ }
+
+ WARN_ON_ONCE(txq->entries[idx].copy_cmd);
+@@ -1254,7 +1288,14 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
+ cmd_size, q->write_ptr, idx, trans_pcie->cmd_queue);
+
+- phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, copy_size,
++ /*
++ * If the entire command is smaller than IWL_HCMD_MIN_COPY_SIZE, we must
++ * still map at least that many bytes for the hardware to write back to.
++ * We have enough space, so that's not a problem.
++ */
++ dma_size = max_t(u16, copy_size, IWL_HCMD_MIN_COPY_SIZE);
++
++ phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, dma_size,
+ DMA_BIDIRECTIONAL);
+ if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
+ idx = -ENOMEM;
+@@ -1262,14 +1303,15 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ }
+
+ dma_unmap_addr_set(out_meta, mapping, phys_addr);
+- dma_unmap_len_set(out_meta, len, copy_size);
++ dma_unmap_len_set(out_meta, len, dma_size);
+
+ iwl_pcie_txq_build_tfd(trans, txq, phys_addr, copy_size, 1);
+
++ /* map the remaining (adjusted) nocopy/dup fragments */
+ for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+- const void *data = cmd->data[i];
++ const void *data = cmddata[i];
+
+- if (!cmd->len[i])
++ if (!cmdlen[i])
+ continue;
+ if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
+ IWL_HCMD_DFL_DUP)))
+@@ -1277,7 +1319,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP)
+ data = dup_buf;
+ phys_addr = dma_map_single(trans->dev, (void *)data,
+- cmd->len[i], DMA_BIDIRECTIONAL);
++ cmdlen[i], DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(trans->dev, phys_addr)) {
+ iwl_pcie_tfd_unmap(trans, out_meta,
+ &txq->tfds[q->write_ptr],
+@@ -1286,7 +1328,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ goto out;
+ }
+
+- iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmd->len[i], 0);
++ iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
+ }
+
+ out_meta->flags = cmd->flags;
+@@ -1296,8 +1338,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+
+ txq->need_update = 1;
+
+- trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size,
+- &out_cmd->hdr, copy_size);
++ trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
+
+ /* start timer if queue currently empty */
+ if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
+diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
+index 739309e..4557833 100644
+--- a/drivers/net/wireless/libertas/if_sdio.c
++++ b/drivers/net/wireless/libertas/if_sdio.c
+@@ -825,6 +825,11 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
+
+ sdio_release_host(func);
+
++ /* Set fw_ready before queuing any commands so that
++ * lbs_thread won't block from sending them to firmware.
++ */
++ priv->fw_ready = 1;
++
+ /*
+ * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
+ */
+@@ -839,7 +844,6 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
+ netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
+ }
+
+- priv->fw_ready = 1;
+ wake_up(&card->pwron_waitq);
+
+ if (!card->started) {
+diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
+index b879e13..0bbea88 100644
+--- a/drivers/net/wireless/mwifiex/pcie.c
++++ b/drivers/net/wireless/mwifiex/pcie.c
+@@ -291,7 +291,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
+ i++;
+ usleep_range(10, 20);
+ /* 50ms max wait */
+- if (i == 50000)
++ if (i == 5000)
+ break;
+ }
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index afed701..684ce75 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -1204,6 +1204,9 @@ static acpi_status WMID_set_capabilities(void)
+ devices = *((u32 *) obj->buffer.pointer);
+ } else if (obj->type == ACPI_TYPE_INTEGER) {
+ devices = (u32) obj->integer.value;
++ } else {
++ kfree(out.pointer);
++ return AE_ERROR;
+ }
+ } else {
+ kfree(out.pointer);
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index b8ad71f..0fe987f 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -1534,7 +1534,7 @@ static int sony_nc_rfkill_set(void *data, bool blocked)
+ int argument = sony_rfkill_address[(long) data] + 0x100;
+
+ if (!blocked)
+- argument |= 0x030000;
++ argument |= 0x070000;
+
+ return sony_call_snc_handle(sony_rfkill_handle, argument, &result);
+ }
+diff --git a/drivers/rtc/rtc-mv.c b/drivers/rtc/rtc-mv.c
+index 57233c8..8f87fec 100644
+--- a/drivers/rtc/rtc-mv.c
++++ b/drivers/rtc/rtc-mv.c
+@@ -14,6 +14,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/of.h>
+ #include <linux/delay.h>
++#include <linux/clk.h>
+ #include <linux/gfp.h>
+ #include <linux/module.h>
+
+@@ -41,6 +42,7 @@ struct rtc_plat_data {
+ struct rtc_device *rtc;
+ void __iomem *ioaddr;
+ int irq;
++ struct clk *clk;
+ };
+
+ static int mv_rtc_set_time(struct device *dev, struct rtc_time *tm)
+@@ -221,6 +223,7 @@ static int mv_rtc_probe(struct platform_device *pdev)
+ struct rtc_plat_data *pdata;
+ resource_size_t size;
+ u32 rtc_time;
++ int ret = 0;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res)
+@@ -239,11 +242,17 @@ static int mv_rtc_probe(struct platform_device *pdev)
+ if (!pdata->ioaddr)
+ return -ENOMEM;
+
++ pdata->clk = devm_clk_get(&pdev->dev, NULL);
++ /* Not all SoCs require a clock.*/
++ if (!IS_ERR(pdata->clk))
++ clk_prepare_enable(pdata->clk);
++
+ /* make sure the 24 hours mode is enabled */
+ rtc_time = readl(pdata->ioaddr + RTC_TIME_REG_OFFS);
+ if (rtc_time & RTC_HOURS_12H_MODE) {
+ dev_err(&pdev->dev, "24 Hours mode not supported.\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+ /* make sure it is actually functional */
+@@ -252,7 +261,8 @@ static int mv_rtc_probe(struct platform_device *pdev)
+ rtc_time = readl(pdata->ioaddr + RTC_TIME_REG_OFFS);
+ if (rtc_time == 0x01000000) {
+ dev_err(&pdev->dev, "internal RTC not ticking\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+ }
+
+@@ -268,8 +278,10 @@ static int mv_rtc_probe(struct platform_device *pdev)
+ } else
+ pdata->rtc = rtc_device_register(pdev->name, &pdev->dev,
+ &mv_rtc_ops, THIS_MODULE);
+- if (IS_ERR(pdata->rtc))
+- return PTR_ERR(pdata->rtc);
++ if (IS_ERR(pdata->rtc)) {
++ ret = PTR_ERR(pdata->rtc);
++ goto out;
++ }
+
+ if (pdata->irq >= 0) {
+ writel(0, pdata->ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+@@ -282,6 +294,11 @@ static int mv_rtc_probe(struct platform_device *pdev)
+ }
+
+ return 0;
++out:
++ if (!IS_ERR(pdata->clk))
++ clk_disable_unprepare(pdata->clk);
++
++ return ret;
+ }
+
+ static int __exit mv_rtc_remove(struct platform_device *pdev)
+@@ -292,6 +309,9 @@ static int __exit mv_rtc_remove(struct platform_device *pdev)
+ device_init_wakeup(&pdev->dev, 0);
+
+ rtc_device_unregister(pdata->rtc);
++ if (!IS_ERR(pdata->clk))
++ clk_disable_unprepare(pdata->clk);
++
+ return 0;
+ }
+
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 865c64f..fed486bf 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -3747,13 +3747,13 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
+ dcb->max_command = 1;
+ dcb->target_id = target;
+ dcb->target_lun = lun;
++ dcb->dev_mode = eeprom->target[target].cfg0;
+ #ifndef DC395x_NO_DISCONNECT
+ dcb->identify_msg =
+ IDENTIFY(dcb->dev_mode & NTC_DO_DISCONNECT, lun);
+ #else
+ dcb->identify_msg = IDENTIFY(0, lun);
+ #endif
+- dcb->dev_mode = eeprom->target[target].cfg0;
+ dcb->inquiry7 = 0;
+ dcb->sync_mode = 0;
+ dcb->min_nego_period = clock_period[period_index];
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 0144078..9f4e560 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -467,6 +467,7 @@ static struct scatterlist *create_bounce_buffer(struct scatterlist *sgl,
+ if (!bounce_sgl)
+ return NULL;
+
++ sg_init_table(bounce_sgl, num_pages);
+ for (i = 0; i < num_pages; i++) {
+ page_buf = alloc_page(GFP_ATOMIC);
+ if (!page_buf)
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 339f97f..42a2bf7 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -3570,6 +3570,10 @@ check_rsp_state:
+ spin_lock_bh(&cmd->istate_lock);
+ cmd->i_state = ISTATE_SENT_STATUS;
+ spin_unlock_bh(&cmd->istate_lock);
++
++ if (atomic_read(&conn->check_immediate_queue))
++ return 1;
++
+ continue;
+ } else if (ret == 2) {
+ /* Still must send status,
+@@ -3659,7 +3663,7 @@ check_rsp_state:
+ }
+
+ if (atomic_read(&conn->check_immediate_queue))
+- break;
++ return 1;
+ }
+
+ return 0;
+@@ -3703,12 +3707,15 @@ restart:
+ signal_pending(current))
+ goto transport_err;
+
++get_immediate:
+ ret = handle_immediate_queue(conn);
+ if (ret < 0)
+ goto transport_err;
+
+ ret = handle_response_queue(conn);
+- if (ret == -EAGAIN)
++ if (ret == 1)
++ goto get_immediate;
++ else if (ret == -EAGAIN)
+ goto restart;
+ else if (ret < 0)
+ goto transport_err;
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 2bcfd79..55b9530 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -940,7 +940,6 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ bio = NULL;
+ }
+
+- page++;
+ len -= bytes;
+ data_len -= bytes;
+ off = 0;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index cbf7168..2a89588 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2538,70 +2538,35 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ if ((portstatus & USB_PORT_STAT_RESET))
+ goto delay;
+
+- /*
+- * Some buggy devices require a warm reset to be issued even
+- * when the port appears not to be connected.
++ if (hub_port_warm_reset_required(hub, portstatus))
++ return -ENOTCONN;
++
++ /* Device went away? */
++ if (!(portstatus & USB_PORT_STAT_CONNECTION))
++ return -ENOTCONN;
++
++ /* bomb out completely if the connection bounced. A USB 3.0
++ * connection may bounce if multiple warm resets were issued,
++ * but the device may have successfully re-connected. Ignore it.
+ */
+- if (!warm) {
+- /*
+- * Some buggy devices can cause an NEC host controller
+- * to transition to the "Error" state after a hot port
+- * reset. This will show up as the port state in
+- * "Inactive", and the port may also report a
+- * disconnect. Forcing a warm port reset seems to make
+- * the device work.
+- *
+- * See https://bugzilla.kernel.org/show_bug.cgi?id=41752
+- */
+- if (hub_port_warm_reset_required(hub, portstatus)) {
+- int ret;
+-
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- if (portchange & USB_PORT_STAT_C_LINK_STATE)
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_PORT_LINK_STATE);
+- if (portchange & USB_PORT_STAT_C_RESET)
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_RESET);
+- dev_dbg(hub->intfdev, "hot reset failed, warm reset port %d\n",
+- port1);
+- ret = hub_port_reset(hub, port1,
+- udev, HUB_BH_RESET_TIME,
+- true);
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- return ret;
+- }
+- /* Device went away? */
+- if (!(portstatus & USB_PORT_STAT_CONNECTION))
+- return -ENOTCONN;
+-
+- /* bomb out completely if the connection bounced */
+- if ((portchange & USB_PORT_STAT_C_CONNECTION))
+- return -ENOTCONN;
+-
+- if ((portstatus & USB_PORT_STAT_ENABLE)) {
+- if (hub_is_wusb(hub))
+- udev->speed = USB_SPEED_WIRELESS;
+- else if (hub_is_superspeed(hub->hdev))
+- udev->speed = USB_SPEED_SUPER;
+- else if (portstatus & USB_PORT_STAT_HIGH_SPEED)
+- udev->speed = USB_SPEED_HIGH;
+- else if (portstatus & USB_PORT_STAT_LOW_SPEED)
+- udev->speed = USB_SPEED_LOW;
+- else
+- udev->speed = USB_SPEED_FULL;
++ if (!hub_is_superspeed(hub->hdev) &&
++ (portchange & USB_PORT_STAT_C_CONNECTION))
++ return -ENOTCONN;
++
++ if ((portstatus & USB_PORT_STAT_ENABLE)) {
++ if (!udev)
+ return 0;
+- }
+- } else {
+- if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+- hub_port_warm_reset_required(hub,
+- portstatus))
+- return -ENOTCONN;
+
++ if (hub_is_wusb(hub))
++ udev->speed = USB_SPEED_WIRELESS;
++ else if (hub_is_superspeed(hub->hdev))
++ udev->speed = USB_SPEED_SUPER;
++ else if (portstatus & USB_PORT_STAT_HIGH_SPEED)
++ udev->speed = USB_SPEED_HIGH;
++ else if (portstatus & USB_PORT_STAT_LOW_SPEED)
++ udev->speed = USB_SPEED_LOW;
++ else
++ udev->speed = USB_SPEED_FULL;
+ return 0;
+ }
+
+@@ -2619,16 +2584,16 @@ delay:
+ }
+
+ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, int *status, bool warm)
++ struct usb_device *udev, int *status)
+ {
+ switch (*status) {
+ case 0:
+- if (!warm) {
+- struct usb_hcd *hcd;
+- /* TRSTRCY = 10 ms; plus some extra */
+- msleep(10 + 40);
++ /* TRSTRCY = 10 ms; plus some extra */
++ msleep(10 + 40);
++ if (udev) {
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
+ update_devnum(udev, 0);
+- hcd = bus_to_hcd(udev->bus);
+ /* The xHC may think the device is already reset,
+ * so ignore the status.
+ */
+@@ -2640,14 +2605,15 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+ case -ENODEV:
+ clear_port_feature(hub->hdev,
+ port1, USB_PORT_FEAT_C_RESET);
+- /* FIXME need disconnect() for NOTATTACHED device */
+ if (hub_is_superspeed(hub->hdev)) {
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
+ }
+- if (!warm)
++ if (udev)
+ usb_set_device_state(udev, *status
+ ? USB_STATE_NOTATTACHED
+ : USB_STATE_DEFAULT);
+@@ -2660,18 +2626,30 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ struct usb_device *udev, unsigned int delay, bool warm)
+ {
+ int i, status;
++ u16 portchange, portstatus;
+
+- if (!warm) {
+- /* Block EHCI CF initialization during the port reset.
+- * Some companion controllers don't like it when they mix.
+- */
+- down_read(&ehci_cf_port_reset_rwsem);
+- } else {
+- if (!hub_is_superspeed(hub->hdev)) {
++ if (!hub_is_superspeed(hub->hdev)) {
++ if (warm) {
+ dev_err(hub->intfdev, "only USB3 hub support "
+ "warm reset\n");
+ return -EINVAL;
+ }
++ /* Block EHCI CF initialization during the port reset.
++ * Some companion controllers don't like it when they mix.
++ */
++ down_read(&ehci_cf_port_reset_rwsem);
++ } else if (!warm) {
++ /*
++ * If the caller hasn't explicitly requested a warm reset,
++ * double check and see if one is needed.
++ */
++ status = hub_port_status(hub, port1,
++ &portstatus, &portchange);
++ if (status < 0)
++ goto done;
++
++ if (hub_port_warm_reset_required(hub, portstatus))
++ warm = true;
+ }
+
+ /* Reset the port */
+@@ -2692,10 +2670,33 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ status);
+ }
+
+- /* return on disconnect or reset */
++ /* Check for disconnect or reset */
+ if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
+- hub_port_finish_reset(hub, port1, udev, &status, warm);
+- goto done;
++ hub_port_finish_reset(hub, port1, udev, &status);
++
++ if (!hub_is_superspeed(hub->hdev))
++ goto done;
++
++ /*
++ * If a USB 3.0 device migrates from reset to an error
++ * state, re-issue the warm reset.
++ */
++ if (hub_port_status(hub, port1,
++ &portstatus, &portchange) < 0)
++ goto done;
++
++ if (!hub_port_warm_reset_required(hub, portstatus))
++ goto done;
++
++ /*
++ * If the port is in SS.Inactive or Compliance Mode, the
++ * hot or warm reset failed. Try another warm reset.
++ */
++ if (!warm) {
++ dev_dbg(hub->intfdev, "hot reset failed, warm reset port %d\n",
++ port1);
++ warm = true;
++ }
+ }
+
+ dev_dbg (hub->intfdev,
+@@ -2709,7 +2710,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ port1);
+
+ done:
+- if (!warm)
++ if (!hub_is_superspeed(hub->hdev))
+ up_read(&ehci_cf_port_reset_rwsem);
+
+ return status;
+@@ -4740,12 +4741,21 @@ static void hub_events(void)
+ */
+ if (hub_port_warm_reset_required(hub, portstatus)) {
+ int status;
++ struct usb_device *udev =
++ hub->ports[i - 1]->child;
+
+ dev_dbg(hub_dev, "warm reset port %d\n", i);
+- status = hub_port_reset(hub, i, NULL,
+- HUB_BH_RESET_TIME, true);
+- if (status < 0)
+- hub_port_disable(hub, i, 1);
++ if (!udev) {
++ status = hub_port_reset(hub, i,
++ NULL, HUB_BH_RESET_TIME,
++ true);
++ if (status < 0)
++ hub_port_disable(hub, i, 1);
++ } else {
++ usb_lock_device(udev);
++ status = usb_reset_device(udev);
++ usb_unlock_device(udev);
++ }
+ connect_change = 0;
+ }
+
+diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
+index f904071..20dbdcb 100644
+--- a/drivers/usb/host/ehci-timer.c
++++ b/drivers/usb/host/ehci-timer.c
+@@ -113,15 +113,14 @@ static void ehci_poll_ASS(struct ehci_hcd *ehci)
+
+ if (want != actual) {
+
+- /* Poll again later */
+- ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
+- ++ehci->ASS_poll_count;
+- return;
++ /* Poll again later, but give up after about 20 ms */
++ if (ehci->ASS_poll_count++ < 20) {
++ ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
++ return;
++ }
++ ehci_dbg(ehci, "Waited too long for the async schedule status (%x/%x), giving up\n",
++ want, actual);
+ }
+-
+- if (ehci->ASS_poll_count > 20)
+- ehci_dbg(ehci, "ASS poll count reached %d\n",
+- ehci->ASS_poll_count);
+ ehci->ASS_poll_count = 0;
+
+ /* The status is up-to-date; restart or stop the schedule as needed */
+@@ -160,14 +159,14 @@ static void ehci_poll_PSS(struct ehci_hcd *ehci)
+
+ if (want != actual) {
+
+- /* Poll again later */
+- ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
+- return;
++ /* Poll again later, but give up after about 20 ms */
++ if (ehci->PSS_poll_count++ < 20) {
++ ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
++ return;
++ }
++ ehci_dbg(ehci, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
++ want, actual);
+ }
+-
+- if (ehci->PSS_poll_count > 20)
+- ehci_dbg(ehci, "PSS poll count reached %d\n",
+- ehci->PSS_poll_count);
+ ehci->PSS_poll_count = 0;
+
+ /* The status is up-to-date; restart or stop the schedule as needed */
+diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
+index 85b363a..d39dfa4 100644
+--- a/drivers/w1/masters/w1-gpio.c
++++ b/drivers/w1/masters/w1-gpio.c
+@@ -72,7 +72,7 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int __init w1_gpio_probe(struct platform_device *pdev)
++static int w1_gpio_probe(struct platform_device *pdev)
+ {
+ struct w1_bus_master *master;
+ struct w1_gpio_platform_data *pdata;
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 7f809fd..19fa73a 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -79,6 +79,7 @@ config DA9052_WATCHDOG
+ config DA9055_WATCHDOG
+ tristate "Dialog Semiconductor DA9055 Watchdog"
+ depends on MFD_DA9055
++ select WATCHDOG_CORE
+ help
+ If you say yes here you get support for watchdog on the Dialog
+ Semiconductor DA9055 PMIC.
+diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
+index 2b0e000..e3b8f75 100644
+--- a/drivers/watchdog/sp5100_tco.c
++++ b/drivers/watchdog/sp5100_tco.c
+@@ -361,7 +361,7 @@ static unsigned char sp5100_tco_setupdevice(void)
+ {
+ struct pci_dev *dev = NULL;
+ const char *dev_name = NULL;
+- u32 val;
++ u32 val, tmp_val;
+ u32 index_reg, data_reg, base_addr;
+
+ /* Match the PCI device */
+@@ -497,30 +497,19 @@ static unsigned char sp5100_tco_setupdevice(void)
+ pr_debug("Got 0x%04x from resource tree\n", val);
+ }
+
+- /* Restore to the low three bits, if chipset is SB8x0(or later) */
+- if (sp5100_tco_pci->revision >= 0x40) {
+- u8 reserved_bit;
+- reserved_bit = inb(base_addr) & 0x7;
+- val |= (u32)reserved_bit;
+- }
++ /* Restore to the low three bits */
++ outb(base_addr+0, index_reg);
++ tmp_val = val | (inb(data_reg) & 0x7);
+
+ /* Re-programming the watchdog timer base address */
+ outb(base_addr+0, index_reg);
+- /* Low three bits of BASE are reserved */
+- outb((val >> 0) & 0xf8, data_reg);
++ outb((tmp_val >> 0) & 0xff, data_reg);
+ outb(base_addr+1, index_reg);
+- outb((val >> 8) & 0xff, data_reg);
++ outb((tmp_val >> 8) & 0xff, data_reg);
+ outb(base_addr+2, index_reg);
+- outb((val >> 16) & 0xff, data_reg);
++ outb((tmp_val >> 16) & 0xff, data_reg);
+ outb(base_addr+3, index_reg);
+- outb((val >> 24) & 0xff, data_reg);
+-
+- /*
+- * Clear unnecessary the low three bits,
+- * if chipset is SB8x0(or later)
+- */
+- if (sp5100_tco_pci->revision >= 0x40)
+- val &= ~0x7;
++ outb((tmp_val >> 24) & 0xff, data_reg);
+
+ if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE,
+ dev_name)) {
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index bcf3ba4..61786be 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -30,6 +30,7 @@
+ * IN THE SOFTWARE.
+ */
+
++#include <linux/mm.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/spinlock.h>
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index cc93b23..659ea81 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -265,6 +265,7 @@ static noinline int cow_file_range_inline(struct btrfs_trans_handle *trans,
+ return 1;
+ }
+
++ set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &BTRFS_I(inode)->runtime_flags);
+ btrfs_delalloc_release_metadata(inode, end + 1 - start);
+ btrfs_drop_extent_cache(inode, start, aligned_end - 1, 0);
+ return 0;
+@@ -2469,6 +2470,7 @@ int btrfs_orphan_cleanup(struct btrfs_root *root)
+ */
+ set_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
+ &BTRFS_I(inode)->runtime_flags);
++ atomic_inc(&root->orphan_inodes);
+
+ /* if we have links, this was a truncate, lets do that */
+ if (inode->i_nlink) {
+@@ -2491,6 +2493,8 @@ int btrfs_orphan_cleanup(struct btrfs_root *root)
+ goto out;
+
+ ret = btrfs_truncate(inode);
++ if (ret)
++ btrfs_orphan_del(NULL, inode);
+ } else {
+ nr_unlink++;
+ }
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 9027bb1..b6818ee 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3281,6 +3281,7 @@ static int log_one_extent(struct btrfs_trans_handle *trans,
+ int ret;
+ bool skip_csum = BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM;
+
++insert:
+ INIT_LIST_HEAD(&ordered_sums);
+ btrfs_init_map_token(&token);
+ key.objectid = btrfs_ino(inode);
+@@ -3296,6 +3297,23 @@ static int log_one_extent(struct btrfs_trans_handle *trans,
+ leaf = path->nodes[0];
+ fi = btrfs_item_ptr(leaf, path->slots[0],
+ struct btrfs_file_extent_item);
++
++ /*
++ * If we are overwriting an inline extent with a real one then we need
++ * to just delete the inline extent as it may not be large enough to
++ * have the entire file_extent_item.
++ */
++ if (ret && btrfs_token_file_extent_type(leaf, fi, &token) ==
++ BTRFS_FILE_EXTENT_INLINE) {
++ ret = btrfs_del_item(trans, log, path);
++ btrfs_release_path(path);
++ if (ret) {
++ path->really_keep_locks = 0;
++ return ret;
++ }
++ goto insert;
++ }
++
+ btrfs_set_token_file_extent_generation(leaf, fi, em->generation,
+ &token);
+ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags)) {
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5cbb7f4..ac8ff8d 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -647,6 +647,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
+ new_device->writeable = 0;
+ new_device->in_fs_metadata = 0;
+ new_device->can_discard = 0;
++ spin_lock_init(&new_device->io_lock);
+ list_replace_rcu(&device->dev_list, &new_device->dev_list);
+
+ call_rcu(&device->rcu, free_device);
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index de7f916..e328339 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -558,6 +558,11 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ dentry = ERR_PTR(-ENOENT);
+ break;
+ }
++ if (!S_ISDIR(dir->i_mode)) {
++ dput(dentry);
++ dentry = ERR_PTR(-ENOTDIR);
++ break;
++ }
+
+ /* skip separators */
+ while (*s == sep)
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index c9c7aa7..bceffe7 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -744,4 +744,5 @@ struct smb_version_values smb30_values = {
+ .cap_unix = 0,
+ .cap_nt_find = SMB2_NT_FIND,
+ .cap_large_files = SMB2_LARGE_FILES,
++ .oplock_read = SMB2_OPLOCK_LEVEL_II,
+ };
+diff --git a/fs/compat.c b/fs/compat.c
+index 015e1e1..a06dcbc 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -558,6 +558,10 @@ ssize_t compat_rw_copy_check_uvector(int type,
+ }
+ *ret_pointer = iov;
+
++ ret = -EFAULT;
++ if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
++ goto out;
++
+ /*
+ * Single unix specification:
+ * We should -EINVAL if an element length is not >= 0 and fitting an
+@@ -1080,17 +1084,12 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
+ if (!file->f_op)
+ goto out;
+
+- ret = -EFAULT;
+- if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
+- goto out;
+-
+- tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs,
++ ret = compat_rw_copy_check_uvector(type, uvector, nr_segs,
+ UIO_FASTIOV, iovstack, &iov);
+- if (tot_len == 0) {
+- ret = 0;
++ if (ret <= 0)
+ goto out;
+- }
+
++ tot_len = ret;
+ ret = rw_verify_area(type, file, pos, tot_len);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index 2f2e0da..92e68b3 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -635,7 +635,7 @@ ext4_fsblk_t ext4_count_free_clusters(struct super_block *sb)
+ brelse(bitmap_bh);
+ printk(KERN_DEBUG "ext4_count_free_clusters: stored = %llu"
+ ", computed = %llu, %llu\n",
+- EXT4_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)),
++ EXT4_NUM_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)),
+ desc_count, bitmap_count);
+ return bitmap_count;
+ #else
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 061727a..28bbf9b 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3444,7 +3444,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+ win = offs;
+
+ ac->ac_b_ex.fe_logical = ac->ac_o_ex.fe_logical -
+- EXT4_B2C(sbi, win);
++ EXT4_NUM_B2C(sbi, win);
+ BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
+ BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);
+ }
+@@ -4590,7 +4590,7 @@ do_more:
+ EXT4_BLOCKS_PER_GROUP(sb);
+ count -= overflow;
+ }
+- count_clusters = EXT4_B2C(sbi, count);
++ count_clusters = EXT4_NUM_B2C(sbi, count);
+ bitmap_bh = ext4_read_block_bitmap(sb, block_group);
+ if (!bitmap_bh) {
+ err = -EIO;
+@@ -4832,11 +4832,11 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
+ ext4_group_desc_csum_set(sb, block_group, desc);
+ ext4_unlock_group(sb, block_group);
+ percpu_counter_add(&sbi->s_freeclusters_counter,
+- EXT4_B2C(sbi, blocks_freed));
++ EXT4_NUM_B2C(sbi, blocks_freed));
+
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
+- atomic_add(EXT4_B2C(sbi, blocks_freed),
++ atomic_add(EXT4_NUM_B2C(sbi, blocks_freed),
+ &sbi->s_flex_groups[flex_group].free_clusters);
+ }
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 02824dc..1aab70d 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1247,7 +1247,7 @@ static int ext4_setup_new_descs(handle_t *handle, struct super_block *sb,
+
+ ext4_inode_table_set(sb, gdp, group_data->inode_table);
+ ext4_free_group_clusters_set(sb, gdp,
+- EXT4_B2C(sbi, group_data->free_blocks_count));
++ EXT4_NUM_B2C(sbi, group_data->free_blocks_count));
+ ext4_free_inodes_set(sb, gdp, EXT4_INODES_PER_GROUP(sb));
+ if (ext4_has_group_desc_csum(sb))
+ ext4_itable_unused_set(sb, gdp,
+@@ -1349,7 +1349,7 @@ static void ext4_update_super(struct super_block *sb,
+
+ /* Update the free space counts */
+ percpu_counter_add(&sbi->s_freeclusters_counter,
+- EXT4_B2C(sbi, free_blocks));
++ EXT4_NUM_B2C(sbi, free_blocks));
+ percpu_counter_add(&sbi->s_freeinodes_counter,
+ EXT4_INODES_PER_GROUP(sb) * flex_gd->count);
+
+@@ -1360,7 +1360,7 @@ static void ext4_update_super(struct super_block *sb,
+ sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group;
+ flex_group = ext4_flex_group(sbi, group_data[0].group);
+- atomic_add(EXT4_B2C(sbi, free_blocks),
++ atomic_add(EXT4_NUM_B2C(sbi, free_blocks),
+ &sbi->s_flex_groups[flex_group].free_clusters);
+ atomic_add(EXT4_INODES_PER_GROUP(sb) * flex_gd->count,
+ &sbi->s_flex_groups[flex_group].free_inodes);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 0465f36..5fa223d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3235,7 +3235,7 @@ int ext4_calculate_overhead(struct super_block *sb)
+ }
+ /* Add the journal blocks as well */
+ if (sbi->s_journal)
+- overhead += EXT4_B2C(sbi, sbi->s_journal->j_maxlen);
++ overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen);
+
+ sbi->s_overhead = overhead;
+ smp_wmb();
+diff --git a/fs/namei.c b/fs/namei.c
+index 43a97ee..ec97aef 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -693,8 +693,6 @@ void nd_jump_link(struct nameidata *nd, struct path *path)
+ nd->path = *path;
+ nd->inode = nd->path.dentry->d_inode;
+ nd->flags |= LOOKUP_JUMPED;
+-
+- BUG_ON(nd->inode->i_op->follow_link);
+ }
+
+ static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
+diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
+index 194c484..49eeb04 100644
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -99,7 +99,8 @@ static void filelayout_reset_write(struct nfs_write_data *data)
+
+ task->tk_status = pnfs_write_done_resend_to_mds(hdr->inode,
+ &hdr->pages,
+- hdr->completion_ops);
++ hdr->completion_ops,
++ hdr->dreq);
+ }
+ }
+
+@@ -119,7 +120,8 @@ static void filelayout_reset_read(struct nfs_read_data *data)
+
+ task->tk_status = pnfs_read_done_resend_to_mds(hdr->inode,
+ &hdr->pages,
+- hdr->completion_ops);
++ hdr->completion_ops,
++ hdr->dreq);
+ }
+ }
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index efda60d..3cb5e77 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6087,11 +6087,13 @@ static struct page **nfs4_alloc_pages(size_t size, gfp_t gfp_flags)
+ static void nfs4_layoutget_release(void *calldata)
+ {
+ struct nfs4_layoutget *lgp = calldata;
+- struct nfs_server *server = NFS_SERVER(lgp->args.inode);
++ struct inode *inode = lgp->args.inode;
++ struct nfs_server *server = NFS_SERVER(inode);
+ size_t max_pages = max_response_pages(server);
+
+ dprintk("--> %s\n", __func__);
+ nfs4_free_pages(lgp->args.layout.pages, max_pages);
++ pnfs_put_layout_hdr(NFS_I(inode)->layout);
+ put_nfs_open_context(lgp->args.ctx);
+ kfree(calldata);
+ dprintk("<-- %s\n", __func__);
+@@ -6106,7 +6108,8 @@ static const struct rpc_call_ops nfs4_layoutget_call_ops = {
+ struct pnfs_layout_segment *
+ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
+ {
+- struct nfs_server *server = NFS_SERVER(lgp->args.inode);
++ struct inode *inode = lgp->args.inode;
++ struct nfs_server *server = NFS_SERVER(inode);
+ size_t max_pages = max_response_pages(server);
+ struct rpc_task *task;
+ struct rpc_message msg = {
+@@ -6136,6 +6139,10 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
+ lgp->res.layoutp = &lgp->args.layout;
+ lgp->res.seq_res.sr_slot = NULL;
+ nfs41_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
++
++ /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
++ pnfs_get_layout_hdr(NFS_I(inode)->layout);
++
+ task = rpc_run_task(&task_setup_data);
+ if (IS_ERR(task))
+ return ERR_CAST(task);
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 6be70f6..97767c8 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1422,13 +1422,15 @@ EXPORT_SYMBOL_GPL(pnfs_generic_pg_test);
+
+ int pnfs_write_done_resend_to_mds(struct inode *inode,
+ struct list_head *head,
+- const struct nfs_pgio_completion_ops *compl_ops)
++ const struct nfs_pgio_completion_ops *compl_ops,
++ struct nfs_direct_req *dreq)
+ {
+ struct nfs_pageio_descriptor pgio;
+ LIST_HEAD(failed);
+
+ /* Resend all requests through the MDS */
+ nfs_pageio_init_write(&pgio, inode, FLUSH_STABLE, compl_ops);
++ pgio.pg_dreq = dreq;
+ while (!list_empty(head)) {
+ struct nfs_page *req = nfs_list_entry(head->next);
+
+@@ -1463,7 +1465,8 @@ static void pnfs_ld_handle_write_error(struct nfs_write_data *data)
+ if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
+ data->task.tk_status = pnfs_write_done_resend_to_mds(hdr->inode,
+ &hdr->pages,
+- hdr->completion_ops);
++ hdr->completion_ops,
++ hdr->dreq);
+ }
+
+ /*
+@@ -1578,13 +1581,15 @@ EXPORT_SYMBOL_GPL(pnfs_generic_pg_writepages);
+
+ int pnfs_read_done_resend_to_mds(struct inode *inode,
+ struct list_head *head,
+- const struct nfs_pgio_completion_ops *compl_ops)
++ const struct nfs_pgio_completion_ops *compl_ops,
++ struct nfs_direct_req *dreq)
+ {
+ struct nfs_pageio_descriptor pgio;
+ LIST_HEAD(failed);
+
+ /* Resend all requests through the MDS */
+ nfs_pageio_init_read(&pgio, inode, compl_ops);
++ pgio.pg_dreq = dreq;
+ while (!list_empty(head)) {
+ struct nfs_page *req = nfs_list_entry(head->next);
+
+@@ -1615,7 +1620,8 @@ static void pnfs_ld_handle_read_error(struct nfs_read_data *data)
+ if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
+ data->task.tk_status = pnfs_read_done_resend_to_mds(hdr->inode,
+ &hdr->pages,
+- hdr->completion_ops);
++ hdr->completion_ops,
++ hdr->dreq);
+ }
+
+ /*
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 97cb358..94ba804 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -230,9 +230,11 @@ struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino,
+
+ void nfs4_deviceid_mark_client_invalid(struct nfs_client *clp);
+ int pnfs_read_done_resend_to_mds(struct inode *inode, struct list_head *head,
+- const struct nfs_pgio_completion_ops *compl_ops);
++ const struct nfs_pgio_completion_ops *compl_ops,
++ struct nfs_direct_req *dreq);
+ int pnfs_write_done_resend_to_mds(struct inode *inode, struct list_head *head,
+- const struct nfs_pgio_completion_ops *compl_ops);
++ const struct nfs_pgio_completion_ops *compl_ops,
++ struct nfs_direct_req *dreq);
+ struct nfs4_threshold *pnfs_mdsthreshold_alloc(void);
+
+ /* nfs4_deviceid_flags */
+diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
+index 3f79c77..6edc807 100644
+--- a/fs/nfs/unlink.c
++++ b/fs/nfs/unlink.c
+@@ -336,20 +336,14 @@ static void nfs_async_rename_done(struct rpc_task *task, void *calldata)
+ struct inode *old_dir = data->old_dir;
+ struct inode *new_dir = data->new_dir;
+ struct dentry *old_dentry = data->old_dentry;
+- struct dentry *new_dentry = data->new_dentry;
+
+ if (!NFS_PROTO(old_dir)->rename_done(task, old_dir, new_dir)) {
+ rpc_restart_call_prepare(task);
+ return;
+ }
+
+- if (task->tk_status != 0) {
++ if (task->tk_status != 0)
+ nfs_cancel_async_unlink(old_dentry);
+- return;
+- }
+-
+- d_drop(old_dentry);
+- d_drop(new_dentry);
+ }
+
+ /**
+@@ -550,6 +544,18 @@ nfs_sillyrename(struct inode *dir, struct dentry *dentry)
+ error = rpc_wait_for_completion_task(task);
+ if (error == 0)
+ error = task->tk_status;
++ switch (error) {
++ case 0:
++ /* The rename succeeded */
++ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
++ d_move(dentry, sdentry);
++ break;
++ case -ERESTARTSYS:
++ /* The result of the rename is unknown. Play it safe by
++ * forcing a new lookup */
++ d_drop(dentry);
++ d_drop(sdentry);
++ }
+ rpc_put_task(task);
+ out_dput:
+ dput(sdentry);
+diff --git a/fs/pipe.c b/fs/pipe.c
+index bd3479d..8e2e73f 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -863,6 +863,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ int ret = -ENOENT;
+
++ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
++ return -EINVAL;
++
+ mutex_lock(&inode->i_mutex);
+
+ if (inode->i_pipe) {
+diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
+index b7a4719..66b51c0 100644
+--- a/fs/proc/namespaces.c
++++ b/fs/proc/namespaces.c
+@@ -118,7 +118,7 @@ static void *proc_ns_follow_link(struct dentry *dentry, struct nameidata *nd)
+ struct super_block *sb = inode->i_sb;
+ struct proc_inode *ei = PROC_I(inode);
+ struct task_struct *task;
+- struct dentry *ns_dentry;
++ struct path ns_path;
+ void *error = ERR_PTR(-EACCES);
+
+ task = get_proc_task(inode);
+@@ -128,14 +128,14 @@ static void *proc_ns_follow_link(struct dentry *dentry, struct nameidata *nd)
+ if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ goto out_put_task;
+
+- ns_dentry = proc_ns_get_dentry(sb, task, ei->ns_ops);
+- if (IS_ERR(ns_dentry)) {
+- error = ERR_CAST(ns_dentry);
++ ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns_ops);
++ if (IS_ERR(ns_path.dentry)) {
++ error = ERR_CAST(ns_path.dentry);
+ goto out_put_task;
+ }
+
+- dput(nd->path.dentry);
+- nd->path.dentry = ns_dentry;
++ ns_path.mnt = mntget(nd->path.mnt);
++ nd_jump_link(nd, &ns_path);
+ error = NULL;
+
+ out_put_task:
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index bf6afa2..a5cda3e 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -68,8 +68,8 @@ typedef void (*dm_postsuspend_fn) (struct dm_target *ti);
+ typedef int (*dm_preresume_fn) (struct dm_target *ti);
+ typedef void (*dm_resume_fn) (struct dm_target *ti);
+
+-typedef int (*dm_status_fn) (struct dm_target *ti, status_type_t status_type,
+- unsigned status_flags, char *result, unsigned maxlen);
++typedef void (*dm_status_fn) (struct dm_target *ti, status_type_t status_type,
++ unsigned status_flags, char *result, unsigned maxlen);
+
+ typedef int (*dm_message_fn) (struct dm_target *ti, unsigned argc, char **argv);
+
+diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
+index 4b117a3..acf4d31 100644
+--- a/include/linux/mfd/rtsx_pci.h
++++ b/include/linux/mfd/rtsx_pci.h
+@@ -735,6 +735,7 @@ struct rtsx_pcr {
+
+ unsigned int card_inserted;
+ unsigned int card_removed;
++ unsigned int card_exist;
+
+ struct delayed_work carddet_work;
+ struct delayed_work idle_work;
+@@ -799,6 +800,7 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
+ u8 ssc_depth, bool initial_mode, bool double_clk, bool vpclk);
+ int rtsx_pci_card_power_on(struct rtsx_pcr *pcr, int card);
+ int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card);
++int rtsx_pci_card_exclusive_check(struct rtsx_pcr *pcr, int card);
+ int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage);
+ unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr);
+ void rtsx_pci_complete_unfinished_transfer(struct rtsx_pcr *pcr);
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 950572f..31cd1bf 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -820,15 +820,17 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
+ struct msg_msg *copy = NULL;
+ unsigned long copy_number = 0;
+
++ ns = current->nsproxy->ipc_ns;
++
+ if (msqid < 0 || (long) bufsz < 0)
+ return -EINVAL;
+ if (msgflg & MSG_COPY) {
+- copy = prepare_copy(buf, bufsz, msgflg, &msgtyp, ©_number);
++ copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax),
++ msgflg, &msgtyp, ©_number);
+ if (IS_ERR(copy))
+ return PTR_ERR(copy);
+ }
+ mode = convert_mode(&msgtyp, msgflg);
+- ns = current->nsproxy->ipc_ns;
+
+ msq = msg_lock_check(ns, msqid);
+ if (IS_ERR(msq)) {
+diff --git a/ipc/msgutil.c b/ipc/msgutil.c
+index ebfcbfa..5df8e4b 100644
+--- a/ipc/msgutil.c
++++ b/ipc/msgutil.c
+@@ -117,9 +117,6 @@ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
+ if (alen > DATALEN_MSG)
+ alen = DATALEN_MSG;
+
+- dst->next = NULL;
+- dst->security = NULL;
+-
+ memcpy(dst + 1, src + 1, alen);
+
+ len -= alen;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index c535f33..5630e52 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1141,6 +1141,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
+ return ERR_PTR(-EINVAL);
+
++ if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * Thread groups must share signals as well, and detached threads
+ * can only be started up within the thread group.
+@@ -1801,7 +1804,7 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+ * If unsharing a user namespace must also unshare the thread.
+ */
+ if (unshare_flags & CLONE_NEWUSER)
+- unshare_flags |= CLONE_THREAD;
++ unshare_flags |= CLONE_THREAD | CLONE_FS;
+ /*
+ * If unsharing a pid namespace must also unshare the thread.
+ */
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index d58e552..e78feff 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -564,14 +564,19 @@ void tick_nohz_idle_enter(void)
+ */
+ void tick_nohz_irq_exit(void)
+ {
++ unsigned long flags;
+ struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+
+ if (!ts->inidle)
+ return;
+
+- /* Cancel the timer because CPU already waken up from the C-states*/
++ local_irq_save(flags);
++
++ /* Cancel the timer because CPU already waken up from the C-states */
+ menu_hrtimer_cancel();
+ __tick_nohz_idle_enter(ts);
++
++ local_irq_restore(flags);
+ }
+
+ /**
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index 5d89335..2747967 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -416,24 +416,28 @@ config PROBE_EVENTS
+ def_bool n
+
+ config DYNAMIC_FTRACE
+- bool "enable/disable ftrace tracepoints dynamically"
++ bool "enable/disable function tracing dynamically"
+ depends on FUNCTION_TRACER
+ depends on HAVE_DYNAMIC_FTRACE
+ default y
+ help
+- This option will modify all the calls to ftrace dynamically
+- (will patch them out of the binary image and replace them
+- with a No-Op instruction) as they are called. A table is
+- created to dynamically enable them again.
++ This option will modify all the calls to function tracing
++ dynamically (will patch them out of the binary image and
++ replace them with a No-Op instruction) on boot up. During
++ compile time, a table is made of all the locations that ftrace
++ can function trace, and this table is linked into the kernel
++ image. When this is enabled, functions can be individually
++ enabled, and the functions not enabled will not affect
++ performance of the system.
++
++ See the files in /sys/kernel/debug/tracing:
++ available_filter_functions
++ set_ftrace_filter
++ set_ftrace_notrace
+
+ This way a CONFIG_FUNCTION_TRACER kernel is slightly larger, but
+ otherwise has native performance as long as no tracing is active.
+
+- The changes to the code are done by a kernel thread that
+- wakes up once a second and checks to see if any ftrace calls
+- were made. If so, it runs stop_machine (stops all CPUS)
+- and modifies the code to jump over the call to ftrace.
+-
+ config FUNCTION_PROFILER
+ bool "Kernel function profiler"
+ depends on FUNCTION_TRACER
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 2b042c4..dbfe36a7 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -21,6 +21,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/ctype.h>
+ #include <linux/projid.h>
++#include <linux/fs_struct.h>
+
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+
+@@ -803,6 +804,9 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
+ if (atomic_read(¤t->mm->mm_users) > 1)
+ return -EINVAL;
+
++ if (current->fs->users != 1)
++ return -EINVAL;
++
+ if (!ns_capable(user_ns, CAP_SYS_ADMIN))
+ return -EPERM;
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index e2df1c1..3df6d12 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2386,8 +2386,8 @@ restart:
+ *mpol_new = *n->policy;
+ atomic_set(&mpol_new->refcnt, 1);
+ sp_node_init(n_new, n->end, end, mpol_new);
+- sp_insert(sp, n_new);
+ n->end = start;
++ sp_insert(sp, n_new);
+ n_new = NULL;
+ mpol_new = NULL;
+ break;
+diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
+index 926b466..fd26d04 100644
+--- a/mm/process_vm_access.c
++++ b/mm/process_vm_access.c
+@@ -429,12 +429,6 @@ compat_process_vm_rw(compat_pid_t pid,
+ if (flags != 0)
+ return -EINVAL;
+
+- if (!access_ok(VERIFY_READ, lvec, liovcnt * sizeof(*lvec)))
+- goto out;
+-
+- if (!access_ok(VERIFY_READ, rvec, riovcnt * sizeof(*rvec)))
+- goto out;
+-
+ if (vm_write)
+ rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
+ UIO_FASTIOV, iovstack_l,
+@@ -459,8 +453,6 @@ free_iovecs:
+ kfree(iov_r);
+ if (iov_l != iovstack_l)
+ kfree(iov_l);
+-
+-out:
+ return rc;
+ }
+
+diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
+index f651da6..76c3d0a 100644
+--- a/net/ieee802154/6lowpan.c
++++ b/net/ieee802154/6lowpan.c
+@@ -1234,7 +1234,7 @@ static inline int __init lowpan_netlink_init(void)
+ return rtnl_link_register(&lowpan_link_ops);
+ }
+
+-static inline void __init lowpan_netlink_fini(void)
++static inline void lowpan_netlink_fini(void)
+ {
+ rtnl_link_unregister(&lowpan_link_ops);
+ }
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index f75ba1a..9979bf8 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4072,6 +4072,17 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
++ /*
++ * Make sure some work items will not run after this,
++ * they will not do anything but might not have been
++ * cancelled when disconnecting.
++ */
++ cancel_work_sync(&ifmgd->monitor_work);
++ cancel_work_sync(&ifmgd->beacon_connection_loss_work);
++ cancel_work_sync(&ifmgd->request_smps_work);
++ cancel_work_sync(&ifmgd->csa_connection_drop_work);
++ cancel_work_sync(&ifmgd->chswitch_work);
++
+ mutex_lock(&ifmgd->mtx);
+ if (ifmgd->assoc_data)
+ ieee80211_destroy_assoc_data(sdata, false);
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 33811db..ab02588 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -485,13 +485,17 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
+ * xprt_wait_for_buffer_space - wait for transport output buffer to clear
+ * @task: task to be put to sleep
+ * @action: function pointer to be executed after wait
++ *
++ * Note that we only set the timer for the case of RPC_IS_SOFT(), since
++ * we don't in general want to force a socket disconnection due to
++ * an incomplete RPC call transmission.
+ */
+ void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
+ {
+ struct rpc_rqst *req = task->tk_rqstp;
+ struct rpc_xprt *xprt = req->rq_xprt;
+
+- task->tk_timeout = req->rq_timeout;
++ task->tk_timeout = RPC_IS_SOFT(task) ? req->rq_timeout : 0;
+ rpc_sleep_on(&xprt->pending, task, action);
+ }
+ EXPORT_SYMBOL_GPL(xprt_wait_for_buffer_space);
+diff --git a/security/keys/compat.c b/security/keys/compat.c
+index 1c26176..d65fa7f 100644
+--- a/security/keys/compat.c
++++ b/security/keys/compat.c
+@@ -40,12 +40,12 @@ static long compat_keyctl_instantiate_key_iov(
+ ARRAY_SIZE(iovstack),
+ iovstack, &iov);
+ if (ret < 0)
+- return ret;
++ goto err;
+ if (ret == 0)
+ goto no_payload_free;
+
+ ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ if (iov != iovstack)
+ kfree(iov);
+ return ret;
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index 58dfe08..42defae 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -57,7 +57,7 @@ int install_user_keyrings(void)
+
+ kenter("%p{%u}", user, uid);
+
+- if (user->uid_keyring) {
++ if (user->uid_keyring && user->session_keyring) {
+ kleave(" = 0 [exist]");
+ return 0;
+ }
+@@ -839,7 +839,7 @@ void key_change_session_keyring(struct callback_head *twork)
+ new-> sgid = old-> sgid;
+ new->fsgid = old->fsgid;
+ new->user = get_uid(old->user);
+- new->user_ns = get_user_ns(new->user_ns);
++ new->user_ns = get_user_ns(old->user_ns);
+ new->group_info = get_group_info(old->group_info);
+
+ new->securebits = old->securebits;
+diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
+index 8575861..0097f36 100644
+--- a/sound/core/vmaster.c
++++ b/sound/core/vmaster.c
+@@ -213,7 +213,10 @@ static int slave_put(struct snd_kcontrol *kcontrol,
+ }
+ if (!changed)
+ return 0;
+- return slave_put_val(slave, ucontrol);
++ err = slave_put_val(slave, ucontrol);
++ if (err < 0)
++ return err;
++ return 1;
+ }
+
+ static int slave_tlv_cmd(struct snd_kcontrol *kcontrol,
+diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
+index 2ffdc35..806407a 100644
+--- a/sound/pci/ice1712/ice1712.c
++++ b/sound/pci/ice1712/ice1712.c
+@@ -2594,6 +2594,8 @@ static int snd_ice1712_create(struct snd_card *card,
+ snd_ice1712_proc_init(ice);
+ synchronize_irq(pci->irq);
+
++ card->private_data = ice;
++
+ err = pci_request_regions(pci, "ICE1712");
+ if (err < 0) {
+ kfree(ice);
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-03-15 20:43 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-03-15 20:43 [gentoo-commits] linux-patches r2311 - in genpatches-2.6/trunk: 3.0 3.4 3.8 Tom Wijsman (tomwij)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox