summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2013-09-10 09:29:09 -0400
committerAnthony G. Basile <blueness@gentoo.org>2013-09-10 09:29:09 -0400
commitd470c6e306c2901c288ec66b1c234991f69e361e (patch)
treeda3b3ba51f52b6c4a03b1018cda7fa57f9a42489
parentGrsec/PaX: 2.9.1-{3.2.50.3.10.11}-201309081953 (diff)
downloadhardened-patchset-d470c6e306c2901c288ec66b1c234991f69e361e.tar.gz
hardened-patchset-d470c6e306c2901c288ec66b1c234991f69e361e.tar.bz2
hardened-patchset-d470c6e306c2901c288ec66b1c234991f69e361e.zip
3.10.11: add missing patch from genpatches20130908
-rw-r--r--3.10.11/0000_README4
-rw-r--r--3.10.11/1010_linux-3.10.11.patch1130
2 files changed, 1134 insertions, 0 deletions
diff --git a/3.10.11/0000_README b/3.10.11/0000_README
index b92d850..a305fe5 100644
--- a/3.10.11/0000_README
+++ b/3.10.11/0000_README
@@ -2,6 +2,10 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
+Patch: 1010_linux-3.10.11.patch
+From: http://www.kernel.org
+Desc: Linux 3.10.11
+
Patch: 4420_grsecurity-2.9.1-3.10.11-201309081953.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.10.11/1010_linux-3.10.11.patch b/3.10.11/1010_linux-3.10.11.patch
new file mode 100644
index 0000000..ff57b3e
--- /dev/null
+++ b/3.10.11/1010_linux-3.10.11.patch
@@ -0,0 +1,1130 @@
+diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp
+index 90956b6..4dfdc8f 100644
+--- a/Documentation/hwmon/k10temp
++++ b/Documentation/hwmon/k10temp
+@@ -12,6 +12,7 @@ Supported chips:
+ * AMD Family 12h processors: "Llano" (E2/A4/A6/A8-Series)
+ * AMD Family 14h processors: "Brazos" (C/E/G/Z-Series)
+ * AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity"
++* AMD Family 16h processors: "Kabini"
+
+ Prefix: 'k10temp'
+ Addresses scanned: PCI space
+diff --git a/Makefile b/Makefile
+index b119684..595076d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 13609e0..05db95d 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -170,6 +170,7 @@ static void __init xen_percpu_init(void *unused)
+ per_cpu(xen_vcpu, cpu) = vcpup;
+
+ enable_percpu_irq(xen_events_irq, 0);
++ put_cpu();
+ }
+
+ static void xen_restart(char str, const char *cmd)
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 74991fe..fe404e7 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -986,6 +986,7 @@ config RELOCATABLE
+ must live at a different physical address than the primary
+ kernel.
+
++# This value must have zeroes in the bottom 60 bits otherwise lots will break
+ config PAGE_OFFSET
+ hex
+ default "0xc000000000000000"
+diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
+index 988c812..b9f4262 100644
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -211,9 +211,19 @@ extern long long virt_phys_offset;
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + VIRT_PHYS_OFFSET))
+ #define __pa(x) ((unsigned long)(x) - VIRT_PHYS_OFFSET)
+ #else
++#ifdef CONFIG_PPC64
++/*
++ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET
++ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit.
++ */
++#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET))
++#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL)
++
++#else /* 32-bit, non book E */
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START))
+ #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START)
+ #endif
++#endif
+
+ /*
+ * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI,
+diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
+index d92f387..e2a0a16 100644
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,7 +35,13 @@
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
+ #include <asm/mmu.h>
++#include <asm/machdep.h>
+
++
++/*
++ * This isn't a module but we expose that to userspace
++ * via /proc so leave the definitions here
++ */
+ #define MODULE_VERS "1.9"
+ #define MODULE_NAME "lparcfg"
+
+@@ -418,7 +424,8 @@ static void parse_em_data(struct seq_file *m)
+ {
+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+
+- if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
++ if (firmware_has_feature(FW_FEATURE_LPAR) &&
++ plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+ seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
+ }
+
+@@ -677,7 +684,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
+ }
+
+ static const struct file_operations lparcfg_fops = {
+- .owner = THIS_MODULE,
+ .read = seq_read,
+ .write = lparcfg_write,
+ .open = lparcfg_open,
+@@ -699,14 +705,4 @@ static int __init lparcfg_init(void)
+ }
+ return 0;
+ }
+-
+-static void __exit lparcfg_cleanup(void)
+-{
+- remove_proc_subtree("powerpc/lparcfg", NULL);
+-}
+-
+-module_init(lparcfg_init);
+-module_exit(lparcfg_cleanup);
+-MODULE_DESCRIPTION("Interface for LPAR configuration data");
+-MODULE_AUTHOR("Dave Engebretsen");
+-MODULE_LICENSE("GPL");
++machine_device_initcall(pseries, lparcfg_init);
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 1f34e92..7a5bf1b 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -78,8 +78,8 @@ __ref void *alloc_low_pages(unsigned int num)
+ return __va(pfn << PAGE_SHIFT);
+ }
+
+-/* need 4 4k for initial PMD_SIZE, 4k for 0-ISA_END_ADDRESS */
+-#define INIT_PGT_BUF_SIZE (5 * PAGE_SIZE)
++/* need 3 4k for initial PMD_SIZE, 3 4k for 0-ISA_END_ADDRESS */
++#define INIT_PGT_BUF_SIZE (6 * PAGE_SIZE)
+ RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE);
+ void __init early_alloc_pgt_buf(void)
+ {
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 80403c1..45af90a 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -987,6 +987,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ ec_skip_dsdt_scan, "HP Folio 13", {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13"),}, NULL},
++ {
++ ec_validate_ecdt, "ASUS hardware", {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+ {},
+ };
+
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 14f8a69..86abbff 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -152,6 +152,8 @@ static ssize_t show_mem_removable(struct device *dev,
+ container_of(dev, struct memory_block, dev);
+
+ for (i = 0; i < sections_per_block; i++) {
++ if (!present_section_nr(mem->start_section_nr + i))
++ continue;
+ pfn = section_nr_to_pfn(mem->start_section_nr + i);
+ ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+ }
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index 02f490b..bb8c3bb 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -362,7 +362,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
+ rbnode = kzalloc(sizeof *rbnode, GFP_KERNEL);
+ if (!rbnode)
+ return -ENOMEM;
+- rbnode->blklen = sizeof(*rbnode);
++ rbnode->blklen = 1;
+ rbnode->base_reg = reg;
+ rbnode->block = kmalloc(rbnode->blklen * map->cache_word_size,
+ GFP_KERNEL);
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 01f6c2c..a365780 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -4246,7 +4246,7 @@
+ #define EDP_LINK_TRAIN_600MV_0DB_IVB (0x30 <<22)
+ #define EDP_LINK_TRAIN_600MV_3_5DB_IVB (0x36 <<22)
+ #define EDP_LINK_TRAIN_800MV_0DB_IVB (0x38 <<22)
+-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x33 <<22)
++#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x3e <<22)
+
+ /* legacy values */
+ #define EDP_LINK_TRAIN_500MV_0DB_IVB (0x00 <<22)
+diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+index d550226..9d2cd20 100644
+--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
++++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+@@ -20,8 +20,8 @@ nouveau_mc(void *obj)
+ return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_MC];
+ }
+
+-#define nouveau_mc_create(p,e,o,d) \
+- nouveau_mc_create_((p), (e), (o), sizeof(**d), (void **)d)
++#define nouveau_mc_create(p,e,o,m,d) \
++ nouveau_mc_create_((p), (e), (o), (m), sizeof(**d), (void **)d)
+ #define nouveau_mc_destroy(p) ({ \
+ struct nouveau_mc *pmc = (p); _nouveau_mc_dtor(nv_object(pmc)); \
+ })
+@@ -33,7 +33,8 @@ nouveau_mc(void *obj)
+ })
+
+ int nouveau_mc_create_(struct nouveau_object *, struct nouveau_object *,
+- struct nouveau_oclass *, int, void **);
++ struct nouveau_oclass *, const struct nouveau_mc_intr *,
++ int, void **);
+ void _nouveau_mc_dtor(struct nouveau_object *);
+ int _nouveau_mc_init(struct nouveau_object *);
+ int _nouveau_mc_fini(struct nouveau_object *, bool);
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+index 1c0330b..ec9cd6f 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+@@ -80,7 +80,9 @@ _nouveau_mc_dtor(struct nouveau_object *object)
+
+ int
+ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
+- struct nouveau_oclass *oclass, int length, void **pobject)
++ struct nouveau_oclass *oclass,
++ const struct nouveau_mc_intr *intr_map,
++ int length, void **pobject)
+ {
+ struct nouveau_device *device = nv_device(parent);
+ struct nouveau_mc *pmc;
+@@ -92,6 +94,8 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
+ if (ret)
+ return ret;
+
++ pmc->intr_map = intr_map;
++
+ ret = request_irq(device->pdev->irq, nouveau_mc_intr,
+ IRQF_SHARED, "nouveau", pmc);
+ if (ret < 0)
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+index 8c76971..64aa4ed 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+@@ -50,12 +50,11 @@ nv04_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ struct nv04_mc_priv *priv;
+ int ret;
+
+- ret = nouveau_mc_create(parent, engine, oclass, &priv);
++ ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
+ *pobject = nv_object(priv);
+ if (ret)
+ return ret;
+
+- priv->base.intr_map = nv04_mc_intr;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+index 5191937..d989178 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+@@ -36,12 +36,11 @@ nv44_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ struct nv44_mc_priv *priv;
+ int ret;
+
+- ret = nouveau_mc_create(parent, engine, oclass, &priv);
++ ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
+ *pobject = nv_object(priv);
+ if (ret)
+ return ret;
+
+- priv->base.intr_map = nv04_mc_intr;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+index d796924..732d810 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+@@ -52,12 +52,11 @@ nv50_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ struct nv50_mc_priv *priv;
+ int ret;
+
+- ret = nouveau_mc_create(parent, engine, oclass, &priv);
++ ret = nouveau_mc_create(parent, engine, oclass, nv50_mc_intr, &priv);
+ *pobject = nv_object(priv);
+ if (ret)
+ return ret;
+
+- priv->base.intr_map = nv50_mc_intr;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+index e82fd21..0d57b4d 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+@@ -54,12 +54,11 @@ nv98_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ struct nv98_mc_priv *priv;
+ int ret;
+
+- ret = nouveau_mc_create(parent, engine, oclass, &priv);
++ ret = nouveau_mc_create(parent, engine, oclass, nv98_mc_intr, &priv);
+ *pobject = nv_object(priv);
+ if (ret)
+ return ret;
+
+- priv->base.intr_map = nv98_mc_intr;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+index 737bd4b..4c97cd2 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+@@ -56,12 +56,11 @@ nvc0_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ struct nvc0_mc_priv *priv;
+ int ret;
+
+- ret = nouveau_mc_create(parent, engine, oclass, &priv);
++ ret = nouveau_mc_create(parent, engine, oclass, nvc0_mc_intr, &priv);
+ *pobject = nv_object(priv);
+ if (ret)
+ return ret;
+
+- priv->base.intr_map = nvc0_mc_intr;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+index 3751730..1a0bf07 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+@@ -29,7 +29,9 @@
+ #include <drm/drmP.h>
+ #include <drm/ttm/ttm_bo_driver.h>
+
+-#define VMW_PPN_SIZE sizeof(unsigned long)
++#define VMW_PPN_SIZE (sizeof(unsigned long))
++/* A future safe maximum remap size. */
++#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
+
+ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ struct page *pages[],
+@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ {
+ SVGAFifoCmdDefineGMR2 define_cmd;
+ SVGAFifoCmdRemapGMR2 remap_cmd;
+- uint32_t define_size = sizeof(define_cmd) + 4;
+- uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
+ uint32_t *cmd;
+ uint32_t *cmd_orig;
++ uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
++ uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
++ uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
++ uint32_t remap_pos = 0;
++ uint32_t cmd_size = define_size + remap_size;
+ uint32_t i;
+
+- cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
++ cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
+ if (unlikely(cmd == NULL))
+ return -ENOMEM;
+
+ define_cmd.gmrId = gmr_id;
+ define_cmd.numPages = num_pages;
+
++ *cmd++ = SVGA_CMD_DEFINE_GMR2;
++ memcpy(cmd, &define_cmd, sizeof(define_cmd));
++ cmd += sizeof(define_cmd) / sizeof(*cmd);
++
++ /*
++ * Need to split the command if there are too many
++ * pages that goes into the gmr.
++ */
++
+ remap_cmd.gmrId = gmr_id;
+ remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
+ SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
+- remap_cmd.offsetPages = 0;
+- remap_cmd.numPages = num_pages;
+
+- *cmd++ = SVGA_CMD_DEFINE_GMR2;
+- memcpy(cmd, &define_cmd, sizeof(define_cmd));
+- cmd += sizeof(define_cmd) / sizeof(uint32);
++ while (num_pages > 0) {
++ unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
++
++ remap_cmd.offsetPages = remap_pos;
++ remap_cmd.numPages = nr;
+
+- *cmd++ = SVGA_CMD_REMAP_GMR2;
+- memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
+- cmd += sizeof(remap_cmd) / sizeof(uint32);
++ *cmd++ = SVGA_CMD_REMAP_GMR2;
++ memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
++ cmd += sizeof(remap_cmd) / sizeof(*cmd);
+
+- for (i = 0; i < num_pages; ++i) {
+- if (VMW_PPN_SIZE <= 4)
+- *cmd = page_to_pfn(*pages++);
+- else
+- *((uint64_t *)cmd) = page_to_pfn(*pages++);
++ for (i = 0; i < nr; ++i) {
++ if (VMW_PPN_SIZE <= 4)
++ *cmd = page_to_pfn(*pages++);
++ else
++ *((uint64_t *)cmd) = page_to_pfn(*pages++);
+
+- cmd += VMW_PPN_SIZE / sizeof(*cmd);
++ cmd += VMW_PPN_SIZE / sizeof(*cmd);
++ }
++
++ num_pages -= nr;
++ remap_pos += nr;
+ }
+
+- vmw_fifo_commit(dev_priv, define_size + remap_size);
++ BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
++
++ vmw_fifo_commit(dev_priv, cmd_size);
+
+ return 0;
+ }
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 0428e8a..df064e8 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -296,8 +296,8 @@ config SENSORS_K10TEMP
+ If you say yes here you get support for the temperature
+ sensor(s) inside your CPU. Supported are later revisions of
+ the AMD Family 10h and all revisions of the AMD Family 11h,
+- 12h (Llano), 14h (Brazos) and 15h (Bulldozer/Trinity)
+- microarchitectures.
++ 12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity) and
++ 16h (Kabini) microarchitectures.
+
+ This driver can also be built as a module. If so, the module
+ will be called k10temp.
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index e3b037c..e633856 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -1,5 +1,5 @@
+ /*
+- * k10temp.c - AMD Family 10h/11h/12h/14h/15h processor hardware monitoring
++ * k10temp.c - AMD Family 10h/11h/12h/14h/15h/16h processor hardware monitoring
+ *
+ * Copyright (c) 2009 Clemens Ladisch <clemens@ladisch.de>
+ *
+@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
+index 621c7a3..b83e3ca 100644
+--- a/drivers/misc/hpilo.c
++++ b/drivers/misc/hpilo.c
+@@ -759,7 +759,7 @@ static int ilo_probe(struct pci_dev *pdev,
+
+ /* Ignore subsystem_device = 0x1979 (set by BIOS) */
+ if (pdev->subsystem_device == 0x1979)
+- goto out;
++ return 0;
+
+ if (max_ccb > MAX_CCB)
+ max_ccb = MAX_CCB;
+@@ -899,7 +899,7 @@ static void __exit ilo_exit(void)
+ class_destroy(ilo_class);
+ }
+
+-MODULE_VERSION("1.4");
++MODULE_VERSION("1.4.1");
+ MODULE_ALIAS(ILO_NAME);
+ MODULE_DESCRIPTION(ILO_NAME);
+ MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 700fe55..1bf3f8b 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -176,16 +176,14 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
+ struct mei_me_hw *hw = to_me_hw(dev);
+ u32 hcsr = mei_hcsr_read(hw);
+
+- dev_dbg(&dev->pdev->dev, "before reset HCSR = 0x%08x.\n", hcsr);
+-
+- hcsr |= (H_RST | H_IG);
++ hcsr |= H_RST | H_IG | H_IS;
+
+ if (intr_enable)
+ hcsr |= H_IE;
+ else
+- hcsr |= ~H_IE;
++ hcsr &= ~H_IE;
+
+- mei_hcsr_set(hw, hcsr);
++ mei_me_reg_write(hw, H_CSR, hcsr);
+
+ if (dev->dev_state == MEI_DEV_POWER_DOWN)
+ mei_me_hw_reset_release(dev);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 6bd0e92..417a089 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
+ struct ieee80211_conf *cur_conf = &priv->hw->conf;
+ bool txok;
+ int slot;
++ int hdrlen, padsize;
+
+ slot = strip_drv_header(priv, skb);
+ if (slot < 0) {
+@@ -504,6 +505,15 @@ send_mac80211:
+
+ ath9k_htc_tx_clear_slot(priv, slot);
+
++ /* Remove padding before handing frame back to mac80211 */
++ hdrlen = ieee80211_get_hdrlen_from_skb(skb);
++
++ padsize = hdrlen & 3;
++ if (padsize && skb->len > hdrlen + padsize) {
++ memmove(skb->data + padsize, skb->data, hdrlen);
++ skb_pull(skb, padsize);
++ }
++
+ /* Send status to mac80211 */
+ ieee80211_tx_status(priv->hw, skb);
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index 2ba4945..bd126c2 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -767,7 +767,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ IEEE80211_HW_PS_NULLFUNC_STACK |
+ IEEE80211_HW_SPECTRUM_MGMT |
+ IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+- IEEE80211_HW_SUPPORTS_RC_TABLE;
++ IEEE80211_HW_SUPPORTS_RC_TABLE |
++ IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+
+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 35ced10..e33a659 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_softc *sc)
+ {
+ ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+
+- if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
+- AR_SREV_9550(sc->sc_ah))
++ if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
+ ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+ msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
+
+diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
+index e9010a4..0686375 100644
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1857,7 +1857,8 @@ void *carl9170_alloc(size_t priv_size)
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK |
+ IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
+- IEEE80211_HW_SIGNAL_DBM;
++ IEEE80211_HW_SIGNAL_DBM |
++ IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+
+ if (!modparam_noht) {
+ /*
+diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
+index 900f5f8..a8eff95 100644
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -4446,9 +4446,9 @@ il4965_irq_tasklet(struct il_priv *il)
+ set_bit(S_RFKILL, &il->status);
+ } else {
+ clear_bit(S_RFKILL, &il->status);
+- wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+ il_force_reset(il, true);
+ }
++ wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+
+ handled |= CSR_INT_BIT_RF_KILL;
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 705aa33..7e66a90 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -5912,7 +5912,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK |
+ IEEE80211_HW_AMPDU_AGGREGATION |
+- IEEE80211_HW_REPORTS_TX_ACK_STATUS;
++ IEEE80211_HW_REPORTS_TX_ACK_STATUS |
++ IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+
+ /*
+ * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 69dd49c..ce3f129d 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -221,7 +221,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm8001_tbl.fatal_err_interrupt = 0x01;
+ for (i = 0; i < PM8001_MAX_INB_NUM; i++) {
+ pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt =
+- PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
++ PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
+ pm8001_ha->inbnd_q_tbl[i].upper_base_addr =
+ pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
+ pm8001_ha->inbnd_q_tbl[i].lower_base_addr =
+@@ -247,7 +247,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ }
+ for (i = 0; i < PM8001_MAX_OUTB_NUM; i++) {
+ pm8001_ha->outbnd_q_tbl[i].element_size_cnt =
+- PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
++ PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
+ pm8001_ha->outbnd_q_tbl[i].upper_base_addr =
+ pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
+ pm8001_ha->outbnd_q_tbl[i].lower_base_addr =
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 302514d..e1c4896 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -275,7 +275,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+
+ for (i = 0; i < PM8001_MAX_SPCV_INB_NUM; i++) {
+ pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt =
+- PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
++ PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
+ pm8001_ha->inbnd_q_tbl[i].upper_base_addr =
+ pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
+ pm8001_ha->inbnd_q_tbl[i].lower_base_addr =
+@@ -301,7 +301,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ }
+ for (i = 0; i < PM8001_MAX_SPCV_OUTB_NUM; i++) {
+ pm8001_ha->outbnd_q_tbl[i].element_size_cnt =
+- PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
++ PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
+ pm8001_ha->outbnd_q_tbl[i].upper_base_addr =
+ pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
+ pm8001_ha->outbnd_q_tbl[i].lower_base_addr =
+diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
+index 6455305..a532ca5 100644
+--- a/drivers/staging/imx-drm/imx-drm-core.c
++++ b/drivers/staging/imx-drm/imx-drm-core.c
+@@ -681,6 +681,7 @@ found:
+
+ return i;
+ }
++EXPORT_SYMBOL_GPL(imx_drm_encoder_get_mux_id);
+
+ /*
+ * imx_drm_remove_encoder - remove an encoder
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 012ff8b..4c1b8db 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1086,7 +1086,6 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ if (cmd->reject_reason)
+ return 0;
+
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+ return 1;
+ }
+ /*
+@@ -1124,14 +1123,10 @@ after_immediate_data:
+ */
+ cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
+ (unsigned char *)hdr, hdr->cmdsn);
+- if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
++ if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+ return -1;
+- } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+- target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+- return 0;
+- }
+
+- if (cmd->sense_reason) {
++ if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+ int rc;
+
+ rc = iscsit_dump_data_payload(cmd->conn,
+@@ -1541,6 +1536,10 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+ pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
+ " not set, protocol error.\n");
++ if (!cmd)
++ return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++ (unsigned char *)hdr);
++
+ return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
+ (unsigned char *)hdr);
+ }
+@@ -1550,6 +1549,10 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ " greater than MaxXmitDataSegmentLength: %u, protocol"
+ " error.\n", payload_length,
+ conn->conn_ops->MaxXmitDataSegmentLength);
++ if (!cmd)
++ return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++ (unsigned char *)hdr);
++
+ return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
+ (unsigned char *)hdr);
+ }
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 3402241..bc788c5 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1163,12 +1163,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+ spin_unlock_bh(&np->np_thread_lock);
+ complete(&np->np_restart_comp);
+- if (ret == -ENODEV) {
+- iscsit_put_transport(conn->conn_transport);
+- kfree(conn);
+- conn = NULL;
++ iscsit_put_transport(conn->conn_transport);
++ kfree(conn);
++ conn = NULL;
++ if (ret == -ENODEV)
+ goto out;
+- }
+ /* Get another socket */
+ return 1;
+ }
+diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
+index 4cb667d..9fabbf7 100644
+--- a/drivers/target/target_core_spc.c
++++ b/drivers/target/target_core_spc.c
+@@ -97,9 +97,12 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf)
+
+ buf[7] = 0x2; /* CmdQue=1 */
+
+- snprintf(&buf[8], 8, "LIO-ORG");
+- snprintf(&buf[16], 16, "%s", dev->t10_wwn.model);
+- snprintf(&buf[32], 4, "%s", dev->t10_wwn.revision);
++ memcpy(&buf[8], "LIO-ORG ", 8);
++ memset(&buf[16], 0x20, 16);
++ memcpy(&buf[16], dev->t10_wwn.model,
++ min_t(size_t, strlen(dev->t10_wwn.model), 16));
++ memcpy(&buf[32], dev->t10_wwn.revision,
++ min_t(size_t, strlen(dev->t10_wwn.revision), 4));
+ buf[4] = 31; /* Set additional length to 31 */
+
+ return 0;
+diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
+index 3396eb9..ac27671 100644
+--- a/drivers/tty/hvc/hvsi_lib.c
++++ b/drivers/tty/hvc/hvsi_lib.c
+@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv)
+
+ pr_devel("HVSI@%x: ... waiting handshake\n", pv->termno);
+
+- /* Try for up to 200s */
+- for (timeout = 0; timeout < 20; timeout++) {
++ /* Try for up to 400ms */
++ for (timeout = 0; timeout < 40; timeout++) {
+ if (pv->established)
+ goto established;
+ if (!hvsi_get_packet(pv))
+diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
+index 4b7e33e..ab1065a 100644
+--- a/drivers/usb/gadget/f_acm.c
++++ b/drivers/usb/gadget/f_acm.c
+@@ -285,6 +285,7 @@ static struct usb_string acm_string_defs[] = {
+ [ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
+ [ACM_DATA_IDX].s = "CDC ACM Data",
+ [ACM_IAD_IDX ].s = "CDC Serial",
++ { } /* end of list */
+ };
+
+ static struct usb_gadget_strings acm_string_table = {
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 0ddbece..c450fdb 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -3047,6 +3047,14 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+
+ dir_index = (u32) filp->f_pos;
+
++ /*
++ * NFSv4 reserves cookies 1 and 2 for . and .. so we add
++ * the value we return to the vfs is one greater than the
++ * one we use internally.
++ */
++ if (dir_index)
++ dir_index--;
++
+ if (dir_index > 1) {
+ struct dir_table_slot dirtab_slot;
+
+@@ -3086,7 +3094,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ if (p->header.flag & BT_INTERNAL) {
+ jfs_err("jfs_readdir: bad index table");
+ DT_PUTPAGE(mp);
+- filp->f_pos = -1;
++ filp->f_pos = DIREND;
+ return 0;
+ }
+ } else {
+@@ -3094,7 +3102,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * self "."
+ */
+- filp->f_pos = 0;
++ filp->f_pos = 1;
+ if (filldir(dirent, ".", 1, 0, ip->i_ino,
+ DT_DIR))
+ return 0;
+@@ -3102,7 +3110,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * parent ".."
+ */
+- filp->f_pos = 1;
++ filp->f_pos = 2;
+ if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR))
+ return 0;
+
+@@ -3123,24 +3131,25 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * Legacy filesystem - OS/2 & Linux JFS < 0.3.6
+ *
+- * pn = index = 0: First entry "."
+- * pn = 0; index = 1: Second entry ".."
++ * pn = 0; index = 1: First entry "."
++ * pn = 0; index = 2: Second entry ".."
+ * pn > 0: Real entries, pn=1 -> leftmost page
+ * pn = index = -1: No more entries
+ */
+ dtpos = filp->f_pos;
+- if (dtpos == 0) {
++ if (dtpos < 2) {
+ /* build "." entry */
+
++ filp->f_pos = 1;
+ if (filldir(dirent, ".", 1, filp->f_pos, ip->i_ino,
+ DT_DIR))
+ return 0;
+- dtoffset->index = 1;
++ dtoffset->index = 2;
+ filp->f_pos = dtpos;
+ }
+
+ if (dtoffset->pn == 0) {
+- if (dtoffset->index == 1) {
++ if (dtoffset->index == 2) {
+ /* build ".." entry */
+
+ if (filldir(dirent, "..", 2, filp->f_pos,
+@@ -3233,6 +3242,12 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ }
+ jfs_dirent->position = unique_pos++;
+ }
++ /*
++ * We add 1 to the index because we may
++ * use a value of 2 internally, and NFSv4
++ * doesn't like that.
++ */
++ jfs_dirent->position++;
+ } else {
+ jfs_dirent->position = dtpos;
+ len = min(d_namleft, DTLHDRDATALEN_LEGACY);
+diff --git a/include/linux/regmap.h b/include/linux/regmap.h
+index f91bb41..98c470ce 100644
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -16,6 +16,7 @@
+ #include <linux/list.h>
+ #include <linux/rbtree.h>
+ #include <linux/err.h>
++#include <linux/bug.h>
+
+ struct module;
+ struct device;
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 885898a..4e50d36 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1484,6 +1484,7 @@ enum ieee80211_hw_flags {
+ IEEE80211_HW_SUPPORTS_RC_TABLE = 1<<24,
+ IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF = 1<<25,
+ IEEE80211_HW_TIMING_BEACON_ONLY = 1<<26,
++ IEEE80211_HW_SUPPORTS_HT_CCK_RATES = 1<<27,
+ };
+
+ /**
+diff --git a/ipc/msg.c b/ipc/msg.c
+index d0c6d96..f8fbe2c 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -795,7 +795,7 @@ static inline void free_copy(struct msg_msg *copy)
+
+ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ {
+- struct msg_msg *msg;
++ struct msg_msg *msg, *found = NULL;
+ long count = 0;
+
+ list_for_each_entry(msg, &msq->q_messages, m_list) {
+@@ -804,6 +804,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ *msgtyp, mode)) {
+ if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
+ *msgtyp = msg->m_type - 1;
++ found = msg;
+ } else if (mode == SEARCH_NUMBER) {
+ if (*msgtyp == count)
+ return msg;
+@@ -813,7 +814,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ }
+ }
+
+- return ERR_PTR(-EAGAIN);
++ return found ?: ERR_PTR(-EAGAIN);
+ }
+
+
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index 3bdf283..61ed862 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -265,10 +265,9 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
+ static int timer_list_show(struct seq_file *m, void *v)
+ {
+ struct timer_list_iter *iter = v;
+- u64 now = ktime_to_ns(ktime_get());
+
+ if (iter->cpu == -1 && !iter->second_pass)
+- timer_list_header(m, now);
++ timer_list_header(m, iter->now);
+ else if (!iter->second_pass)
+ print_cpu(m, iter->cpu, iter->now);
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void)
+ return;
+ }
+
+-static void *timer_list_start(struct seq_file *file, loff_t *offset)
++static void *move_iter(struct timer_list_iter *iter, loff_t offset)
+ {
+- struct timer_list_iter *iter = file->private;
+-
+- if (!*offset) {
+- iter->cpu = -1;
+- iter->now = ktime_to_ns(ktime_get());
+- } else if (iter->cpu >= nr_cpu_ids) {
++ for (; offset; offset--) {
++ iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
++ if (iter->cpu >= nr_cpu_ids) {
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+- if (!iter->second_pass) {
+- iter->cpu = -1;
+- iter->second_pass = true;
+- } else
+- return NULL;
++ if (!iter->second_pass) {
++ iter->cpu = -1;
++ iter->second_pass = true;
++ } else
++ return NULL;
+ #else
+- return NULL;
++ return NULL;
+ #endif
++ }
+ }
+ return iter;
+ }
+
++static void *timer_list_start(struct seq_file *file, loff_t *offset)
++{
++ struct timer_list_iter *iter = file->private;
++
++ if (!*offset)
++ iter->now = ktime_to_ns(ktime_get());
++ iter->cpu = -1;
++ iter->second_pass = false;
++ return move_iter(iter, *offset);
++}
++
+ static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
+ {
+ struct timer_list_iter *iter = file->private;
+- iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
+ ++*offset;
+- return timer_list_start(file, offset);
++ return move_iter(iter, 1);
+ }
+
+ static void timer_list_stop(struct seq_file *seq, void *v)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 6f01921..e52d002 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2188,6 +2188,15 @@ __acquires(&pool->lock)
+ dump_stack();
+ }
+
++ /*
++ * The following prevents a kworker from hogging CPU on !PREEMPT
++ * kernels, where a requeueing work item waiting for something to
++ * happen could deadlock with stop_machine as such work item could
++ * indefinitely requeue itself while all other CPUs are trapped in
++ * stop_machine.
++ */
++ cond_resched();
++
+ spin_lock_irq(&pool->lock);
+
+ /* clear cpu intensive status */
+diff --git a/mm/slab.h b/mm/slab.h
+index f96b49e..4d6d836 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -162,6 +162,8 @@ static inline const char *cache_name(struct kmem_cache *s)
+
+ static inline struct kmem_cache *cache_from_memcg(struct kmem_cache *s, int idx)
+ {
++ if (!s->memcg_params)
++ return NULL;
+ return s->memcg_params->memcg_caches[idx];
+ }
+
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 170f9a7..3052672 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1166,6 +1166,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+ BSS_CHANGED_IBSS);
++ ieee80211_vif_release_channel(sdata);
+ synchronize_rcu();
+ kfree(presp);
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index f5aed96..f3bbea1 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -828,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+ if (sband->band != IEEE80211_BAND_2GHZ)
+ return;
+
++ if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
++ return;
++
+ mi->cck_supported = 0;
+ mi->cck_supported_short = 0;
+ for (i = 0; i < 4; i++) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 75edcfa..1504bb1 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -207,10 +207,13 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
+ pgfrom_base -= copy;
+
+ vto = kmap_atomic(*pgto);
+- vfrom = kmap_atomic(*pgfrom);
+- memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
++ if (*pgto != *pgfrom) {
++ vfrom = kmap_atomic(*pgfrom);
++ memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
++ kunmap_atomic(vfrom);
++ } else
++ memmove(vto + pgto_base, vto + pgfrom_base, copy);
+ flush_dcache_page(*pgto);
+- kunmap_atomic(vfrom);
+ kunmap_atomic(vto);
+
+ } while ((len -= copy) != 0);
+diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
+index b41ed86..e427dbf 100644
+--- a/sound/isa/opti9xx/opti92x-ad1848.c
++++ b/sound/isa/opti9xx/opti92x-ad1848.c
+@@ -173,11 +173,7 @@ MODULE_DEVICE_TABLE(pnp_card, snd_opti9xx_pnpids);
+
+ #endif /* CONFIG_PNP */
+
+-#ifdef OPTi93X
+-#define DEV_NAME "opti93x"
+-#else
+-#define DEV_NAME "opti92x"
+-#endif
++#define DEV_NAME KBUILD_MODNAME
+
+ static char * snd_opti9xx_names[] = {
+ "unknown",
+@@ -1168,7 +1164,7 @@ static int snd_opti9xx_pnp_resume(struct pnp_card_link *pcard)
+
+ static struct pnp_card_driver opti9xx_pnpc_driver = {
+ .flags = PNP_DRIVER_RES_DISABLE,
+- .name = "opti9xx",
++ .name = DEV_NAME,
+ .id_table = snd_opti9xx_pnpids,
+ .probe = snd_opti9xx_pnp_probe,
+ .remove = snd_opti9xx_pnp_remove,
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 496d7f2..5bc4194 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1715,6 +1715,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
+ struct snd_pcm_chmap *chmap;
+ struct snd_kcontrol *kctl;
+ int i;
++
++ if (!codec->pcm_info[pin_idx].pcm)
++ break;
+ err = snd_pcm_add_chmap_ctls(codec->pcm_info[pin_idx].pcm,
+ SNDRV_PCM_STREAM_PLAYBACK,
+ NULL, 0, pin_idx, &chmap);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 57f9f2a..458cf89 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4207,6 +4207,7 @@ static const struct hda_fixup alc662_fixups[] = {
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
++ SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),