summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2014-11-08 10:35:52 -0500
committerAnthony G. Basile <blueness@gentoo.org>2014-11-08 10:35:52 -0500
commit13dee1876996ccf19092607a8e95928bd7548a3d (patch)
tree4ec142c0e4d230d3e7a196d542fc07364f18a967
parentGrsec/PaX: 3.0-3.2.63-201411020808 (diff)
downloadhardened-patchset-13dee1876996ccf19092607a8e95928bd7548a3d.tar.gz
hardened-patchset-13dee1876996ccf19092607a8e95928bd7548a3d.tar.bz2
hardened-patchset-13dee1876996ccf19092607a8e95928bd7548a3d.zip
Grsec/PaX: 3.0-{3.2.64,3.14.23,3.17.2}-20141106203420141106
-rw-r--r--3.14.23/0000_README6
-rw-r--r--3.14.23/1022_linux-3.14.23.patch5877
-rw-r--r--3.14.23/4420_grsecurity-3.0-3.14.23-201411062033.patch (renamed from 3.14.23/4420_grsecurity-3.0-3.14.23-201410312212.patch)91
-rw-r--r--3.17.2/0000_README2
-rw-r--r--3.17.2/4420_grsecurity-3.0-3.17.2-201411062034.patch (renamed from 3.17.2/4420_grsecurity-3.0-3.17.2-201410312213.patch)151
-rw-r--r--3.2.64/0000_README (renamed from 3.2.63/0000_README)6
-rw-r--r--3.2.64/1021_linux-3.2.22.patch (renamed from 3.2.63/1021_linux-3.2.22.patch)0
-rw-r--r--3.2.64/1022_linux-3.2.23.patch (renamed from 3.2.63/1022_linux-3.2.23.patch)0
-rw-r--r--3.2.64/1023_linux-3.2.24.patch (renamed from 3.2.63/1023_linux-3.2.24.patch)0
-rw-r--r--3.2.64/1024_linux-3.2.25.patch (renamed from 3.2.63/1024_linux-3.2.25.patch)0
-rw-r--r--3.2.64/1025_linux-3.2.26.patch (renamed from 3.2.63/1025_linux-3.2.26.patch)0
-rw-r--r--3.2.64/1026_linux-3.2.27.patch (renamed from 3.2.63/1026_linux-3.2.27.patch)0
-rw-r--r--3.2.64/1027_linux-3.2.28.patch (renamed from 3.2.63/1027_linux-3.2.28.patch)0
-rw-r--r--3.2.64/1028_linux-3.2.29.patch (renamed from 3.2.63/1028_linux-3.2.29.patch)0
-rw-r--r--3.2.64/1029_linux-3.2.30.patch (renamed from 3.2.63/1029_linux-3.2.30.patch)0
-rw-r--r--3.2.64/1030_linux-3.2.31.patch (renamed from 3.2.63/1030_linux-3.2.31.patch)0
-rw-r--r--3.2.64/1031_linux-3.2.32.patch (renamed from 3.2.63/1031_linux-3.2.32.patch)0
-rw-r--r--3.2.64/1032_linux-3.2.33.patch (renamed from 3.2.63/1032_linux-3.2.33.patch)0
-rw-r--r--3.2.64/1033_linux-3.2.34.patch (renamed from 3.2.63/1033_linux-3.2.34.patch)0
-rw-r--r--3.2.64/1034_linux-3.2.35.patch (renamed from 3.2.63/1034_linux-3.2.35.patch)0
-rw-r--r--3.2.64/1035_linux-3.2.36.patch (renamed from 3.2.63/1035_linux-3.2.36.patch)0
-rw-r--r--3.2.64/1036_linux-3.2.37.patch (renamed from 3.2.63/1036_linux-3.2.37.patch)0
-rw-r--r--3.2.64/1037_linux-3.2.38.patch (renamed from 3.2.63/1037_linux-3.2.38.patch)0
-rw-r--r--3.2.64/1038_linux-3.2.39.patch (renamed from 3.2.63/1038_linux-3.2.39.patch)0
-rw-r--r--3.2.64/1039_linux-3.2.40.patch (renamed from 3.2.63/1039_linux-3.2.40.patch)0
-rw-r--r--3.2.64/1040_linux-3.2.41.patch (renamed from 3.2.63/1040_linux-3.2.41.patch)0
-rw-r--r--3.2.64/1041_linux-3.2.42.patch (renamed from 3.2.63/1041_linux-3.2.42.patch)0
-rw-r--r--3.2.64/1042_linux-3.2.43.patch (renamed from 3.2.63/1042_linux-3.2.43.patch)0
-rw-r--r--3.2.64/1043_linux-3.2.44.patch (renamed from 3.2.63/1043_linux-3.2.44.patch)0
-rw-r--r--3.2.64/1044_linux-3.2.45.patch (renamed from 3.2.63/1044_linux-3.2.45.patch)0
-rw-r--r--3.2.64/1045_linux-3.2.46.patch (renamed from 3.2.63/1045_linux-3.2.46.patch)0
-rw-r--r--3.2.64/1046_linux-3.2.47.patch (renamed from 3.2.63/1046_linux-3.2.47.patch)0
-rw-r--r--3.2.64/1047_linux-3.2.48.patch (renamed from 3.2.63/1047_linux-3.2.48.patch)0
-rw-r--r--3.2.64/1048_linux-3.2.49.patch (renamed from 3.2.63/1048_linux-3.2.49.patch)0
-rw-r--r--3.2.64/1049_linux-3.2.50.patch (renamed from 3.2.63/1049_linux-3.2.50.patch)0
-rw-r--r--3.2.64/1050_linux-3.2.51.patch (renamed from 3.2.63/1050_linux-3.2.51.patch)0
-rw-r--r--3.2.64/1051_linux-3.2.52.patch (renamed from 3.2.63/1051_linux-3.2.52.patch)0
-rw-r--r--3.2.64/1052_linux-3.2.53.patch (renamed from 3.2.63/1052_linux-3.2.53.patch)0
-rw-r--r--3.2.64/1053_linux-3.2.54.patch (renamed from 3.2.63/1053_linux-3.2.54.patch)0
-rw-r--r--3.2.64/1054_linux-3.2.55.patch (renamed from 3.2.63/1054_linux-3.2.55.patch)0
-rw-r--r--3.2.64/1055_linux-3.2.56.patch (renamed from 3.2.63/1055_linux-3.2.56.patch)0
-rw-r--r--3.2.64/1056_linux-3.2.57.patch (renamed from 3.2.63/1056_linux-3.2.57.patch)0
-rw-r--r--3.2.64/1057_linux-3.2.58.patch (renamed from 3.2.63/1057_linux-3.2.58.patch)0
-rw-r--r--3.2.64/1058_linux-3.2.59.patch (renamed from 3.2.63/1058_linux-3.2.59.patch)0
-rw-r--r--3.2.64/1059_linux-3.2.60.patch (renamed from 3.2.63/1059_linux-3.2.60.patch)0
-rw-r--r--3.2.64/1060_linux-3.2.61.patch (renamed from 3.2.63/1060_linux-3.2.61.patch)0
-rw-r--r--3.2.64/1061_linux-3.2.62.patch (renamed from 3.2.63/1061_linux-3.2.62.patch)0
-rw-r--r--3.2.64/1062_linux-3.2.63.patch (renamed from 3.2.63/1062_linux-3.2.63.patch)0
-rw-r--r--3.2.64/1063_linux-3.2.64.patch3821
-rw-r--r--3.2.64/4420_grsecurity-3.0-3.2.64-201411062032.patch (renamed from 3.2.63/4420_grsecurity-3.0-3.2.63-201411020808.patch)926
-rw-r--r--3.2.64/4425_grsec_remove_EI_PAX.patch (renamed from 3.2.63/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--3.2.64/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.2.63/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--3.2.64/4430_grsec-remove-localversion-grsec.patch (renamed from 3.2.63/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--3.2.64/4435_grsec-mute-warnings.patch (renamed from 3.2.63/4435_grsec-mute-warnings.patch)0
-rw-r--r--3.2.64/4440_grsec-remove-protected-paths.patch (renamed from 3.2.63/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--3.2.64/4450_grsec-kconfig-default-gids.patch (renamed from 3.2.63/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--3.2.64/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.2.63/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--3.2.64/4470_disable-compat_vdso.patch (renamed from 3.2.63/4470_disable-compat_vdso.patch)0
-rw-r--r--3.2.64/4475_emutramp_default_on.patch (renamed from 3.2.63/4475_emutramp_default_on.patch)0
59 files changed, 4267 insertions, 6613 deletions
diff --git a/3.14.23/0000_README b/3.14.23/0000_README
index ceedf6a..3f5888e 100644
--- a/3.14.23/0000_README
+++ b/3.14.23/0000_README
@@ -2,11 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1022_linux-3.14.23.patch
-From: http://www.kernel.org
-Desc: Linux 3.14.23
-
-Patch: 4420_grsecurity-3.0-3.14.23-201410312212.patch
+Patch: 4420_grsecurity-3.0-3.14.23-201411062033.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.14.23/1022_linux-3.14.23.patch b/3.14.23/1022_linux-3.14.23.patch
deleted file mode 100644
index d74580b..0000000
--- a/3.14.23/1022_linux-3.14.23.patch
+++ /dev/null
@@ -1,5877 +0,0 @@
-diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt
-new file mode 100644
-index 0000000..ea45dd3
---- /dev/null
-+++ b/Documentation/lzo.txt
-@@ -0,0 +1,164 @@
-+
-+LZO stream format as understood by Linux's LZO decompressor
-+===========================================================
-+
-+Introduction
-+
-+ This is not a specification. No specification seems to be publicly available
-+ for the LZO stream format. This document describes what input format the LZO
-+ decompressor as implemented in the Linux kernel understands. The file subject
-+ of this analysis is lib/lzo/lzo1x_decompress_safe.c. No analysis was made on
-+ the compressor nor on any other implementations though it seems likely that
-+ the format matches the standard one. The purpose of this document is to
-+ better understand what the code does in order to propose more efficient fixes
-+ for future bug reports.
-+
-+Description
-+
-+ The stream is composed of a series of instructions, operands, and data. The
-+ instructions consist in a few bits representing an opcode, and bits forming
-+ the operands for the instruction, whose size and position depend on the
-+ opcode and on the number of literals copied by previous instruction. The
-+ operands are used to indicate :
-+
-+ - a distance when copying data from the dictionary (past output buffer)
-+ - a length (number of bytes to copy from dictionary)
-+ - the number of literals to copy, which is retained in variable "state"
-+ as a piece of information for next instructions.
-+
-+ Optionally depending on the opcode and operands, extra data may follow. These
-+ extra data can be a complement for the operand (eg: a length or a distance
-+ encoded on larger values), or a literal to be copied to the output buffer.
-+
-+ The first byte of the block follows a different encoding from other bytes, it
-+ seems to be optimized for literal use only, since there is no dictionary yet
-+ prior to that byte.
-+
-+ Lengths are always encoded on a variable size starting with a small number
-+ of bits in the operand. If the number of bits isn't enough to represent the
-+ length, up to 255 may be added in increments by consuming more bytes with a
-+ rate of at most 255 per extra byte (thus the compression ratio cannot exceed
-+ around 255:1). The variable length encoding using #bits is always the same :
-+
-+ length = byte & ((1 << #bits) - 1)
-+ if (!length) {
-+ length = ((1 << #bits) - 1)
-+ length += 255*(number of zero bytes)
-+ length += first-non-zero-byte
-+ }
-+ length += constant (generally 2 or 3)
-+
-+ For references to the dictionary, distances are relative to the output
-+ pointer. Distances are encoded using very few bits belonging to certain
-+ ranges, resulting in multiple copy instructions using different encodings.
-+ Certain encodings involve one extra byte, others involve two extra bytes
-+ forming a little-endian 16-bit quantity (marked LE16 below).
-+
-+ After any instruction except the large literal copy, 0, 1, 2 or 3 literals
-+ are copied before starting the next instruction. The number of literals that
-+ were copied may change the meaning and behaviour of the next instruction. In
-+ practice, only one instruction needs to know whether 0, less than 4, or more
-+ literals were copied. This is the information stored in the <state> variable
-+ in this implementation. This number of immediate literals to be copied is
-+ generally encoded in the last two bits of the instruction but may also be
-+ taken from the last two bits of an extra operand (eg: distance).
-+
-+ End of stream is declared when a block copy of distance 0 is seen. Only one
-+ instruction may encode this distance (0001HLLL), it takes one LE16 operand
-+ for the distance, thus requiring 3 bytes.
-+
-+ IMPORTANT NOTE : in the code some length checks are missing because certain
-+ instructions are called under the assumption that a certain number of bytes
-+ follow because it has already been garanteed before parsing the instructions.
-+ They just have to "refill" this credit if they consume extra bytes. This is
-+ an implementation design choice independant on the algorithm or encoding.
-+
-+Byte sequences
-+
-+ First byte encoding :
-+
-+ 0..17 : follow regular instruction encoding, see below. It is worth
-+ noting that codes 16 and 17 will represent a block copy from
-+ the dictionary which is empty, and that they will always be
-+ invalid at this place.
-+
-+ 18..21 : copy 0..3 literals
-+ state = (byte - 17) = 0..3 [ copy <state> literals ]
-+ skip byte
-+
-+ 22..255 : copy literal string
-+ length = (byte - 17) = 4..238
-+ state = 4 [ don't copy extra literals ]
-+ skip byte
-+
-+ Instruction encoding :
-+
-+ 0 0 0 0 X X X X (0..15)
-+ Depends on the number of literals copied by the last instruction.
-+ If last instruction did not copy any literal (state == 0), this
-+ encoding will be a copy of 4 or more literal, and must be interpreted
-+ like this :
-+
-+ 0 0 0 0 L L L L (0..15) : copy long literal string
-+ length = 3 + (L ?: 15 + (zero_bytes * 255) + non_zero_byte)
-+ state = 4 (no extra literals are copied)
-+
-+ If last instruction used to copy between 1 to 3 literals (encoded in
-+ the instruction's opcode or distance), the instruction is a copy of a
-+ 2-byte block from the dictionary within a 1kB distance. It is worth
-+ noting that this instruction provides little savings since it uses 2
-+ bytes to encode a copy of 2 other bytes but it encodes the number of
-+ following literals for free. It must be interpreted like this :
-+
-+ 0 0 0 0 D D S S (0..15) : copy 2 bytes from <= 1kB distance
-+ length = 2
-+ state = S (copy S literals after this block)
-+ Always followed by exactly one byte : H H H H H H H H
-+ distance = (H << 2) + D + 1
-+
-+ If last instruction used to copy 4 or more literals (as detected by
-+ state == 4), the instruction becomes a copy of a 3-byte block from the
-+ dictionary from a 2..3kB distance, and must be interpreted like this :
-+
-+ 0 0 0 0 D D S S (0..15) : copy 3 bytes from 2..3 kB distance
-+ length = 3
-+ state = S (copy S literals after this block)
-+ Always followed by exactly one byte : H H H H H H H H
-+ distance = (H << 2) + D + 2049
-+
-+ 0 0 0 1 H L L L (16..31)
-+ Copy of a block within 16..48kB distance (preferably less than 10B)
-+ length = 2 + (L ?: 7 + (zero_bytes * 255) + non_zero_byte)
-+ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
-+ distance = 16384 + (H << 14) + D
-+ state = S (copy S literals after this block)
-+ End of stream is reached if distance == 16384
-+
-+ 0 0 1 L L L L L (32..63)
-+ Copy of small block within 16kB distance (preferably less than 34B)
-+ length = 2 + (L ?: 31 + (zero_bytes * 255) + non_zero_byte)
-+ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
-+ distance = D + 1
-+ state = S (copy S literals after this block)
-+
-+ 0 1 L D D D S S (64..127)
-+ Copy 3-4 bytes from block within 2kB distance
-+ state = S (copy S literals after this block)
-+ length = 3 + L
-+ Always followed by exactly one byte : H H H H H H H H
-+ distance = (H << 3) + D + 1
-+
-+ 1 L L D D D S S (128..255)
-+ Copy 5-8 bytes from block within 2kB distance
-+ state = S (copy S literals after this block)
-+ length = 5 + L
-+ Always followed by exactly one byte : H H H H H H H H
-+ distance = (H << 3) + D + 1
-+
-+Authors
-+
-+ This document was written by Willy Tarreau <w@1wt.eu> on 2014/07/19 during an
-+ analysis of the decompression code available in Linux 3.16-rc5. The code is
-+ tricky, it is possible that this document contains mistakes or that a few
-+ corner cases were overlooked. In any case, please report any doubt, fix, or
-+ proposed updates to the author(s) so that the document can be updated.
-diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
-index 2908941..53838d9 100644
---- a/Documentation/virtual/kvm/mmu.txt
-+++ b/Documentation/virtual/kvm/mmu.txt
-@@ -425,6 +425,20 @@ fault through the slow path.
- Since only 19 bits are used to store generation-number on mmio spte, all
- pages are zapped when there is an overflow.
-
-+Unfortunately, a single memory access might access kvm_memslots(kvm) multiple
-+times, the last one happening when the generation number is retrieved and
-+stored into the MMIO spte. Thus, the MMIO spte might be created based on
-+out-of-date information, but with an up-to-date generation number.
-+
-+To avoid this, the generation number is incremented again after synchronize_srcu
-+returns; thus, the low bit of kvm_memslots(kvm)->generation is only 1 during a
-+memslot update, while some SRCU readers might be using the old copy. We do not
-+want to use an MMIO sptes created with an odd generation number, and we can do
-+this without losing a bit in the MMIO spte. The low bit of the generation
-+is not stored in MMIO spte, and presumed zero when it is extracted out of the
-+spte. If KVM is unlucky and creates an MMIO spte while the low bit is 1,
-+the next access to the spte will always be a cache miss.
-+
-
- Further reading
- ===============
-diff --git a/Makefile b/Makefile
-index a59980e..135a04a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 22
-+SUBLEVEL = 23
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arm/boot/dts/armada-370-netgear-rn102.dts b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-index 651aeb5..f3188e9 100644
---- a/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-+++ b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-@@ -144,6 +144,10 @@
- marvell,nand-enable-arbiter;
- nand-on-flash-bbt;
-
-+ /* Use Hardware BCH ECC */
-+ nand-ecc-strength = <4>;
-+ nand-ecc-step-size = <512>;
-+
- partition@0 {
- label = "u-boot";
- reg = <0x0000000 0x180000>; /* 1.5MB */
-diff --git a/arch/arm/boot/dts/armada-370-netgear-rn104.dts b/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-index 4e27587..da406c1 100644
---- a/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-+++ b/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-@@ -146,6 +146,10 @@
- marvell,nand-enable-arbiter;
- nand-on-flash-bbt;
-
-+ /* Use Hardware BCH ECC */
-+ nand-ecc-strength = <4>;
-+ nand-ecc-step-size = <512>;
-+
- partition@0 {
- label = "u-boot";
- reg = <0x0000000 0x180000>; /* 1.5MB */
-diff --git a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-index ff049ee..b4aba09 100644
---- a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-+++ b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-@@ -224,6 +224,10 @@
- marvell,nand-enable-arbiter;
- nand-on-flash-bbt;
-
-+ /* Use Hardware BCH ECC */
-+ nand-ecc-strength = <4>;
-+ nand-ecc-step-size = <512>;
-+
- partition@0 {
- label = "u-boot";
- reg = <0x0000000 0x180000>; /* 1.5MB */
-diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
-index fece866..b8f234b 100644
---- a/arch/arm/boot/dts/at91sam9263.dtsi
-+++ b/arch/arm/boot/dts/at91sam9263.dtsi
-@@ -535,6 +535,7 @@
- compatible = "atmel,hsmci";
- reg = <0xfff80000 0x600>;
- interrupts = <10 IRQ_TYPE_LEVEL_HIGH 0>;
-+ pinctrl-names = "default";
- #address-cells = <1>;
- #size-cells = <0>;
- status = "disabled";
-@@ -544,6 +545,7 @@
- compatible = "atmel,hsmci";
- reg = <0xfff84000 0x600>;
- interrupts = <11 IRQ_TYPE_LEVEL_HIGH 0>;
-+ pinctrl-names = "default";
- #address-cells = <1>;
- #size-cells = <0>;
- status = "disabled";
-diff --git a/arch/arm/boot/dts/sama5d3_can.dtsi b/arch/arm/boot/dts/sama5d3_can.dtsi
-index a077585..eaf4145 100644
---- a/arch/arm/boot/dts/sama5d3_can.dtsi
-+++ b/arch/arm/boot/dts/sama5d3_can.dtsi
-@@ -40,7 +40,7 @@
- atmel,clk-output-range = <0 66000000>;
- };
-
-- can1_clk: can0_clk {
-+ can1_clk: can1_clk {
- #clock-cells = <0>;
- reg = <41>;
- atmel,clk-output-range = <0 66000000>;
-diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
-index 034529d..d66f102 100644
---- a/arch/arm/mach-at91/clock.c
-+++ b/arch/arm/mach-at91/clock.c
-@@ -962,6 +962,7 @@ static int __init at91_clock_reset(void)
- }
-
- at91_pmc_write(AT91_PMC_SCDR, scdr);
-+ at91_pmc_write(AT91_PMC_PCDR, pcdr);
- if (cpu_is_sama5d3())
- at91_pmc_write(AT91_PMC_PCDR1, pcdr1);
-
-diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
-index fda2704..e72289a 100644
---- a/arch/arm64/include/asm/compat.h
-+++ b/arch/arm64/include/asm/compat.h
-@@ -37,8 +37,8 @@ typedef s32 compat_ssize_t;
- typedef s32 compat_time_t;
- typedef s32 compat_clock_t;
- typedef s32 compat_pid_t;
--typedef u32 __compat_uid_t;
--typedef u32 __compat_gid_t;
-+typedef u16 __compat_uid_t;
-+typedef u16 __compat_gid_t;
- typedef u16 __compat_uid16_t;
- typedef u16 __compat_gid16_t;
- typedef u32 __compat_uid32_t;
-diff --git a/arch/m68k/mm/hwtest.c b/arch/m68k/mm/hwtest.c
-index 2c7dde3..2a5259f 100644
---- a/arch/m68k/mm/hwtest.c
-+++ b/arch/m68k/mm/hwtest.c
-@@ -28,9 +28,11 @@
- int hwreg_present( volatile void *regp )
- {
- int ret = 0;
-+ unsigned long flags;
- long save_sp, save_vbr;
- long tmp_vectors[3];
-
-+ local_irq_save(flags);
- __asm__ __volatile__
- ( "movec %/vbr,%2\n\t"
- "movel #Lberr1,%4@(8)\n\t"
-@@ -46,6 +48,7 @@ int hwreg_present( volatile void *regp )
- : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
- : "a" (regp), "a" (tmp_vectors)
- );
-+ local_irq_restore(flags);
-
- return( ret );
- }
-@@ -58,9 +61,11 @@ EXPORT_SYMBOL(hwreg_present);
- int hwreg_write( volatile void *regp, unsigned short val )
- {
- int ret;
-+ unsigned long flags;
- long save_sp, save_vbr;
- long tmp_vectors[3];
-
-+ local_irq_save(flags);
- __asm__ __volatile__
- ( "movec %/vbr,%2\n\t"
- "movel #Lberr2,%4@(8)\n\t"
-@@ -78,6 +83,7 @@ int hwreg_write( volatile void *regp, unsigned short val )
- : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
- : "a" (regp), "a" (tmp_vectors), "g" (val)
- );
-+ local_irq_restore(flags);
-
- return( ret );
- }
-diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
-index 4642d6a..de1ec54 100644
---- a/arch/powerpc/platforms/pseries/iommu.c
-+++ b/arch/powerpc/platforms/pseries/iommu.c
-@@ -329,16 +329,16 @@ struct direct_window {
-
- /* Dynamic DMA Window support */
- struct ddw_query_response {
-- __be32 windows_available;
-- __be32 largest_available_block;
-- __be32 page_size;
-- __be32 migration_capable;
-+ u32 windows_available;
-+ u32 largest_available_block;
-+ u32 page_size;
-+ u32 migration_capable;
- };
-
- struct ddw_create_response {
-- __be32 liobn;
-- __be32 addr_hi;
-- __be32 addr_lo;
-+ u32 liobn;
-+ u32 addr_hi;
-+ u32 addr_lo;
- };
-
- static LIST_HEAD(direct_window_list);
-@@ -725,16 +725,18 @@ static void remove_ddw(struct device_node *np, bool remove_prop)
- {
- struct dynamic_dma_window_prop *dwp;
- struct property *win64;
-- const u32 *ddw_avail;
-+ u32 ddw_avail[3];
- u64 liobn;
-- int len, ret = 0;
-+ int ret = 0;
-+
-+ ret = of_property_read_u32_array(np, "ibm,ddw-applicable",
-+ &ddw_avail[0], 3);
-
-- ddw_avail = of_get_property(np, "ibm,ddw-applicable", &len);
- win64 = of_find_property(np, DIRECT64_PROPNAME, NULL);
- if (!win64)
- return;
-
-- if (!ddw_avail || len < 3 * sizeof(u32) || win64->length < sizeof(*dwp))
-+ if (ret || win64->length < sizeof(*dwp))
- goto delprop;
-
- dwp = win64->value;
-@@ -872,8 +874,9 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail,
-
- do {
- /* extra outputs are LIOBN and dma-addr (hi, lo) */
-- ret = rtas_call(ddw_avail[1], 5, 4, (u32 *)create, cfg_addr,
-- BUID_HI(buid), BUID_LO(buid), page_shift, window_shift);
-+ ret = rtas_call(ddw_avail[1], 5, 4, (u32 *)create,
-+ cfg_addr, BUID_HI(buid), BUID_LO(buid),
-+ page_shift, window_shift);
- } while (rtas_busy_delay(ret));
- dev_info(&dev->dev,
- "ibm,create-pe-dma-window(%x) %x %x %x %x %x returned %d "
-@@ -910,7 +913,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- int page_shift;
- u64 dma_addr, max_addr;
- struct device_node *dn;
-- const u32 *uninitialized_var(ddw_avail);
-+ u32 ddw_avail[3];
- struct direct_window *window;
- struct property *win64;
- struct dynamic_dma_window_prop *ddwprop;
-@@ -942,8 +945,9 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- * for the given node in that order.
- * the property is actually in the parent, not the PE
- */
-- ddw_avail = of_get_property(pdn, "ibm,ddw-applicable", &len);
-- if (!ddw_avail || len < 3 * sizeof(u32))
-+ ret = of_property_read_u32_array(pdn, "ibm,ddw-applicable",
-+ &ddw_avail[0], 3);
-+ if (ret)
- goto out_failed;
-
- /*
-@@ -966,11 +970,11 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- dev_dbg(&dev->dev, "no free dynamic windows");
- goto out_failed;
- }
-- if (be32_to_cpu(query.page_size) & 4) {
-+ if (query.page_size & 4) {
- page_shift = 24; /* 16MB */
-- } else if (be32_to_cpu(query.page_size) & 2) {
-+ } else if (query.page_size & 2) {
- page_shift = 16; /* 64kB */
-- } else if (be32_to_cpu(query.page_size) & 1) {
-+ } else if (query.page_size & 1) {
- page_shift = 12; /* 4kB */
- } else {
- dev_dbg(&dev->dev, "no supported direct page size in mask %x",
-@@ -980,7 +984,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- /* verify the window * number of ptes will map the partition */
- /* check largest block * page size > max memory hotplug addr */
- max_addr = memory_hotplug_max();
-- if (be32_to_cpu(query.largest_available_block) < (max_addr >> page_shift)) {
-+ if (query.largest_available_block < (max_addr >> page_shift)) {
- dev_dbg(&dev->dev, "can't map partiton max 0x%llx with %u "
- "%llu-sized pages\n", max_addr, query.largest_available_block,
- 1ULL << page_shift);
-@@ -1006,8 +1010,9 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- if (ret != 0)
- goto out_free_prop;
-
-- ddwprop->liobn = create.liobn;
-- ddwprop->dma_base = cpu_to_be64(of_read_number(&create.addr_hi, 2));
-+ ddwprop->liobn = cpu_to_be32(create.liobn);
-+ ddwprop->dma_base = cpu_to_be64(((u64)create.addr_hi << 32) |
-+ create.addr_lo);
- ddwprop->tce_shift = cpu_to_be32(page_shift);
- ddwprop->window_shift = cpu_to_be32(len);
-
-@@ -1039,7 +1044,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- list_add(&window->list, &direct_window_list);
- spin_unlock(&direct_window_list_lock);
-
-- dma_addr = of_read_number(&create.addr_hi, 2);
-+ dma_addr = be64_to_cpu(ddwprop->dma_base);
- goto out_unlock;
-
- out_free_window:
-diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
-index 5f79d2d..f1ba119 100644
---- a/arch/s390/kvm/interrupt.c
-+++ b/arch/s390/kvm/interrupt.c
-@@ -71,6 +71,7 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu,
- return 0;
- if (vcpu->arch.sie_block->gcr[0] & 0x2000ul)
- return 1;
-+ return 0;
- case KVM_S390_INT_EMERGENCY:
- if (psw_extint_disabled(vcpu))
- return 0;
-diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index b398c68..a38513c 100644
---- a/arch/sparc/Kconfig
-+++ b/arch/sparc/Kconfig
-@@ -67,6 +67,7 @@ config SPARC64
- select HAVE_SYSCALL_TRACEPOINTS
- select HAVE_CONTEXT_TRACKING
- select HAVE_DEBUG_KMEMLEAK
-+ select SPARSE_IRQ
- select RTC_DRV_CMOS
- select RTC_DRV_BQ4802
- select RTC_DRV_SUN4V
-diff --git a/arch/sparc/include/asm/hypervisor.h b/arch/sparc/include/asm/hypervisor.h
-index ca121f0..17be9d6 100644
---- a/arch/sparc/include/asm/hypervisor.h
-+++ b/arch/sparc/include/asm/hypervisor.h
-@@ -2944,6 +2944,16 @@ extern unsigned long sun4v_vt_set_perfreg(unsigned long reg_num,
- unsigned long reg_val);
- #endif
-
-+#define HV_FAST_T5_GET_PERFREG 0x1a8
-+#define HV_FAST_T5_SET_PERFREG 0x1a9
-+
-+#ifndef __ASSEMBLY__
-+unsigned long sun4v_t5_get_perfreg(unsigned long reg_num,
-+ unsigned long *reg_val);
-+unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
-+ unsigned long reg_val);
-+#endif
-+
- /* Function numbers for HV_CORE_TRAP. */
- #define HV_CORE_SET_VER 0x00
- #define HV_CORE_PUTCHAR 0x01
-@@ -2975,6 +2985,7 @@ extern unsigned long sun4v_vt_set_perfreg(unsigned long reg_num,
- #define HV_GRP_VF_CPU 0x0205
- #define HV_GRP_KT_CPU 0x0209
- #define HV_GRP_VT_CPU 0x020c
-+#define HV_GRP_T5_CPU 0x0211
- #define HV_GRP_DIAG 0x0300
-
- #ifndef __ASSEMBLY__
-diff --git a/arch/sparc/include/asm/irq_64.h b/arch/sparc/include/asm/irq_64.h
-index abf6afe..3deb07f 100644
---- a/arch/sparc/include/asm/irq_64.h
-+++ b/arch/sparc/include/asm/irq_64.h
-@@ -37,7 +37,7 @@
- *
- * ino_bucket->irq allocation is made during {sun4v_,}build_irq().
- */
--#define NR_IRQS 255
-+#define NR_IRQS (2048)
-
- extern void irq_install_pre_handler(int irq,
- void (*func)(unsigned int, void *, void *),
-@@ -57,11 +57,8 @@ extern unsigned int sun4u_build_msi(u32 portid, unsigned int *irq_p,
- unsigned long iclr_base);
- extern void sun4u_destroy_msi(unsigned int irq);
-
--extern unsigned char irq_alloc(unsigned int dev_handle,
-- unsigned int dev_ino);
--#ifdef CONFIG_PCI_MSI
--extern void irq_free(unsigned int irq);
--#endif
-+unsigned int irq_alloc(unsigned int dev_handle, unsigned int dev_ino);
-+void irq_free(unsigned int irq);
-
- extern void __init init_IRQ(void);
- extern void fixup_irqs(void);
-diff --git a/arch/sparc/include/asm/ldc.h b/arch/sparc/include/asm/ldc.h
-index bdb524a..8732ed3 100644
---- a/arch/sparc/include/asm/ldc.h
-+++ b/arch/sparc/include/asm/ldc.h
-@@ -53,13 +53,14 @@ struct ldc_channel;
- /* Allocate state for a channel. */
- extern struct ldc_channel *ldc_alloc(unsigned long id,
- const struct ldc_channel_config *cfgp,
-- void *event_arg);
-+ void *event_arg,
-+ const char *name);
-
- /* Shut down and free state for a channel. */
- extern void ldc_free(struct ldc_channel *lp);
-
- /* Register TX and RX queues of the link with the hypervisor. */
--extern int ldc_bind(struct ldc_channel *lp, const char *name);
-+extern int ldc_bind(struct ldc_channel *lp);
-
- /* For non-RAW protocols we need to complete a handshake before
- * communication can proceed. ldc_connect() does that, if the
-diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h
-index a12dbe3..e48fdf4 100644
---- a/arch/sparc/include/asm/oplib_64.h
-+++ b/arch/sparc/include/asm/oplib_64.h
-@@ -62,7 +62,8 @@ struct linux_mem_p1275 {
- /* You must call prom_init() before using any of the library services,
- * preferably as early as possible. Pass it the romvec pointer.
- */
--extern void prom_init(void *cif_handler, void *cif_stack);
-+extern void prom_init(void *cif_handler);
-+extern void prom_init_report(void);
-
- /* Boot argument acquisition, returns the boot command line string. */
- extern char *prom_getbootargs(void);
-diff --git a/arch/sparc/include/asm/page_64.h b/arch/sparc/include/asm/page_64.h
-index aac53fc..b18e602 100644
---- a/arch/sparc/include/asm/page_64.h
-+++ b/arch/sparc/include/asm/page_64.h
-@@ -57,18 +57,21 @@ extern void copy_user_page(void *to, void *from, unsigned long vaddr, struct pag
- typedef struct { unsigned long pte; } pte_t;
- typedef struct { unsigned long iopte; } iopte_t;
- typedef struct { unsigned long pmd; } pmd_t;
-+typedef struct { unsigned long pud; } pud_t;
- typedef struct { unsigned long pgd; } pgd_t;
- typedef struct { unsigned long pgprot; } pgprot_t;
-
- #define pte_val(x) ((x).pte)
- #define iopte_val(x) ((x).iopte)
- #define pmd_val(x) ((x).pmd)
-+#define pud_val(x) ((x).pud)
- #define pgd_val(x) ((x).pgd)
- #define pgprot_val(x) ((x).pgprot)
-
- #define __pte(x) ((pte_t) { (x) } )
- #define __iopte(x) ((iopte_t) { (x) } )
- #define __pmd(x) ((pmd_t) { (x) } )
-+#define __pud(x) ((pud_t) { (x) } )
- #define __pgd(x) ((pgd_t) { (x) } )
- #define __pgprot(x) ((pgprot_t) { (x) } )
-
-@@ -77,18 +80,21 @@ typedef struct { unsigned long pgprot; } pgprot_t;
- typedef unsigned long pte_t;
- typedef unsigned long iopte_t;
- typedef unsigned long pmd_t;
-+typedef unsigned long pud_t;
- typedef unsigned long pgd_t;
- typedef unsigned long pgprot_t;
-
- #define pte_val(x) (x)
- #define iopte_val(x) (x)
- #define pmd_val(x) (x)
-+#define pud_val(x) (x)
- #define pgd_val(x) (x)
- #define pgprot_val(x) (x)
-
- #define __pte(x) (x)
- #define __iopte(x) (x)
- #define __pmd(x) (x)
-+#define __pud(x) (x)
- #define __pgd(x) (x)
- #define __pgprot(x) (x)
-
-@@ -96,21 +102,14 @@ typedef unsigned long pgprot_t;
-
- typedef pte_t *pgtable_t;
-
--/* These two values define the virtual address space range in which we
-- * must forbid 64-bit user processes from making mappings. It used to
-- * represent precisely the virtual address space hole present in most
-- * early sparc64 chips including UltraSPARC-I. But now it also is
-- * further constrained by the limits of our page tables, which is
-- * 43-bits of virtual address.
-- */
--#define SPARC64_VA_HOLE_TOP _AC(0xfffffc0000000000,UL)
--#define SPARC64_VA_HOLE_BOTTOM _AC(0x0000040000000000,UL)
-+extern unsigned long sparc64_va_hole_top;
-+extern unsigned long sparc64_va_hole_bottom;
-
- /* The next two defines specify the actual exclusion region we
- * enforce, wherein we use a 4GB red zone on each side of the VA hole.
- */
--#define VA_EXCLUDE_START (SPARC64_VA_HOLE_BOTTOM - (1UL << 32UL))
--#define VA_EXCLUDE_END (SPARC64_VA_HOLE_TOP + (1UL << 32UL))
-+#define VA_EXCLUDE_START (sparc64_va_hole_bottom - (1UL << 32UL))
-+#define VA_EXCLUDE_END (sparc64_va_hole_top + (1UL << 32UL))
-
- #define TASK_UNMAPPED_BASE (test_thread_flag(TIF_32BIT) ? \
- _AC(0x0000000070000000,UL) : \
-@@ -118,20 +117,16 @@ typedef pte_t *pgtable_t;
-
- #include <asm-generic/memory_model.h>
-
--#define PAGE_OFFSET_BY_BITS(X) (-(_AC(1,UL) << (X)))
- extern unsigned long PAGE_OFFSET;
-
- #endif /* !(__ASSEMBLY__) */
-
--/* The maximum number of physical memory address bits we support, this
-- * is used to size various tables used to manage kernel TLB misses and
-- * also the sparsemem code.
-+/* The maximum number of physical memory address bits we support. The
-+ * largest value we can support is whatever "KPGD_SHIFT + KPTE_BITS"
-+ * evaluates to.
- */
--#define MAX_PHYS_ADDRESS_BITS 47
-+#define MAX_PHYS_ADDRESS_BITS 53
-
--/* These two shift counts are used when indexing sparc64_valid_addr_bitmap
-- * and kpte_linear_bitmap.
-- */
- #define ILOG2_4MB 22
- #define ILOG2_256MB 28
-
-diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
-index bcfe063..2c8d41f 100644
---- a/arch/sparc/include/asm/pgalloc_64.h
-+++ b/arch/sparc/include/asm/pgalloc_64.h
-@@ -15,6 +15,13 @@
-
- extern struct kmem_cache *pgtable_cache;
-
-+static inline void __pgd_populate(pgd_t *pgd, pud_t *pud)
-+{
-+ pgd_set(pgd, pud);
-+}
-+
-+#define pgd_populate(MM, PGD, PUD) __pgd_populate(PGD, PUD)
-+
- static inline pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- return kmem_cache_alloc(pgtable_cache, GFP_KERNEL);
-@@ -25,7 +32,23 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- kmem_cache_free(pgtable_cache, pgd);
- }
-
--#define pud_populate(MM, PUD, PMD) pud_set(PUD, PMD)
-+static inline void __pud_populate(pud_t *pud, pmd_t *pmd)
-+{
-+ pud_set(pud, pmd);
-+}
-+
-+#define pud_populate(MM, PUD, PMD) __pud_populate(PUD, PMD)
-+
-+static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
-+{
-+ return kmem_cache_alloc(pgtable_cache,
-+ GFP_KERNEL|__GFP_REPEAT);
-+}
-+
-+static inline void pud_free(struct mm_struct *mm, pud_t *pud)
-+{
-+ kmem_cache_free(pgtable_cache, pud);
-+}
-
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-@@ -91,4 +114,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pte_t *pte,
- #define __pmd_free_tlb(tlb, pmd, addr) \
- pgtable_free_tlb(tlb, pmd, false)
-
-+#define __pud_free_tlb(tlb, pud, addr) \
-+ pgtable_free_tlb(tlb, pud, false)
-+
- #endif /* _SPARC64_PGALLOC_H */
-diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
-index 1a49ffd..e8dfabf 100644
---- a/arch/sparc/include/asm/pgtable_64.h
-+++ b/arch/sparc/include/asm/pgtable_64.h
-@@ -20,8 +20,6 @@
- #include <asm/page.h>
- #include <asm/processor.h>
-
--#include <asm-generic/pgtable-nopud.h>
--
- /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB).
- * The page copy blockops can use 0x6000000 to 0x8000000.
- * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range.
-@@ -42,10 +40,7 @@
- #define LOW_OBP_ADDRESS _AC(0x00000000f0000000,UL)
- #define HI_OBP_ADDRESS _AC(0x0000000100000000,UL)
- #define VMALLOC_START _AC(0x0000000100000000,UL)
--#define VMALLOC_END _AC(0x0000010000000000,UL)
--#define VMEMMAP_BASE _AC(0x0000010000000000,UL)
--
--#define vmemmap ((struct page *)VMEMMAP_BASE)
-+#define VMEMMAP_BASE VMALLOC_END
-
- /* PMD_SHIFT determines the size of the area a second-level page
- * table can map
-@@ -55,13 +50,25 @@
- #define PMD_MASK (~(PMD_SIZE-1))
- #define PMD_BITS (PAGE_SHIFT - 3)
-
--/* PGDIR_SHIFT determines what a third-level page table entry can map */
--#define PGDIR_SHIFT (PAGE_SHIFT + (PAGE_SHIFT-3) + PMD_BITS)
-+/* PUD_SHIFT determines the size of the area a third-level page
-+ * table can map
-+ */
-+#define PUD_SHIFT (PMD_SHIFT + PMD_BITS)
-+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
-+#define PUD_MASK (~(PUD_SIZE-1))
-+#define PUD_BITS (PAGE_SHIFT - 3)
-+
-+/* PGDIR_SHIFT determines what a fourth-level page table entry can map */
-+#define PGDIR_SHIFT (PUD_SHIFT + PUD_BITS)
- #define PGDIR_SIZE (_AC(1,UL) << PGDIR_SHIFT)
- #define PGDIR_MASK (~(PGDIR_SIZE-1))
- #define PGDIR_BITS (PAGE_SHIFT - 3)
-
--#if (PGDIR_SHIFT + PGDIR_BITS) != 43
-+#if (MAX_PHYS_ADDRESS_BITS > PGDIR_SHIFT + PGDIR_BITS)
-+#error MAX_PHYS_ADDRESS_BITS exceeds what kernel page tables can support
-+#endif
-+
-+#if (PGDIR_SHIFT + PGDIR_BITS) != 53
- #error Page table parameters do not cover virtual address space properly.
- #endif
-
-@@ -71,28 +78,18 @@
-
- #ifndef __ASSEMBLY__
-
--#include <linux/sched.h>
--
--extern unsigned long sparc64_valid_addr_bitmap[];
-+extern unsigned long VMALLOC_END;
-
--/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
--static inline bool __kern_addr_valid(unsigned long paddr)
--{
-- if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL)
-- return false;
-- return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap);
--}
-+#define vmemmap ((struct page *)VMEMMAP_BASE)
-
--static inline bool kern_addr_valid(unsigned long addr)
--{
-- unsigned long paddr = __pa(addr);
-+#include <linux/sched.h>
-
-- return __kern_addr_valid(paddr);
--}
-+bool kern_addr_valid(unsigned long addr);
-
- /* Entries per page directory level. */
- #define PTRS_PER_PTE (1UL << (PAGE_SHIFT-3))
- #define PTRS_PER_PMD (1UL << PMD_BITS)
-+#define PTRS_PER_PUD (1UL << PUD_BITS)
- #define PTRS_PER_PGD (1UL << PGDIR_BITS)
-
- /* Kernel has a separate 44bit address space. */
-@@ -101,6 +98,9 @@ static inline bool kern_addr_valid(unsigned long addr)
- #define pmd_ERROR(e) \
- pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n", \
- __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0))
-+#define pud_ERROR(e) \
-+ pr_err("%s:%d: bad pud %p(%016lx) seen at (%pS)\n", \
-+ __FILE__, __LINE__, &(e), pud_val(e), __builtin_return_address(0))
- #define pgd_ERROR(e) \
- pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n", \
- __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0))
-@@ -112,6 +112,7 @@ static inline bool kern_addr_valid(unsigned long addr)
- #define _PAGE_R _AC(0x8000000000000000,UL) /* Keep ref bit uptodate*/
- #define _PAGE_SPECIAL _AC(0x0200000000000000,UL) /* Special page */
- #define _PAGE_PMD_HUGE _AC(0x0100000000000000,UL) /* Huge page */
-+#define _PAGE_PUD_HUGE _PAGE_PMD_HUGE
-
- /* Advertise support for _PAGE_SPECIAL */
- #define __HAVE_ARCH_PTE_SPECIAL
-@@ -658,26 +659,26 @@ static inline unsigned long pmd_large(pmd_t pmd)
- return pte_val(pte) & _PAGE_PMD_HUGE;
- }
-
--#ifdef CONFIG_TRANSPARENT_HUGEPAGE
--static inline unsigned long pmd_young(pmd_t pmd)
-+static inline unsigned long pmd_pfn(pmd_t pmd)
- {
- pte_t pte = __pte(pmd_val(pmd));
-
-- return pte_young(pte);
-+ return pte_pfn(pte);
- }
-
--static inline unsigned long pmd_write(pmd_t pmd)
-+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-+static inline unsigned long pmd_young(pmd_t pmd)
- {
- pte_t pte = __pte(pmd_val(pmd));
-
-- return pte_write(pte);
-+ return pte_young(pte);
- }
-
--static inline unsigned long pmd_pfn(pmd_t pmd)
-+static inline unsigned long pmd_write(pmd_t pmd)
- {
- pte_t pte = __pte(pmd_val(pmd));
-
-- return pte_pfn(pte);
-+ return pte_write(pte);
- }
-
- static inline unsigned long pmd_trans_huge(pmd_t pmd)
-@@ -771,13 +772,15 @@ static inline int pmd_present(pmd_t pmd)
- * the top bits outside of the range of any physical address size we
- * support are clear as well. We also validate the physical itself.
- */
--#define pmd_bad(pmd) ((pmd_val(pmd) & ~PAGE_MASK) || \
-- !__kern_addr_valid(pmd_val(pmd)))
-+#define pmd_bad(pmd) (pmd_val(pmd) & ~PAGE_MASK)
-
- #define pud_none(pud) (!pud_val(pud))
-
--#define pud_bad(pud) ((pud_val(pud) & ~PAGE_MASK) || \
-- !__kern_addr_valid(pud_val(pud)))
-+#define pud_bad(pud) (pud_val(pud) & ~PAGE_MASK)
-+
-+#define pgd_none(pgd) (!pgd_val(pgd))
-+
-+#define pgd_bad(pgd) (pgd_val(pgd) & ~PAGE_MASK)
-
- #ifdef CONFIG_TRANSPARENT_HUGEPAGE
- extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
-@@ -815,10 +818,31 @@ static inline unsigned long __pmd_page(pmd_t pmd)
- #define pmd_clear(pmdp) (pmd_val(*(pmdp)) = 0UL)
- #define pud_present(pud) (pud_val(pud) != 0U)
- #define pud_clear(pudp) (pud_val(*(pudp)) = 0UL)
-+#define pgd_page_vaddr(pgd) \
-+ ((unsigned long) __va(pgd_val(pgd)))
-+#define pgd_present(pgd) (pgd_val(pgd) != 0U)
-+#define pgd_clear(pgdp) (pgd_val(*(pgd)) = 0UL)
-+
-+static inline unsigned long pud_large(pud_t pud)
-+{
-+ pte_t pte = __pte(pud_val(pud));
-+
-+ return pte_val(pte) & _PAGE_PMD_HUGE;
-+}
-+
-+static inline unsigned long pud_pfn(pud_t pud)
-+{
-+ pte_t pte = __pte(pud_val(pud));
-+
-+ return pte_pfn(pte);
-+}
-
- /* Same in both SUN4V and SUN4U. */
- #define pte_none(pte) (!pte_val(pte))
-
-+#define pgd_set(pgdp, pudp) \
-+ (pgd_val(*(pgdp)) = (__pa((unsigned long) (pudp))))
-+
- /* to find an entry in a page-table-directory. */
- #define pgd_index(address) (((address) >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1))
- #define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-@@ -826,6 +850,11 @@ static inline unsigned long __pmd_page(pmd_t pmd)
- /* to find an entry in a kernel page-table-directory */
- #define pgd_offset_k(address) pgd_offset(&init_mm, address)
-
-+/* Find an entry in the third-level page table.. */
-+#define pud_index(address) (((address) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
-+#define pud_offset(pgdp, address) \
-+ ((pud_t *) pgd_page_vaddr(*(pgdp)) + pud_index(address))
-+
- /* Find an entry in the second-level page table.. */
- #define pmd_offset(pudp, address) \
- ((pmd_t *) pud_page_vaddr(*(pudp)) + \
-@@ -898,7 +927,6 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
- #endif
-
- extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
--extern pmd_t swapper_low_pmd_dir[PTRS_PER_PMD];
-
- extern void paging_init(void);
- extern unsigned long find_ecache_flush_span(unsigned long size);
-diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
-index 5e35e05..acd6146 100644
---- a/arch/sparc/include/asm/setup.h
-+++ b/arch/sparc/include/asm/setup.h
-@@ -24,6 +24,10 @@ static inline int con_is_present(void)
- }
- #endif
-
-+#ifdef CONFIG_SPARC64
-+extern void __init start_early_boot(void);
-+#endif
-+
- extern void sun_do_break(void);
- extern int stop_a_enabled;
- extern int scons_pwroff;
-diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
-index 6b67e50..69424d4 100644
---- a/arch/sparc/include/asm/spitfire.h
-+++ b/arch/sparc/include/asm/spitfire.h
-@@ -45,6 +45,8 @@
- #define SUN4V_CHIP_NIAGARA3 0x03
- #define SUN4V_CHIP_NIAGARA4 0x04
- #define SUN4V_CHIP_NIAGARA5 0x05
-+#define SUN4V_CHIP_SPARC_M6 0x06
-+#define SUN4V_CHIP_SPARC_M7 0x07
- #define SUN4V_CHIP_SPARC64X 0x8a
- #define SUN4V_CHIP_UNKNOWN 0xff
-
-diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index a5f01ac..cc6275c 100644
---- a/arch/sparc/include/asm/thread_info_64.h
-+++ b/arch/sparc/include/asm/thread_info_64.h
-@@ -63,7 +63,8 @@ struct thread_info {
- struct pt_regs *kern_una_regs;
- unsigned int kern_una_insn;
-
-- unsigned long fpregs[0] __attribute__ ((aligned(64)));
-+ unsigned long fpregs[(7 * 256) / sizeof(unsigned long)]
-+ __attribute__ ((aligned(64)));
- };
-
- #endif /* !(__ASSEMBLY__) */
-@@ -102,6 +103,7 @@ struct thread_info {
- #define FAULT_CODE_ITLB 0x04 /* Miss happened in I-TLB */
- #define FAULT_CODE_WINFIXUP 0x08 /* Miss happened during spill/fill */
- #define FAULT_CODE_BLKCOMMIT 0x10 /* Use blk-commit ASI in copy_page */
-+#define FAULT_CODE_BAD_RA 0x20 /* Bad RA for sun4v */
-
- #if PAGE_SHIFT == 13
- #define THREAD_SIZE (2*PAGE_SIZE)
-diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
-index 90916f9..ecb49cf 100644
---- a/arch/sparc/include/asm/tsb.h
-+++ b/arch/sparc/include/asm/tsb.h
-@@ -133,9 +133,24 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- sub TSB, 0x8, TSB; \
- TSB_STORE(TSB, TAG);
-
-- /* Do a kernel page table walk. Leaves physical PTE pointer in
-- * REG1. Jumps to FAIL_LABEL on early page table walk termination.
-- * VADDR will not be clobbered, but REG2 will.
-+ /* Do a kernel page table walk. Leaves valid PTE value in
-+ * REG1. Jumps to FAIL_LABEL on early page table walk
-+ * termination. VADDR will not be clobbered, but REG2 will.
-+ *
-+ * There are two masks we must apply to propagate bits from
-+ * the virtual address into the PTE physical address field
-+ * when dealing with huge pages. This is because the page
-+ * table boundaries do not match the huge page size(s) the
-+ * hardware supports.
-+ *
-+ * In these cases we propagate the bits that are below the
-+ * page table level where we saw the huge page mapping, but
-+ * are still within the relevant physical bits for the huge
-+ * page size in question. So for PMD mappings (which fall on
-+ * bit 23, for 8MB per PMD) we must propagate bit 22 for a
-+ * 4MB huge page. For huge PUDs (which fall on bit 33, for
-+ * 8GB per PUD), we have to accomodate 256MB and 2GB huge
-+ * pages. So for those we propagate bits 32 to 28.
- */
- #define KERN_PGTABLE_WALK(VADDR, REG1, REG2, FAIL_LABEL) \
- sethi %hi(swapper_pg_dir), REG1; \
-@@ -145,15 +160,40 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- andn REG2, 0x7, REG2; \
- ldx [REG1 + REG2], REG1; \
- brz,pn REG1, FAIL_LABEL; \
-- sllx VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
-+ sllx VADDR, 64 - (PUD_SHIFT + PUD_BITS), REG2; \
- srlx REG2, 64 - PAGE_SHIFT, REG2; \
- andn REG2, 0x7, REG2; \
- ldxa [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
- brz,pn REG1, FAIL_LABEL; \
-- sllx VADDR, 64 - PMD_SHIFT, REG2; \
-+ sethi %uhi(_PAGE_PUD_HUGE), REG2; \
-+ brz,pn REG1, FAIL_LABEL; \
-+ sllx REG2, 32, REG2; \
-+ andcc REG1, REG2, %g0; \
-+ sethi %hi(0xf8000000), REG2; \
-+ bne,pt %xcc, 697f; \
-+ sllx REG2, 1, REG2; \
-+ sllx VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
- srlx REG2, 64 - PAGE_SHIFT, REG2; \
- andn REG2, 0x7, REG2; \
-- add REG1, REG2, REG1;
-+ ldxa [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+ sethi %uhi(_PAGE_PMD_HUGE), REG2; \
-+ brz,pn REG1, FAIL_LABEL; \
-+ sllx REG2, 32, REG2; \
-+ andcc REG1, REG2, %g0; \
-+ be,pn %xcc, 698f; \
-+ sethi %hi(0x400000), REG2; \
-+697: brgez,pn REG1, FAIL_LABEL; \
-+ andn REG1, REG2, REG1; \
-+ and VADDR, REG2, REG2; \
-+ ba,pt %xcc, 699f; \
-+ or REG1, REG2, REG1; \
-+698: sllx VADDR, 64 - PMD_SHIFT, REG2; \
-+ srlx REG2, 64 - PAGE_SHIFT, REG2; \
-+ andn REG2, 0x7, REG2; \
-+ ldxa [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+ brgez,pn REG1, FAIL_LABEL; \
-+ nop; \
-+699:
-
- /* PMD has been loaded into REG1, interpret the value, seeing
- * if it is a HUGE PMD or a normal one. If it is not valid
-@@ -198,6 +238,11 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- andn REG2, 0x7, REG2; \
- ldxa [PHYS_PGD + REG2] ASI_PHYS_USE_EC, REG1; \
- brz,pn REG1, FAIL_LABEL; \
-+ sllx VADDR, 64 - (PUD_SHIFT + PUD_BITS), REG2; \
-+ srlx REG2, 64 - PAGE_SHIFT, REG2; \
-+ andn REG2, 0x7, REG2; \
-+ ldxa [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+ brz,pn REG1, FAIL_LABEL; \
- sllx VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
- srlx REG2, 64 - PAGE_SHIFT, REG2; \
- andn REG2, 0x7, REG2; \
-@@ -246,8 +291,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- (KERNEL_TSB_SIZE_BYTES / 16)
- #define KERNEL_TSB4M_NENTRIES 4096
-
--#define KTSB_PHYS_SHIFT 15
--
- /* Do a kernel TSB lookup at tl>0 on VADDR+TAG, branch to OK_LABEL
- * on TSB hit. REG1, REG2, REG3, and REG4 are used as temporaries
- * and the found TTE will be left in REG1. REG3 and REG4 must
-@@ -256,17 +299,15 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- * VADDR and TAG will be preserved and not clobbered by this macro.
- */
- #define KERN_TSB_LOOKUP_TL1(VADDR, TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
--661: sethi %hi(swapper_tsb), REG1; \
-- or REG1, %lo(swapper_tsb), REG1; \
-+661: sethi %uhi(swapper_tsb), REG1; \
-+ sethi %hi(swapper_tsb), REG2; \
-+ or REG1, %ulo(swapper_tsb), REG1; \
-+ or REG2, %lo(swapper_tsb), REG2; \
- .section .swapper_tsb_phys_patch, "ax"; \
- .word 661b; \
- .previous; \
--661: nop; \
-- .section .tsb_ldquad_phys_patch, "ax"; \
-- .word 661b; \
-- sllx REG1, KTSB_PHYS_SHIFT, REG1; \
-- sllx REG1, KTSB_PHYS_SHIFT, REG1; \
-- .previous; \
-+ sllx REG1, 32, REG1; \
-+ or REG1, REG2, REG1; \
- srlx VADDR, PAGE_SHIFT, REG2; \
- and REG2, (KERNEL_TSB_NENTRIES - 1), REG2; \
- sllx REG2, 4, REG2; \
-@@ -281,17 +322,15 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- * we can make use of that for the index computation.
- */
- #define KERN_TSB4M_LOOKUP_TL1(TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
--661: sethi %hi(swapper_4m_tsb), REG1; \
-- or REG1, %lo(swapper_4m_tsb), REG1; \
-+661: sethi %uhi(swapper_4m_tsb), REG1; \
-+ sethi %hi(swapper_4m_tsb), REG2; \
-+ or REG1, %ulo(swapper_4m_tsb), REG1; \
-+ or REG2, %lo(swapper_4m_tsb), REG2; \
- .section .swapper_4m_tsb_phys_patch, "ax"; \
- .word 661b; \
- .previous; \
--661: nop; \
-- .section .tsb_ldquad_phys_patch, "ax"; \
-- .word 661b; \
-- sllx REG1, KTSB_PHYS_SHIFT, REG1; \
-- sllx REG1, KTSB_PHYS_SHIFT, REG1; \
-- .previous; \
-+ sllx REG1, 32, REG1; \
-+ or REG1, REG2, REG1; \
- and TAG, (KERNEL_TSB4M_NENTRIES - 1), REG2; \
- sllx REG2, 4, REG2; \
- add REG1, REG2, REG2; \
-diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
-index 39ca301..11fdf0e 100644
---- a/arch/sparc/include/asm/visasm.h
-+++ b/arch/sparc/include/asm/visasm.h
-@@ -39,6 +39,14 @@
- 297: wr %o5, FPRS_FEF, %fprs; \
- 298:
-
-+#define VISEntryHalfFast(fail_label) \
-+ rd %fprs, %o5; \
-+ andcc %o5, FPRS_FEF, %g0; \
-+ be,pt %icc, 297f; \
-+ nop; \
-+ ba,a,pt %xcc, fail_label; \
-+297: wr %o5, FPRS_FEF, %fprs;
-+
- #define VISExitHalf \
- wr %o5, 0, %fprs;
-
-diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
-index 5c51258..52e10de 100644
---- a/arch/sparc/kernel/cpu.c
-+++ b/arch/sparc/kernel/cpu.c
-@@ -493,6 +493,18 @@ static void __init sun4v_cpu_probe(void)
- sparc_pmu_type = "niagara5";
- break;
-
-+ case SUN4V_CHIP_SPARC_M6:
-+ sparc_cpu_type = "SPARC-M6";
-+ sparc_fpu_type = "SPARC-M6 integrated FPU";
-+ sparc_pmu_type = "sparc-m6";
-+ break;
-+
-+ case SUN4V_CHIP_SPARC_M7:
-+ sparc_cpu_type = "SPARC-M7";
-+ sparc_fpu_type = "SPARC-M7 integrated FPU";
-+ sparc_pmu_type = "sparc-m7";
-+ break;
-+
- case SUN4V_CHIP_SPARC64X:
- sparc_cpu_type = "SPARC64-X";
- sparc_fpu_type = "SPARC64-X integrated FPU";
-diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
-index de1c844..e69ec0e 100644
---- a/arch/sparc/kernel/cpumap.c
-+++ b/arch/sparc/kernel/cpumap.c
-@@ -326,6 +326,8 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
- case SUN4V_CHIP_NIAGARA3:
- case SUN4V_CHIP_NIAGARA4:
- case SUN4V_CHIP_NIAGARA5:
-+ case SUN4V_CHIP_SPARC_M6:
-+ case SUN4V_CHIP_SPARC_M7:
- case SUN4V_CHIP_SPARC64X:
- rover_inc_table = niagara_iterate_method;
- break;
-diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
-index dff60ab..f87a55d 100644
---- a/arch/sparc/kernel/ds.c
-+++ b/arch/sparc/kernel/ds.c
-@@ -1200,14 +1200,14 @@ static int ds_probe(struct vio_dev *vdev, const struct vio_device_id *id)
- ds_cfg.tx_irq = vdev->tx_irq;
- ds_cfg.rx_irq = vdev->rx_irq;
-
-- lp = ldc_alloc(vdev->channel_id, &ds_cfg, dp);
-+ lp = ldc_alloc(vdev->channel_id, &ds_cfg, dp, "DS");
- if (IS_ERR(lp)) {
- err = PTR_ERR(lp);
- goto out_free_ds_states;
- }
- dp->lp = lp;
-
-- err = ldc_bind(lp, "DS");
-+ err = ldc_bind(lp);
- if (err)
- goto out_free_ldc;
-
-diff --git a/arch/sparc/kernel/dtlb_prot.S b/arch/sparc/kernel/dtlb_prot.S
-index b2c2c5b..d668ca14 100644
---- a/arch/sparc/kernel/dtlb_prot.S
-+++ b/arch/sparc/kernel/dtlb_prot.S
-@@ -24,11 +24,11 @@
- mov TLB_TAG_ACCESS, %g4 ! For reload of vaddr
-
- /* PROT ** ICACHE line 2: More real fault processing */
-+ ldxa [%g4] ASI_DMMU, %g5 ! Put tagaccess in %g5
- bgu,pn %xcc, winfix_trampoline ! Yes, perform winfixup
-- ldxa [%g4] ASI_DMMU, %g5 ! Put tagaccess in %g5
-- ba,pt %xcc, sparc64_realfault_common ! Nope, normal fault
- mov FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4
-- nop
-+ ba,pt %xcc, sparc64_realfault_common ! Nope, normal fault
-+ nop
- nop
- nop
- nop
-diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
-index 140966f..c88ffb9 100644
---- a/arch/sparc/kernel/entry.h
-+++ b/arch/sparc/kernel/entry.h
-@@ -66,13 +66,10 @@ struct pause_patch_entry {
- extern struct pause_patch_entry __pause_3insn_patch,
- __pause_3insn_patch_end;
-
--extern void __init per_cpu_patch(void);
- extern void sun4v_patch_1insn_range(struct sun4v_1insn_patch_entry *,
- struct sun4v_1insn_patch_entry *);
- extern void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *,
- struct sun4v_2insn_patch_entry *);
--extern void __init sun4v_patch(void);
--extern void __init boot_cpu_id_too_large(int cpu);
- extern unsigned int dcache_parity_tl1_occurred;
- extern unsigned int icache_parity_tl1_occurred;
-
-diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
-index 452f04f..3d61fca 100644
---- a/arch/sparc/kernel/head_64.S
-+++ b/arch/sparc/kernel/head_64.S
-@@ -427,6 +427,12 @@ sun4v_chip_type:
- cmp %g2, '5'
- be,pt %xcc, 5f
- mov SUN4V_CHIP_NIAGARA5, %g4
-+ cmp %g2, '6'
-+ be,pt %xcc, 5f
-+ mov SUN4V_CHIP_SPARC_M6, %g4
-+ cmp %g2, '7'
-+ be,pt %xcc, 5f
-+ mov SUN4V_CHIP_SPARC_M7, %g4
- ba,pt %xcc, 49f
- nop
-
-@@ -585,6 +591,12 @@ niagara_tlb_fixup:
- cmp %g1, SUN4V_CHIP_NIAGARA5
- be,pt %xcc, niagara4_patch
- nop
-+ cmp %g1, SUN4V_CHIP_SPARC_M6
-+ be,pt %xcc, niagara4_patch
-+ nop
-+ cmp %g1, SUN4V_CHIP_SPARC_M7
-+ be,pt %xcc, niagara4_patch
-+ nop
-
- call generic_patch_copyops
- nop
-@@ -660,14 +672,12 @@ tlb_fixup_done:
- sethi %hi(init_thread_union), %g6
- or %g6, %lo(init_thread_union), %g6
- ldx [%g6 + TI_TASK], %g4
-- mov %sp, %l6
-
- wr %g0, ASI_P, %asi
- mov 1, %g1
- sllx %g1, THREAD_SHIFT, %g1
- sub %g1, (STACKFRAME_SZ + STACK_BIAS), %g1
- add %g6, %g1, %sp
-- mov 0, %fp
-
- /* Set per-cpu pointer initially to zero, this makes
- * the boot-cpu use the in-kernel-image per-cpu areas
-@@ -694,44 +704,14 @@ tlb_fixup_done:
- nop
- #endif
-
-- mov %l6, %o1 ! OpenPROM stack
- call prom_init
- mov %l7, %o0 ! OpenPROM cif handler
-
-- /* Initialize current_thread_info()->cpu as early as possible.
-- * In order to do that accurately we have to patch up the get_cpuid()
-- * assembler sequences. And that, in turn, requires that we know
-- * if we are on a Starfire box or not. While we're here, patch up
-- * the sun4v sequences as well.
-+ /* To create a one-register-window buffer between the kernel's
-+ * initial stack and the last stack frame we use from the firmware,
-+ * do the rest of the boot from a C helper function.
- */
-- call check_if_starfire
-- nop
-- call per_cpu_patch
-- nop
-- call sun4v_patch
-- nop
--
--#ifdef CONFIG_SMP
-- call hard_smp_processor_id
-- nop
-- cmp %o0, NR_CPUS
-- blu,pt %xcc, 1f
-- nop
-- call boot_cpu_id_too_large
-- nop
-- /* Not reached... */
--
--1:
--#else
-- mov 0, %o0
--#endif
-- sth %o0, [%g6 + TI_CPU]
--
-- call prom_init_report
-- nop
--
-- /* Off we go.... */
-- call start_kernel
-+ call start_early_boot
- nop
- /* Not reached... */
-
-diff --git a/arch/sparc/kernel/hvapi.c b/arch/sparc/kernel/hvapi.c
-index c0a2de0..5c55145 100644
---- a/arch/sparc/kernel/hvapi.c
-+++ b/arch/sparc/kernel/hvapi.c
-@@ -46,6 +46,7 @@ static struct api_info api_table[] = {
- { .group = HV_GRP_VF_CPU, },
- { .group = HV_GRP_KT_CPU, },
- { .group = HV_GRP_VT_CPU, },
-+ { .group = HV_GRP_T5_CPU, },
- { .group = HV_GRP_DIAG, .flags = FLAG_PRE_API },
- };
-
-diff --git a/arch/sparc/kernel/hvcalls.S b/arch/sparc/kernel/hvcalls.S
-index f3ab509..caedf83 100644
---- a/arch/sparc/kernel/hvcalls.S
-+++ b/arch/sparc/kernel/hvcalls.S
-@@ -821,3 +821,19 @@ ENTRY(sun4v_vt_set_perfreg)
- retl
- nop
- ENDPROC(sun4v_vt_set_perfreg)
-+
-+ENTRY(sun4v_t5_get_perfreg)
-+ mov %o1, %o4
-+ mov HV_FAST_T5_GET_PERFREG, %o5
-+ ta HV_FAST_TRAP
-+ stx %o1, [%o4]
-+ retl
-+ nop
-+ENDPROC(sun4v_t5_get_perfreg)
-+
-+ENTRY(sun4v_t5_set_perfreg)
-+ mov HV_FAST_T5_SET_PERFREG, %o5
-+ ta HV_FAST_TRAP
-+ retl
-+ nop
-+ENDPROC(sun4v_t5_set_perfreg)
-diff --git a/arch/sparc/kernel/hvtramp.S b/arch/sparc/kernel/hvtramp.S
-index b7ddcdd..cdbfec2 100644
---- a/arch/sparc/kernel/hvtramp.S
-+++ b/arch/sparc/kernel/hvtramp.S
-@@ -109,7 +109,6 @@ hv_cpu_startup:
- sllx %g5, THREAD_SHIFT, %g5
- sub %g5, (STACKFRAME_SZ + STACK_BIAS), %g5
- add %g6, %g5, %sp
-- mov 0, %fp
-
- call init_irqwork_curcpu
- nop
-diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
-index e7e215d..c2d81ad 100644
---- a/arch/sparc/kernel/ioport.c
-+++ b/arch/sparc/kernel/ioport.c
-@@ -278,7 +278,8 @@ static void *sbus_alloc_coherent(struct device *dev, size_t len,
- }
-
- order = get_order(len_total);
-- if ((va = __get_free_pages(GFP_KERNEL|__GFP_COMP, order)) == 0)
-+ va = __get_free_pages(gfp, order);
-+ if (va == 0)
- goto err_nopages;
-
- if ((res = kzalloc(sizeof(struct resource), GFP_KERNEL)) == NULL)
-@@ -443,7 +444,7 @@ static void *pci32_alloc_coherent(struct device *dev, size_t len,
- }
-
- order = get_order(len_total);
-- va = (void *) __get_free_pages(GFP_KERNEL, order);
-+ va = (void *) __get_free_pages(gfp, order);
- if (va == NULL) {
- printk("pci_alloc_consistent: no %ld pages\n", len_total>>PAGE_SHIFT);
- goto err_nopages;
-diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
-index 666193f..4033c23 100644
---- a/arch/sparc/kernel/irq_64.c
-+++ b/arch/sparc/kernel/irq_64.c
-@@ -47,8 +47,6 @@
- #include "cpumap.h"
- #include "kstack.h"
-
--#define NUM_IVECS (IMAP_INR + 1)
--
- struct ino_bucket *ivector_table;
- unsigned long ivector_table_pa;
-
-@@ -107,55 +105,196 @@ static void bucket_set_irq(unsigned long bucket_pa, unsigned int irq)
-
- #define irq_work_pa(__cpu) &(trap_block[(__cpu)].irq_worklist_pa)
-
--static struct {
-- unsigned int dev_handle;
-- unsigned int dev_ino;
-- unsigned int in_use;
--} irq_table[NR_IRQS];
--static DEFINE_SPINLOCK(irq_alloc_lock);
-+static unsigned long hvirq_major __initdata;
-+static int __init early_hvirq_major(char *p)
-+{
-+ int rc = kstrtoul(p, 10, &hvirq_major);
-+
-+ return rc;
-+}
-+early_param("hvirq", early_hvirq_major);
-+
-+static int hv_irq_version;
-+
-+/* Major version 2.0 of HV_GRP_INTR added support for the VIRQ cookie
-+ * based interfaces, but:
-+ *
-+ * 1) Several OSs, Solaris and Linux included, use them even when only
-+ * negotiating version 1.0 (or failing to negotiate at all). So the
-+ * hypervisor has a workaround that provides the VIRQ interfaces even
-+ * when only verion 1.0 of the API is in use.
-+ *
-+ * 2) Second, and more importantly, with major version 2.0 these VIRQ
-+ * interfaces only were actually hooked up for LDC interrupts, even
-+ * though the Hypervisor specification clearly stated:
-+ *
-+ * The new interrupt API functions will be available to a guest
-+ * when it negotiates version 2.0 in the interrupt API group 0x2. When
-+ * a guest negotiates version 2.0, all interrupt sources will only
-+ * support using the cookie interface, and any attempt to use the
-+ * version 1.0 interrupt APIs numbered 0xa0 to 0xa6 will result in the
-+ * ENOTSUPPORTED error being returned.
-+ *
-+ * with an emphasis on "all interrupt sources".
-+ *
-+ * To correct this, major version 3.0 was created which does actually
-+ * support VIRQs for all interrupt sources (not just LDC devices). So
-+ * if we want to move completely over the cookie based VIRQs we must
-+ * negotiate major version 3.0 or later of HV_GRP_INTR.
-+ */
-+static bool sun4v_cookie_only_virqs(void)
-+{
-+ if (hv_irq_version >= 3)
-+ return true;
-+ return false;
-+}
-
--unsigned char irq_alloc(unsigned int dev_handle, unsigned int dev_ino)
-+static void __init irq_init_hv(void)
- {
-- unsigned long flags;
-- unsigned char ent;
-+ unsigned long hv_error, major, minor = 0;
-+
-+ if (tlb_type != hypervisor)
-+ return;
-
-- BUILD_BUG_ON(NR_IRQS >= 256);
-+ if (hvirq_major)
-+ major = hvirq_major;
-+ else
-+ major = 3;
-
-- spin_lock_irqsave(&irq_alloc_lock, flags);
-+ hv_error = sun4v_hvapi_register(HV_GRP_INTR, major, &minor);
-+ if (!hv_error)
-+ hv_irq_version = major;
-+ else
-+ hv_irq_version = 1;
-
-- for (ent = 1; ent < NR_IRQS; ent++) {
-- if (!irq_table[ent].in_use)
-+ pr_info("SUN4V: Using IRQ API major %d, cookie only virqs %s\n",
-+ hv_irq_version,
-+ sun4v_cookie_only_virqs() ? "enabled" : "disabled");
-+}
-+
-+/* This function is for the timer interrupt.*/
-+int __init arch_probe_nr_irqs(void)
-+{
-+ return 1;
-+}
-+
-+#define DEFAULT_NUM_IVECS (0xfffU)
-+static unsigned int nr_ivec = DEFAULT_NUM_IVECS;
-+#define NUM_IVECS (nr_ivec)
-+
-+static unsigned int __init size_nr_ivec(void)
-+{
-+ if (tlb_type == hypervisor) {
-+ switch (sun4v_chip_type) {
-+ /* Athena's devhandle|devino is large.*/
-+ case SUN4V_CHIP_SPARC64X:
-+ nr_ivec = 0xffff;
- break;
-+ }
- }
-- if (ent >= NR_IRQS) {
-- printk(KERN_ERR "IRQ: Out of virtual IRQs.\n");
-- ent = 0;
-- } else {
-- irq_table[ent].dev_handle = dev_handle;
-- irq_table[ent].dev_ino = dev_ino;
-- irq_table[ent].in_use = 1;
-- }
-+ return nr_ivec;
-+}
-+
-+struct irq_handler_data {
-+ union {
-+ struct {
-+ unsigned int dev_handle;
-+ unsigned int dev_ino;
-+ };
-+ unsigned long sysino;
-+ };
-+ struct ino_bucket bucket;
-+ unsigned long iclr;
-+ unsigned long imap;
-+};
-+
-+static inline unsigned int irq_data_to_handle(struct irq_data *data)
-+{
-+ struct irq_handler_data *ihd = data->handler_data;
-+
-+ return ihd->dev_handle;
-+}
-+
-+static inline unsigned int irq_data_to_ino(struct irq_data *data)
-+{
-+ struct irq_handler_data *ihd = data->handler_data;
-
-- spin_unlock_irqrestore(&irq_alloc_lock, flags);
-+ return ihd->dev_ino;
-+}
-+
-+static inline unsigned long irq_data_to_sysino(struct irq_data *data)
-+{
-+ struct irq_handler_data *ihd = data->handler_data;
-
-- return ent;
-+ return ihd->sysino;
- }
-
--#ifdef CONFIG_PCI_MSI
- void irq_free(unsigned int irq)
- {
-- unsigned long flags;
-+ void *data = irq_get_handler_data(irq);
-
-- if (irq >= NR_IRQS)
-- return;
-+ kfree(data);
-+ irq_set_handler_data(irq, NULL);
-+ irq_free_descs(irq, 1);
-+}
-
-- spin_lock_irqsave(&irq_alloc_lock, flags);
-+unsigned int irq_alloc(unsigned int dev_handle, unsigned int dev_ino)
-+{
-+ int irq;
-
-- irq_table[irq].in_use = 0;
-+ irq = __irq_alloc_descs(-1, 1, 1, numa_node_id(), NULL);
-+ if (irq <= 0)
-+ goto out;
-
-- spin_unlock_irqrestore(&irq_alloc_lock, flags);
-+ return irq;
-+out:
-+ return 0;
-+}
-+
-+static unsigned int cookie_exists(u32 devhandle, unsigned int devino)
-+{
-+ unsigned long hv_err, cookie;
-+ struct ino_bucket *bucket;
-+ unsigned int irq = 0U;
-+
-+ hv_err = sun4v_vintr_get_cookie(devhandle, devino, &cookie);
-+ if (hv_err) {
-+ pr_err("HV get cookie failed hv_err = %ld\n", hv_err);
-+ goto out;
-+ }
-+
-+ if (cookie & ((1UL << 63UL))) {
-+ cookie = ~cookie;
-+ bucket = (struct ino_bucket *) __va(cookie);
-+ irq = bucket->__irq;
-+ }
-+out:
-+ return irq;
-+}
-+
-+static unsigned int sysino_exists(u32 devhandle, unsigned int devino)
-+{
-+ unsigned long sysino = sun4v_devino_to_sysino(devhandle, devino);
-+ struct ino_bucket *bucket;
-+ unsigned int irq;
-+
-+ bucket = &ivector_table[sysino];
-+ irq = bucket_get_irq(__pa(bucket));
-+
-+ return irq;
-+}
-+
-+void ack_bad_irq(unsigned int irq)
-+{
-+ pr_crit("BAD IRQ ack %d\n", irq);
-+}
-+
-+void irq_install_pre_handler(int irq,
-+ void (*func)(unsigned int, void *, void *),
-+ void *arg1, void *arg2)
-+{
-+ pr_warn("IRQ pre handler NOT supported.\n");
- }
--#endif
-
- /*
- * /proc/interrupts printing:
-@@ -206,15 +345,6 @@ static unsigned int sun4u_compute_tid(unsigned long imap, unsigned long cpuid)
- return tid;
- }
-
--struct irq_handler_data {
-- unsigned long iclr;
-- unsigned long imap;
--
-- void (*pre_handler)(unsigned int, void *, void *);
-- void *arg1;
-- void *arg2;
--};
--
- #ifdef CONFIG_SMP
- static int irq_choose_cpu(unsigned int irq, const struct cpumask *affinity)
- {
-@@ -316,8 +446,8 @@ static void sun4u_irq_eoi(struct irq_data *data)
-
- static void sun4v_irq_enable(struct irq_data *data)
- {
-- unsigned int ino = irq_table[data->irq].dev_ino;
- unsigned long cpuid = irq_choose_cpu(data->irq, data->affinity);
-+ unsigned int ino = irq_data_to_sysino(data);
- int err;
-
- err = sun4v_intr_settarget(ino, cpuid);
-@@ -337,8 +467,8 @@ static void sun4v_irq_enable(struct irq_data *data)
- static int sun4v_set_affinity(struct irq_data *data,
- const struct cpumask *mask, bool force)
- {
-- unsigned int ino = irq_table[data->irq].dev_ino;
- unsigned long cpuid = irq_choose_cpu(data->irq, mask);
-+ unsigned int ino = irq_data_to_sysino(data);
- int err;
-
- err = sun4v_intr_settarget(ino, cpuid);
-@@ -351,7 +481,7 @@ static int sun4v_set_affinity(struct irq_data *data,
-
- static void sun4v_irq_disable(struct irq_data *data)
- {
-- unsigned int ino = irq_table[data->irq].dev_ino;
-+ unsigned int ino = irq_data_to_sysino(data);
- int err;
-
- err = sun4v_intr_setenabled(ino, HV_INTR_DISABLED);
-@@ -362,7 +492,7 @@ static void sun4v_irq_disable(struct irq_data *data)
-
- static void sun4v_irq_eoi(struct irq_data *data)
- {
-- unsigned int ino = irq_table[data->irq].dev_ino;
-+ unsigned int ino = irq_data_to_sysino(data);
- int err;
-
- err = sun4v_intr_setstate(ino, HV_INTR_STATE_IDLE);
-@@ -373,14 +503,13 @@ static void sun4v_irq_eoi(struct irq_data *data)
-
- static void sun4v_virq_enable(struct irq_data *data)
- {
-- unsigned long cpuid, dev_handle, dev_ino;
-+ unsigned long dev_handle = irq_data_to_handle(data);
-+ unsigned long dev_ino = irq_data_to_ino(data);
-+ unsigned long cpuid;
- int err;
-
- cpuid = irq_choose_cpu(data->irq, data->affinity);
-
-- dev_handle = irq_table[data->irq].dev_handle;
-- dev_ino = irq_table[data->irq].dev_ino;
--
- err = sun4v_vintr_set_target(dev_handle, dev_ino, cpuid);
- if (err != HV_EOK)
- printk(KERN_ERR "sun4v_vintr_set_target(%lx,%lx,%lu): "
-@@ -403,14 +532,13 @@ static void sun4v_virq_enable(struct irq_data *data)
- static int sun4v_virt_set_affinity(struct irq_data *data,
- const struct cpumask *mask, bool force)
- {
-- unsigned long cpuid, dev_handle, dev_ino;
-+ unsigned long dev_handle = irq_data_to_handle(data);
-+ unsigned long dev_ino = irq_data_to_ino(data);
-+ unsigned long cpuid;
- int err;
-
- cpuid = irq_choose_cpu(data->irq, mask);
-
-- dev_handle = irq_table[data->irq].dev_handle;
-- dev_ino = irq_table[data->irq].dev_ino;
--
- err = sun4v_vintr_set_target(dev_handle, dev_ino, cpuid);
- if (err != HV_EOK)
- printk(KERN_ERR "sun4v_vintr_set_target(%lx,%lx,%lu): "
-@@ -422,11 +550,10 @@ static int sun4v_virt_set_affinity(struct irq_data *data,
-
- static void sun4v_virq_disable(struct irq_data *data)
- {
-- unsigned long dev_handle, dev_ino;
-+ unsigned long dev_handle = irq_data_to_handle(data);
-+ unsigned long dev_ino = irq_data_to_ino(data);
- int err;
-
-- dev_handle = irq_table[data->irq].dev_handle;
-- dev_ino = irq_table[data->irq].dev_ino;
-
- err = sun4v_vintr_set_valid(dev_handle, dev_ino,
- HV_INTR_DISABLED);
-@@ -438,12 +565,10 @@ static void sun4v_virq_disable(struct irq_data *data)
-
- static void sun4v_virq_eoi(struct irq_data *data)
- {
-- unsigned long dev_handle, dev_ino;
-+ unsigned long dev_handle = irq_data_to_handle(data);
-+ unsigned long dev_ino = irq_data_to_ino(data);
- int err;
-
-- dev_handle = irq_table[data->irq].dev_handle;
-- dev_ino = irq_table[data->irq].dev_ino;
--
- err = sun4v_vintr_set_state(dev_handle, dev_ino,
- HV_INTR_STATE_IDLE);
- if (err != HV_EOK)
-@@ -479,31 +604,10 @@ static struct irq_chip sun4v_virq = {
- .flags = IRQCHIP_EOI_IF_HANDLED,
- };
-
--static void pre_flow_handler(struct irq_data *d)
--{
-- struct irq_handler_data *handler_data = irq_data_get_irq_handler_data(d);
-- unsigned int ino = irq_table[d->irq].dev_ino;
--
-- handler_data->pre_handler(ino, handler_data->arg1, handler_data->arg2);
--}
--
--void irq_install_pre_handler(int irq,
-- void (*func)(unsigned int, void *, void *),
-- void *arg1, void *arg2)
--{
-- struct irq_handler_data *handler_data = irq_get_handler_data(irq);
--
-- handler_data->pre_handler = func;
-- handler_data->arg1 = arg1;
-- handler_data->arg2 = arg2;
--
-- __irq_set_preflow_handler(irq, pre_flow_handler);
--}
--
- unsigned int build_irq(int inofixup, unsigned long iclr, unsigned long imap)
- {
-- struct ino_bucket *bucket;
- struct irq_handler_data *handler_data;
-+ struct ino_bucket *bucket;
- unsigned int irq;
- int ino;
-
-@@ -537,119 +641,166 @@ out:
- return irq;
- }
-
--static unsigned int sun4v_build_common(unsigned long sysino,
-- struct irq_chip *chip)
-+static unsigned int sun4v_build_common(u32 devhandle, unsigned int devino,
-+ void (*handler_data_init)(struct irq_handler_data *data,
-+ u32 devhandle, unsigned int devino),
-+ struct irq_chip *chip)
- {
-- struct ino_bucket *bucket;
-- struct irq_handler_data *handler_data;
-+ struct irq_handler_data *data;
- unsigned int irq;
-
-- BUG_ON(tlb_type != hypervisor);
-+ irq = irq_alloc(devhandle, devino);
-+ if (!irq)
-+ goto out;
-
-- bucket = &ivector_table[sysino];
-- irq = bucket_get_irq(__pa(bucket));
-- if (!irq) {
-- irq = irq_alloc(0, sysino);
-- bucket_set_irq(__pa(bucket), irq);
-- irq_set_chip_and_handler_name(irq, chip, handle_fasteoi_irq,
-- "IVEC");
-+ data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
-+ if (unlikely(!data)) {
-+ pr_err("IRQ handler data allocation failed.\n");
-+ irq_free(irq);
-+ irq = 0;
-+ goto out;
- }
-
-- handler_data = irq_get_handler_data(irq);
-- if (unlikely(handler_data))
-- goto out;
-+ irq_set_handler_data(irq, data);
-+ handler_data_init(data, devhandle, devino);
-+ irq_set_chip_and_handler_name(irq, chip, handle_fasteoi_irq, "IVEC");
-+ data->imap = ~0UL;
-+ data->iclr = ~0UL;
-+out:
-+ return irq;
-+}
-
-- handler_data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
-- if (unlikely(!handler_data)) {
-- prom_printf("IRQ: kzalloc(irq_handler_data) failed.\n");
-- prom_halt();
-- }
-- irq_set_handler_data(irq, handler_data);
-+static unsigned long cookie_assign(unsigned int irq, u32 devhandle,
-+ unsigned int devino)
-+{
-+ struct irq_handler_data *ihd = irq_get_handler_data(irq);
-+ unsigned long hv_error, cookie;
-
-- /* Catch accidental accesses to these things. IMAP/ICLR handling
-- * is done by hypervisor calls on sun4v platforms, not by direct
-- * register accesses.
-+ /* handler_irq needs to find the irq. cookie is seen signed in
-+ * sun4v_dev_mondo and treated as a non ivector_table delivery.
- */
-- handler_data->imap = ~0UL;
-- handler_data->iclr = ~0UL;
-+ ihd->bucket.__irq = irq;
-+ cookie = ~__pa(&ihd->bucket);
-
--out:
-- return irq;
-+ hv_error = sun4v_vintr_set_cookie(devhandle, devino, cookie);
-+ if (hv_error)
-+ pr_err("HV vintr set cookie failed = %ld\n", hv_error);
-+
-+ return hv_error;
- }
-
--unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino)
-+static void cookie_handler_data(struct irq_handler_data *data,
-+ u32 devhandle, unsigned int devino)
- {
-- unsigned long sysino = sun4v_devino_to_sysino(devhandle, devino);
-+ data->dev_handle = devhandle;
-+ data->dev_ino = devino;
-+}
-
-- return sun4v_build_common(sysino, &sun4v_irq);
-+static unsigned int cookie_build_irq(u32 devhandle, unsigned int devino,
-+ struct irq_chip *chip)
-+{
-+ unsigned long hv_error;
-+ unsigned int irq;
-+
-+ irq = sun4v_build_common(devhandle, devino, cookie_handler_data, chip);
-+
-+ hv_error = cookie_assign(irq, devhandle, devino);
-+ if (hv_error) {
-+ irq_free(irq);
-+ irq = 0;
-+ }
-+
-+ return irq;
- }
-
--unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
-+static unsigned int sun4v_build_cookie(u32 devhandle, unsigned int devino)
- {
-- struct irq_handler_data *handler_data;
-- unsigned long hv_err, cookie;
-- struct ino_bucket *bucket;
- unsigned int irq;
-
-- bucket = kzalloc(sizeof(struct ino_bucket), GFP_ATOMIC);
-- if (unlikely(!bucket))
-- return 0;
-+ irq = cookie_exists(devhandle, devino);
-+ if (irq)
-+ goto out;
-
-- /* The only reference we store to the IRQ bucket is
-- * by physical address which kmemleak can't see, tell
-- * it that this object explicitly is not a leak and
-- * should be scanned.
-- */
-- kmemleak_not_leak(bucket);
-+ irq = cookie_build_irq(devhandle, devino, &sun4v_virq);
-
-- __flush_dcache_range((unsigned long) bucket,
-- ((unsigned long) bucket +
-- sizeof(struct ino_bucket)));
-+out:
-+ return irq;
-+}
-
-- irq = irq_alloc(devhandle, devino);
-+static void sysino_set_bucket(unsigned int irq)
-+{
-+ struct irq_handler_data *ihd = irq_get_handler_data(irq);
-+ struct ino_bucket *bucket;
-+ unsigned long sysino;
-+
-+ sysino = sun4v_devino_to_sysino(ihd->dev_handle, ihd->dev_ino);
-+ BUG_ON(sysino >= nr_ivec);
-+ bucket = &ivector_table[sysino];
- bucket_set_irq(__pa(bucket), irq);
-+}
-
-- irq_set_chip_and_handler_name(irq, &sun4v_virq, handle_fasteoi_irq,
-- "IVEC");
-+static void sysino_handler_data(struct irq_handler_data *data,
-+ u32 devhandle, unsigned int devino)
-+{
-+ unsigned long sysino;
-
-- handler_data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
-- if (unlikely(!handler_data))
-- return 0;
-+ sysino = sun4v_devino_to_sysino(devhandle, devino);
-+ data->sysino = sysino;
-+}
-
-- /* In order to make the LDC channel startup sequence easier,
-- * especially wrt. locking, we do not let request_irq() enable
-- * the interrupt.
-- */
-- irq_set_status_flags(irq, IRQ_NOAUTOEN);
-- irq_set_handler_data(irq, handler_data);
-+static unsigned int sysino_build_irq(u32 devhandle, unsigned int devino,
-+ struct irq_chip *chip)
-+{
-+ unsigned int irq;
-
-- /* Catch accidental accesses to these things. IMAP/ICLR handling
-- * is done by hypervisor calls on sun4v platforms, not by direct
-- * register accesses.
-- */
-- handler_data->imap = ~0UL;
-- handler_data->iclr = ~0UL;
-+ irq = sun4v_build_common(devhandle, devino, sysino_handler_data, chip);
-+ if (!irq)
-+ goto out;
-
-- cookie = ~__pa(bucket);
-- hv_err = sun4v_vintr_set_cookie(devhandle, devino, cookie);
-- if (hv_err) {
-- prom_printf("IRQ: Fatal, cannot set cookie for [%x:%x] "
-- "err=%lu\n", devhandle, devino, hv_err);
-- prom_halt();
-- }
-+ sysino_set_bucket(irq);
-+out:
-+ return irq;
-+}
-
-+static int sun4v_build_sysino(u32 devhandle, unsigned int devino)
-+{
-+ int irq;
-+
-+ irq = sysino_exists(devhandle, devino);
-+ if (irq)
-+ goto out;
-+
-+ irq = sysino_build_irq(devhandle, devino, &sun4v_irq);
-+out:
- return irq;
- }
-
--void ack_bad_irq(unsigned int irq)
-+unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino)
- {
-- unsigned int ino = irq_table[irq].dev_ino;
-+ unsigned int irq;
-
-- if (!ino)
-- ino = 0xdeadbeef;
-+ if (sun4v_cookie_only_virqs())
-+ irq = sun4v_build_cookie(devhandle, devino);
-+ else
-+ irq = sun4v_build_sysino(devhandle, devino);
-
-- printk(KERN_CRIT "Unexpected IRQ from ino[%x] irq[%u]\n",
-- ino, irq);
-+ return irq;
-+}
-+
-+unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
-+{
-+ int irq;
-+
-+ irq = cookie_build_irq(devhandle, devino, &sun4v_virq);
-+ if (!irq)
-+ goto out;
-+
-+ /* This is borrowed from the original function.
-+ */
-+ irq_set_status_flags(irq, IRQ_NOAUTOEN);
-+
-+out:
-+ return irq;
- }
-
- void *hardirq_stack[NR_CPUS];
-@@ -720,9 +871,12 @@ void fixup_irqs(void)
-
- for (irq = 0; irq < NR_IRQS; irq++) {
- struct irq_desc *desc = irq_to_desc(irq);
-- struct irq_data *data = irq_desc_get_irq_data(desc);
-+ struct irq_data *data;
- unsigned long flags;
-
-+ if (!desc)
-+ continue;
-+ data = irq_desc_get_irq_data(desc);
- raw_spin_lock_irqsave(&desc->lock, flags);
- if (desc->action && !irqd_is_per_cpu(data)) {
- if (data->chip->irq_set_affinity)
-@@ -922,16 +1076,22 @@ static struct irqaction timer_irq_action = {
- .name = "timer",
- };
-
--/* Only invoked on boot processor. */
--void __init init_IRQ(void)
-+static void __init irq_ivector_init(void)
- {
-- unsigned long size;
-+ unsigned long size, order;
-+ unsigned int ivecs;
-
-- map_prom_timers();
-- kill_prom_timer();
-+ /* If we are doing cookie only VIRQs then we do not need the ivector
-+ * table to process interrupts.
-+ */
-+ if (sun4v_cookie_only_virqs())
-+ return;
-
-- size = sizeof(struct ino_bucket) * NUM_IVECS;
-- ivector_table = kzalloc(size, GFP_KERNEL);
-+ ivecs = size_nr_ivec();
-+ size = sizeof(struct ino_bucket) * ivecs;
-+ order = get_order(size);
-+ ivector_table = (struct ino_bucket *)
-+ __get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
- if (!ivector_table) {
- prom_printf("Fatal error, cannot allocate ivector_table\n");
- prom_halt();
-@@ -940,6 +1100,15 @@ void __init init_IRQ(void)
- ((unsigned long) ivector_table) + size);
-
- ivector_table_pa = __pa(ivector_table);
-+}
-+
-+/* Only invoked on boot processor.*/
-+void __init init_IRQ(void)
-+{
-+ irq_init_hv();
-+ irq_ivector_init();
-+ map_prom_timers();
-+ kill_prom_timer();
-
- if (tlb_type == hypervisor)
- sun4v_init_mondo_queues();
-diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
-index 605d492..ef0d8e9 100644
---- a/arch/sparc/kernel/ktlb.S
-+++ b/arch/sparc/kernel/ktlb.S
-@@ -47,14 +47,6 @@ kvmap_itlb_vmalloc_addr:
- KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_itlb_longpath)
-
- TSB_LOCK_TAG(%g1, %g2, %g7)
--
-- /* Load and check PTE. */
-- ldxa [%g5] ASI_PHYS_USE_EC, %g5
-- mov 1, %g7
-- sllx %g7, TSB_TAG_INVALID_BIT, %g7
-- brgez,a,pn %g5, kvmap_itlb_longpath
-- TSB_STORE(%g1, %g7)
--
- TSB_WRITE(%g1, %g5, %g6)
-
- /* fallthrough to TLB load */
-@@ -118,6 +110,12 @@ kvmap_dtlb_obp:
- ba,pt %xcc, kvmap_dtlb_load
- nop
-
-+kvmap_linear_early:
-+ sethi %hi(kern_linear_pte_xor), %g7
-+ ldx [%g7 + %lo(kern_linear_pte_xor)], %g2
-+ ba,pt %xcc, kvmap_dtlb_tsb4m_load
-+ xor %g2, %g4, %g5
-+
- .align 32
- kvmap_dtlb_tsb4m_load:
- TSB_LOCK_TAG(%g1, %g2, %g7)
-@@ -146,105 +144,17 @@ kvmap_dtlb_4v:
- /* Correct TAG_TARGET is already in %g6, check 4mb TSB. */
- KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
- #endif
-- /* TSB entry address left in %g1, lookup linear PTE.
-- * Must preserve %g1 and %g6 (TAG).
-- */
--kvmap_dtlb_tsb4m_miss:
-- /* Clear the PAGE_OFFSET top virtual bits, shift
-- * down to get PFN, and make sure PFN is in range.
-- */
--661: sllx %g4, 0, %g5
-- .section .page_offset_shift_patch, "ax"
-- .word 661b
-- .previous
--
-- /* Check to see if we know about valid memory at the 4MB
-- * chunk this physical address will reside within.
-+ /* Linear mapping TSB lookup failed. Fallthrough to kernel
-+ * page table based lookup.
- */
--661: srlx %g5, MAX_PHYS_ADDRESS_BITS, %g2
-- .section .page_offset_shift_patch, "ax"
-- .word 661b
-- .previous
--
-- brnz,pn %g2, kvmap_dtlb_longpath
-- nop
--
-- /* This unconditional branch and delay-slot nop gets patched
-- * by the sethi sequence once the bitmap is properly setup.
-- */
-- .globl valid_addr_bitmap_insn
--valid_addr_bitmap_insn:
-- ba,pt %xcc, 2f
-- nop
-- .subsection 2
-- .globl valid_addr_bitmap_patch
--valid_addr_bitmap_patch:
-- sethi %hi(sparc64_valid_addr_bitmap), %g7
-- or %g7, %lo(sparc64_valid_addr_bitmap), %g7
-- .previous
--
--661: srlx %g5, ILOG2_4MB, %g2
-- .section .page_offset_shift_patch, "ax"
-- .word 661b
-- .previous
--
-- srlx %g2, 6, %g5
-- and %g2, 63, %g2
-- sllx %g5, 3, %g5
-- ldx [%g7 + %g5], %g5
-- mov 1, %g7
-- sllx %g7, %g2, %g7
-- andcc %g5, %g7, %g0
-- be,pn %xcc, kvmap_dtlb_longpath
--
--2: sethi %hi(kpte_linear_bitmap), %g2
--
-- /* Get the 256MB physical address index. */
--661: sllx %g4, 0, %g5
-- .section .page_offset_shift_patch, "ax"
-- .word 661b
-- .previous
--
-- or %g2, %lo(kpte_linear_bitmap), %g2
--
--661: srlx %g5, ILOG2_256MB, %g5
-- .section .page_offset_shift_patch, "ax"
-- .word 661b
-- .previous
--
-- and %g5, (32 - 1), %g7
--
-- /* Divide by 32 to get the offset into the bitmask. */
-- srlx %g5, 5, %g5
-- add %g7, %g7, %g7
-- sllx %g5, 3, %g5
--
-- /* kern_linear_pte_xor[(mask >> shift) & 3)] */
-- ldx [%g2 + %g5], %g2
-- srlx %g2, %g7, %g7
-- sethi %hi(kern_linear_pte_xor), %g5
-- and %g7, 3, %g7
-- or %g5, %lo(kern_linear_pte_xor), %g5
-- sllx %g7, 3, %g7
-- ldx [%g5 + %g7], %g2
--
- .globl kvmap_linear_patch
- kvmap_linear_patch:
-- ba,pt %xcc, kvmap_dtlb_tsb4m_load
-- xor %g2, %g4, %g5
-+ ba,a,pt %xcc, kvmap_linear_early
-
- kvmap_dtlb_vmalloc_addr:
- KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_dtlb_longpath)
-
- TSB_LOCK_TAG(%g1, %g2, %g7)
--
-- /* Load and check PTE. */
-- ldxa [%g5] ASI_PHYS_USE_EC, %g5
-- mov 1, %g7
-- sllx %g7, TSB_TAG_INVALID_BIT, %g7
-- brgez,a,pn %g5, kvmap_dtlb_longpath
-- TSB_STORE(%g1, %g7)
--
- TSB_WRITE(%g1, %g5, %g6)
-
- /* fallthrough to TLB load */
-@@ -276,13 +186,8 @@ kvmap_dtlb_load:
-
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
- kvmap_vmemmap:
-- sub %g4, %g5, %g5
-- srlx %g5, ILOG2_4MB, %g5
-- sethi %hi(vmemmap_table), %g1
-- sllx %g5, 3, %g5
-- or %g1, %lo(vmemmap_table), %g1
-- ba,pt %xcc, kvmap_dtlb_load
-- ldx [%g1 + %g5], %g5
-+ KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_dtlb_longpath)
-+ ba,a,pt %xcc, kvmap_dtlb_load
- #endif
-
- kvmap_dtlb_nonlinear:
-@@ -294,8 +199,8 @@ kvmap_dtlb_nonlinear:
-
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
- /* Do not use the TSB for vmemmap. */
-- mov (VMEMMAP_BASE >> 40), %g5
-- sllx %g5, 40, %g5
-+ sethi %hi(VMEMMAP_BASE), %g5
-+ ldx [%g5 + %lo(VMEMMAP_BASE)], %g5
- cmp %g4,%g5
- bgeu,pn %xcc, kvmap_vmemmap
- nop
-@@ -307,8 +212,8 @@ kvmap_dtlb_tsbmiss:
- sethi %hi(MODULES_VADDR), %g5
- cmp %g4, %g5
- blu,pn %xcc, kvmap_dtlb_longpath
-- mov (VMALLOC_END >> 40), %g5
-- sllx %g5, 40, %g5
-+ sethi %hi(VMALLOC_END), %g5
-+ ldx [%g5 + %lo(VMALLOC_END)], %g5
- cmp %g4, %g5
- bgeu,pn %xcc, kvmap_dtlb_longpath
- nop
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 66dacd5..27bb554 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -1078,7 +1078,8 @@ static void ldc_iommu_release(struct ldc_channel *lp)
-
- struct ldc_channel *ldc_alloc(unsigned long id,
- const struct ldc_channel_config *cfgp,
-- void *event_arg)
-+ void *event_arg,
-+ const char *name)
- {
- struct ldc_channel *lp;
- const struct ldc_mode_ops *mops;
-@@ -1093,6 +1094,8 @@ struct ldc_channel *ldc_alloc(unsigned long id,
- err = -EINVAL;
- if (!cfgp)
- goto out_err;
-+ if (!name)
-+ goto out_err;
-
- switch (cfgp->mode) {
- case LDC_MODE_RAW:
-@@ -1185,6 +1188,21 @@ struct ldc_channel *ldc_alloc(unsigned long id,
-
- INIT_HLIST_HEAD(&lp->mh_list);
-
-+ snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
-+ snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
-+
-+ err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
-+ lp->rx_irq_name, lp);
-+ if (err)
-+ goto out_free_txq;
-+
-+ err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
-+ lp->tx_irq_name, lp);
-+ if (err) {
-+ free_irq(lp->cfg.rx_irq, lp);
-+ goto out_free_txq;
-+ }
-+
- return lp;
-
- out_free_txq:
-@@ -1237,31 +1255,14 @@ EXPORT_SYMBOL(ldc_free);
- * state. This does not initiate a handshake, ldc_connect() does
- * that.
- */
--int ldc_bind(struct ldc_channel *lp, const char *name)
-+int ldc_bind(struct ldc_channel *lp)
- {
- unsigned long hv_err, flags;
- int err = -EINVAL;
-
-- if (!name ||
-- (lp->state != LDC_STATE_INIT))
-+ if (lp->state != LDC_STATE_INIT)
- return -EINVAL;
-
-- snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
-- snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
--
-- err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
-- lp->rx_irq_name, lp);
-- if (err)
-- return err;
--
-- err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
-- lp->tx_irq_name, lp);
-- if (err) {
-- free_irq(lp->cfg.rx_irq, lp);
-- return err;
-- }
--
--
- spin_lock_irqsave(&lp->lock, flags);
-
- enable_irq(lp->cfg.rx_irq);
-diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
-index 6479256..fce8ab1 100644
---- a/arch/sparc/kernel/nmi.c
-+++ b/arch/sparc/kernel/nmi.c
-@@ -141,7 +141,6 @@ static inline unsigned int get_nmi_count(int cpu)
-
- static __init void nmi_cpu_busy(void *data)
- {
-- local_irq_enable_in_hardirq();
- while (endflag == 0)
- mb();
- }
-diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
-index 269af58..7e967c8 100644
---- a/arch/sparc/kernel/pcr.c
-+++ b/arch/sparc/kernel/pcr.c
-@@ -191,12 +191,41 @@ static const struct pcr_ops n4_pcr_ops = {
- .pcr_nmi_disable = PCR_N4_PICNPT,
- };
-
-+static u64 n5_pcr_read(unsigned long reg_num)
-+{
-+ unsigned long val;
-+
-+ (void) sun4v_t5_get_perfreg(reg_num, &val);
-+
-+ return val;
-+}
-+
-+static void n5_pcr_write(unsigned long reg_num, u64 val)
-+{
-+ (void) sun4v_t5_set_perfreg(reg_num, val);
-+}
-+
-+static const struct pcr_ops n5_pcr_ops = {
-+ .read_pcr = n5_pcr_read,
-+ .write_pcr = n5_pcr_write,
-+ .read_pic = n4_pic_read,
-+ .write_pic = n4_pic_write,
-+ .nmi_picl_value = n4_picl_value,
-+ .pcr_nmi_enable = (PCR_N4_PICNPT | PCR_N4_STRACE |
-+ PCR_N4_UTRACE | PCR_N4_TOE |
-+ (26 << PCR_N4_SL_SHIFT)),
-+ .pcr_nmi_disable = PCR_N4_PICNPT,
-+};
-+
-+
- static unsigned long perf_hsvc_group;
- static unsigned long perf_hsvc_major;
- static unsigned long perf_hsvc_minor;
-
- static int __init register_perf_hsvc(void)
- {
-+ unsigned long hverror;
-+
- if (tlb_type == hypervisor) {
- switch (sun4v_chip_type) {
- case SUN4V_CHIP_NIAGARA1:
-@@ -215,6 +244,10 @@ static int __init register_perf_hsvc(void)
- perf_hsvc_group = HV_GRP_VT_CPU;
- break;
-
-+ case SUN4V_CHIP_NIAGARA5:
-+ perf_hsvc_group = HV_GRP_T5_CPU;
-+ break;
-+
- default:
- return -ENODEV;
- }
-@@ -222,10 +255,12 @@ static int __init register_perf_hsvc(void)
-
- perf_hsvc_major = 1;
- perf_hsvc_minor = 0;
-- if (sun4v_hvapi_register(perf_hsvc_group,
-- perf_hsvc_major,
-- &perf_hsvc_minor)) {
-- printk("perfmon: Could not register hvapi.\n");
-+ hverror = sun4v_hvapi_register(perf_hsvc_group,
-+ perf_hsvc_major,
-+ &perf_hsvc_minor);
-+ if (hverror) {
-+ pr_err("perfmon: Could not register hvapi(0x%lx).\n",
-+ hverror);
- return -ENODEV;
- }
- }
-@@ -254,6 +289,10 @@ static int __init setup_sun4v_pcr_ops(void)
- pcr_ops = &n4_pcr_ops;
- break;
-
-+ case SUN4V_CHIP_NIAGARA5:
-+ pcr_ops = &n5_pcr_ops;
-+ break;
-+
- default:
- ret = -ENODEV;
- break;
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index b5c38fa..617b9fe 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -1662,7 +1662,8 @@ static bool __init supported_pmu(void)
- sparc_pmu = &niagara2_pmu;
- return true;
- }
-- if (!strcmp(sparc_pmu_type, "niagara4")) {
-+ if (!strcmp(sparc_pmu_type, "niagara4") ||
-+ !strcmp(sparc_pmu_type, "niagara5")) {
- sparc_pmu = &niagara4_pmu;
- return true;
- }
-@@ -1671,9 +1672,12 @@ static bool __init supported_pmu(void)
-
- int __init init_hw_perf_events(void)
- {
-+ int err;
-+
- pr_info("Performance events: ");
-
-- if (!supported_pmu()) {
-+ err = pcr_arch_init();
-+ if (err || !supported_pmu()) {
- pr_cont("No support for PMU type '%s'\n", sparc_pmu_type);
- return 0;
- }
-@@ -1685,7 +1689,7 @@ int __init init_hw_perf_events(void)
-
- return 0;
- }
--early_initcall(init_hw_perf_events);
-+pure_initcall(init_hw_perf_events);
-
- void perf_callchain_kernel(struct perf_callchain_entry *entry,
- struct pt_regs *regs)
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index d7b4967..c6f7113 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -306,6 +306,9 @@ static void __global_pmu_self(int this_cpu)
- struct global_pmu_snapshot *pp;
- int i, num;
-
-+ if (!pcr_ops)
-+ return;
-+
- pp = &global_cpu_snapshot[this_cpu].pmu;
-
- num = 1;
-diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
-index 3fdb455..61a5198 100644
---- a/arch/sparc/kernel/setup_64.c
-+++ b/arch/sparc/kernel/setup_64.c
-@@ -30,6 +30,7 @@
- #include <linux/cpu.h>
- #include <linux/initrd.h>
- #include <linux/module.h>
-+#include <linux/start_kernel.h>
-
- #include <asm/io.h>
- #include <asm/processor.h>
-@@ -174,7 +175,7 @@ char reboot_command[COMMAND_LINE_SIZE];
-
- static struct pt_regs fake_swapper_regs = { { 0, }, 0, 0, 0, 0 };
-
--void __init per_cpu_patch(void)
-+static void __init per_cpu_patch(void)
- {
- struct cpuid_patch_entry *p;
- unsigned long ver;
-@@ -266,7 +267,7 @@ void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *start,
- }
- }
-
--void __init sun4v_patch(void)
-+static void __init sun4v_patch(void)
- {
- extern void sun4v_hvapi_init(void);
-
-@@ -335,14 +336,25 @@ static void __init pause_patch(void)
- }
- }
-
--#ifdef CONFIG_SMP
--void __init boot_cpu_id_too_large(int cpu)
-+void __init start_early_boot(void)
- {
-- prom_printf("Serious problem, boot cpu id (%d) >= NR_CPUS (%d)\n",
-- cpu, NR_CPUS);
-- prom_halt();
-+ int cpu;
-+
-+ check_if_starfire();
-+ per_cpu_patch();
-+ sun4v_patch();
-+
-+ cpu = hard_smp_processor_id();
-+ if (cpu >= NR_CPUS) {
-+ prom_printf("Serious problem, boot cpu id (%d) >= NR_CPUS (%d)\n",
-+ cpu, NR_CPUS);
-+ prom_halt();
-+ }
-+ current_thread_info()->cpu = cpu;
-+
-+ prom_init_report();
-+ start_kernel();
- }
--#endif
-
- /* On Ultra, we support all of the v8 capabilities. */
- unsigned long sparc64_elf_hwcap = (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
-@@ -500,12 +512,16 @@ static void __init init_sparc64_elf_hwcap(void)
- sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- cap |= HWCAP_SPARC_BLKINIT;
- if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- cap |= HWCAP_SPARC_N2;
- }
-@@ -533,6 +549,8 @@ static void __init init_sparc64_elf_hwcap(void)
- sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
- AV_SPARC_ASI_BLK_INIT |
-@@ -540,6 +558,8 @@ static void __init init_sparc64_elf_hwcap(void)
- if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+ sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
- AV_SPARC_FMAF);
-diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index 8416d7f..50c3dd03 100644
---- a/arch/sparc/kernel/smp_64.c
-+++ b/arch/sparc/kernel/smp_64.c
-@@ -1395,7 +1395,6 @@ void __cpu_die(unsigned int cpu)
-
- void __init smp_cpus_done(unsigned int max_cpus)
- {
-- pcr_arch_init();
- }
-
- void smp_send_reschedule(int cpu)
-@@ -1480,6 +1479,13 @@ static void __init pcpu_populate_pte(unsigned long addr)
- pud_t *pud;
- pmd_t *pmd;
-
-+ if (pgd_none(*pgd)) {
-+ pud_t *new;
-+
-+ new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
-+ pgd_populate(&init_mm, pgd, new);
-+ }
-+
- pud = pud_offset(pgd, addr);
- if (pud_none(*pud)) {
- pmd_t *new;
-diff --git a/arch/sparc/kernel/sun4v_tlb_miss.S b/arch/sparc/kernel/sun4v_tlb_miss.S
-index e0c09bf8..6179e19 100644
---- a/arch/sparc/kernel/sun4v_tlb_miss.S
-+++ b/arch/sparc/kernel/sun4v_tlb_miss.S
-@@ -195,6 +195,11 @@ sun4v_tsb_miss_common:
- ldx [%g2 + TRAP_PER_CPU_PGD_PADDR], %g7
-
- sun4v_itlb_error:
-+ rdpr %tl, %g1
-+ cmp %g1, 1
-+ ble,pt %icc, sun4v_bad_ra
-+ or %g0, FAULT_CODE_BAD_RA | FAULT_CODE_ITLB, %g1
-+
- sethi %hi(sun4v_err_itlb_vaddr), %g1
- stx %g4, [%g1 + %lo(sun4v_err_itlb_vaddr)]
- sethi %hi(sun4v_err_itlb_ctx), %g1
-@@ -206,15 +211,10 @@ sun4v_itlb_error:
- sethi %hi(sun4v_err_itlb_error), %g1
- stx %o0, [%g1 + %lo(sun4v_err_itlb_error)]
-
-+ sethi %hi(1f), %g7
- rdpr %tl, %g4
-- cmp %g4, 1
-- ble,pt %icc, 1f
-- sethi %hi(2f), %g7
- ba,pt %xcc, etraptl1
-- or %g7, %lo(2f), %g7
--
--1: ba,pt %xcc, etrap
--2: or %g7, %lo(2b), %g7
-+1: or %g7, %lo(1f), %g7
- mov %l4, %o1
- call sun4v_itlb_error_report
- add %sp, PTREGS_OFF, %o0
-@@ -222,6 +222,11 @@ sun4v_itlb_error:
- /* NOTREACHED */
-
- sun4v_dtlb_error:
-+ rdpr %tl, %g1
-+ cmp %g1, 1
-+ ble,pt %icc, sun4v_bad_ra
-+ or %g0, FAULT_CODE_BAD_RA | FAULT_CODE_DTLB, %g1
-+
- sethi %hi(sun4v_err_dtlb_vaddr), %g1
- stx %g4, [%g1 + %lo(sun4v_err_dtlb_vaddr)]
- sethi %hi(sun4v_err_dtlb_ctx), %g1
-@@ -233,21 +238,23 @@ sun4v_dtlb_error:
- sethi %hi(sun4v_err_dtlb_error), %g1
- stx %o0, [%g1 + %lo(sun4v_err_dtlb_error)]
-
-+ sethi %hi(1f), %g7
- rdpr %tl, %g4
-- cmp %g4, 1
-- ble,pt %icc, 1f
-- sethi %hi(2f), %g7
- ba,pt %xcc, etraptl1
-- or %g7, %lo(2f), %g7
--
--1: ba,pt %xcc, etrap
--2: or %g7, %lo(2b), %g7
-+1: or %g7, %lo(1f), %g7
- mov %l4, %o1
- call sun4v_dtlb_error_report
- add %sp, PTREGS_OFF, %o0
-
- /* NOTREACHED */
-
-+sun4v_bad_ra:
-+ or %g0, %g4, %g5
-+ ba,pt %xcc, sparc64_realfault_common
-+ or %g1, %g0, %g4
-+
-+ /* NOTREACHED */
-+
- /* Instruction Access Exception, tl0. */
- sun4v_iacc:
- ldxa [%g0] ASI_SCRATCHPAD, %g2
-diff --git a/arch/sparc/kernel/trampoline_64.S b/arch/sparc/kernel/trampoline_64.S
-index 737f8cb..88ede1d 100644
---- a/arch/sparc/kernel/trampoline_64.S
-+++ b/arch/sparc/kernel/trampoline_64.S
-@@ -109,10 +109,13 @@ startup_continue:
- brnz,pn %g1, 1b
- nop
-
-- sethi %hi(p1275buf), %g2
-- or %g2, %lo(p1275buf), %g2
-- ldx [%g2 + 0x10], %l2
-- add %l2, -(192 + 128), %sp
-+ /* Get onto temporary stack which will be in the locked
-+ * kernel image.
-+ */
-+ sethi %hi(tramp_stack), %g1
-+ or %g1, %lo(tramp_stack), %g1
-+ add %g1, TRAMP_STACK_SIZE, %g1
-+ sub %g1, STACKFRAME_SZ + STACK_BIAS + 256, %sp
- flushw
-
- /* Setup the loop variables:
-@@ -394,7 +397,6 @@ after_lock_tlb:
- sllx %g5, THREAD_SHIFT, %g5
- sub %g5, (STACKFRAME_SZ + STACK_BIAS), %g5
- add %g6, %g5, %sp
-- mov 0, %fp
-
- rdpr %pstate, %o1
- or %o1, PSTATE_IE, %o1
-diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index 4ced92f..25d0c7e 100644
---- a/arch/sparc/kernel/traps_64.c
-+++ b/arch/sparc/kernel/traps_64.c
-@@ -2102,6 +2102,11 @@ void sun4v_nonresum_overflow(struct pt_regs *regs)
- atomic_inc(&sun4v_nonresum_oflow_cnt);
- }
-
-+static void sun4v_tlb_error(struct pt_regs *regs)
-+{
-+ die_if_kernel("TLB/TSB error", regs);
-+}
-+
- unsigned long sun4v_err_itlb_vaddr;
- unsigned long sun4v_err_itlb_ctx;
- unsigned long sun4v_err_itlb_pte;
-@@ -2109,8 +2114,7 @@ unsigned long sun4v_err_itlb_error;
-
- void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
- {
-- if (tl > 1)
-- dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-+ dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-
- printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-@@ -2123,7 +2127,7 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
- sun4v_err_itlb_vaddr, sun4v_err_itlb_ctx,
- sun4v_err_itlb_pte, sun4v_err_itlb_error);
-
-- prom_halt();
-+ sun4v_tlb_error(regs);
- }
-
- unsigned long sun4v_err_dtlb_vaddr;
-@@ -2133,8 +2137,7 @@ unsigned long sun4v_err_dtlb_error;
-
- void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
- {
-- if (tl > 1)
-- dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-+ dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-
- printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-@@ -2147,7 +2150,7 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
- sun4v_err_dtlb_vaddr, sun4v_err_dtlb_ctx,
- sun4v_err_dtlb_pte, sun4v_err_dtlb_error);
-
-- prom_halt();
-+ sun4v_tlb_error(regs);
- }
-
- void hypervisor_tlbop_error(unsigned long err, unsigned long op)
-diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
-index 14158d4..be98685 100644
---- a/arch/sparc/kernel/tsb.S
-+++ b/arch/sparc/kernel/tsb.S
-@@ -162,10 +162,10 @@ tsb_miss_page_table_walk_sun4v_fastpath:
- nop
- .previous
-
-- rdpr %tl, %g3
-- cmp %g3, 1
-+ rdpr %tl, %g7
-+ cmp %g7, 1
- bne,pn %xcc, winfix_trampoline
-- nop
-+ mov %g3, %g4
- ba,pt %xcc, etrap
- rd %pc, %g7
- call hugetlb_setup
-diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c
-index f8e7dd5..9c5fbd0 100644
---- a/arch/sparc/kernel/viohs.c
-+++ b/arch/sparc/kernel/viohs.c
-@@ -714,7 +714,7 @@ int vio_ldc_alloc(struct vio_driver_state *vio,
- cfg.tx_irq = vio->vdev->tx_irq;
- cfg.rx_irq = vio->vdev->rx_irq;
-
-- lp = ldc_alloc(vio->vdev->channel_id, &cfg, event_arg);
-+ lp = ldc_alloc(vio->vdev->channel_id, &cfg, event_arg, vio->name);
- if (IS_ERR(lp))
- return PTR_ERR(lp);
-
-@@ -746,7 +746,7 @@ void vio_port_up(struct vio_driver_state *vio)
-
- err = 0;
- if (state == LDC_STATE_INIT) {
-- err = ldc_bind(vio->lp, vio->name);
-+ err = ldc_bind(vio->lp);
- if (err)
- printk(KERN_WARNING "%s: Port %lu bind failed, "
- "err=%d\n",
-diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
-index 932ff90..0924305 100644
---- a/arch/sparc/kernel/vmlinux.lds.S
-+++ b/arch/sparc/kernel/vmlinux.lds.S
-@@ -35,8 +35,9 @@ jiffies = jiffies_64;
-
- SECTIONS
- {
-- /* swapper_low_pmd_dir is sparc64 only */
-- swapper_low_pmd_dir = 0x0000000000402000;
-+#ifdef CONFIG_SPARC64
-+ swapper_pg_dir = 0x0000000000402000;
-+#endif
- . = INITIAL_ADDRESS;
- .text TEXTSTART :
- {
-@@ -122,11 +123,6 @@ SECTIONS
- *(.swapper_4m_tsb_phys_patch)
- __swapper_4m_tsb_phys_patch_end = .;
- }
-- .page_offset_shift_patch : {
-- __page_offset_shift_patch = .;
-- *(.page_offset_shift_patch)
-- __page_offset_shift_patch_end = .;
-- }
- .popc_3insn_patch : {
- __popc_3insn_patch = .;
- *(.popc_3insn_patch)
-diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
-index 9cf2ee0..140527a 100644
---- a/arch/sparc/lib/NG4memcpy.S
-+++ b/arch/sparc/lib/NG4memcpy.S
-@@ -41,6 +41,10 @@
- #endif
- #endif
-
-+#if !defined(EX_LD) && !defined(EX_ST)
-+#define NON_USER_COPY
-+#endif
-+
- #ifndef EX_LD
- #define EX_LD(x) x
- #endif
-@@ -197,9 +201,13 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
- mov EX_RETVAL(%o3), %o0
-
- .Llarge_src_unaligned:
-+#ifdef NON_USER_COPY
-+ VISEntryHalfFast(.Lmedium_vis_entry_fail)
-+#else
-+ VISEntryHalf
-+#endif
- andn %o2, 0x3f, %o4
- sub %o2, %o4, %o2
-- VISEntryHalf
- alignaddr %o1, %g0, %g1
- add %o1, %o4, %o1
- EX_LD(LOAD(ldd, %g1 + 0x00, %f0))
-@@ -240,6 +248,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
- nop
- ba,a,pt %icc, .Lmedium_unaligned
-
-+#ifdef NON_USER_COPY
-+.Lmedium_vis_entry_fail:
-+ or %o0, %o1, %g2
-+#endif
- .Lmedium:
- LOAD(prefetch, %o1 + 0x40, #n_reads_strong)
- andcc %g2, 0x7, %g0
-diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S
-index 99c017b..f75e690 100644
---- a/arch/sparc/lib/memset.S
-+++ b/arch/sparc/lib/memset.S
-@@ -3,8 +3,9 @@
- * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
- * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
- *
-- * Returns 0, if ok, and number of bytes not yet set if exception
-- * occurs and we were called as clear_user.
-+ * Calls to memset returns initial %o0. Calls to bzero returns 0, if ok, and
-+ * number of bytes not yet set if exception occurs and we were called as
-+ * clear_user.
- */
-
- #include <asm/ptrace.h>
-@@ -65,6 +66,8 @@ __bzero_begin:
- .globl __memset_start, __memset_end
- __memset_start:
- memset:
-+ mov %o0, %g1
-+ mov 1, %g4
- and %o1, 0xff, %g3
- sll %g3, 8, %g2
- or %g3, %g2, %g3
-@@ -89,6 +92,7 @@ memset:
- sub %o0, %o2, %o0
-
- __bzero:
-+ clr %g4
- mov %g0, %g3
- 1:
- cmp %o1, 7
-@@ -151,8 +155,8 @@ __bzero:
- bne,a 8f
- EX(stb %g3, [%o0], and %o1, 1)
- 8:
-- retl
-- clr %o0
-+ b 0f
-+ nop
- 7:
- be 13b
- orcc %o1, 0, %g0
-@@ -164,6 +168,12 @@ __bzero:
- bne 8b
- EX(stb %g3, [%o0 - 1], add %o1, 1)
- 0:
-+ andcc %g4, 1, %g0
-+ be 5f
-+ nop
-+ retl
-+ mov %g1, %o0
-+5:
- retl
- clr %o0
- __memset_end:
-diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 4ced3fc..45a413e 100644
---- a/arch/sparc/mm/fault_64.c
-+++ b/arch/sparc/mm/fault_64.c
-@@ -348,6 +348,9 @@ retry:
- down_read(&mm->mmap_sem);
- }
-
-+ if (fault_code & FAULT_CODE_BAD_RA)
-+ goto do_sigbus;
-+
- vma = find_vma(mm, address);
- if (!vma)
- goto bad_area;
-diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
-index 1aed043..ae6ce38 100644
---- a/arch/sparc/mm/gup.c
-+++ b/arch/sparc/mm/gup.c
-@@ -160,6 +160,36 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
- return 1;
- }
-
-+int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
-+ struct page **pages)
-+{
-+ struct mm_struct *mm = current->mm;
-+ unsigned long addr, len, end;
-+ unsigned long next, flags;
-+ pgd_t *pgdp;
-+ int nr = 0;
-+
-+ start &= PAGE_MASK;
-+ addr = start;
-+ len = (unsigned long) nr_pages << PAGE_SHIFT;
-+ end = start + len;
-+
-+ local_irq_save(flags);
-+ pgdp = pgd_offset(mm, addr);
-+ do {
-+ pgd_t pgd = *pgdp;
-+
-+ next = pgd_addr_end(addr, end);
-+ if (pgd_none(pgd))
-+ break;
-+ if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
-+ break;
-+ } while (pgdp++, addr = next, addr != end);
-+ local_irq_restore(flags);
-+
-+ return nr;
-+}
-+
- int get_user_pages_fast(unsigned long start, int nr_pages, int write,
- struct page **pages)
- {
-diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index 9686224..34506f2 100644
---- a/arch/sparc/mm/init_64.c
-+++ b/arch/sparc/mm/init_64.c
-@@ -73,7 +73,6 @@ unsigned long kern_linear_pte_xor[4] __read_mostly;
- * 'cpu' properties, but we need to have this table setup before the
- * MDESC is initialized.
- */
--unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
-
- #ifndef CONFIG_DEBUG_PAGEALLOC
- /* A special kernel TSB for 4MB, 256MB, 2GB and 16GB linear mappings.
-@@ -82,10 +81,11 @@ unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
- */
- extern struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
- #endif
-+extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
-
- static unsigned long cpu_pgsz_mask;
-
--#define MAX_BANKS 32
-+#define MAX_BANKS 1024
-
- static struct linux_prom64_registers pavail[MAX_BANKS];
- static int pavail_ents;
-@@ -163,10 +163,6 @@ static void __init read_obp_memory(const char *property,
- cmp_p64, NULL);
- }
-
--unsigned long sparc64_valid_addr_bitmap[VALID_ADDR_BITMAP_BYTES /
-- sizeof(unsigned long)];
--EXPORT_SYMBOL(sparc64_valid_addr_bitmap);
--
- /* Kernel physical address base and size in bytes. */
- unsigned long kern_base __read_mostly;
- unsigned long kern_size __read_mostly;
-@@ -838,7 +834,10 @@ static int find_node(unsigned long addr)
- if ((addr & p->mask) == p->val)
- return i;
- }
-- return -1;
-+ /* The following condition has been observed on LDOM guests.*/
-+ WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node"
-+ " rule. Some physical memory will be owned by node 0.");
-+ return 0;
- }
-
- static u64 memblock_nid_range(u64 start, u64 end, int *nid)
-@@ -1360,9 +1359,144 @@ static unsigned long __init bootmem_init(unsigned long phys_base)
- static struct linux_prom64_registers pall[MAX_BANKS] __initdata;
- static int pall_ents __initdata;
-
--#ifdef CONFIG_DEBUG_PAGEALLOC
-+static unsigned long max_phys_bits = 40;
-+
-+bool kern_addr_valid(unsigned long addr)
-+{
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+ pte_t *pte;
-+
-+ if ((long)addr < 0L) {
-+ unsigned long pa = __pa(addr);
-+
-+ if ((addr >> max_phys_bits) != 0UL)
-+ return false;
-+
-+ return pfn_valid(pa >> PAGE_SHIFT);
-+ }
-+
-+ if (addr >= (unsigned long) KERNBASE &&
-+ addr < (unsigned long)&_end)
-+ return true;
-+
-+ pgd = pgd_offset_k(addr);
-+ if (pgd_none(*pgd))
-+ return 0;
-+
-+ pud = pud_offset(pgd, addr);
-+ if (pud_none(*pud))
-+ return 0;
-+
-+ if (pud_large(*pud))
-+ return pfn_valid(pud_pfn(*pud));
-+
-+ pmd = pmd_offset(pud, addr);
-+ if (pmd_none(*pmd))
-+ return 0;
-+
-+ if (pmd_large(*pmd))
-+ return pfn_valid(pmd_pfn(*pmd));
-+
-+ pte = pte_offset_kernel(pmd, addr);
-+ if (pte_none(*pte))
-+ return 0;
-+
-+ return pfn_valid(pte_pfn(*pte));
-+}
-+EXPORT_SYMBOL(kern_addr_valid);
-+
-+static unsigned long __ref kernel_map_hugepud(unsigned long vstart,
-+ unsigned long vend,
-+ pud_t *pud)
-+{
-+ const unsigned long mask16gb = (1UL << 34) - 1UL;
-+ u64 pte_val = vstart;
-+
-+ /* Each PUD is 8GB */
-+ if ((vstart & mask16gb) ||
-+ (vend - vstart <= mask16gb)) {
-+ pte_val ^= kern_linear_pte_xor[2];
-+ pud_val(*pud) = pte_val | _PAGE_PUD_HUGE;
-+
-+ return vstart + PUD_SIZE;
-+ }
-+
-+ pte_val ^= kern_linear_pte_xor[3];
-+ pte_val |= _PAGE_PUD_HUGE;
-+
-+ vend = vstart + mask16gb + 1UL;
-+ while (vstart < vend) {
-+ pud_val(*pud) = pte_val;
-+
-+ pte_val += PUD_SIZE;
-+ vstart += PUD_SIZE;
-+ pud++;
-+ }
-+ return vstart;
-+}
-+
-+static bool kernel_can_map_hugepud(unsigned long vstart, unsigned long vend,
-+ bool guard)
-+{
-+ if (guard && !(vstart & ~PUD_MASK) && (vend - vstart) >= PUD_SIZE)
-+ return true;
-+
-+ return false;
-+}
-+
-+static unsigned long __ref kernel_map_hugepmd(unsigned long vstart,
-+ unsigned long vend,
-+ pmd_t *pmd)
-+{
-+ const unsigned long mask256mb = (1UL << 28) - 1UL;
-+ const unsigned long mask2gb = (1UL << 31) - 1UL;
-+ u64 pte_val = vstart;
-+
-+ /* Each PMD is 8MB */
-+ if ((vstart & mask256mb) ||
-+ (vend - vstart <= mask256mb)) {
-+ pte_val ^= kern_linear_pte_xor[0];
-+ pmd_val(*pmd) = pte_val | _PAGE_PMD_HUGE;
-+
-+ return vstart + PMD_SIZE;
-+ }
-+
-+ if ((vstart & mask2gb) ||
-+ (vend - vstart <= mask2gb)) {
-+ pte_val ^= kern_linear_pte_xor[1];
-+ pte_val |= _PAGE_PMD_HUGE;
-+ vend = vstart + mask256mb + 1UL;
-+ } else {
-+ pte_val ^= kern_linear_pte_xor[2];
-+ pte_val |= _PAGE_PMD_HUGE;
-+ vend = vstart + mask2gb + 1UL;
-+ }
-+
-+ while (vstart < vend) {
-+ pmd_val(*pmd) = pte_val;
-+
-+ pte_val += PMD_SIZE;
-+ vstart += PMD_SIZE;
-+ pmd++;
-+ }
-+
-+ return vstart;
-+}
-+
-+static bool kernel_can_map_hugepmd(unsigned long vstart, unsigned long vend,
-+ bool guard)
-+{
-+ if (guard && !(vstart & ~PMD_MASK) && (vend - vstart) >= PMD_SIZE)
-+ return true;
-+
-+ return false;
-+}
-+
- static unsigned long __ref kernel_map_range(unsigned long pstart,
-- unsigned long pend, pgprot_t prot)
-+ unsigned long pend, pgprot_t prot,
-+ bool use_huge)
- {
- unsigned long vstart = PAGE_OFFSET + pstart;
- unsigned long vend = PAGE_OFFSET + pend;
-@@ -1381,19 +1515,34 @@ static unsigned long __ref kernel_map_range(unsigned long pstart,
- pmd_t *pmd;
- pte_t *pte;
-
-+ if (pgd_none(*pgd)) {
-+ pud_t *new;
-+
-+ new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
-+ alloc_bytes += PAGE_SIZE;
-+ pgd_populate(&init_mm, pgd, new);
-+ }
- pud = pud_offset(pgd, vstart);
- if (pud_none(*pud)) {
- pmd_t *new;
-
-+ if (kernel_can_map_hugepud(vstart, vend, use_huge)) {
-+ vstart = kernel_map_hugepud(vstart, vend, pud);
-+ continue;
-+ }
- new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
- alloc_bytes += PAGE_SIZE;
- pud_populate(&init_mm, pud, new);
- }
-
- pmd = pmd_offset(pud, vstart);
-- if (!pmd_present(*pmd)) {
-+ if (pmd_none(*pmd)) {
- pte_t *new;
-
-+ if (kernel_can_map_hugepmd(vstart, vend, use_huge)) {
-+ vstart = kernel_map_hugepmd(vstart, vend, pmd);
-+ continue;
-+ }
- new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
- alloc_bytes += PAGE_SIZE;
- pmd_populate_kernel(&init_mm, pmd, new);
-@@ -1416,100 +1565,34 @@ static unsigned long __ref kernel_map_range(unsigned long pstart,
- return alloc_bytes;
- }
-
--extern unsigned int kvmap_linear_patch[1];
--#endif /* CONFIG_DEBUG_PAGEALLOC */
--
--static void __init kpte_set_val(unsigned long index, unsigned long val)
-+static void __init flush_all_kernel_tsbs(void)
- {
-- unsigned long *ptr = kpte_linear_bitmap;
--
-- val <<= ((index % (BITS_PER_LONG / 2)) * 2);
-- ptr += (index / (BITS_PER_LONG / 2));
--
-- *ptr |= val;
--}
--
--static const unsigned long kpte_shift_min = 28; /* 256MB */
--static const unsigned long kpte_shift_max = 34; /* 16GB */
--static const unsigned long kpte_shift_incr = 3;
--
--static unsigned long kpte_mark_using_shift(unsigned long start, unsigned long end,
-- unsigned long shift)
--{
-- unsigned long size = (1UL << shift);
-- unsigned long mask = (size - 1UL);
-- unsigned long remains = end - start;
-- unsigned long val;
--
-- if (remains < size || (start & mask))
-- return start;
--
-- /* VAL maps:
-- *
-- * shift 28 --> kern_linear_pte_xor index 1
-- * shift 31 --> kern_linear_pte_xor index 2
-- * shift 34 --> kern_linear_pte_xor index 3
-- */
-- val = ((shift - kpte_shift_min) / kpte_shift_incr) + 1;
--
-- remains &= ~mask;
-- if (shift != kpte_shift_max)
-- remains = size;
--
-- while (remains) {
-- unsigned long index = start >> kpte_shift_min;
-+ int i;
-
-- kpte_set_val(index, val);
-+ for (i = 0; i < KERNEL_TSB_NENTRIES; i++) {
-+ struct tsb *ent = &swapper_tsb[i];
-
-- start += 1UL << kpte_shift_min;
-- remains -= 1UL << kpte_shift_min;
-+ ent->tag = (1UL << TSB_TAG_INVALID_BIT);
- }
-+#ifndef CONFIG_DEBUG_PAGEALLOC
-+ for (i = 0; i < KERNEL_TSB4M_NENTRIES; i++) {
-+ struct tsb *ent = &swapper_4m_tsb[i];
-
-- return start;
--}
--
--static void __init mark_kpte_bitmap(unsigned long start, unsigned long end)
--{
-- unsigned long smallest_size, smallest_mask;
-- unsigned long s;
--
-- smallest_size = (1UL << kpte_shift_min);
-- smallest_mask = (smallest_size - 1UL);
--
-- while (start < end) {
-- unsigned long orig_start = start;
--
-- for (s = kpte_shift_max; s >= kpte_shift_min; s -= kpte_shift_incr) {
-- start = kpte_mark_using_shift(start, end, s);
--
-- if (start != orig_start)
-- break;
-- }
--
-- if (start == orig_start)
-- start = (start + smallest_size) & ~smallest_mask;
-+ ent->tag = (1UL << TSB_TAG_INVALID_BIT);
- }
-+#endif
- }
-
--static void __init init_kpte_bitmap(void)
--{
-- unsigned long i;
--
-- for (i = 0; i < pall_ents; i++) {
-- unsigned long phys_start, phys_end;
--
-- phys_start = pall[i].phys_addr;
-- phys_end = phys_start + pall[i].reg_size;
--
-- mark_kpte_bitmap(phys_start, phys_end);
-- }
--}
-+extern unsigned int kvmap_linear_patch[1];
-
- static void __init kernel_physical_mapping_init(void)
- {
--#ifdef CONFIG_DEBUG_PAGEALLOC
- unsigned long i, mem_alloced = 0UL;
-+ bool use_huge = true;
-
-+#ifdef CONFIG_DEBUG_PAGEALLOC
-+ use_huge = false;
-+#endif
- for (i = 0; i < pall_ents; i++) {
- unsigned long phys_start, phys_end;
-
-@@ -1517,7 +1600,7 @@ static void __init kernel_physical_mapping_init(void)
- phys_end = phys_start + pall[i].reg_size;
-
- mem_alloced += kernel_map_range(phys_start, phys_end,
-- PAGE_KERNEL);
-+ PAGE_KERNEL, use_huge);
- }
-
- printk("Allocated %ld bytes for kernel page tables.\n",
-@@ -1526,8 +1609,9 @@ static void __init kernel_physical_mapping_init(void)
- kvmap_linear_patch[0] = 0x01000000; /* nop */
- flushi(&kvmap_linear_patch[0]);
-
-+ flush_all_kernel_tsbs();
-+
- __flush_tlb_all();
--#endif
- }
-
- #ifdef CONFIG_DEBUG_PAGEALLOC
-@@ -1537,7 +1621,7 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
- unsigned long phys_end = phys_start + (numpages * PAGE_SIZE);
-
- kernel_map_range(phys_start, phys_end,
-- (enable ? PAGE_KERNEL : __pgprot(0)));
-+ (enable ? PAGE_KERNEL : __pgprot(0)), false);
-
- flush_tsb_kernel_range(PAGE_OFFSET + phys_start,
- PAGE_OFFSET + phys_end);
-@@ -1565,76 +1649,56 @@ unsigned long __init find_ecache_flush_span(unsigned long size)
- unsigned long PAGE_OFFSET;
- EXPORT_SYMBOL(PAGE_OFFSET);
-
--static void __init page_offset_shift_patch_one(unsigned int *insn, unsigned long phys_bits)
--{
-- unsigned long final_shift;
-- unsigned int val = *insn;
-- unsigned int cnt;
--
-- /* We are patching in ilog2(max_supported_phys_address), and
-- * we are doing so in a manner similar to a relocation addend.
-- * That is, we are adding the shift value to whatever value
-- * is in the shift instruction count field already.
-- */
-- cnt = (val & 0x3f);
-- val &= ~0x3f;
--
-- /* If we are trying to shift >= 64 bits, clear the destination
-- * register. This can happen when phys_bits ends up being equal
-- * to MAX_PHYS_ADDRESS_BITS.
-- */
-- final_shift = (cnt + (64 - phys_bits));
-- if (final_shift >= 64) {
-- unsigned int rd = (val >> 25) & 0x1f;
--
-- val = 0x80100000 | (rd << 25);
-- } else {
-- val |= final_shift;
-- }
-- *insn = val;
--
-- __asm__ __volatile__("flush %0"
-- : /* no outputs */
-- : "r" (insn));
--}
--
--static void __init page_offset_shift_patch(unsigned long phys_bits)
--{
-- extern unsigned int __page_offset_shift_patch;
-- extern unsigned int __page_offset_shift_patch_end;
-- unsigned int *p;
--
-- p = &__page_offset_shift_patch;
-- while (p < &__page_offset_shift_patch_end) {
-- unsigned int *insn = (unsigned int *)(unsigned long)*p;
-+unsigned long VMALLOC_END = 0x0000010000000000UL;
-+EXPORT_SYMBOL(VMALLOC_END);
-
-- page_offset_shift_patch_one(insn, phys_bits);
--
-- p++;
-- }
--}
-+unsigned long sparc64_va_hole_top = 0xfffff80000000000UL;
-+unsigned long sparc64_va_hole_bottom = 0x0000080000000000UL;
-
- static void __init setup_page_offset(void)
- {
-- unsigned long max_phys_bits = 40;
--
- if (tlb_type == cheetah || tlb_type == cheetah_plus) {
-+ /* Cheetah/Panther support a full 64-bit virtual
-+ * address, so we can use all that our page tables
-+ * support.
-+ */
-+ sparc64_va_hole_top = 0xfff0000000000000UL;
-+ sparc64_va_hole_bottom = 0x0010000000000000UL;
-+
- max_phys_bits = 42;
- } else if (tlb_type == hypervisor) {
- switch (sun4v_chip_type) {
- case SUN4V_CHIP_NIAGARA1:
- case SUN4V_CHIP_NIAGARA2:
-+ /* T1 and T2 support 48-bit virtual addresses. */
-+ sparc64_va_hole_top = 0xffff800000000000UL;
-+ sparc64_va_hole_bottom = 0x0000800000000000UL;
-+
- max_phys_bits = 39;
- break;
- case SUN4V_CHIP_NIAGARA3:
-+ /* T3 supports 48-bit virtual addresses. */
-+ sparc64_va_hole_top = 0xffff800000000000UL;
-+ sparc64_va_hole_bottom = 0x0000800000000000UL;
-+
- max_phys_bits = 43;
- break;
- case SUN4V_CHIP_NIAGARA4:
- case SUN4V_CHIP_NIAGARA5:
- case SUN4V_CHIP_SPARC64X:
-- default:
-+ case SUN4V_CHIP_SPARC_M6:
-+ /* T4 and later support 52-bit virtual addresses. */
-+ sparc64_va_hole_top = 0xfff8000000000000UL;
-+ sparc64_va_hole_bottom = 0x0008000000000000UL;
- max_phys_bits = 47;
- break;
-+ case SUN4V_CHIP_SPARC_M7:
-+ default:
-+ /* M7 and later support 52-bit virtual addresses. */
-+ sparc64_va_hole_top = 0xfff8000000000000UL;
-+ sparc64_va_hole_bottom = 0x0008000000000000UL;
-+ max_phys_bits = 49;
-+ break;
- }
- }
-
-@@ -1644,12 +1708,16 @@ static void __init setup_page_offset(void)
- prom_halt();
- }
-
-- PAGE_OFFSET = PAGE_OFFSET_BY_BITS(max_phys_bits);
-+ PAGE_OFFSET = sparc64_va_hole_top;
-+ VMALLOC_END = ((sparc64_va_hole_bottom >> 1) +
-+ (sparc64_va_hole_bottom >> 2));
-
-- pr_info("PAGE_OFFSET is 0x%016lx (max_phys_bits == %lu)\n",
-+ pr_info("MM: PAGE_OFFSET is 0x%016lx (max_phys_bits == %lu)\n",
- PAGE_OFFSET, max_phys_bits);
--
-- page_offset_shift_patch(max_phys_bits);
-+ pr_info("MM: VMALLOC [0x%016lx --> 0x%016lx]\n",
-+ VMALLOC_START, VMALLOC_END);
-+ pr_info("MM: VMEMMAP [0x%016lx --> 0x%016lx]\n",
-+ VMEMMAP_BASE, VMEMMAP_BASE << 1);
- }
-
- static void __init tsb_phys_patch(void)
-@@ -1694,21 +1762,42 @@ static void __init tsb_phys_patch(void)
- #define NUM_KTSB_DESCR 1
- #endif
- static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
--extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
-+
-+/* The swapper TSBs are loaded with a base sequence of:
-+ *
-+ * sethi %uhi(SYMBOL), REG1
-+ * sethi %hi(SYMBOL), REG2
-+ * or REG1, %ulo(SYMBOL), REG1
-+ * or REG2, %lo(SYMBOL), REG2
-+ * sllx REG1, 32, REG1
-+ * or REG1, REG2, REG1
-+ *
-+ * When we use physical addressing for the TSB accesses, we patch the
-+ * first four instructions in the above sequence.
-+ */
-
- static void patch_one_ktsb_phys(unsigned int *start, unsigned int *end, unsigned long pa)
- {
-- pa >>= KTSB_PHYS_SHIFT;
-+ unsigned long high_bits, low_bits;
-+
-+ high_bits = (pa >> 32) & 0xffffffff;
-+ low_bits = (pa >> 0) & 0xffffffff;
-
- while (start < end) {
- unsigned int *ia = (unsigned int *)(unsigned long)*start;
-
-- ia[0] = (ia[0] & ~0x3fffff) | (pa >> 10);
-+ ia[0] = (ia[0] & ~0x3fffff) | (high_bits >> 10);
- __asm__ __volatile__("flush %0" : : "r" (ia));
-
-- ia[1] = (ia[1] & ~0x3ff) | (pa & 0x3ff);
-+ ia[1] = (ia[1] & ~0x3fffff) | (low_bits >> 10);
- __asm__ __volatile__("flush %0" : : "r" (ia + 1));
-
-+ ia[2] = (ia[2] & ~0x1fff) | (high_bits & 0x3ff);
-+ __asm__ __volatile__("flush %0" : : "r" (ia + 2));
-+
-+ ia[3] = (ia[3] & ~0x1fff) | (low_bits & 0x3ff);
-+ __asm__ __volatile__("flush %0" : : "r" (ia + 3));
-+
- start++;
- }
- }
-@@ -1847,7 +1936,6 @@ static void __init sun4v_linear_pte_xor_finalize(void)
- /* paging_init() sets up the page tables */
-
- static unsigned long last_valid_pfn;
--pgd_t swapper_pg_dir[PTRS_PER_PGD];
-
- static void sun4u_pgprot_init(void);
- static void sun4v_pgprot_init(void);
-@@ -1950,16 +2038,10 @@ void __init paging_init(void)
- */
- init_mm.pgd += ((shift) / (sizeof(pgd_t)));
-
-- memset(swapper_low_pmd_dir, 0, sizeof(swapper_low_pmd_dir));
-+ memset(swapper_pg_dir, 0, sizeof(swapper_pg_dir));
-
-- /* Now can init the kernel/bad page tables. */
-- pud_set(pud_offset(&swapper_pg_dir[0], 0),
-- swapper_low_pmd_dir + (shift / sizeof(pgd_t)));
--
- inherit_prom_mappings();
-
-- init_kpte_bitmap();
--
- /* Ok, we can use our TLB miss and window trap handlers safely. */
- setup_tba();
-
-@@ -2066,70 +2148,6 @@ int page_in_phys_avail(unsigned long paddr)
- return 0;
- }
-
--static struct linux_prom64_registers pavail_rescan[MAX_BANKS] __initdata;
--static int pavail_rescan_ents __initdata;
--
--/* Certain OBP calls, such as fetching "available" properties, can
-- * claim physical memory. So, along with initializing the valid
-- * address bitmap, what we do here is refetch the physical available
-- * memory list again, and make sure it provides at least as much
-- * memory as 'pavail' does.
-- */
--static void __init setup_valid_addr_bitmap_from_pavail(unsigned long *bitmap)
--{
-- int i;
--
-- read_obp_memory("available", &pavail_rescan[0], &pavail_rescan_ents);
--
-- for (i = 0; i < pavail_ents; i++) {
-- unsigned long old_start, old_end;
--
-- old_start = pavail[i].phys_addr;
-- old_end = old_start + pavail[i].reg_size;
-- while (old_start < old_end) {
-- int n;
--
-- for (n = 0; n < pavail_rescan_ents; n++) {
-- unsigned long new_start, new_end;
--
-- new_start = pavail_rescan[n].phys_addr;
-- new_end = new_start +
-- pavail_rescan[n].reg_size;
--
-- if (new_start <= old_start &&
-- new_end >= (old_start + PAGE_SIZE)) {
-- set_bit(old_start >> ILOG2_4MB, bitmap);
-- goto do_next_page;
-- }
-- }
--
-- prom_printf("mem_init: Lost memory in pavail\n");
-- prom_printf("mem_init: OLD start[%lx] size[%lx]\n",
-- pavail[i].phys_addr,
-- pavail[i].reg_size);
-- prom_printf("mem_init: NEW start[%lx] size[%lx]\n",
-- pavail_rescan[i].phys_addr,
-- pavail_rescan[i].reg_size);
-- prom_printf("mem_init: Cannot continue, aborting.\n");
-- prom_halt();
--
-- do_next_page:
-- old_start += PAGE_SIZE;
-- }
-- }
--}
--
--static void __init patch_tlb_miss_handler_bitmap(void)
--{
-- extern unsigned int valid_addr_bitmap_insn[];
-- extern unsigned int valid_addr_bitmap_patch[];
--
-- valid_addr_bitmap_insn[1] = valid_addr_bitmap_patch[1];
-- mb();
-- valid_addr_bitmap_insn[0] = valid_addr_bitmap_patch[0];
-- flushi(&valid_addr_bitmap_insn[0]);
--}
--
- static void __init register_page_bootmem_info(void)
- {
- #ifdef CONFIG_NEED_MULTIPLE_NODES
-@@ -2142,18 +2160,6 @@ static void __init register_page_bootmem_info(void)
- }
- void __init mem_init(void)
- {
-- unsigned long addr, last;
--
-- addr = PAGE_OFFSET + kern_base;
-- last = PAGE_ALIGN(kern_size) + addr;
-- while (addr < last) {
-- set_bit(__pa(addr) >> ILOG2_4MB, sparc64_valid_addr_bitmap);
-- addr += PAGE_SIZE;
-- }
--
-- setup_valid_addr_bitmap_from_pavail(sparc64_valid_addr_bitmap);
-- patch_tlb_miss_handler_bitmap();
--
- high_memory = __va(last_valid_pfn << PAGE_SHIFT);
-
- register_page_bootmem_info();
-@@ -2243,18 +2249,9 @@ unsigned long _PAGE_CACHE __read_mostly;
- EXPORT_SYMBOL(_PAGE_CACHE);
-
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
--unsigned long vmemmap_table[VMEMMAP_SIZE];
--
--static long __meminitdata addr_start, addr_end;
--static int __meminitdata node_start;
--
- int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
- int node)
- {
-- unsigned long phys_start = (vstart - VMEMMAP_BASE);
-- unsigned long phys_end = (vend - VMEMMAP_BASE);
-- unsigned long addr = phys_start & VMEMMAP_CHUNK_MASK;
-- unsigned long end = VMEMMAP_ALIGN(phys_end);
- unsigned long pte_base;
-
- pte_base = (_PAGE_VALID | _PAGE_SZ4MB_4U |
-@@ -2265,47 +2262,52 @@ int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
- _PAGE_CP_4V | _PAGE_CV_4V |
- _PAGE_P_4V | _PAGE_W_4V);
-
-- for (; addr < end; addr += VMEMMAP_CHUNK) {
-- unsigned long *vmem_pp =
-- vmemmap_table + (addr >> VMEMMAP_CHUNK_SHIFT);
-- void *block;
-+ pte_base |= _PAGE_PMD_HUGE;
-
-- if (!(*vmem_pp & _PAGE_VALID)) {
-- block = vmemmap_alloc_block(1UL << ILOG2_4MB, node);
-- if (!block)
-+ vstart = vstart & PMD_MASK;
-+ vend = ALIGN(vend, PMD_SIZE);
-+ for (; vstart < vend; vstart += PMD_SIZE) {
-+ pgd_t *pgd = pgd_offset_k(vstart);
-+ unsigned long pte;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+
-+ if (pgd_none(*pgd)) {
-+ pud_t *new = vmemmap_alloc_block(PAGE_SIZE, node);
-+
-+ if (!new)
- return -ENOMEM;
-+ pgd_populate(&init_mm, pgd, new);
-+ }
-
-- *vmem_pp = pte_base | __pa(block);
-+ pud = pud_offset(pgd, vstart);
-+ if (pud_none(*pud)) {
-+ pmd_t *new = vmemmap_alloc_block(PAGE_SIZE, node);
-
-- /* check to see if we have contiguous blocks */
-- if (addr_end != addr || node_start != node) {
-- if (addr_start)
-- printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
-- addr_start, addr_end-1, node_start);
-- addr_start = addr;
-- node_start = node;
-- }
-- addr_end = addr + VMEMMAP_CHUNK;
-+ if (!new)
-+ return -ENOMEM;
-+ pud_populate(&init_mm, pud, new);
- }
-- }
-- return 0;
--}
-
--void __meminit vmemmap_populate_print_last(void)
--{
-- if (addr_start) {
-- printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
-- addr_start, addr_end-1, node_start);
-- addr_start = 0;
-- addr_end = 0;
-- node_start = 0;
-+ pmd = pmd_offset(pud, vstart);
-+
-+ pte = pmd_val(*pmd);
-+ if (!(pte & _PAGE_VALID)) {
-+ void *block = vmemmap_alloc_block(PMD_SIZE, node);
-+
-+ if (!block)
-+ return -ENOMEM;
-+
-+ pmd_val(*pmd) = pte_base | __pa(block);
-+ }
- }
-+
-+ return 0;
- }
-
- void vmemmap_free(unsigned long start, unsigned long end)
- {
- }
--
- #endif /* CONFIG_SPARSEMEM_VMEMMAP */
-
- static void prot_init_common(unsigned long page_none,
-@@ -2717,8 +2719,8 @@ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
- do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
- }
- if (end > HI_OBP_ADDRESS) {
-- flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
-- do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
-+ flush_tsb_kernel_range(HI_OBP_ADDRESS, end);
-+ do_flush_tlb_kernel_range(HI_OBP_ADDRESS, end);
- }
- } else {
- flush_tsb_kernel_range(start, end);
-diff --git a/arch/sparc/mm/init_64.h b/arch/sparc/mm/init_64.h
-index 5d3782de..ac49119 100644
---- a/arch/sparc/mm/init_64.h
-+++ b/arch/sparc/mm/init_64.h
-@@ -8,15 +8,8 @@
- */
-
- #define MAX_PHYS_ADDRESS (1UL << MAX_PHYS_ADDRESS_BITS)
--#define KPTE_BITMAP_CHUNK_SZ (256UL * 1024UL * 1024UL)
--#define KPTE_BITMAP_BYTES \
-- ((MAX_PHYS_ADDRESS / KPTE_BITMAP_CHUNK_SZ) / 4)
--#define VALID_ADDR_BITMAP_CHUNK_SZ (4UL * 1024UL * 1024UL)
--#define VALID_ADDR_BITMAP_BYTES \
-- ((MAX_PHYS_ADDRESS / VALID_ADDR_BITMAP_CHUNK_SZ) / 8)
-
- extern unsigned long kern_linear_pte_xor[4];
--extern unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
- extern unsigned int sparc64_highest_unlocked_tlb_ent;
- extern unsigned long sparc64_kern_pri_context;
- extern unsigned long sparc64_kern_pri_nuc_bits;
-@@ -38,15 +31,4 @@ extern unsigned long kern_locked_tte_data;
-
- extern void prom_world(int enter);
-
--#ifdef CONFIG_SPARSEMEM_VMEMMAP
--#define VMEMMAP_CHUNK_SHIFT 22
--#define VMEMMAP_CHUNK (1UL << VMEMMAP_CHUNK_SHIFT)
--#define VMEMMAP_CHUNK_MASK ~(VMEMMAP_CHUNK - 1UL)
--#define VMEMMAP_ALIGN(x) (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
--
--#define VMEMMAP_SIZE ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
-- sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
--extern unsigned long vmemmap_table[VMEMMAP_SIZE];
--#endif
--
- #endif /* _SPARC64_MM_INIT_H */
-diff --git a/arch/sparc/power/hibernate_asm.S b/arch/sparc/power/hibernate_asm.S
-index 7994216..d7d9017 100644
---- a/arch/sparc/power/hibernate_asm.S
-+++ b/arch/sparc/power/hibernate_asm.S
-@@ -54,8 +54,8 @@ ENTRY(swsusp_arch_resume)
- nop
-
- /* Write PAGE_OFFSET to %g7 */
-- sethi %uhi(PAGE_OFFSET), %g7
-- sllx %g7, 32, %g7
-+ sethi %hi(PAGE_OFFSET), %g7
-+ ldx [%g7 + %lo(PAGE_OFFSET)], %g7
-
- setuw (PAGE_SIZE-8), %g3
-
-diff --git a/arch/sparc/prom/bootstr_64.c b/arch/sparc/prom/bootstr_64.c
-index ab9ccc6..7149e77 100644
---- a/arch/sparc/prom/bootstr_64.c
-+++ b/arch/sparc/prom/bootstr_64.c
-@@ -14,7 +14,10 @@
- * the .bss section or it will break things.
- */
-
--#define BARG_LEN 256
-+/* We limit BARG_LEN to 1024 because this is the size of the
-+ * 'barg_out' command line buffer in the SILO bootloader.
-+ */
-+#define BARG_LEN 1024
- struct {
- int bootstr_len;
- int bootstr_valid;
-diff --git a/arch/sparc/prom/cif.S b/arch/sparc/prom/cif.S
-index 9c86b4b..8050f38 100644
---- a/arch/sparc/prom/cif.S
-+++ b/arch/sparc/prom/cif.S
-@@ -11,11 +11,10 @@
- .text
- .globl prom_cif_direct
- prom_cif_direct:
-+ save %sp, -192, %sp
- sethi %hi(p1275buf), %o1
- or %o1, %lo(p1275buf), %o1
-- ldx [%o1 + 0x0010], %o2 ! prom_cif_stack
-- save %o2, -192, %sp
-- ldx [%i1 + 0x0008], %l2 ! prom_cif_handler
-+ ldx [%o1 + 0x0008], %l2 ! prom_cif_handler
- mov %g4, %l0
- mov %g5, %l1
- mov %g6, %l3
-diff --git a/arch/sparc/prom/init_64.c b/arch/sparc/prom/init_64.c
-index d95db75..110b0d7 100644
---- a/arch/sparc/prom/init_64.c
-+++ b/arch/sparc/prom/init_64.c
-@@ -26,13 +26,13 @@ phandle prom_chosen_node;
- * It gets passed the pointer to the PROM vector.
- */
-
--extern void prom_cif_init(void *, void *);
-+extern void prom_cif_init(void *);
-
--void __init prom_init(void *cif_handler, void *cif_stack)
-+void __init prom_init(void *cif_handler)
- {
- phandle node;
-
-- prom_cif_init(cif_handler, cif_stack);
-+ prom_cif_init(cif_handler);
-
- prom_chosen_node = prom_finddevice(prom_chosen_path);
- if (!prom_chosen_node || (s32)prom_chosen_node == -1)
-diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c
-index e58b817..545d8bb 100644
---- a/arch/sparc/prom/p1275.c
-+++ b/arch/sparc/prom/p1275.c
-@@ -9,6 +9,7 @@
- #include <linux/smp.h>
- #include <linux/string.h>
- #include <linux/spinlock.h>
-+#include <linux/irqflags.h>
-
- #include <asm/openprom.h>
- #include <asm/oplib.h>
-@@ -19,7 +20,6 @@
- struct {
- long prom_callback; /* 0x00 */
- void (*prom_cif_handler)(long *); /* 0x08 */
-- unsigned long prom_cif_stack; /* 0x10 */
- } p1275buf;
-
- extern void prom_world(int);
-@@ -36,8 +36,8 @@ void p1275_cmd_direct(unsigned long *args)
- {
- unsigned long flags;
-
-- raw_local_save_flags(flags);
-- raw_local_irq_restore((unsigned long)PIL_NMI);
-+ local_save_flags(flags);
-+ local_irq_restore((unsigned long)PIL_NMI);
- raw_spin_lock(&prom_entry_lock);
-
- prom_world(1);
-@@ -45,11 +45,10 @@ void p1275_cmd_direct(unsigned long *args)
- prom_world(0);
-
- raw_spin_unlock(&prom_entry_lock);
-- raw_local_irq_restore(flags);
-+ local_irq_restore(flags);
- }
-
- void prom_cif_init(void *cif_handler, void *cif_stack)
- {
- p1275buf.prom_cif_handler = (void (*)(long *))cif_handler;
-- p1275buf.prom_cif_stack = (unsigned long)cif_stack;
- }
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index d71d5ac..ac63ea4 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -480,6 +480,7 @@ struct kvm_vcpu_arch {
- u64 mmio_gva;
- unsigned access;
- gfn_t mmio_gfn;
-+ u64 mmio_gen;
-
- struct kvm_pmu pmu;
-
-diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
-index 5cd9bfa..c1a07d3 100644
---- a/arch/x86/kernel/cpu/intel.c
-+++ b/arch/x86/kernel/cpu/intel.c
-@@ -153,6 +153,21 @@ static void early_init_intel(struct cpuinfo_x86 *c)
- setup_clear_cpu_cap(X86_FEATURE_ERMS);
- }
- }
-+
-+ /*
-+ * Intel Quark Core DevMan_001.pdf section 6.4.11
-+ * "The operating system also is required to invalidate (i.e., flush)
-+ * the TLB when any changes are made to any of the page table entries.
-+ * The operating system must reload CR3 to cause the TLB to be flushed"
-+ *
-+ * As a result cpu_has_pge() in arch/x86/include/asm/tlbflush.h should
-+ * be false so that __flush_tlb_all() causes CR3 insted of CR4.PGE
-+ * to be modified
-+ */
-+ if (c->x86 == 5 && c->x86_model == 9) {
-+ pr_info("Disabling PGE capability bit\n");
-+ setup_clear_cpu_cap(X86_FEATURE_PGE);
-+ }
- }
-
- #ifdef CONFIG_X86_32
-diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index 9b53135..49088b8 100644
---- a/arch/x86/kvm/mmu.c
-+++ b/arch/x86/kvm/mmu.c
-@@ -198,16 +198,20 @@ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask)
- EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask);
-
- /*
-- * spte bits of bit 3 ~ bit 11 are used as low 9 bits of generation number,
-- * the bits of bits 52 ~ bit 61 are used as high 10 bits of generation
-- * number.
-+ * the low bit of the generation number is always presumed to be zero.
-+ * This disables mmio caching during memslot updates. The concept is
-+ * similar to a seqcount but instead of retrying the access we just punt
-+ * and ignore the cache.
-+ *
-+ * spte bits 3-11 are used as bits 1-9 of the generation number,
-+ * the bits 52-61 are used as bits 10-19 of the generation number.
- */
--#define MMIO_SPTE_GEN_LOW_SHIFT 3
-+#define MMIO_SPTE_GEN_LOW_SHIFT 2
- #define MMIO_SPTE_GEN_HIGH_SHIFT 52
-
--#define MMIO_GEN_SHIFT 19
--#define MMIO_GEN_LOW_SHIFT 9
--#define MMIO_GEN_LOW_MASK ((1 << MMIO_GEN_LOW_SHIFT) - 1)
-+#define MMIO_GEN_SHIFT 20
-+#define MMIO_GEN_LOW_SHIFT 10
-+#define MMIO_GEN_LOW_MASK ((1 << MMIO_GEN_LOW_SHIFT) - 2)
- #define MMIO_GEN_MASK ((1 << MMIO_GEN_SHIFT) - 1)
- #define MMIO_MAX_GEN ((1 << MMIO_GEN_SHIFT) - 1)
-
-@@ -3157,7 +3161,7 @@ static void mmu_sync_roots(struct kvm_vcpu *vcpu)
- if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
- return;
-
-- vcpu_clear_mmio_info(vcpu, ~0ul);
-+ vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY);
- kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
- if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
- hpa_t root = vcpu->arch.mmu.root_hpa;
-@@ -4379,7 +4383,7 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
- * The very rare case: if the generation-number is round,
- * zap all shadow pages.
- */
-- if (unlikely(kvm_current_mmio_generation(kvm) >= MMIO_MAX_GEN)) {
-+ if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
- printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
- kvm_mmu_invalidate_zap_all_pages(kvm);
- }
-diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
-index 8da5823..21ea4fc 100644
---- a/arch/x86/kvm/x86.h
-+++ b/arch/x86/kvm/x86.h
-@@ -78,15 +78,23 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
- vcpu->arch.mmio_gva = gva & PAGE_MASK;
- vcpu->arch.access = access;
- vcpu->arch.mmio_gfn = gfn;
-+ vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation;
-+}
-+
-+static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
-+{
-+ return vcpu->arch.mmio_gen == kvm_memslots(vcpu->kvm)->generation;
- }
-
- /*
-- * Clear the mmio cache info for the given gva,
-- * specially, if gva is ~0ul, we clear all mmio cache info.
-+ * Clear the mmio cache info for the given gva. If gva is MMIO_GVA_ANY, we
-+ * clear all mmio cache info.
- */
-+#define MMIO_GVA_ANY (~(gva_t)0)
-+
- static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
- {
-- if (gva != (~0ul) && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
-+ if (gva != MMIO_GVA_ANY && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
- return;
-
- vcpu->arch.mmio_gva = 0;
-@@ -94,7 +102,8 @@ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
-
- static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
- {
-- if (vcpu->arch.mmio_gva && vcpu->arch.mmio_gva == (gva & PAGE_MASK))
-+ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gva &&
-+ vcpu->arch.mmio_gva == (gva & PAGE_MASK))
- return true;
-
- return false;
-@@ -102,7 +111,8 @@ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
-
- static inline bool vcpu_match_mmio_gpa(struct kvm_vcpu *vcpu, gpa_t gpa)
- {
-- if (vcpu->arch.mmio_gfn && vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
-+ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gfn &&
-+ vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
- return true;
-
- return false;
-diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
-index 3c562f5..e1bce26 100644
---- a/crypto/async_tx/async_xor.c
-+++ b/crypto/async_tx/async_xor.c
-@@ -78,8 +78,6 @@ do_async_xor(struct dma_chan *chan, struct dmaengine_unmap_data *unmap,
- tx = dma->device_prep_dma_xor(chan, dma_dest, src_list,
- xor_src_cnt, unmap->len,
- dma_flags);
-- src_list[0] = tmp;
--
-
- if (unlikely(!tx))
- async_tx_quiesce(&submit->depend_tx);
-@@ -92,6 +90,7 @@ do_async_xor(struct dma_chan *chan, struct dmaengine_unmap_data *unmap,
- xor_src_cnt, unmap->len,
- dma_flags);
- }
-+ src_list[0] = tmp;
-
- dma_set_unmap(tx, unmap);
- async_tx_submit(chan, tx, submit);
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index c30df50e..2495ee5 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -1081,6 +1081,9 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
- if (!firmware_p)
- return -EINVAL;
-
-+ if (!name || name[0] == '\0')
-+ return -EINVAL;
-+
- ret = _request_firmware_prepare(&fw, name, device);
- if (ret <= 0) /* error or already assigned */
- goto out;
-diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
-index c5471cd..d39fd61 100644
---- a/drivers/base/regmap/regmap-debugfs.c
-+++ b/drivers/base/regmap/regmap-debugfs.c
-@@ -473,6 +473,7 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
- {
- struct rb_node *next;
- struct regmap_range_node *range_node;
-+ const char *devname = "dummy";
-
- /* If we don't have the debugfs root yet, postpone init */
- if (!regmap_debugfs_root) {
-@@ -491,12 +492,15 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
- INIT_LIST_HEAD(&map->debugfs_off_cache);
- mutex_init(&map->cache_lock);
-
-+ if (map->dev)
-+ devname = dev_name(map->dev);
-+
- if (name) {
- map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s",
-- dev_name(map->dev), name);
-+ devname, name);
- name = map->debugfs_name;
- } else {
-- name = dev_name(map->dev);
-+ name = devname;
- }
-
- map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2ea056c..f6cff3b 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -1308,7 +1308,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
- }
-
- #ifdef LOG_DEVICE
-- if (strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
-+ if (map->dev && strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
- dev_info(map->dev, "%x <= %x\n", reg, val);
- #endif
-
-@@ -1557,6 +1557,9 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
- } else {
- void *wval;
-
-+ if (!val_count)
-+ return -EINVAL;
-+
- wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL);
- if (!wval) {
- ret = -ENOMEM;
-@@ -1739,7 +1742,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
- ret = map->reg_read(context, reg, val);
- if (ret == 0) {
- #ifdef LOG_DEVICE
-- if (strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
-+ if (map->dev && strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
- dev_info(map->dev, "%x => %x\n", reg, *val);
- #endif
-
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 1c7b504..e00c3f8 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -309,6 +309,9 @@ static void btusb_intr_complete(struct urb *urb)
- BT_ERR("%s corrupted event packet", hdev->name);
- hdev->stat.err_rx++;
- }
-+ } else if (urb->status == -ENOENT) {
-+ /* Avoid suspend failed when usb_kill_urb */
-+ return;
- }
-
- if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
-@@ -397,6 +400,9 @@ static void btusb_bulk_complete(struct urb *urb)
- BT_ERR("%s corrupted ACL packet", hdev->name);
- hdev->stat.err_rx++;
- }
-+ } else if (urb->status == -ENOENT) {
-+ /* Avoid suspend failed when usb_kill_urb */
-+ return;
- }
-
- if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
-@@ -491,6 +497,9 @@ static void btusb_isoc_complete(struct urb *urb)
- hdev->stat.err_rx++;
- }
- }
-+ } else if (urb->status == -ENOENT) {
-+ /* Avoid suspend failed when usb_kill_urb */
-+ return;
- }
-
- if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
-diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
-index e36a024..5651992 100644
---- a/drivers/bluetooth/hci_h5.c
-+++ b/drivers/bluetooth/hci_h5.c
-@@ -237,7 +237,7 @@ static void h5_pkt_cull(struct h5 *h5)
- break;
-
- to_remove--;
-- seq = (seq - 1) % 8;
-+ seq = (seq - 1) & 0x07;
- }
-
- if (seq != h5->rx_ack)
-diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 69ea36f..e99e71a 100644
---- a/drivers/hv/channel.c
-+++ b/drivers/hv/channel.c
-@@ -164,8 +164,10 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
- ret = vmbus_post_msg(open_msg,
- sizeof(struct vmbus_channel_open_channel));
-
-- if (ret != 0)
-+ if (ret != 0) {
-+ err = ret;
- goto error1;
-+ }
-
- t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
- if (t == 0) {
-@@ -362,7 +364,6 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
- u32 next_gpadl_handle;
- unsigned long flags;
- int ret = 0;
-- int t;
-
- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
- atomic_inc(&vmbus_connection.next_gpadl_handle);
-@@ -409,9 +410,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
-
- }
- }
-- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
-- BUG_ON(t == 0);
--
-+ wait_for_completion(&msginfo->waitevent);
-
- /* At this point, we received the gpadl created msg */
- *gpadl_handle = gpadlmsg->gpadl;
-@@ -434,7 +433,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- struct vmbus_channel_gpadl_teardown *msg;
- struct vmbus_channel_msginfo *info;
- unsigned long flags;
-- int ret, t;
-+ int ret;
-
- info = kmalloc(sizeof(*info) +
- sizeof(struct vmbus_channel_gpadl_teardown), GFP_KERNEL);
-@@ -456,11 +455,12 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- ret = vmbus_post_msg(msg,
- sizeof(struct vmbus_channel_gpadl_teardown));
-
-- BUG_ON(ret != 0);
-- t = wait_for_completion_timeout(&info->waitevent, 5*HZ);
-- BUG_ON(t == 0);
-+ if (ret)
-+ goto post_msg_err;
-+
-+ wait_for_completion(&info->waitevent);
-
-- /* Received a torndown response */
-+post_msg_err:
- spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
- list_del(&info->msglistentry);
- spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
-@@ -470,7 +470,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- }
- EXPORT_SYMBOL_GPL(vmbus_teardown_gpadl);
-
--static void vmbus_close_internal(struct vmbus_channel *channel)
-+static int vmbus_close_internal(struct vmbus_channel *channel)
- {
- struct vmbus_channel_close_channel *msg;
- int ret;
-@@ -492,11 +492,28 @@ static void vmbus_close_internal(struct vmbus_channel *channel)
-
- ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel));
-
-- BUG_ON(ret != 0);
-+ if (ret) {
-+ pr_err("Close failed: close post msg return is %d\n", ret);
-+ /*
-+ * If we failed to post the close msg,
-+ * it is perhaps better to leak memory.
-+ */
-+ return ret;
-+ }
-+
- /* Tear down the gpadl for the channel's ring buffer */
-- if (channel->ringbuffer_gpadlhandle)
-- vmbus_teardown_gpadl(channel,
-- channel->ringbuffer_gpadlhandle);
-+ if (channel->ringbuffer_gpadlhandle) {
-+ ret = vmbus_teardown_gpadl(channel,
-+ channel->ringbuffer_gpadlhandle);
-+ if (ret) {
-+ pr_err("Close failed: teardown gpadl return %d\n", ret);
-+ /*
-+ * If we failed to teardown gpadl,
-+ * it is perhaps better to leak memory.
-+ */
-+ return ret;
-+ }
-+ }
-
- /* Cleanup the ring buffers for this channel */
- hv_ringbuffer_cleanup(&channel->outbound);
-@@ -505,7 +522,7 @@ static void vmbus_close_internal(struct vmbus_channel *channel)
- free_pages((unsigned long)channel->ringbuffer_pages,
- get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
-
--
-+ return ret;
- }
-
- /*
-diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
-index ce5a9f2..d8fd95c 100644
---- a/drivers/hv/connection.c
-+++ b/drivers/hv/connection.c
-@@ -408,10 +408,21 @@ int vmbus_post_msg(void *buffer, size_t buflen)
- * insufficient resources. Retry the operation a couple of
- * times before giving up.
- */
-- while (retries < 3) {
-- ret = hv_post_message(conn_id, 1, buffer, buflen);
-- if (ret != HV_STATUS_INSUFFICIENT_BUFFERS)
-+ while (retries < 10) {
-+ ret = hv_post_message(conn_id, 1, buffer, buflen);
-+
-+ switch (ret) {
-+ case HV_STATUS_INSUFFICIENT_BUFFERS:
-+ ret = -ENOMEM;
-+ case -ENOMEM:
-+ break;
-+ case HV_STATUS_SUCCESS:
- return ret;
-+ default:
-+ pr_err("hv_post_msg() failed; error code:%d\n", ret);
-+ return -EINVAL;
-+ }
-+
- retries++;
- msleep(100);
- }
-diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
-index 5653e50..424f51d 100644
---- a/drivers/message/fusion/mptspi.c
-+++ b/drivers/message/fusion/mptspi.c
-@@ -1422,6 +1422,11 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- goto out_mptspi_probe;
- }
-
-+ /* VMWare emulation doesn't properly implement WRITE_SAME
-+ */
-+ if (pdev->subsystem_vendor == 0x15AD)
-+ sh->no_write_same = 1;
-+
- spin_lock_irqsave(&ioc->FreeQlock, flags);
-
- /* Attach the SCSI Host to the IOC structure
-diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
-index 4bc7d62..9a07bba 100644
---- a/drivers/misc/mei/bus.c
-+++ b/drivers/misc/mei/bus.c
-@@ -71,7 +71,7 @@ static int mei_cl_device_probe(struct device *dev)
-
- dev_dbg(dev, "Device probe\n");
-
-- strncpy(id.name, dev_name(dev), sizeof(id.name));
-+ strlcpy(id.name, dev_name(dev), sizeof(id.name));
-
- return driver->probe(device, &id);
- }
-diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
-index df1f5e7..1ac33d9 100644
---- a/drivers/net/wireless/iwlwifi/pcie/drv.c
-+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
-@@ -272,6 +272,8 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
- {IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x08B1, 0x4C60, iwl7260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x08B1, 0x4C70, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
-@@ -315,6 +317,8 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
- {IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
- {IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x08B1, 0xCC70, iwl7260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x08B1, 0xCC60, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
- {IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
-diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
-index a394a9a..7cf6081 100644
---- a/drivers/net/wireless/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/rt2x00/rt2800.h
-@@ -2039,7 +2039,7 @@ struct mac_iveiv_entry {
- * 2 - drop tx power by 12dBm,
- * 3 - increase tx power by 6dBm
- */
--#define BBP1_TX_POWER_CTRL FIELD8(0x07)
-+#define BBP1_TX_POWER_CTRL FIELD8(0x03)
- #define BBP1_TX_ANTENNA FIELD8(0x18)
-
- /*
-diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
-index 483d9ad..9773667 100644
---- a/drivers/pci/host/pci-mvebu.c
-+++ b/drivers/pci/host/pci-mvebu.c
-@@ -855,7 +855,7 @@ static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
- rangesz = pna + na + ns;
- nranges = rlen / sizeof(__be32) / rangesz;
-
-- for (i = 0; i < nranges; i++) {
-+ for (i = 0; i < nranges; i++, range += rangesz) {
- u32 flags = of_read_number(range, 1);
- u32 slot = of_read_number(range + 1, 1);
- u64 cpuaddr = of_read_number(range + na, pna);
-@@ -865,14 +865,14 @@ static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
- rtype = IORESOURCE_IO;
- else if (DT_FLAGS_TO_TYPE(flags) == DT_TYPE_MEM32)
- rtype = IORESOURCE_MEM;
-+ else
-+ continue;
-
- if (slot == PCI_SLOT(devfn) && type == rtype) {
- *tgt = DT_CPUADDR_TO_TARGET(cpuaddr);
- *attr = DT_CPUADDR_TO_ATTR(cpuaddr);
- return 0;
- }
--
-- range += rangesz;
- }
-
- return -ENOENT;
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 276ef9c..39a207a 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -178,7 +178,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
- {
- struct pci_dev *pci_dev = to_pci_dev(dev);
-
-- return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n",
-+ return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X\n",
- pci_dev->vendor, pci_dev->device,
- pci_dev->subsystem_vendor, pci_dev->subsystem_device,
- (u8)(pci_dev->class >> 16), (u8)(pci_dev->class >> 8),
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 813f437..6e8776b 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -24,6 +24,7 @@
- #include <linux/ioport.h>
- #include <linux/sched.h>
- #include <linux/ktime.h>
-+#include <linux/mm.h>
- #include <asm/dma.h> /* isa_dma_bridge_buggy */
- #include "pci.h"
-
-@@ -287,6 +288,25 @@ static void quirk_citrine(struct pci_dev *dev)
- }
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine);
-
-+/* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */
-+static void quirk_extend_bar_to_page(struct pci_dev *dev)
-+{
-+ int i;
-+
-+ for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
-+ struct resource *r = &dev->resource[i];
-+
-+ if (r->flags & IORESOURCE_MEM && resource_size(r) < PAGE_SIZE) {
-+ r->end = PAGE_SIZE - 1;
-+ r->start = 0;
-+ r->flags |= IORESOURCE_UNSET;
-+ dev_info(&dev->dev, "expanded BAR %d to page size: %pR\n",
-+ i, r);
-+ }
-+ }
-+}
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, 0x034a, quirk_extend_bar_to_page);
-+
- /*
- * S3 868 and 968 chips report region size equal to 32M, but they decode 64M.
- * If it's needed, re-allocate the region.
-diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
-index b2fcac7..5bb9406 100644
---- a/drivers/scsi/be2iscsi/be_mgmt.c
-+++ b/drivers/scsi/be2iscsi/be_mgmt.c
-@@ -897,17 +897,20 @@ mgmt_static_ip_modify(struct beiscsi_hba *phba,
-
- if (ip_action == IP_ACTION_ADD) {
- memcpy(req->ip_params.ip_record.ip_addr.addr, ip_param->value,
-- ip_param->len);
-+ sizeof(req->ip_params.ip_record.ip_addr.addr));
-
- if (subnet_param)
- memcpy(req->ip_params.ip_record.ip_addr.subnet_mask,
-- subnet_param->value, subnet_param->len);
-+ subnet_param->value,
-+ sizeof(req->ip_params.ip_record.ip_addr.subnet_mask));
- } else {
- memcpy(req->ip_params.ip_record.ip_addr.addr,
-- if_info->ip_addr.addr, ip_param->len);
-+ if_info->ip_addr.addr,
-+ sizeof(req->ip_params.ip_record.ip_addr.addr));
-
- memcpy(req->ip_params.ip_record.ip_addr.subnet_mask,
-- if_info->ip_addr.subnet_mask, ip_param->len);
-+ if_info->ip_addr.subnet_mask,
-+ sizeof(req->ip_params.ip_record.ip_addr.subnet_mask));
- }
-
- rc = mgmt_exec_nonemb_cmd(phba, &nonemb_cmd, NULL, 0);
-@@ -935,7 +938,7 @@ static int mgmt_modify_gateway(struct beiscsi_hba *phba, uint8_t *gt_addr,
- req->action = gtway_action;
- req->ip_addr.ip_type = BE2_IPV4;
-
-- memcpy(req->ip_addr.addr, gt_addr, param_len);
-+ memcpy(req->ip_addr.addr, gt_addr, sizeof(req->ip_addr.addr));
-
- return mgmt_exec_nonemb_cmd(phba, &nonemb_cmd, NULL, 0);
- }
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 83cb612..23c1b0c 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -3039,10 +3039,8 @@ qla2x00_unmap_iobases(struct qla_hw_data *ha)
- }
-
- static void
--qla2x00_clear_drv_active(scsi_qla_host_t *vha)
-+qla2x00_clear_drv_active(struct qla_hw_data *ha)
- {
-- struct qla_hw_data *ha = vha->hw;
--
- if (IS_QLA8044(ha)) {
- qla8044_idc_lock(ha);
- qla8044_clear_drv_active(ha);
-@@ -3111,7 +3109,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
-
- scsi_host_put(base_vha->host);
-
-- qla2x00_clear_drv_active(base_vha);
-+ qla2x00_clear_drv_active(ha);
-
- qla2x00_unmap_iobases(ha);
-
-diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
-index 0cb7307..2f264ac 100644
---- a/drivers/scsi/qla2xxx/qla_target.c
-+++ b/drivers/scsi/qla2xxx/qla_target.c
-@@ -1382,12 +1382,10 @@ static inline void qlt_unmap_sg(struct scsi_qla_host *vha,
- static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
- uint32_t req_cnt)
- {
-- struct qla_hw_data *ha = vha->hw;
-- device_reg_t __iomem *reg = ha->iobase;
- uint32_t cnt;
-
- if (vha->req->cnt < (req_cnt + 2)) {
-- cnt = (uint16_t)RD_REG_DWORD(&reg->isp24.req_q_out);
-+ cnt = (uint16_t)RD_REG_DWORD(vha->req->req_q_out);
-
- ql_dbg(ql_dbg_tgt, vha, 0xe00a,
- "Request ring circled: cnt=%d, vha->->ring_index=%d, "
-diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
-index 6d207af..a4c45ea 100644
---- a/drivers/spi/spi-dw-mid.c
-+++ b/drivers/spi/spi-dw-mid.c
-@@ -89,7 +89,13 @@ err_exit:
-
- static void mid_spi_dma_exit(struct dw_spi *dws)
- {
-+ if (!dws->dma_inited)
-+ return;
-+
-+ dmaengine_terminate_all(dws->txchan);
- dma_release_channel(dws->txchan);
-+
-+ dmaengine_terminate_all(dws->rxchan);
- dma_release_channel(dws->rxchan);
- }
-
-@@ -136,7 +142,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
- txconf.dst_addr = dws->dma_addr;
- txconf.dst_maxburst = LNW_DMA_MSIZE_16;
- txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-- txconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-+ txconf.dst_addr_width = dws->dma_width;
- txconf.device_fc = false;
-
- txchan->device->device_control(txchan, DMA_SLAVE_CONFIG,
-@@ -159,7 +165,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
- rxconf.src_addr = dws->dma_addr;
- rxconf.src_maxburst = LNW_DMA_MSIZE_16;
- rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-- rxconf.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-+ rxconf.src_addr_width = dws->dma_width;
- rxconf.device_fc = false;
-
- rxchan->device->device_control(rxchan, DMA_SLAVE_CONFIG,
-diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
-index db8434d..f4e68b3 100644
---- a/drivers/tty/serial/omap-serial.c
-+++ b/drivers/tty/serial/omap-serial.c
-@@ -260,8 +260,16 @@ serial_omap_baud_is_mode16(struct uart_port *port, unsigned int baud)
- {
- unsigned int n13 = port->uartclk / (13 * baud);
- unsigned int n16 = port->uartclk / (16 * baud);
-- int baudAbsDiff13 = baud - (port->uartclk / (13 * n13));
-- int baudAbsDiff16 = baud - (port->uartclk / (16 * n16));
-+ int baudAbsDiff13;
-+ int baudAbsDiff16;
-+
-+ if (n13 == 0)
-+ n13 = 1;
-+ if (n16 == 0)
-+ n16 = 1;
-+
-+ baudAbsDiff13 = baud - (port->uartclk / (13 * n13));
-+ baudAbsDiff16 = baud - (port->uartclk / (16 * n16));
- if (baudAbsDiff13 < 0)
- baudAbsDiff13 = -baudAbsDiff13;
- if (baudAbsDiff16 < 0)
-diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
-index 8154165..fd13ef0 100644
---- a/drivers/usb/gadget/Kconfig
-+++ b/drivers/usb/gadget/Kconfig
-@@ -445,7 +445,7 @@ config USB_GOKU
- gadget drivers to also be dynamically linked.
-
- config USB_EG20T
-- tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
-+ tristate "Intel QUARK X1000/EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
- depends on PCI
- help
- This is a USB device driver for EG20T PCH.
-@@ -466,6 +466,7 @@ config USB_EG20T
- ML7213/ML7831 is companion chip for Intel Atom E6xx series.
- ML7213/ML7831 is completely compatible for Intel EG20T PCH.
-
-+ This driver can be used with Intel's Quark X1000 SOC platform
- #
- # LAST -- dummy/emulated controller
- #
-diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
-index eb8c3be..460d953 100644
---- a/drivers/usb/gadget/pch_udc.c
-+++ b/drivers/usb/gadget/pch_udc.c
-@@ -343,6 +343,7 @@ struct pch_vbus_gpio_data {
- * @setup_data: Received setup data
- * @phys_addr: of device memory
- * @base_addr: for mapped device memory
-+ * @bar: Indicates which PCI BAR for USB regs
- * @irq: IRQ line for the device
- * @cfg_data: current cfg, intf, and alt in use
- * @vbus_gpio: GPIO informaton for detecting VBUS
-@@ -370,14 +371,17 @@ struct pch_udc_dev {
- struct usb_ctrlrequest setup_data;
- unsigned long phys_addr;
- void __iomem *base_addr;
-+ unsigned bar;
- unsigned irq;
- struct pch_udc_cfg_data cfg_data;
- struct pch_vbus_gpio_data vbus_gpio;
- };
- #define to_pch_udc(g) (container_of((g), struct pch_udc_dev, gadget))
-
-+#define PCH_UDC_PCI_BAR_QUARK_X1000 0
- #define PCH_UDC_PCI_BAR 1
- #define PCI_DEVICE_ID_INTEL_EG20T_UDC 0x8808
-+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC 0x0939
- #define PCI_VENDOR_ID_ROHM 0x10DB
- #define PCI_DEVICE_ID_ML7213_IOH_UDC 0x801D
- #define PCI_DEVICE_ID_ML7831_IOH_UDC 0x8808
-@@ -3076,7 +3080,7 @@ static void pch_udc_remove(struct pci_dev *pdev)
- iounmap(dev->base_addr);
- if (dev->mem_region)
- release_mem_region(dev->phys_addr,
-- pci_resource_len(pdev, PCH_UDC_PCI_BAR));
-+ pci_resource_len(pdev, dev->bar));
- if (dev->active)
- pci_disable_device(pdev);
- kfree(dev);
-@@ -3144,9 +3148,15 @@ static int pch_udc_probe(struct pci_dev *pdev,
- dev->active = 1;
- pci_set_drvdata(pdev, dev);
-
-+ /* Determine BAR based on PCI ID */
-+ if (id->device == PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC)
-+ dev->bar = PCH_UDC_PCI_BAR_QUARK_X1000;
-+ else
-+ dev->bar = PCH_UDC_PCI_BAR;
-+
- /* PCI resource allocation */
-- resource = pci_resource_start(pdev, 1);
-- len = pci_resource_len(pdev, 1);
-+ resource = pci_resource_start(pdev, dev->bar);
-+ len = pci_resource_len(pdev, dev->bar);
-
- if (!request_mem_region(resource, len, KBUILD_MODNAME)) {
- dev_err(&pdev->dev, "%s: pci device used already\n", __func__);
-@@ -3212,6 +3222,12 @@ finished:
-
- static const struct pci_device_id pch_udc_pcidev_id[] = {
- {
-+ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-+ PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC),
-+ .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
-+ .class_mask = 0xffffffff,
-+ },
-+ {
- PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EG20T_UDC),
- .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
- .class_mask = 0xffffffff,
-diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 0165b86..a9a881e 100644
---- a/fs/btrfs/file.c
-+++ b/fs/btrfs/file.c
-@@ -2510,23 +2510,28 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int whence)
- struct btrfs_root *root = BTRFS_I(inode)->root;
- struct extent_map *em = NULL;
- struct extent_state *cached_state = NULL;
-- u64 lockstart = *offset;
-- u64 lockend = i_size_read(inode);
-- u64 start = *offset;
-- u64 len = i_size_read(inode);
-+ u64 lockstart;
-+ u64 lockend;
-+ u64 start;
-+ u64 len;
- int ret = 0;
-
-- lockend = max_t(u64, root->sectorsize, lockend);
-+ if (inode->i_size == 0)
-+ return -ENXIO;
-+
-+ /*
-+ * *offset can be negative, in this case we start finding DATA/HOLE from
-+ * the very start of the file.
-+ */
-+ start = max_t(loff_t, 0, *offset);
-+
-+ lockstart = round_down(start, root->sectorsize);
-+ lockend = round_up(i_size_read(inode), root->sectorsize);
- if (lockend <= lockstart)
- lockend = lockstart + root->sectorsize;
--
- lockend--;
- len = lockend - lockstart + 1;
-
-- len = max_t(u64, len, root->sectorsize);
-- if (inode->i_size == 0)
-- return -ENXIO;
--
- lock_extent_bits(&BTRFS_I(inode)->io_tree, lockstart, lockend, 0,
- &cached_state);
-
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index c69c763..d68a725 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -3596,7 +3596,8 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
- * without delay
- */
- if (!btrfs_is_free_space_inode(inode)
-- && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID) {
-+ && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
-+ && !root->fs_info->log_root_recovering) {
- btrfs_update_root_times(trans, root);
-
- ret = btrfs_delayed_update_inode(trans, root, inode);
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index a6d8efa..0b72006 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -302,6 +302,9 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
- goto out_drop;
-
- } else {
-+ ret = btrfs_set_prop(inode, "btrfs.compression", NULL, 0, 0);
-+ if (ret && ret != -ENODATA)
-+ goto out_drop;
- ip->flags &= ~(BTRFS_INODE_COMPRESS | BTRFS_INODE_NOCOMPRESS);
- }
-
-@@ -4750,6 +4753,12 @@ long btrfs_ioctl(struct file *file, unsigned int
- if (ret)
- return ret;
- ret = btrfs_sync_fs(file->f_dentry->d_sb, 1);
-+ /*
-+ * The transaction thread may want to do more work,
-+ * namely it pokes the cleaner ktread that will start
-+ * processing uncleaned subvols.
-+ */
-+ wake_up_process(root->fs_info->transaction_kthread);
- return ret;
- }
- case BTRFS_IOC_START_SYNC:
-diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
-index 07b3b36..01f977e 100644
---- a/fs/btrfs/relocation.c
-+++ b/fs/btrfs/relocation.c
-@@ -736,7 +736,8 @@ again:
- err = ret;
- goto out;
- }
-- BUG_ON(!ret || !path1->slots[0]);
-+ ASSERT(ret);
-+ ASSERT(path1->slots[0]);
-
- path1->slots[0]--;
-
-@@ -746,10 +747,10 @@ again:
- * the backref was added previously when processing
- * backref of type BTRFS_TREE_BLOCK_REF_KEY
- */
-- BUG_ON(!list_is_singular(&cur->upper));
-+ ASSERT(list_is_singular(&cur->upper));
- edge = list_entry(cur->upper.next, struct backref_edge,
- list[LOWER]);
-- BUG_ON(!list_empty(&edge->list[UPPER]));
-+ ASSERT(list_empty(&edge->list[UPPER]));
- exist = edge->node[UPPER];
- /*
- * add the upper level block to pending list if we need
-@@ -831,7 +832,7 @@ again:
- cur->cowonly = 1;
- }
- #else
-- BUG_ON(key.type == BTRFS_EXTENT_REF_V0_KEY);
-+ ASSERT(key.type != BTRFS_EXTENT_REF_V0_KEY);
- if (key.type == BTRFS_SHARED_BLOCK_REF_KEY) {
- #endif
- if (key.objectid == key.offset) {
-@@ -840,7 +841,7 @@ again:
- * backref of this type.
- */
- root = find_reloc_root(rc, cur->bytenr);
-- BUG_ON(!root);
-+ ASSERT(root);
- cur->root = root;
- break;
- }
-@@ -868,7 +869,7 @@ again:
- } else {
- upper = rb_entry(rb_node, struct backref_node,
- rb_node);
-- BUG_ON(!upper->checked);
-+ ASSERT(upper->checked);
- INIT_LIST_HEAD(&edge->list[UPPER]);
- }
- list_add_tail(&edge->list[LOWER], &cur->upper);
-@@ -892,7 +893,7 @@ again:
-
- if (btrfs_root_level(&root->root_item) == cur->level) {
- /* tree root */
-- BUG_ON(btrfs_root_bytenr(&root->root_item) !=
-+ ASSERT(btrfs_root_bytenr(&root->root_item) ==
- cur->bytenr);
- if (should_ignore_root(root))
- list_add(&cur->list, &useless);
-@@ -927,7 +928,7 @@ again:
- need_check = true;
- for (; level < BTRFS_MAX_LEVEL; level++) {
- if (!path2->nodes[level]) {
-- BUG_ON(btrfs_root_bytenr(&root->root_item) !=
-+ ASSERT(btrfs_root_bytenr(&root->root_item) ==
- lower->bytenr);
- if (should_ignore_root(root))
- list_add(&lower->list, &useless);
-@@ -976,12 +977,15 @@ again:
- need_check = false;
- list_add_tail(&edge->list[UPPER],
- &list);
-- } else
-+ } else {
-+ if (upper->checked)
-+ need_check = true;
- INIT_LIST_HEAD(&edge->list[UPPER]);
-+ }
- } else {
- upper = rb_entry(rb_node, struct backref_node,
- rb_node);
-- BUG_ON(!upper->checked);
-+ ASSERT(upper->checked);
- INIT_LIST_HEAD(&edge->list[UPPER]);
- if (!upper->owner)
- upper->owner = btrfs_header_owner(eb);
-@@ -1025,7 +1029,7 @@ next:
- * everything goes well, connect backref nodes and insert backref nodes
- * into the cache.
- */
-- BUG_ON(!node->checked);
-+ ASSERT(node->checked);
- cowonly = node->cowonly;
- if (!cowonly) {
- rb_node = tree_insert(&cache->rb_root, node->bytenr,
-@@ -1061,8 +1065,21 @@ next:
- continue;
- }
-
-- BUG_ON(!upper->checked);
-- BUG_ON(cowonly != upper->cowonly);
-+ if (!upper->checked) {
-+ /*
-+ * Still want to blow up for developers since this is a
-+ * logic bug.
-+ */
-+ ASSERT(0);
-+ err = -EINVAL;
-+ goto out;
-+ }
-+ if (cowonly != upper->cowonly) {
-+ ASSERT(0);
-+ err = -EINVAL;
-+ goto out;
-+ }
-+
- if (!cowonly) {
- rb_node = tree_insert(&cache->rb_root, upper->bytenr,
- &upper->rb_node);
-@@ -1085,7 +1102,7 @@ next:
- while (!list_empty(&useless)) {
- upper = list_entry(useless.next, struct backref_node, list);
- list_del_init(&upper->list);
-- BUG_ON(!list_empty(&upper->upper));
-+ ASSERT(list_empty(&upper->upper));
- if (upper == node)
- node = NULL;
- if (upper->lowest) {
-@@ -1118,29 +1135,45 @@ out:
- if (err) {
- while (!list_empty(&useless)) {
- lower = list_entry(useless.next,
-- struct backref_node, upper);
-- list_del_init(&lower->upper);
-+ struct backref_node, list);
-+ list_del_init(&lower->list);
- }
-- upper = node;
-- INIT_LIST_HEAD(&list);
-- while (upper) {
-- if (RB_EMPTY_NODE(&upper->rb_node)) {
-- list_splice_tail(&upper->upper, &list);
-- free_backref_node(cache, upper);
-- }
--
-- if (list_empty(&list))
-- break;
--
-- edge = list_entry(list.next, struct backref_edge,
-- list[LOWER]);
-+ while (!list_empty(&list)) {
-+ edge = list_first_entry(&list, struct backref_edge,
-+ list[UPPER]);
-+ list_del(&edge->list[UPPER]);
- list_del(&edge->list[LOWER]);
-+ lower = edge->node[LOWER];
- upper = edge->node[UPPER];
- free_backref_edge(cache, edge);
-+
-+ /*
-+ * Lower is no longer linked to any upper backref nodes
-+ * and isn't in the cache, we can free it ourselves.
-+ */
-+ if (list_empty(&lower->upper) &&
-+ RB_EMPTY_NODE(&lower->rb_node))
-+ list_add(&lower->list, &useless);
-+
-+ if (!RB_EMPTY_NODE(&upper->rb_node))
-+ continue;
-+
-+ /* Add this guy's upper edges to the list to proces */
-+ list_for_each_entry(edge, &upper->upper, list[LOWER])
-+ list_add_tail(&edge->list[UPPER], &list);
-+ if (list_empty(&upper->upper))
-+ list_add(&upper->list, &useless);
-+ }
-+
-+ while (!list_empty(&useless)) {
-+ lower = list_entry(useless.next,
-+ struct backref_node, list);
-+ list_del_init(&lower->list);
-+ free_backref_node(cache, lower);
- }
- return ERR_PTR(err);
- }
-- BUG_ON(node && node->detached);
-+ ASSERT(!node || !node->detached);
- return node;
- }
-
-diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
-index a65ed4c..20d7935 100644
---- a/fs/btrfs/send.c
-+++ b/fs/btrfs/send.c
-@@ -4728,7 +4728,9 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
-
- if (S_ISREG(sctx->cur_inode_mode)) {
- if (need_send_hole(sctx)) {
-- if (sctx->cur_inode_last_extent == (u64)-1) {
-+ if (sctx->cur_inode_last_extent == (u64)-1 ||
-+ sctx->cur_inode_last_extent <
-+ sctx->cur_inode_size) {
- ret = get_last_extent(sctx, (u64)-1);
- if (ret)
- goto out;
-diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
-index b05bf58..a0b65a0 100644
---- a/fs/btrfs/transaction.c
-+++ b/fs/btrfs/transaction.c
-@@ -592,7 +592,6 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid)
- if (transid <= root->fs_info->last_trans_committed)
- goto out;
-
-- ret = -EINVAL;
- /* find specified transaction */
- spin_lock(&root->fs_info->trans_lock);
- list_for_each_entry(t, &root->fs_info->trans_list, list) {
-@@ -608,9 +607,16 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid)
- }
- }
- spin_unlock(&root->fs_info->trans_lock);
-- /* The specified transaction doesn't exist */
-- if (!cur_trans)
-+
-+ /*
-+ * The specified transaction doesn't exist, or we
-+ * raced with btrfs_commit_transaction
-+ */
-+ if (!cur_trans) {
-+ if (transid > root->fs_info->last_trans_committed)
-+ ret = -EINVAL;
- goto out;
-+ }
- } else {
- /* find newest transaction that is committing | committed */
- spin_lock(&root->fs_info->trans_lock);
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index b167ca4..a85ceb7 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -1039,7 +1039,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
- }
-
- rc = vfs_setxattr(lower_dentry, name, value, size, flags);
-- if (!rc)
-+ if (!rc && dentry->d_inode)
- fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
- out:
- return rc;
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 75536db..c7d4a0a 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1365,6 +1365,8 @@ static int do_umount(struct mount *mnt, int flags)
- * Special case for "unmounting" root ...
- * we just try to remount it readonly.
- */
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
- down_write(&sb->s_umount);
- if (!(sb->s_flags & MS_RDONLY))
- retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 2e9662e..da657b7 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -7242,7 +7242,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr
- int ret = 0;
-
- if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
-- return 0;
-+ return -EAGAIN;
- task = _nfs41_proc_sequence(clp, cred, false);
- if (IS_ERR(task))
- ret = PTR_ERR(task);
-diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
-index 1720d32..e1ba58c 100644
---- a/fs/nfs/nfs4renewd.c
-+++ b/fs/nfs/nfs4renewd.c
-@@ -88,10 +88,18 @@ nfs4_renew_state(struct work_struct *work)
- }
- nfs_expire_all_delegations(clp);
- } else {
-+ int ret;
-+
- /* Queue an asynchronous RENEW. */
-- ops->sched_state_renewal(clp, cred, renew_flags);
-+ ret = ops->sched_state_renewal(clp, cred, renew_flags);
- put_rpccred(cred);
-- goto out_exp;
-+ switch (ret) {
-+ default:
-+ goto out_exp;
-+ case -EAGAIN:
-+ case -ENOMEM:
-+ break;
-+ }
- }
- } else {
- dprintk("%s: failed to call renewd. Reason: lease not expired \n",
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index 27f5f85..b4f177f 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1732,7 +1732,8 @@ restart:
- if (status < 0) {
- set_bit(ops->owner_flag_bit, &sp->so_flags);
- nfs4_put_state_owner(sp);
-- return nfs4_recovery_handle_error(clp, status);
-+ status = nfs4_recovery_handle_error(clp, status);
-+ return (status != 0) ? status : -EAGAIN;
- }
-
- nfs4_put_state_owner(sp);
-@@ -1741,7 +1742,7 @@ restart:
- spin_unlock(&clp->cl_lock);
- }
- rcu_read_unlock();
-- return status;
-+ return 0;
- }
-
- static int nfs4_check_lease(struct nfs_client *clp)
-@@ -1788,7 +1789,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
- break;
- case -NFS4ERR_STALE_CLIENTID:
- clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
-- nfs4_state_clear_reclaim_reboot(clp);
- nfs4_state_start_reclaim_reboot(clp);
- break;
- case -NFS4ERR_CLID_INUSE:
-@@ -2370,6 +2370,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
- status = nfs4_check_lease(clp);
- if (status < 0)
- goto out_error;
-+ continue;
- }
-
- if (test_and_clear_bit(NFS4CLNT_MOVED, &clp->cl_state)) {
-@@ -2391,14 +2392,11 @@ static void nfs4_state_manager(struct nfs_client *clp)
- section = "reclaim reboot";
- status = nfs4_do_reclaim(clp,
- clp->cl_mvops->reboot_recovery_ops);
-- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
-- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
-- continue;
-- nfs4_state_end_reclaim_reboot(clp);
-- if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state))
-+ if (status == -EAGAIN)
- continue;
- if (status < 0)
- goto out_error;
-+ nfs4_state_end_reclaim_reboot(clp);
- }
-
- /* Now recover expired state... */
-@@ -2406,9 +2404,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
- section = "reclaim nograce";
- status = nfs4_do_reclaim(clp,
- clp->cl_mvops->nograce_recovery_ops);
-- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
-- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) ||
-- test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
-+ if (status == -EAGAIN)
- continue;
- if (status < 0)
- goto out_error;
-diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
-index 287a22c..de6323e 100644
---- a/fs/notify/fanotify/fanotify_user.c
-+++ b/fs/notify/fanotify/fanotify_user.c
-@@ -71,7 +71,7 @@ static int create_fd(struct fsnotify_group *group,
-
- pr_debug("%s: group=%p event=%p\n", __func__, group, event);
-
-- client_fd = get_unused_fd();
-+ client_fd = get_unused_fd_flags(group->fanotify_data.f_flags);
- if (client_fd < 0)
- return client_fd;
-
-diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
-index 5d2518b..0461fbe 100644
---- a/fs/xfs/xfs_aops.c
-+++ b/fs/xfs/xfs_aops.c
-@@ -434,10 +434,22 @@ xfs_start_page_writeback(
- {
- ASSERT(PageLocked(page));
- ASSERT(!PageWriteback(page));
-- if (clear_dirty)
-+
-+ /*
-+ * if the page was not fully cleaned, we need to ensure that the higher
-+ * layers come back to it correctly. That means we need to keep the page
-+ * dirty, and for WB_SYNC_ALL writeback we need to ensure the
-+ * PAGECACHE_TAG_TOWRITE index mark is not removed so another attempt to
-+ * write this page in this writeback sweep will be made.
-+ */
-+ if (clear_dirty) {
- clear_page_dirty_for_io(page);
-- set_page_writeback(page);
-+ set_page_writeback(page);
-+ } else
-+ set_page_writeback_keepwrite(page);
-+
- unlock_page(page);
-+
- /* If no buffers on the page are to be written, finish it here */
- if (!buffers)
- end_page_writeback(page);
-diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h
-new file mode 100644
-index 0000000..cdd1cc2
---- /dev/null
-+++ b/include/linux/compiler-gcc5.h
-@@ -0,0 +1,66 @@
-+#ifndef __LINUX_COMPILER_H
-+#error "Please don't include <linux/compiler-gcc5.h> directly, include <linux/compiler.h> instead."
-+#endif
-+
-+#define __used __attribute__((__used__))
-+#define __must_check __attribute__((warn_unused_result))
-+#define __compiler_offsetof(a, b) __builtin_offsetof(a, b)
-+
-+/* Mark functions as cold. gcc will assume any path leading to a call
-+ to them will be unlikely. This means a lot of manual unlikely()s
-+ are unnecessary now for any paths leading to the usual suspects
-+ like BUG(), printk(), panic() etc. [but let's keep them for now for
-+ older compilers]
-+
-+ Early snapshots of gcc 4.3 don't support this and we can't detect this
-+ in the preprocessor, but we can live with this because they're unreleased.
-+ Maketime probing would be overkill here.
-+
-+ gcc also has a __attribute__((__hot__)) to move hot functions into
-+ a special section, but I don't see any sense in this right now in
-+ the kernel context */
-+#define __cold __attribute__((__cold__))
-+
-+#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
-+
-+#ifndef __CHECKER__
-+# define __compiletime_warning(message) __attribute__((warning(message)))
-+# define __compiletime_error(message) __attribute__((error(message)))
-+#endif /* __CHECKER__ */
-+
-+/*
-+ * Mark a position in code as unreachable. This can be used to
-+ * suppress control flow warnings after asm blocks that transfer
-+ * control elsewhere.
-+ *
-+ * Early snapshots of gcc 4.5 don't support this and we can't detect
-+ * this in the preprocessor, but we can live with this because they're
-+ * unreleased. Really, we need to have autoconf for the kernel.
-+ */
-+#define unreachable() __builtin_unreachable()
-+
-+/* Mark a function definition as prohibited from being cloned. */
-+#define __noclone __attribute__((__noclone__))
-+
-+/*
-+ * Tell the optimizer that something else uses this function or variable.
-+ */
-+#define __visible __attribute__((externally_visible))
-+
-+/*
-+ * GCC 'asm goto' miscompiles certain code sequences:
-+ *
-+ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
-+ *
-+ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
-+ * Fixed in GCC 4.8.2 and later versions.
-+ *
-+ * (asm goto is automatically volatile - the naming reflects this.)
-+ */
-+#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
-+
-+#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
-+#define __HAVE_BUILTIN_BSWAP32__
-+#define __HAVE_BUILTIN_BSWAP64__
-+#define __HAVE_BUILTIN_BSWAP16__
-+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
-diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
-index 97fbecd..057c1d8 100644
---- a/include/linux/pci_ids.h
-+++ b/include/linux/pci_ids.h
-@@ -2551,6 +2551,7 @@
- #define PCI_DEVICE_ID_INTEL_MFD_EMMC0 0x0823
- #define PCI_DEVICE_ID_INTEL_MFD_EMMC1 0x0824
- #define PCI_DEVICE_ID_INTEL_MRST_SD2 0x084F
-+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_ILB 0x095E
- #define PCI_DEVICE_ID_INTEL_I960 0x0960
- #define PCI_DEVICE_ID_INTEL_I960RM 0x0962
- #define PCI_DEVICE_ID_INTEL_CENTERTON_ILB 0x0c60
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index d7ca410..218b058 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1876,11 +1876,13 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
- #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
- #define used_math() tsk_used_math(current)
-
--/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags */
-+/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags
-+ * __GFP_FS is also cleared as it implies __GFP_IO.
-+ */
- static inline gfp_t memalloc_noio_flags(gfp_t flags)
- {
- if (unlikely(current->flags & PF_MEMALLOC_NOIO))
-- flags &= ~__GFP_IO;
-+ flags &= ~(__GFP_IO | __GFP_FS);
- return flags;
- }
-
-diff --git a/kernel/futex.c b/kernel/futex.c
-index 0b0dc02..fda2950 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -329,6 +329,8 @@ static void get_futex_key_refs(union futex_key *key)
- case FUT_OFF_MMSHARED:
- futex_get_mm(key); /* implies MB (B) */
- break;
-+ default:
-+ smp_mb(); /* explicit MB (B) */
- }
- }
-
-diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
-index 8563081..a1c387f 100644
---- a/lib/lzo/lzo1x_decompress_safe.c
-+++ b/lib/lzo/lzo1x_decompress_safe.c
-@@ -19,31 +19,21 @@
- #include <linux/lzo.h>
- #include "lzodefs.h"
-
--#define HAVE_IP(t, x) \
-- (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
-- (((t + x) >= t) && ((t + x) >= x)))
-+#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x))
-+#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x))
-+#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun
-+#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun
-+#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun
-
--#define HAVE_OP(t, x) \
-- (((size_t)(op_end - op) >= (size_t)(t + x)) && \
-- (((t + x) >= t) && ((t + x) >= x)))
--
--#define NEED_IP(t, x) \
-- do { \
-- if (!HAVE_IP(t, x)) \
-- goto input_overrun; \
-- } while (0)
--
--#define NEED_OP(t, x) \
-- do { \
-- if (!HAVE_OP(t, x)) \
-- goto output_overrun; \
-- } while (0)
--
--#define TEST_LB(m_pos) \
-- do { \
-- if ((m_pos) < out) \
-- goto lookbehind_overrun; \
-- } while (0)
-+/* This MAX_255_COUNT is the maximum number of times we can add 255 to a base
-+ * count without overflowing an integer. The multiply will overflow when
-+ * multiplying 255 by more than MAXINT/255. The sum will overflow earlier
-+ * depending on the base count. Since the base count is taken from a u8
-+ * and a few bits, it is safe to assume that it will always be lower than
-+ * or equal to 2*255, thus we can always prevent any overflow by accepting
-+ * two less 255 steps. See Documentation/lzo.txt for more information.
-+ */
-+#define MAX_255_COUNT ((((size_t)~0) / 255) - 2)
-
- int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
- unsigned char *out, size_t *out_len)
-@@ -75,17 +65,24 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
- if (t < 16) {
- if (likely(state == 0)) {
- if (unlikely(t == 0)) {
-+ size_t offset;
-+ const unsigned char *ip_last = ip;
-+
- while (unlikely(*ip == 0)) {
-- t += 255;
- ip++;
-- NEED_IP(1, 0);
-+ NEED_IP(1);
- }
-- t += 15 + *ip++;
-+ offset = ip - ip_last;
-+ if (unlikely(offset > MAX_255_COUNT))
-+ return LZO_E_ERROR;
-+
-+ offset = (offset << 8) - offset;
-+ t += offset + 15 + *ip++;
- }
- t += 3;
- copy_literal_run:
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-- if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
-+ if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
- const unsigned char *ie = ip + t;
- unsigned char *oe = op + t;
- do {
-@@ -101,8 +98,8 @@ copy_literal_run:
- } else
- #endif
- {
-- NEED_OP(t, 0);
-- NEED_IP(t, 3);
-+ NEED_OP(t);
-+ NEED_IP(t + 3);
- do {
- *op++ = *ip++;
- } while (--t > 0);
-@@ -115,7 +112,7 @@ copy_literal_run:
- m_pos -= t >> 2;
- m_pos -= *ip++ << 2;
- TEST_LB(m_pos);
-- NEED_OP(2, 0);
-+ NEED_OP(2);
- op[0] = m_pos[0];
- op[1] = m_pos[1];
- op += 2;
-@@ -136,13 +133,20 @@ copy_literal_run:
- } else if (t >= 32) {
- t = (t & 31) + (3 - 1);
- if (unlikely(t == 2)) {
-+ size_t offset;
-+ const unsigned char *ip_last = ip;
-+
- while (unlikely(*ip == 0)) {
-- t += 255;
- ip++;
-- NEED_IP(1, 0);
-+ NEED_IP(1);
- }
-- t += 31 + *ip++;
-- NEED_IP(2, 0);
-+ offset = ip - ip_last;
-+ if (unlikely(offset > MAX_255_COUNT))
-+ return LZO_E_ERROR;
-+
-+ offset = (offset << 8) - offset;
-+ t += offset + 31 + *ip++;
-+ NEED_IP(2);
- }
- m_pos = op - 1;
- next = get_unaligned_le16(ip);
-@@ -154,13 +158,20 @@ copy_literal_run:
- m_pos -= (t & 8) << 11;
- t = (t & 7) + (3 - 1);
- if (unlikely(t == 2)) {
-+ size_t offset;
-+ const unsigned char *ip_last = ip;
-+
- while (unlikely(*ip == 0)) {
-- t += 255;
- ip++;
-- NEED_IP(1, 0);
-+ NEED_IP(1);
- }
-- t += 7 + *ip++;
-- NEED_IP(2, 0);
-+ offset = ip - ip_last;
-+ if (unlikely(offset > MAX_255_COUNT))
-+ return LZO_E_ERROR;
-+
-+ offset = (offset << 8) - offset;
-+ t += offset + 7 + *ip++;
-+ NEED_IP(2);
- }
- next = get_unaligned_le16(ip);
- ip += 2;
-@@ -174,7 +185,7 @@ copy_literal_run:
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- if (op - m_pos >= 8) {
- unsigned char *oe = op + t;
-- if (likely(HAVE_OP(t, 15))) {
-+ if (likely(HAVE_OP(t + 15))) {
- do {
- COPY8(op, m_pos);
- op += 8;
-@@ -184,7 +195,7 @@ copy_literal_run:
- m_pos += 8;
- } while (op < oe);
- op = oe;
-- if (HAVE_IP(6, 0)) {
-+ if (HAVE_IP(6)) {
- state = next;
- COPY4(op, ip);
- op += next;
-@@ -192,7 +203,7 @@ copy_literal_run:
- continue;
- }
- } else {
-- NEED_OP(t, 0);
-+ NEED_OP(t);
- do {
- *op++ = *m_pos++;
- } while (op < oe);
-@@ -201,7 +212,7 @@ copy_literal_run:
- #endif
- {
- unsigned char *oe = op + t;
-- NEED_OP(t, 0);
-+ NEED_OP(t);
- op[0] = m_pos[0];
- op[1] = m_pos[1];
- op += 2;
-@@ -214,15 +225,15 @@ match_next:
- state = next;
- t = next;
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-- if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
-+ if (likely(HAVE_IP(6) && HAVE_OP(4))) {
- COPY4(op, ip);
- op += t;
- ip += t;
- } else
- #endif
- {
-- NEED_IP(t, 3);
-- NEED_OP(t, 0);
-+ NEED_IP(t + 3);
-+ NEED_OP(t);
- while (t > 0) {
- *op++ = *ip++;
- t--;
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index 6afa3b4..0007c9e 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -2608,12 +2608,8 @@ static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
-
- BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
-
-- pdu_len = chan->conn->mtu - L2CAP_HDR_SIZE;
--
-- pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
--
- sdu_len = len;
-- pdu_len -= L2CAP_SDULEN_SIZE;
-+ pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
-
- while (len > 0) {
- if (len <= pdu_len)
-diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
-index 734e946..6df1b25 100644
---- a/security/integrity/ima/ima_appraise.c
-+++ b/security/integrity/ima/ima_appraise.c
-@@ -194,8 +194,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
- goto out;
-
- cause = "missing-hash";
-- status =
-- (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
-+ status = INTEGRITY_NOLABEL;
-+ if (inode->i_size == 0) {
-+ iint->flags |= IMA_NEW_FILE;
-+ status = INTEGRITY_PASS;
-+ }
- goto out;
- }
-
-diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
-index 76d8aad..9f70efd 100644
---- a/security/integrity/ima/ima_main.c
-+++ b/security/integrity/ima/ima_main.c
-@@ -131,11 +131,13 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
- return;
-
- mutex_lock(&inode->i_mutex);
-- if (atomic_read(&inode->i_writecount) == 1 &&
-- iint->version != inode->i_version) {
-- iint->flags &= ~IMA_DONE_MASK;
-- if (iint->flags & IMA_APPRAISE)
-- ima_update_xattr(iint, file);
-+ if (atomic_read(&inode->i_writecount) == 1) {
-+ if ((iint->version != inode->i_version) ||
-+ (iint->flags & IMA_NEW_FILE)) {
-+ iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
-+ if (iint->flags & IMA_APPRAISE)
-+ ima_update_xattr(iint, file);
-+ }
- }
- mutex_unlock(&inode->i_mutex);
- }
-diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
-index 33c0a70..2f8715d 100644
---- a/security/integrity/integrity.h
-+++ b/security/integrity/integrity.h
-@@ -31,6 +31,7 @@
- #define IMA_DIGSIG 0x01000000
- #define IMA_DIGSIG_REQUIRED 0x02000000
- #define IMA_PERMIT_DIRECTIO 0x04000000
-+#define IMA_NEW_FILE 0x08000000
-
- #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
- IMA_APPRAISE_SUBMASK)
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 01a5e05..566b0f6 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -3189,7 +3189,7 @@ static const struct vm_operations_struct snd_pcm_vm_ops_data_fault = {
-
- #ifndef ARCH_HAS_DMA_MMAP_COHERENT
- /* This should be defined / handled globally! */
--#ifdef CONFIG_ARM
-+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
- #define ARCH_HAS_DMA_MMAP_COHERENT
- #endif
- #endif
-diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
-index cae3659..0a34b5f 100644
---- a/sound/pci/emu10k1/emu10k1_callback.c
-+++ b/sound/pci/emu10k1/emu10k1_callback.c
-@@ -85,6 +85,8 @@ snd_emu10k1_ops_setup(struct snd_emux *emux)
- * get more voice for pcm
- *
- * terminate most inactive voice and give it as a pcm voice.
-+ *
-+ * voice_lock is already held.
- */
- int
- snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
-@@ -92,12 +94,10 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
- struct snd_emux *emu;
- struct snd_emux_voice *vp;
- struct best_voice best[V_END];
-- unsigned long flags;
- int i;
-
- emu = hw->synth;
-
-- spin_lock_irqsave(&emu->voice_lock, flags);
- lookup_voices(emu, hw, best, 1); /* no OFF voices */
- for (i = 0; i < V_END; i++) {
- if (best[i].voice >= 0) {
-@@ -113,11 +113,9 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
- vp->emu->num_voices--;
- vp->ch = -1;
- vp->state = SNDRV_EMUX_ST_OFF;
-- spin_unlock_irqrestore(&emu->voice_lock, flags);
- return ch;
- }
- }
-- spin_unlock_irqrestore(&emu->voice_lock, flags);
-
- /* not found */
- return -ENOMEM;
-diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
-index d135c90..8253b48 100644
---- a/sound/pci/hda/patch_hdmi.c
-+++ b/sound/pci/hda/patch_hdmi.c
-@@ -1557,19 +1557,22 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
- }
- }
-
-- if (pin_eld->eld_valid && !eld->eld_valid) {
-- update_eld = true;
-+ if (pin_eld->eld_valid != eld->eld_valid)
- eld_changed = true;
-- }
-+
-+ if (pin_eld->eld_valid && !eld->eld_valid)
-+ update_eld = true;
-+
- if (update_eld) {
- bool old_eld_valid = pin_eld->eld_valid;
- pin_eld->eld_valid = eld->eld_valid;
-- eld_changed = pin_eld->eld_size != eld->eld_size ||
-+ if (pin_eld->eld_size != eld->eld_size ||
- memcmp(pin_eld->eld_buffer, eld->eld_buffer,
-- eld->eld_size) != 0;
-- if (eld_changed)
-+ eld->eld_size) != 0) {
- memcpy(pin_eld->eld_buffer, eld->eld_buffer,
- eld->eld_size);
-+ eld_changed = true;
-+ }
- pin_eld->eld_size = eld->eld_size;
- pin_eld->info = eld->info;
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 5d0058b..4c826a4 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -2926,6 +2926,9 @@ static void alc283_shutup(struct hda_codec *codec)
-
- alc_write_coef_idx(codec, 0x43, 0x9004);
-
-+ /*depop hp during suspend*/
-+ alc_write_coef_idx(codec, 0x06, 0x2100);
-+
- snd_hda_codec_write(codec, hp_pin, 0,
- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 223c47b..c657752 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -385,6 +385,36 @@ YAMAHA_DEVICE(0x105d, NULL),
- }
- },
- {
-+ USB_DEVICE(0x0499, 0x1509),
-+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+ /* .vendor_name = "Yamaha", */
-+ /* .product_name = "Steinberg UR22", */
-+ .ifnum = QUIRK_ANY_INTERFACE,
-+ .type = QUIRK_COMPOSITE,
-+ .data = (const struct snd_usb_audio_quirk[]) {
-+ {
-+ .ifnum = 1,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 2,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 3,
-+ .type = QUIRK_MIDI_YAMAHA
-+ },
-+ {
-+ .ifnum = 4,
-+ .type = QUIRK_IGNORE_INTERFACE
-+ },
-+ {
-+ .ifnum = -1
-+ }
-+ }
-+ }
-+},
-+{
- USB_DEVICE(0x0499, 0x150a),
- .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
- /* .vendor_name = "Yamaha", */
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 03a0381..6611253 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -52,6 +52,7 @@
-
- #include <asm/processor.h>
- #include <asm/io.h>
-+#include <asm/ioctl.h>
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
-
-@@ -95,8 +96,6 @@ static int hardware_enable_all(void);
- static void hardware_disable_all(void);
-
- static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
--static void update_memslots(struct kvm_memslots *slots,
-- struct kvm_memory_slot *new, u64 last_generation);
-
- static void kvm_release_pfn_dirty(pfn_t pfn);
- static void mark_page_dirty_in_slot(struct kvm *kvm,
-@@ -682,8 +681,7 @@ static void sort_memslots(struct kvm_memslots *slots)
- }
-
- static void update_memslots(struct kvm_memslots *slots,
-- struct kvm_memory_slot *new,
-- u64 last_generation)
-+ struct kvm_memory_slot *new)
- {
- if (new) {
- int id = new->id;
-@@ -694,8 +692,6 @@ static void update_memslots(struct kvm_memslots *slots,
- if (new->npages != npages)
- sort_memslots(slots);
- }
--
-- slots->generation = last_generation + 1;
- }
-
- static int check_memory_region_flags(struct kvm_userspace_memory_region *mem)
-@@ -717,10 +713,24 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
- {
- struct kvm_memslots *old_memslots = kvm->memslots;
-
-- update_memslots(slots, new, kvm->memslots->generation);
-+ /*
-+ * Set the low bit in the generation, which disables SPTE caching
-+ * until the end of synchronize_srcu_expedited.
-+ */
-+ WARN_ON(old_memslots->generation & 1);
-+ slots->generation = old_memslots->generation + 1;
-+
-+ update_memslots(slots, new);
- rcu_assign_pointer(kvm->memslots, slots);
- synchronize_srcu_expedited(&kvm->srcu);
-
-+ /*
-+ * Increment the new memslot generation a second time. This prevents
-+ * vm exits that race with memslot updates from caching a memslot
-+ * generation that will (potentially) be valid forever.
-+ */
-+ slots->generation++;
-+
- kvm_arch_memslots_updated(kvm);
-
- return old_memslots;
-@@ -1970,6 +1980,9 @@ static long kvm_vcpu_ioctl(struct file *filp,
- if (vcpu->kvm->mm != current->mm)
- return -EIO;
-
-+ if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
-+ return -EINVAL;
-+
- #if defined(CONFIG_S390) || defined(CONFIG_PPC) || defined(CONFIG_MIPS)
- /*
- * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
diff --git a/3.14.23/4420_grsecurity-3.0-3.14.23-201410312212.patch b/3.14.23/4420_grsecurity-3.0-3.14.23-201411062033.patch
index 2b0f9bd..399d2be 100644
--- a/3.14.23/4420_grsecurity-3.0-3.14.23-201410312212.patch
+++ b/3.14.23/4420_grsecurity-3.0-3.14.23-201411062033.patch
@@ -93492,6 +93492,82 @@ index e6be585..d73ae5e 100644
return;
local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 759d5e0..5156a5fe 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+
+ /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
+@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ int syscall_nr;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+
+ /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
+@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ return;
+@@ -602,6 +602,8 @@ static int perf_sysenter_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_enter)
+@@ -622,6 +624,8 @@ static void perf_sysenter_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_enter--;
+@@ -641,7 +645,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ return;
+@@ -674,6 +678,8 @@ static int perf_sysexit_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_exit)
+@@ -694,6 +700,8 @@ static void perf_sysexit_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_exit--;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 80a57af..7f5a7ff 100644
--- a/kernel/user_namespace.c
@@ -100239,7 +100315,7 @@ index b543470..d2ddae2 100644
if (!can_dir) {
printk(KERN_INFO "can: failed to create /proc/net/can . "
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index 0a31298..241da43 100644
+index 0a31298..6301eb0 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -187,7 +187,7 @@ static void con_fault(struct ceph_connection *con);
@@ -100260,6 +100336,19 @@ index 0a31298..241da43 100644
s = addr_str[i];
switch (ss->ss_family) {
+@@ -291,7 +291,11 @@ int ceph_msgr_init(void)
+ if (ceph_msgr_slab_init())
+ return -ENOMEM;
+
+- ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0);
++ /*
++ * The number of active work items is limited by the number of
++ * connections, so leave @max_active at default.
++ */
++ ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0);
+ if (ceph_msgr_wq)
+ return 0;
+
diff --git a/net/compat.c b/net/compat.c
index cbc1a2a..ab7644e 100644
--- a/net/compat.c
diff --git a/3.17.2/0000_README b/3.17.2/0000_README
index c71a071..08a13b9 100644
--- a/3.17.2/0000_README
+++ b/3.17.2/0000_README
@@ -2,7 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 4420_grsecurity-3.0-3.17.2-201410312213.patch
+Patch: 4420_grsecurity-3.0-3.17.2-201411062034.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.17.2/4420_grsecurity-3.0-3.17.2-201410312213.patch b/3.17.2/4420_grsecurity-3.0-3.17.2-201411062034.patch
index 942b997..2da5648 100644
--- a/3.17.2/4420_grsecurity-3.0-3.17.2-201410312213.patch
+++ b/3.17.2/4420_grsecurity-3.0-3.17.2-201411062034.patch
@@ -29335,7 +29335,7 @@ index 38a0afe..94421a9 100644
out:
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 03954f7..48daa1a 100644
+index 03954f7..0f4ad73 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -504,11 +504,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
@@ -29350,7 +29350,7 @@ index 03954f7..48daa1a 100644
static u32 desc_limit_scaled(struct desc_struct *desc)
{
u32 limit = get_desc_limit(desc);
-@@ -568,6 +563,38 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
+@@ -568,6 +563,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
return emulate_exception(ctxt, NM_VECTOR, 0, false);
}
@@ -29364,12 +29364,14 @@ index 03954f7..48daa1a 100644
+ case 4:
+ ctxt->_eip = (u32)dst;
+ break;
++#ifdef CONFIG_X86_64
+ case 8:
+ if ((cs_l && is_noncanonical_address(dst)) ||
-+ (!cs_l && (dst & ~(u32)-1)))
++ (!cs_l && (dst >> 32) != 0))
+ return emulate_gp(ctxt, 0);
+ ctxt->_eip = dst;
+ break;
++#endif
+ default:
+ WARN(1, "unsupported eip assignment size\n");
+ }
@@ -29389,7 +29391,7 @@ index 03954f7..48daa1a 100644
static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
{
u16 selector;
-@@ -750,8 +777,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
+@@ -750,8 +779,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
static __always_inline int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt,
unsigned size)
{
@@ -29402,7 +29404,7 @@ index 03954f7..48daa1a 100644
else
return X86EMUL_CONTINUE;
}
-@@ -1415,7 +1444,9 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1415,7 +1446,9 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
/* Does not support long mode */
static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
@@ -29413,7 +29415,7 @@ index 03954f7..48daa1a 100644
{
struct desc_struct seg_desc, old_desc;
u8 dpl, rpl;
-@@ -1547,6 +1578,8 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1547,6 +1580,8 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
}
load:
ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
@@ -29422,7 +29424,7 @@ index 03954f7..48daa1a 100644
return X86EMUL_CONTINUE;
exception:
emulate_exception(ctxt, err_vec, err_code, true);
-@@ -1557,7 +1590,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1557,7 +1592,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
u16 selector, int seg)
{
u8 cpl = ctxt->ops->cpl(ctxt);
@@ -29431,7 +29433,7 @@ index 03954f7..48daa1a 100644
}
static void write_register_operand(struct operand *op)
-@@ -1951,17 +1984,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
+@@ -1951,17 +1986,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
{
int rc;
@@ -29459,7 +29461,7 @@ index 03954f7..48daa1a 100644
- return X86EMUL_CONTINUE;
+ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
+ if (rc != X86EMUL_CONTINUE) {
-+ WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
+ /* assigning eip failed; restore the old cs */
+ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
+ return rc;
@@ -29468,7 +29470,7 @@ index 03954f7..48daa1a 100644
}
static int em_grp45(struct x86_emulate_ctxt *ctxt)
-@@ -1972,13 +2019,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
+@@ -1972,13 +2021,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
case 2: /* call near abs */ {
long int old_eip;
old_eip = ctxt->_eip;
@@ -29486,7 +29488,7 @@ index 03954f7..48daa1a 100644
break;
case 5: /* jmp far */
rc = em_jmp_far(ctxt);
-@@ -2013,30 +2062,47 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
+@@ -2013,30 +2064,47 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
static int em_ret(struct x86_emulate_ctxt *ctxt)
{
@@ -29537,13 +29539,13 @@ index 03954f7..48daa1a 100644
+ return rc;
+ rc = assign_eip_far(ctxt, eip, new_desc.l);
+ if (rc != X86EMUL_CONTINUE) {
-+ WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
+ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
+ }
return rc;
}
-@@ -2297,7 +2363,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2297,7 +2365,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
{
const struct x86_emulate_ops *ops = ctxt->ops;
struct desc_struct cs, ss;
@@ -29552,7 +29554,7 @@ index 03954f7..48daa1a 100644
int usermode;
u16 cs_sel = 0, ss_sel = 0;
-@@ -2313,6 +2379,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2313,6 +2381,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
else
usermode = X86EMUL_MODE_PROT32;
@@ -29562,7 +29564,7 @@ index 03954f7..48daa1a 100644
cs.dpl = 3;
ss.dpl = 3;
ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
-@@ -2330,6 +2399,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2330,6 +2401,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
ss_sel = cs_sel + 8;
cs.d = 0;
cs.l = 1;
@@ -29572,7 +29574,7 @@ index 03954f7..48daa1a 100644
break;
}
cs_sel |= SELECTOR_RPL_MASK;
-@@ -2338,8 +2410,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2338,8 +2412,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
@@ -29583,7 +29585,7 @@ index 03954f7..48daa1a 100644
return X86EMUL_CONTINUE;
}
-@@ -2457,19 +2529,24 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+@@ -2457,19 +2531,24 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
* Now load segment descriptors. If fault happens at this stage
* it is handled in a context of new task
*/
@@ -29613,7 +29615,7 @@ index 03954f7..48daa1a 100644
if (ret != X86EMUL_CONTINUE)
return ret;
-@@ -2594,25 +2671,32 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+@@ -2594,25 +2673,32 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
* Now load segment descriptors. If fault happenes at this stage
* it is handled in a context of new task
*/
@@ -29653,7 +29655,7 @@ index 03954f7..48daa1a 100644
if (ret != X86EMUL_CONTINUE)
return ret;
-@@ -2880,10 +2964,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt)
+@@ -2880,10 +2966,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt)
static int em_call(struct x86_emulate_ctxt *ctxt)
{
@@ -29668,7 +29670,7 @@ index 03954f7..48daa1a 100644
return em_push(ctxt);
}
-@@ -2892,34 +2979,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+@@ -2892,34 +2981,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
u16 sel, old_cs;
ulong old_eip;
int rc;
@@ -29729,7 +29731,7 @@ index 03954f7..48daa1a 100644
if (rc != X86EMUL_CONTINUE)
return rc;
rsp_increment(ctxt, ctxt->src.val);
-@@ -3250,20 +3353,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+@@ -3250,20 +3355,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
static int em_loop(struct x86_emulate_ctxt *ctxt)
{
@@ -29758,7 +29760,7 @@ index 03954f7..48daa1a 100644
}
static int em_in(struct x86_emulate_ctxt *ctxt)
-@@ -3351,6 +3458,12 @@ static int em_bswap(struct x86_emulate_ctxt *ctxt)
+@@ -3351,6 +3460,12 @@ static int em_bswap(struct x86_emulate_ctxt *ctxt)
return X86EMUL_CONTINUE;
}
@@ -29771,7 +29773,7 @@ index 03954f7..48daa1a 100644
static bool valid_cr(int nr)
{
switch (nr) {
-@@ -3683,6 +3796,16 @@ static const struct opcode group11[] = {
+@@ -3683,6 +3798,16 @@ static const struct opcode group11[] = {
X7(D(Undefined)),
};
@@ -29788,7 +29790,7 @@ index 03954f7..48daa1a 100644
static const struct gprefix pfx_0f_6f_0f_7f = {
I(Mmx, em_mov), I(Sse | Aligned, em_mov), N, I(Sse | Unaligned, em_mov),
};
-@@ -3887,10 +4010,11 @@ static const struct opcode twobyte_table[256] = {
+@@ -3887,10 +4012,11 @@ static const struct opcode twobyte_table[256] = {
N, I(ImplicitOps | EmulateOnUD, em_syscall),
II(ImplicitOps | Priv, em_clts, clts), N,
DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N,
@@ -29802,7 +29804,7 @@ index 03954f7..48daa1a 100644
/* 0x20 - 0x2F */
DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read),
DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read),
-@@ -3942,7 +4066,7 @@ static const struct opcode twobyte_table[256] = {
+@@ -3942,7 +4068,7 @@ static const struct opcode twobyte_table[256] = {
F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_bts),
F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shrd),
F(DstMem | SrcReg | Src2CL | ModRM, em_shrd),
@@ -29811,7 +29813,7 @@ index 03954f7..48daa1a 100644
/* 0xB0 - 0xB7 */
I2bv(DstMem | SrcReg | ModRM | Lock | PageTable, em_cmpxchg),
I(DstReg | SrcMemFAddr | ModRM | Src2SS, em_lseg),
-@@ -4458,10 +4582,10 @@ done_prefixes:
+@@ -4458,10 +4584,10 @@ done_prefixes:
/* Decode and fetch the destination operand: register or memory. */
rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
@@ -29823,7 +29825,7 @@ index 03954f7..48daa1a 100644
return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
}
-@@ -4711,7 +4835,7 @@ special_insn:
+@@ -4711,7 +4837,7 @@ special_insn:
break;
case 0x70 ... 0x7f: /* jcc (short) */
if (test_cc(ctxt->b, ctxt->eflags))
@@ -29832,7 +29834,7 @@ index 03954f7..48daa1a 100644
break;
case 0x8d: /* lea r16/r32, m */
ctxt->dst.val = ctxt->src.addr.mem.ea;
-@@ -4741,7 +4865,7 @@ special_insn:
+@@ -4741,7 +4867,7 @@ special_insn:
break;
case 0xe9: /* jmp rel */
case 0xeb: /* jmp rel short */
@@ -29841,7 +29843,7 @@ index 03954f7..48daa1a 100644
ctxt->dst.type = OP_NONE; /* Disable writeback. */
break;
case 0xf4: /* hlt */
-@@ -4864,13 +4988,11 @@ twobyte_insn:
+@@ -4864,13 +4990,11 @@ twobyte_insn:
break;
case 0x80 ... 0x8f: /* jnz rel, etc*/
if (test_cc(ctxt->b, ctxt->eflags))
@@ -95262,6 +95264,82 @@ index 8a4e5cb..64f270d 100644
return;
local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 759d5e0..5156a5fe 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+
+ /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
+@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ int syscall_nr;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+
+ /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
+@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ return;
+@@ -602,6 +602,8 @@ static int perf_sysenter_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_enter)
+@@ -622,6 +624,8 @@ static void perf_sysenter_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_enter--;
+@@ -641,7 +645,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int size;
+
+ syscall_nr = trace_get_syscall_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ return;
+@@ -674,6 +678,8 @@ static int perf_sysexit_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_exit)
+@@ -694,6 +700,8 @@ static void perf_sysexit_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_exit--;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index aa312b0..395f343 100644
--- a/kernel/user_namespace.c
@@ -101964,7 +102042,7 @@ index 1a19b98..df2b4ec 100644
if (!can_dir) {
printk(KERN_INFO "can: failed to create /proc/net/can . "
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index b2f571d..b584643 100644
+index b2f571d..e6160e9 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -188,7 +188,7 @@ static void con_fault(struct ceph_connection *con);
@@ -101985,6 +102063,19 @@ index b2f571d..b584643 100644
s = addr_str[i];
switch (ss->ss_family) {
+@@ -292,7 +292,11 @@ int ceph_msgr_init(void)
+ if (ceph_msgr_slab_init())
+ return -ENOMEM;
+
+- ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0);
++ /*
++ * The number of active work items is limited by the number of
++ * connections, so leave @max_active at default.
++ */
++ ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0);
+ if (ceph_msgr_wq)
+ return 0;
+
diff --git a/net/compat.c b/net/compat.c
index bc8aeef..f9c070c 100644
--- a/net/compat.c
diff --git a/3.2.63/0000_README b/3.2.64/0000_README
index dc58512..4dc0dd8 100644
--- a/3.2.63/0000_README
+++ b/3.2.64/0000_README
@@ -170,7 +170,11 @@ Patch: 1062_linux-3.2.63.patch
From: http://www.kernel.org
Desc: Linux 3.2.63
-Patch: 4420_grsecurity-3.0-3.2.63-201411020808.patch
+Patch: 1063_linux-3.2.64.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.64
+
+Patch: 4420_grsecurity-3.0-3.2.64-201411062032.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.63/1021_linux-3.2.22.patch b/3.2.64/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.63/1021_linux-3.2.22.patch
+++ b/3.2.64/1021_linux-3.2.22.patch
diff --git a/3.2.63/1022_linux-3.2.23.patch b/3.2.64/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.63/1022_linux-3.2.23.patch
+++ b/3.2.64/1022_linux-3.2.23.patch
diff --git a/3.2.63/1023_linux-3.2.24.patch b/3.2.64/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.63/1023_linux-3.2.24.patch
+++ b/3.2.64/1023_linux-3.2.24.patch
diff --git a/3.2.63/1024_linux-3.2.25.patch b/3.2.64/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.63/1024_linux-3.2.25.patch
+++ b/3.2.64/1024_linux-3.2.25.patch
diff --git a/3.2.63/1025_linux-3.2.26.patch b/3.2.64/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.63/1025_linux-3.2.26.patch
+++ b/3.2.64/1025_linux-3.2.26.patch
diff --git a/3.2.63/1026_linux-3.2.27.patch b/3.2.64/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.63/1026_linux-3.2.27.patch
+++ b/3.2.64/1026_linux-3.2.27.patch
diff --git a/3.2.63/1027_linux-3.2.28.patch b/3.2.64/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.63/1027_linux-3.2.28.patch
+++ b/3.2.64/1027_linux-3.2.28.patch
diff --git a/3.2.63/1028_linux-3.2.29.patch b/3.2.64/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.63/1028_linux-3.2.29.patch
+++ b/3.2.64/1028_linux-3.2.29.patch
diff --git a/3.2.63/1029_linux-3.2.30.patch b/3.2.64/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.63/1029_linux-3.2.30.patch
+++ b/3.2.64/1029_linux-3.2.30.patch
diff --git a/3.2.63/1030_linux-3.2.31.patch b/3.2.64/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.63/1030_linux-3.2.31.patch
+++ b/3.2.64/1030_linux-3.2.31.patch
diff --git a/3.2.63/1031_linux-3.2.32.patch b/3.2.64/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.63/1031_linux-3.2.32.patch
+++ b/3.2.64/1031_linux-3.2.32.patch
diff --git a/3.2.63/1032_linux-3.2.33.patch b/3.2.64/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.63/1032_linux-3.2.33.patch
+++ b/3.2.64/1032_linux-3.2.33.patch
diff --git a/3.2.63/1033_linux-3.2.34.patch b/3.2.64/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.63/1033_linux-3.2.34.patch
+++ b/3.2.64/1033_linux-3.2.34.patch
diff --git a/3.2.63/1034_linux-3.2.35.patch b/3.2.64/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.63/1034_linux-3.2.35.patch
+++ b/3.2.64/1034_linux-3.2.35.patch
diff --git a/3.2.63/1035_linux-3.2.36.patch b/3.2.64/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.63/1035_linux-3.2.36.patch
+++ b/3.2.64/1035_linux-3.2.36.patch
diff --git a/3.2.63/1036_linux-3.2.37.patch b/3.2.64/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.63/1036_linux-3.2.37.patch
+++ b/3.2.64/1036_linux-3.2.37.patch
diff --git a/3.2.63/1037_linux-3.2.38.patch b/3.2.64/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.63/1037_linux-3.2.38.patch
+++ b/3.2.64/1037_linux-3.2.38.patch
diff --git a/3.2.63/1038_linux-3.2.39.patch b/3.2.64/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.63/1038_linux-3.2.39.patch
+++ b/3.2.64/1038_linux-3.2.39.patch
diff --git a/3.2.63/1039_linux-3.2.40.patch b/3.2.64/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.63/1039_linux-3.2.40.patch
+++ b/3.2.64/1039_linux-3.2.40.patch
diff --git a/3.2.63/1040_linux-3.2.41.patch b/3.2.64/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.63/1040_linux-3.2.41.patch
+++ b/3.2.64/1040_linux-3.2.41.patch
diff --git a/3.2.63/1041_linux-3.2.42.patch b/3.2.64/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.63/1041_linux-3.2.42.patch
+++ b/3.2.64/1041_linux-3.2.42.patch
diff --git a/3.2.63/1042_linux-3.2.43.patch b/3.2.64/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.63/1042_linux-3.2.43.patch
+++ b/3.2.64/1042_linux-3.2.43.patch
diff --git a/3.2.63/1043_linux-3.2.44.patch b/3.2.64/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.63/1043_linux-3.2.44.patch
+++ b/3.2.64/1043_linux-3.2.44.patch
diff --git a/3.2.63/1044_linux-3.2.45.patch b/3.2.64/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.63/1044_linux-3.2.45.patch
+++ b/3.2.64/1044_linux-3.2.45.patch
diff --git a/3.2.63/1045_linux-3.2.46.patch b/3.2.64/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.63/1045_linux-3.2.46.patch
+++ b/3.2.64/1045_linux-3.2.46.patch
diff --git a/3.2.63/1046_linux-3.2.47.patch b/3.2.64/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.63/1046_linux-3.2.47.patch
+++ b/3.2.64/1046_linux-3.2.47.patch
diff --git a/3.2.63/1047_linux-3.2.48.patch b/3.2.64/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.63/1047_linux-3.2.48.patch
+++ b/3.2.64/1047_linux-3.2.48.patch
diff --git a/3.2.63/1048_linux-3.2.49.patch b/3.2.64/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.63/1048_linux-3.2.49.patch
+++ b/3.2.64/1048_linux-3.2.49.patch
diff --git a/3.2.63/1049_linux-3.2.50.patch b/3.2.64/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.63/1049_linux-3.2.50.patch
+++ b/3.2.64/1049_linux-3.2.50.patch
diff --git a/3.2.63/1050_linux-3.2.51.patch b/3.2.64/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.63/1050_linux-3.2.51.patch
+++ b/3.2.64/1050_linux-3.2.51.patch
diff --git a/3.2.63/1051_linux-3.2.52.patch b/3.2.64/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.63/1051_linux-3.2.52.patch
+++ b/3.2.64/1051_linux-3.2.52.patch
diff --git a/3.2.63/1052_linux-3.2.53.patch b/3.2.64/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.63/1052_linux-3.2.53.patch
+++ b/3.2.64/1052_linux-3.2.53.patch
diff --git a/3.2.63/1053_linux-3.2.54.patch b/3.2.64/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.63/1053_linux-3.2.54.patch
+++ b/3.2.64/1053_linux-3.2.54.patch
diff --git a/3.2.63/1054_linux-3.2.55.patch b/3.2.64/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.63/1054_linux-3.2.55.patch
+++ b/3.2.64/1054_linux-3.2.55.patch
diff --git a/3.2.63/1055_linux-3.2.56.patch b/3.2.64/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.63/1055_linux-3.2.56.patch
+++ b/3.2.64/1055_linux-3.2.56.patch
diff --git a/3.2.63/1056_linux-3.2.57.patch b/3.2.64/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.63/1056_linux-3.2.57.patch
+++ b/3.2.64/1056_linux-3.2.57.patch
diff --git a/3.2.63/1057_linux-3.2.58.patch b/3.2.64/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.63/1057_linux-3.2.58.patch
+++ b/3.2.64/1057_linux-3.2.58.patch
diff --git a/3.2.63/1058_linux-3.2.59.patch b/3.2.64/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.63/1058_linux-3.2.59.patch
+++ b/3.2.64/1058_linux-3.2.59.patch
diff --git a/3.2.63/1059_linux-3.2.60.patch b/3.2.64/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.63/1059_linux-3.2.60.patch
+++ b/3.2.64/1059_linux-3.2.60.patch
diff --git a/3.2.63/1060_linux-3.2.61.patch b/3.2.64/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.63/1060_linux-3.2.61.patch
+++ b/3.2.64/1060_linux-3.2.61.patch
diff --git a/3.2.63/1061_linux-3.2.62.patch b/3.2.64/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.63/1061_linux-3.2.62.patch
+++ b/3.2.64/1061_linux-3.2.62.patch
diff --git a/3.2.63/1062_linux-3.2.63.patch b/3.2.64/1062_linux-3.2.63.patch
index f7c7415..f7c7415 100644
--- a/3.2.63/1062_linux-3.2.63.patch
+++ b/3.2.64/1062_linux-3.2.63.patch
diff --git a/3.2.64/1063_linux-3.2.64.patch b/3.2.64/1063_linux-3.2.64.patch
new file mode 100644
index 0000000..862b4f0
--- /dev/null
+++ b/3.2.64/1063_linux-3.2.64.patch
@@ -0,0 +1,3821 @@
+diff --git a/Makefile b/Makefile
+index 6d3f2d4..2b58ffc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 63
++SUBLEVEL = 64
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index a125c4b..6e39bf1 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -38,6 +38,7 @@
+ * This code is not portable to processors with late data abort handling.
+ */
+ #define CODING_BITS(i) (i & 0x0e000000)
++#define COND_BITS(i) (i & 0xf0000000)
+
+ #define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */
+ #define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */
+@@ -812,6 +813,8 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ break;
+
+ case 0x04000000: /* ldr or str immediate */
++ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
++ goto bad;
+ offset.un = OFFSET_BITS(instr);
+ handler = do_alignment_ldrstr;
+ break;
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 5cad0fa..ca51d69 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/string.h>
+
+ #include <asm/addrspace.h>
+
+diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
+index 4c968e7..55eca41 100644
+--- a/arch/mips/kernel/mcount.S
++++ b/arch/mips/kernel/mcount.S
+@@ -119,7 +119,11 @@ NESTED(_mcount, PT_SIZE, ra)
+ nop
+ #endif
+ b ftrace_stub
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#else
+ nop
++#endif
+
+ static_trace:
+ MCOUNT_SAVE_REGS
+@@ -129,6 +133,9 @@ static_trace:
+ move a1, AT /* arg2: parent's return address */
+
+ MCOUNT_RESTORE_REGS
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#endif
+ .globl ftrace_stub
+ ftrace_stub:
+ RETURN_BACK
+@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
+ jal prepare_ftrace_return
+ nop
+ MCOUNT_RESTORE_REGS
++#ifndef CONFIG_DYNAMIC_FTRACE
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#endif
++#endif
+ RETURN_BACK
+ END(ftrace_graph_caller)
+
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index fe425bb..228a205 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -606,6 +606,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ r4k_blast_scache();
+ else
+ blast_scache_range(addr, addr + size);
++ preempt_enable();
+ __sync();
+ return;
+ }
+@@ -647,6 +648,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ */
+ blast_inv_scache_range(addr, addr + size);
+ }
++ preempt_enable();
+ __sync();
+ return;
+ }
+diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
+index 55cca1d..75947e0 100644
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -47,7 +47,12 @@ cflags-y := -pipe
+
+ # These flags should be implied by an hppa-linux configuration, but they
+ # are not in gcc 3.2.
+-cflags-y += -mno-space-regs -mfast-indirect-calls
++cflags-y += -mno-space-regs
++
++# -mfast-indirect-calls is only relevant for 32-bit kernels.
++ifndef CONFIG_64BIT
++cflags-y += -mfast-indirect-calls
++endif
+
+ # Currently we save and restore fpregs on all kernel entry/interruption paths.
+ # If that gets optimized, we might need to disable the use of fpregs in the
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index dd072b1..f6f41dd 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -516,16 +516,6 @@ rerun_vcpu:
+
+ BUG_ON(vcpu->kvm->arch.float_int.local_int[vcpu->vcpu_id] == NULL);
+
+- switch (kvm_run->exit_reason) {
+- case KVM_EXIT_S390_SIEIC:
+- case KVM_EXIT_UNKNOWN:
+- case KVM_EXIT_INTR:
+- case KVM_EXIT_S390_RESET:
+- break;
+- default:
+- BUG();
+- }
+-
+ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
+ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index b3eb9a7..15d24cb 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -821,6 +821,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code)
+ kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
+ }
+
++static inline u64 get_canonical(u64 la)
++{
++ return ((int64_t)la << 16) >> 16;
++}
++
++static inline bool is_noncanonical_address(u64 la)
++{
++#ifdef CONFIG_X86_64
++ return get_canonical(la) != la;
++#else
++ return false;
++#endif
++}
++
+ #define TSS_IOPB_BASE_OFFSET 0x66
+ #define TSS_BASE_SIZE 0x68
+ #define TSS_IOPB_SIZE (65536 / 8)
+diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
+index 31f180c..36cbe2a 100644
+--- a/arch/x86/include/asm/vmx.h
++++ b/arch/x86/include/asm/vmx.h
+@@ -279,6 +279,8 @@ enum vmcs_field {
+ #define EXIT_REASON_APIC_ACCESS 44
+ #define EXIT_REASON_EPT_VIOLATION 48
+ #define EXIT_REASON_EPT_MISCONFIG 49
++#define EXIT_REASON_INVEPT 50
++#define EXIT_REASON_INVVPID 53
+ #define EXIT_REASON_WBINVD 54
+ #define EXIT_REASON_XSETBV 55
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 6e68bd9..bb28f2ca 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1252,6 +1252,9 @@ static void remove_siblinginfo(int cpu)
+
+ for_each_cpu(sibling, cpu_sibling_mask(cpu))
+ cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling));
++ for_each_cpu(sibling, cpu_llc_shared_mask(cpu))
++ cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling));
++ cpumask_clear(cpu_llc_shared_mask(cpu));
+ cpumask_clear(cpu_sibling_mask(cpu));
+ cpumask_clear(cpu_core_mask(cpu));
+ c->phys_proc_id = 0;
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 638cab5..f0ac042 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -456,11 +456,6 @@ register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, in
+ *reg = (*reg & ~ad_mask(ctxt)) | ((*reg + inc) & ad_mask(ctxt));
+ }
+
+-static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+-{
+- register_address_increment(ctxt, &ctxt->_eip, rel);
+-}
+-
+ static u32 desc_limit_scaled(struct desc_struct *desc)
+ {
+ u32 limit = get_desc_limit(desc);
+@@ -534,6 +529,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
+ return emulate_exception(ctxt, NM_VECTOR, 0, false);
+ }
+
++static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
++ int cs_l)
++{
++ switch (ctxt->op_bytes) {
++ case 2:
++ ctxt->_eip = (u16)dst;
++ break;
++ case 4:
++ ctxt->_eip = (u32)dst;
++ break;
++#ifdef CONFIG_X86_64
++ case 8:
++ if ((cs_l && is_noncanonical_address(dst)) ||
++ (!cs_l && (dst >> 32) != 0))
++ return emulate_gp(ctxt, 0);
++ ctxt->_eip = dst;
++ break;
++#endif
++ default:
++ WARN(1, "unsupported eip assignment size\n");
++ }
++ return X86EMUL_CONTINUE;
++}
++
++static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
++{
++ return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64);
++}
++
++static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
++{
++ return assign_eip_near(ctxt, ctxt->_eip + rel);
++}
++
+ static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
+ {
+ u16 selector;
+@@ -1206,11 +1235,12 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ }
+
+ /* Does not support long mode */
+-static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+- u16 selector, int seg)
++static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++ u16 selector, int seg, u8 cpl,
++ struct desc_struct *desc)
+ {
+ struct desc_struct seg_desc;
+- u8 dpl, rpl, cpl;
++ u8 dpl, rpl;
+ unsigned err_vec = GP_VECTOR;
+ u32 err_code = 0;
+ bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
+@@ -1259,7 +1289,6 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+
+ rpl = selector & 3;
+ dpl = seg_desc.dpl;
+- cpl = ctxt->ops->cpl(ctxt);
+
+ switch (seg) {
+ case VCPU_SREG_SS:
+@@ -1316,12 +1345,21 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ }
+ load:
+ ctxt->ops->set_segment(ctxt, selector, &seg_desc, 0, seg);
++ if (desc)
++ *desc = seg_desc;
+ return X86EMUL_CONTINUE;
+ exception:
+ emulate_exception(ctxt, err_vec, err_code, true);
+ return X86EMUL_PROPAGATE_FAULT;
+ }
+
++static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++ u16 selector, int seg)
++{
++ u8 cpl = ctxt->ops->cpl(ctxt);
++ return __load_segment_descriptor(ctxt, selector, seg, cpl, NULL);
++}
++
+ static void write_register_operand(struct operand *op)
+ {
+ /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
+@@ -1661,17 +1699,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
+ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
+- unsigned short sel;
++ unsigned short sel, old_sel;
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
++ u8 cpl = ctxt->ops->cpl(ctxt);
++
++ /* Assignment of RIP may only fail in 64-bit mode */
++ if (ctxt->mode == X86EMUL_MODE_PROT64)
++ ops->get_segment(ctxt, &old_sel, &old_desc, NULL,
++ VCPU_SREG_CS);
+
+ memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+
+- rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS);
++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl,
++ &new_desc);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+
+- ctxt->_eip = 0;
+- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
+- return X86EMUL_CONTINUE;
++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++ if (rc != X86EMUL_CONTINUE) {
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++ /* assigning eip failed; restore the old cs */
++ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
++ return rc;
++ }
++ return rc;
+ }
+
+ static int em_grp1a(struct x86_emulate_ctxt *ctxt)
+@@ -1770,13 +1822,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
+ case 2: /* call near abs */ {
+ long int old_eip;
+ old_eip = ctxt->_eip;
+- ctxt->_eip = ctxt->src.val;
++ rc = assign_eip_near(ctxt, ctxt->src.val);
++ if (rc != X86EMUL_CONTINUE)
++ break;
+ ctxt->src.val = old_eip;
+ rc = em_push(ctxt);
+ break;
+ }
+ case 4: /* jmp abs */
+- ctxt->_eip = ctxt->src.val;
++ rc = assign_eip_near(ctxt, ctxt->src.val);
+ break;
+ case 5: /* jmp far */
+ rc = em_jmp_far(ctxt);
+@@ -1808,30 +1862,47 @@ static int em_grp9(struct x86_emulate_ctxt *ctxt)
+
+ static int em_ret(struct x86_emulate_ctxt *ctxt)
+ {
+- ctxt->dst.type = OP_REG;
+- ctxt->dst.addr.reg = &ctxt->_eip;
+- ctxt->dst.bytes = ctxt->op_bytes;
+- return em_pop(ctxt);
++ int rc;
++ unsigned long eip;
++
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++
++ return assign_eip_near(ctxt, eip);
+ }
+
+ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
+- unsigned long cs;
++ unsigned long eip, cs;
++ u16 old_cs;
+ int cpl = ctxt->ops->cpl(ctxt);
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
+
+- rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes);
++ if (ctxt->mode == X86EMUL_MODE_PROT64)
++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL,
++ VCPU_SREG_CS);
++
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+- if (ctxt->op_bytes == 4)
+- ctxt->_eip = (u32)ctxt->_eip;
+ rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+ /* Outer-privilege level return is not implemented */
+ if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
+ return X86EMUL_UNHANDLEABLE;
+- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
++ rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0,
++ &new_desc);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++ rc = assign_eip_far(ctxt, eip, new_desc.l);
++ if (rc != X86EMUL_CONTINUE) {
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++ }
+ return rc;
+ }
+
+@@ -2043,7 +2114,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ {
+ struct x86_emulate_ops *ops = ctxt->ops;
+ struct desc_struct cs, ss;
+- u64 msr_data;
++ u64 msr_data, rcx, rdx;
+ int usermode;
+ u16 cs_sel = 0, ss_sel = 0;
+
+@@ -2059,6 +2130,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ else
+ usermode = X86EMUL_MODE_PROT32;
+
++ rcx = ctxt->regs[VCPU_REGS_RCX];
++ rdx = ctxt->regs[VCPU_REGS_RDX];
++
+ cs.dpl = 3;
+ ss.dpl = 3;
+ ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
+@@ -2076,6 +2150,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ ss_sel = cs_sel + 8;
+ cs.d = 0;
+ cs.l = 1;
++ if (is_noncanonical_address(rcx) ||
++ is_noncanonical_address(rdx))
++ return emulate_gp(ctxt, 0);
+ break;
+ }
+ cs_sel |= SELECTOR_RPL_MASK;
+@@ -2084,8 +2161,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+ ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+
+- ctxt->_eip = ctxt->regs[VCPU_REGS_RDX];
+- ctxt->regs[VCPU_REGS_RSP] = ctxt->regs[VCPU_REGS_RCX];
++ ctxt->_eip = rdx;
++ ctxt->regs[VCPU_REGS_RSP] = rcx;
+
+ return X86EMUL_CONTINUE;
+ }
+@@ -2174,6 +2251,7 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ struct tss_segment_16 *tss)
+ {
+ int ret;
++ u8 cpl;
+
+ ctxt->_eip = tss->ip;
+ ctxt->eflags = tss->flag | 2;
+@@ -2196,23 +2274,30 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
+ set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
+
++ cpl = tss->cs & 3;
++
+ /*
+ * Now load segment descriptors. If fault happenes at this stage
+ * it is handled in a context of new task
+ */
+- ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR);
++ ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+
+@@ -2291,6 +2376,7 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ struct tss_segment_32 *tss)
+ {
+ int ret;
++ u8 cpl;
+
+ if (ctxt->ops->set_cr(ctxt, 3, tss->cr3))
+ return emulate_gp(ctxt, 0);
+@@ -2307,7 +2393,8 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+
+ /*
+ * SDM says that segment selectors are loaded before segment
+- * descriptors
++ * descriptors. This is important because CPL checks will
++ * use CS.RPL.
+ */
+ set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
+ set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
+@@ -2317,29 +2404,38 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ set_segment_selector(ctxt, tss->fs, VCPU_SREG_FS);
+ set_segment_selector(ctxt, tss->gs, VCPU_SREG_GS);
+
++ cpl = tss->cs & 3;
++
+ /*
+ * Now load segment descriptors. If fault happenes at this stage
+ * it is handled in a context of new task
+ */
+- ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
++ ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR,
++ cpl, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS);
++ ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS);
++ ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl,
++ NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+
+@@ -2536,39 +2632,67 @@ static int em_das(struct x86_emulate_ctxt *ctxt)
+ return X86EMUL_CONTINUE;
+ }
+
++static int em_call(struct x86_emulate_ctxt *ctxt)
++{
++ int rc;
++ long rel = ctxt->src.val;
++
++ ctxt->src.val = (unsigned long)ctxt->_eip;
++ rc = jmp_rel(ctxt, rel);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++ return em_push(ctxt);
++}
++
+ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+ {
+ u16 sel, old_cs;
+ ulong old_eip;
+ int rc;
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
++ int cpl = ctxt->ops->cpl(ctxt);
+
+- old_cs = get_segment_selector(ctxt, VCPU_SREG_CS);
+ old_eip = ctxt->_eip;
++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS);
+
+ memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+- if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS))
++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl,
++ &new_desc);
++ if (rc != X86EMUL_CONTINUE)
+ return X86EMUL_CONTINUE;
+
+- ctxt->_eip = 0;
+- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++ if (rc != X86EMUL_CONTINUE)
++ goto fail;
+
+ ctxt->src.val = old_cs;
+ rc = em_push(ctxt);
+ if (rc != X86EMUL_CONTINUE)
+- return rc;
++ goto fail;
+
+ ctxt->src.val = old_eip;
+- return em_push(ctxt);
++ rc = em_push(ctxt);
++ /* If we failed, we tainted the memory, but the very least we should
++ restore cs */
++ if (rc != X86EMUL_CONTINUE)
++ goto fail;
++ return rc;
++fail:
++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++ return rc;
++
+ }
+
+ static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
++ unsigned long eip;
+
+- ctxt->dst.type = OP_REG;
+- ctxt->dst.addr.reg = &ctxt->_eip;
+- ctxt->dst.bytes = ctxt->op_bytes;
+- rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++ rc = assign_eip_near(ctxt, eip);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+ register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], ctxt->src.val);
+@@ -2814,20 +2938,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+
+ static int em_loop(struct x86_emulate_ctxt *ctxt)
+ {
++ int rc = X86EMUL_CONTINUE;
++
+ register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RCX], -1);
+ if ((address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) != 0) &&
+ (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags)))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+
+- return X86EMUL_CONTINUE;
++ return rc;
+ }
+
+ static int em_jcxz(struct x86_emulate_ctxt *ctxt)
+ {
++ int rc = X86EMUL_CONTINUE;
++
+ if (address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) == 0)
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+
+- return X86EMUL_CONTINUE;
++ return rc;
+ }
+
+ static int em_cli(struct x86_emulate_ctxt *ctxt)
+@@ -3271,7 +3399,7 @@ static struct opcode opcode_table[256] = {
+ D2bvIP(SrcImmUByte | DstAcc, in, check_perm_in),
+ D2bvIP(SrcAcc | DstImmUByte, out, check_perm_out),
+ /* 0xE8 - 0xEF */
+- D(SrcImm | Stack), D(SrcImm | ImplicitOps),
++ I(SrcImm | Stack, em_call), D(SrcImm | ImplicitOps),
+ I(SrcImmFAddr | No64, em_jmp_far), D(SrcImmByte | ImplicitOps),
+ D2bvIP(SrcDX | DstAcc, in, check_perm_in),
+ D2bvIP(SrcAcc | DstDX, out, check_perm_out),
+@@ -3920,7 +4048,7 @@ special_insn:
+ break;
+ case 0x70 ... 0x7f: /* jcc (short) */
+ if (test_cc(ctxt->b, ctxt->eflags))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ break;
+ case 0x8d: /* lea r16/r32, m */
+ ctxt->dst.val = ctxt->src.addr.mem.ea;
+@@ -3966,16 +4094,9 @@ special_insn:
+ case 0xe6: /* outb */
+ case 0xe7: /* out */
+ goto do_io_out;
+- case 0xe8: /* call (near) */ {
+- long int rel = ctxt->src.val;
+- ctxt->src.val = (unsigned long) ctxt->_eip;
+- jmp_rel(ctxt, rel);
+- rc = em_push(ctxt);
+- break;
+- }
+ case 0xe9: /* jmp rel */
+ case 0xeb: /* jmp rel short */
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ ctxt->dst.type = OP_NONE; /* Disable writeback. */
+ break;
+ case 0xec: /* in al,dx */
+@@ -4141,7 +4262,7 @@ twobyte_insn:
+ break;
+ case 0x80 ... 0x8f: /* jnz rel, etc*/
+ if (test_cc(ctxt->b, ctxt->eflags))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ break;
+ case 0x90 ... 0x9f: /* setcc r/m8 */
+ ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags);
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 139415e..cced57f 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -264,8 +264,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+ return;
+
+ timer = &pit->pit_state.pit_timer.timer;
++ mutex_lock(&pit->pit_state.lock);
+ if (hrtimer_cancel(timer))
+ hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
++ mutex_unlock(&pit->pit_state.lock);
+ }
+
+ static void destroy_pit_timer(struct kvm_pit *pit)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 2102a17..82f97a5 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3109,7 +3109,7 @@ static int wrmsr_interception(struct vcpu_svm *svm)
+
+
+ svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
+- if (svm_set_msr(&svm->vcpu, ecx, data)) {
++ if (kvm_set_msr(&svm->vcpu, ecx, data)) {
+ trace_kvm_msr_write_ex(ecx, data);
+ kvm_inject_gp(&svm->vcpu, 0);
+ } else {
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a4f6bda..578b1c6 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -390,6 +390,7 @@ struct vcpu_vmx {
+ u16 fs_sel, gs_sel, ldt_sel;
+ int gs_ldt_reload_needed;
+ int fs_reload_needed;
++ unsigned long vmcs_host_cr4; /* May not match real cr4 */
+ } host_state;
+ struct {
+ int vm86_active;
+@@ -3629,16 +3630,21 @@ static void vmx_disable_intercept_for_msr(u32 msr, bool longmode_only)
+ * Note that host-state that does change is set elsewhere. E.g., host-state
+ * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
+ */
+-static void vmx_set_constant_host_state(void)
++static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ {
+ u32 low32, high32;
+ unsigned long tmpl;
+ struct desc_ptr dt;
++ unsigned long cr4;
+
+ vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
+- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
+
++ /* Save the most likely value for this task's CR4 in the VMCS. */
++ cr4 = read_cr4();
++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
++ vmx->host_state.vmcs_host_cr4 = cr4;
++
+ vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
+ vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+ vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+@@ -3760,7 +3766,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
+
+ vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
+ vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
+- vmx_set_constant_host_state();
++ vmx_set_constant_host_state(vmx);
+ #ifdef CONFIG_X86_64
+ rdmsrl(MSR_FS_BASE, a);
+ vmcs_writel(HOST_FS_BASE, a); /* 22.2.4 */
+@@ -4544,7 +4550,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu)
+ u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u)
+ | ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32);
+
+- if (vmx_set_msr(vcpu, ecx, data) != 0) {
++ if (kvm_set_msr(vcpu, ecx, data) != 0) {
+ trace_kvm_msr_write_ex(ecx, data);
+ kvm_inject_gp(vcpu, 0);
+ return 1;
+@@ -5550,6 +5556,18 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
+ return 1;
+ }
+
++static int handle_invept(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++static int handle_invvpid(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
+ /*
+ * The exit handlers return 1 if the exit was handled fully and guest execution
+ * may resume. Otherwise they set the kvm_run parameter to indicate what needs
+@@ -5591,6 +5609,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+ [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
+ [EXIT_REASON_MWAIT_INSTRUCTION] = handle_invalid_op,
+ [EXIT_REASON_MONITOR_INSTRUCTION] = handle_invalid_op,
++ [EXIT_REASON_INVEPT] = handle_invept,
++ [EXIT_REASON_INVVPID] = handle_invvpid,
+ };
+
+ static const int kvm_vmx_max_exit_handlers =
+@@ -5775,6 +5795,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+ case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD:
+ case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE:
+ case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
++ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID:
+ /*
+ * VMX instructions trap unconditionally. This allows L1 to
+ * emulate them for its L2 guest, i.e., allows 3-level nesting!
+@@ -6093,6 +6114,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
+ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long cr4;
+
+ if (is_guest_mode(vcpu) && !vmx->nested.nested_run_pending) {
+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+@@ -6123,6 +6145,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+ vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+
++ cr4 = read_cr4();
++ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
++ vmcs_writel(HOST_CR4, cr4);
++ vmx->host_state.vmcs_host_cr4 = cr4;
++ }
++
+ /* When single-stepping over STI and MOV SS, we must clear the
+ * corresponding interruptibility bits in the guest state. Otherwise
+ * vmentry fails as it then expects bit 14 (BS) in pending debug
+@@ -6581,7 +6609,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+ * Other fields are different per CPU, and will be set later when
+ * vmx_vcpu_load() is called, and when vmx_save_host_state() is called.
+ */
+- vmx_set_constant_host_state();
++ vmx_set_constant_host_state(vmx);
+
+ /*
+ * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index b9fefaf..2d7d0df 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -893,7 +893,6 @@ void kvm_enable_efer_bits(u64 mask)
+ }
+ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+
+-
+ /*
+ * Writes msr value into into the appropriate "register".
+ * Returns 0 on success, non-0 otherwise.
+@@ -901,8 +900,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+ */
+ int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+ {
++ switch (msr_index) {
++ case MSR_FS_BASE:
++ case MSR_GS_BASE:
++ case MSR_KERNEL_GS_BASE:
++ case MSR_CSTAR:
++ case MSR_LSTAR:
++ if (is_noncanonical_address(data))
++ return 1;
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ case MSR_IA32_SYSENTER_ESP:
++ /*
++ * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if
++ * non-canonical address is written on Intel but not on
++ * AMD (which ignores the top 32-bits, because it does
++ * not implement 64-bit SYSENTER).
++ *
++ * 64-bit code should hence be able to write a non-canonical
++ * value on AMD. Making the address canonical ensures that
++ * vmentry does not fail on Intel after writing a non-canonical
++ * value, and that something deterministic happens if the guest
++ * invokes 64-bit SYSENTER.
++ */
++ data = get_canonical(data);
++ }
+ return kvm_x86_ops->set_msr(vcpu, msr_index, data);
+ }
++EXPORT_SYMBOL_GPL(kvm_set_msr);
+
+ /*
+ * Adapt set_msr() to msr_io()'s calling convention
+diff --git a/block/genhd.c b/block/genhd.c
+index 8bd4ef2..41b0435 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -28,10 +28,10 @@ struct kobject *block_depr;
+ /* for extended dynamic devt allocation, currently only one major is used */
+ #define NR_EXT_DEVT (1 << MINORBITS)
+
+-/* For extended devt allocation. ext_devt_mutex prevents look up
++/* For extended devt allocation. ext_devt_lock prevents look up
+ * results from going away underneath its user.
+ */
+-static DEFINE_MUTEX(ext_devt_mutex);
++static DEFINE_SPINLOCK(ext_devt_lock);
+ static DEFINE_IDR(ext_devt_idr);
+
+ static struct device_type disk_type;
+@@ -421,13 +421,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ do {
+ if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
+ return -ENOMEM;
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ rc = idr_get_new(&ext_devt_idr, part, &idx);
+ if (!rc && idx >= NR_EXT_DEVT) {
+ idr_remove(&ext_devt_idr, idx);
+ rc = -EBUSY;
+ }
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ } while (rc == -EAGAIN);
+
+ if (rc)
+@@ -448,15 +448,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ */
+ void blk_free_devt(dev_t devt)
+ {
+- might_sleep();
+-
+ if (devt == MKDEV(0, 0))
+ return;
+
+ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+ }
+
+@@ -663,7 +661,6 @@ void del_gendisk(struct gendisk *disk)
+ if (!sysfs_deprecated)
+ sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
+ device_del(disk_to_dev(disk));
+- blk_free_devt(disk_to_dev(disk)->devt);
+ }
+ EXPORT_SYMBOL(del_gendisk);
+
+@@ -688,13 +685,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
+ } else {
+ struct hd_struct *part;
+
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ if (part && get_disk(part_to_disk(part))) {
+ *partno = part->partno;
+ disk = part_to_disk(part);
+ }
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+
+ return disk;
+@@ -1102,6 +1099,7 @@ static void disk_release(struct device *dev)
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+
++ blk_free_devt(dev->devt);
+ disk_release_events(disk);
+ kfree(disk->random);
+ disk_replace_part_tbl(disk, NULL);
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index de0791c..388ba10 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1165,9 +1165,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ if (smp_processor_id() == 0 &&
+ cpuidle_get_driver() == &acpi_idle_driver) {
+
+- cpuidle_pause_and_lock();
+ /* Protect against cpu-hotplug */
+ get_online_cpus();
++ cpuidle_pause_and_lock();
+
+ /* Disable all cpuidle devices */
+ for_each_online_cpu(cpu) {
+@@ -1192,8 +1192,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ cpuidle_enable_device(&_pr->power.dev);
+ }
+ }
+- put_online_cpus();
+ cpuidle_resume_and_unlock();
++ put_online_cpus();
+ }
+
+ return 0;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 43b0acf..4007f62 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -315,6 +315,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
++ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
++ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
++ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+
+ /* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -449,6 +457,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
++ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */
++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 5b0b5f7..b1e8e11 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -362,6 +362,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ /* SATA Controller IDE (Coleto Creek) */
+ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+
+ { } /* terminate list */
+ };
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index bf441db..ea78bc46 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -36,6 +36,9 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
+ if (map->max_register && reg > map->max_register)
+ return false;
+
++ if (map->format.format_write)
++ return false;
++
+ if (map->readable_reg)
+ return map->readable_reg(map->dev, reg);
+
+@@ -44,7 +47,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
+
+ bool regmap_volatile(struct regmap *map, unsigned int reg)
+ {
+- if (map->max_register && reg > map->max_register)
++ if (!map->format.format_write && !regmap_readable(map, reg))
+ return false;
+
+ if (map->volatile_reg)
+@@ -55,7 +58,7 @@ bool regmap_volatile(struct regmap *map, unsigned int reg)
+
+ bool regmap_precious(struct regmap *map, unsigned int reg)
+ {
+- if (map->max_register && reg > map->max_register)
++ if (!regmap_readable(map, reg))
+ return false;
+
+ if (map->precious_reg)
+diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
+index 0016fee..96d5cfc 100644
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -651,7 +651,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
+ DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq);
+ }
+
+-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
++static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+ {
+ DRM_DEBUG_KMS("Falling back to manually reading VBT from "
+ "VBIOS ROM for %s\n",
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 74d312f..fadd021 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -613,7 +613,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
+ .destroy = intel_encoder_destroy,
+ };
+
+-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
++static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+ {
+ DRM_DEBUG_KMS("Skipping LVDS initialization for %s\n", id->ident);
+ return 1;
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 6d9c32b..24e9756 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -457,6 +457,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ }
+ }
+
++ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
++ if ((dev->pdev->device == 0x9805) &&
++ (dev->pdev->subsystem_vendor == 0x1734) &&
++ (dev->pdev->subsystem_device == 0x11bd)) {
++ if (*connector_type == DRM_MODE_CONNECTOR_VGA)
++ return false;
++ }
+
+ return true;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+index a0c2f12..decca82 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+
+ mutex_lock(&dev_priv->hw_mutex);
+
++ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+ while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
+- vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
++ ;
+
+ dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE);
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 70423dc..2d5bb5b 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1130,6 +1130,13 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ if (param[1] == 0)
+ return true;
+
++ /*
++ * Some models have a revision higher then 20. Meaning param[2] may
++ * be 10 or 20, skip the rates check for these.
++ */
++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ return true;
++
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+ if (param[2] == rates[i])
+ return false;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index df8b72b..a50e121 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -506,10 +506,61 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ ((buf[0] & 0x04) >> 1) |
+ ((buf[3] & 0x04) >> 2));
+
++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
++ hw->w == 2) {
++ synaptics_parse_agm(buf, priv, hw);
++ return 1;
++ }
++
++ hw->x = (((buf[3] & 0x10) << 8) |
++ ((buf[1] & 0x0f) << 8) |
++ buf[4]);
++ hw->y = (((buf[3] & 0x20) << 7) |
++ ((buf[1] & 0xf0) << 4) |
++ buf[5]);
++ hw->z = buf[2];
++
+ hw->left = (buf[0] & 0x01) ? 1 : 0;
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+
+- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
++ /*
++ * ForcePads, like Clickpads, use middle button
++ * bits to report primary button clicks.
++ * Unfortunately they report primary button not
++ * only when user presses on the pad above certain
++ * threshold, but also when there are more than one
++ * finger on the touchpad, which interferes with
++ * out multi-finger gestures.
++ */
++ if (hw->z == 0) {
++ /* No contacts */
++ priv->press = priv->report_press = false;
++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) {
++ /*
++ * Single-finger touch with pressure above
++ * the threshold. If pressure stays long
++ * enough, we'll start reporting primary
++ * button. We rely on the device continuing
++ * sending data even if finger does not
++ * move.
++ */
++ if (!priv->press) {
++ priv->press_start = jiffies;
++ priv->press = true;
++ } else if (time_after(jiffies,
++ priv->press_start +
++ msecs_to_jiffies(50))) {
++ priv->report_press = true;
++ }
++ } else {
++ priv->press = false;
++ }
++
++ hw->left = priv->report_press;
++
++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ /*
+ * Clickpad's button is transmitted as middle button,
+ * however, since it is primary button, we will report
+@@ -528,21 +579,6 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
+- hw->w == 2) {
+- synaptics_parse_agm(buf, priv, hw);
+- return 1;
+- }
+-
+- hw->x = (((buf[3] & 0x10) << 8) |
+- ((buf[1] & 0x0f) << 8) |
+- buf[4]);
+- hw->y = (((buf[3] & 0x20) << 7) |
+- ((buf[1] & 0xf0) << 4) |
+- buf[5]);
+- hw->z = buf[2];
+-
+ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+ switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
+index 622aea8..908d167 100644
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -77,6 +77,11 @@
+ * 2 0x08 image sensor image sensor tracks 5 fingers, but only
+ * reports 2.
+ * 2 0x20 report min query 0x0f gives min coord reported
++ * 2 0x80 forcepad forcepad is a variant of clickpad that
++ * does not have physical buttons but rather
++ * uses pressure above certain threshold to
++ * report primary clicks. Forcepads also have
++ * clickpad bit set.
+ */
+ #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
+ #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
+@@ -85,6 +90,7 @@
+ #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000)
+ #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
+ #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800)
++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000)
+
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
+@@ -170,6 +176,11 @@ struct synaptics_data {
+ */
+ struct synaptics_hw_state agm;
+ bool agm_pending; /* new AGM packet received */
++
++ /* ForcePad handling */
++ unsigned long press_start;
++ bool press;
++ bool report_press;
+ };
+
+ void synaptics_module_init(void);
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 031270c..bab8238 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -458,6 +458,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Avatar AVIU-145A6 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
++ },
++ },
+ { }
+ };
+
+@@ -594,6 +601,14 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Fujitsu U574 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
+index 8755f5f..e4ecf3b 100644
+--- a/drivers/input/serio/serport.c
++++ b/drivers/input/serio/serport.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/serio.h>
+ #include <linux/tty.h>
++#include <linux/compat.h>
+
+ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
+ MODULE_DESCRIPTION("Input device TTY line discipline");
+@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u
+ return 0;
+ }
+
++static void serport_set_type(struct tty_struct *tty, unsigned long type)
++{
++ struct serport *serport = tty->disc_data;
++
++ serport->id.proto = type & 0x000000ff;
++ serport->id.id = (type & 0x0000ff00) >> 8;
++ serport->id.extra = (type & 0x00ff0000) >> 16;
++}
++
+ /*
+ * serport_ldisc_ioctl() allows to set the port protocol, and device ID
+ */
+
+-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file,
++ unsigned int cmd, unsigned long arg)
+ {
+- struct serport *serport = (struct serport*) tty->disc_data;
+- unsigned long type;
+-
+ if (cmd == SPIOCSTYPE) {
++ unsigned long type;
++
+ if (get_user(type, (unsigned long __user *) arg))
+ return -EFAULT;
+
+- serport->id.proto = type & 0x000000ff;
+- serport->id.id = (type & 0x0000ff00) >> 8;
+- serport->id.extra = (type & 0x00ff0000) >> 16;
++ serport_set_type(tty, type);
++ return 0;
++ }
++
++ return -EINVAL;
++}
++
++#ifdef CONFIG_COMPAT
++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t)
++static long serport_ldisc_compat_ioctl(struct tty_struct *tty,
++ struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ if (cmd == COMPAT_SPIOCSTYPE) {
++ void __user *uarg = compat_ptr(arg);
++ compat_ulong_t compat_type;
++
++ if (get_user(compat_type, (compat_ulong_t __user *)uarg))
++ return -EFAULT;
+
++ serport_set_type(tty, compat_type);
+ return 0;
+ }
+
+ return -EINVAL;
+ }
++#endif
+
+ static void serport_ldisc_write_wakeup(struct tty_struct * tty)
+ {
+@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldisc = {
+ .close = serport_ldisc_close,
+ .read = serport_ldisc_read,
+ .ioctl = serport_ldisc_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = serport_ldisc_compat_ioctl,
++#endif
+ .receive_buf = serport_ldisc_receive,
+ .write_wakeup = serport_ldisc_write_wakeup
+ };
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index aa142f9..4878d91 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1565,6 +1565,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ unsigned int key_size, opt_params;
+ unsigned long long tmpll;
+ int ret;
++ size_t iv_size_padding;
+ struct dm_arg_set as;
+ const char *opt_string;
+
+@@ -1600,12 +1601,23 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+
+ cc->dmreq_start = sizeof(struct ablkcipher_request);
+ cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
+- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
+- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
+- ~(crypto_tfm_ctx_alignment() - 1);
++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
++
++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
++ /* Allocate the padding exactly */
++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
++ & crypto_ablkcipher_alignmask(any_tfm(cc));
++ } else {
++ /*
++ * If the cipher requires greater alignment than kmalloc
++ * alignment, we don't know the exact position of the
++ * initialization vector. We must assume worst case.
++ */
++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
++ }
+
+ cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
+- sizeof(struct dm_crypt_request) + cc->iv_size);
++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
+ if (!cc->req_pool) {
+ ti->error = "Cannot allocate crypt request mempool";
+ goto bad;
+diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
+index 044ea06..ab411c3 100644
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -1115,7 +1115,9 @@ static int at91_open(struct net_device *dev)
+ struct at91_priv *priv = netdev_priv(dev);
+ int err;
+
+- clk_enable(priv->clk);
++ err = clk_prepare_enable(priv->clk);
++ if (err)
++ return err;
+
+ /* check or determine and set bittime */
+ err = open_candev(dev);
+@@ -1139,7 +1141,7 @@ static int at91_open(struct net_device *dev)
+ out_close:
+ close_candev(dev);
+ out:
+- clk_disable(priv->clk);
++ clk_disable_unprepare(priv->clk);
+
+ return err;
+ }
+@@ -1156,7 +1158,7 @@ static int at91_close(struct net_device *dev)
+ at91_chip_stop(dev, CAN_STATE_STOPPED);
+
+ free_irq(dev->irq, dev);
+- clk_disable(priv->clk);
++ clk_disable_unprepare(priv->clk);
+
+ close_candev(dev);
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 7c6bb5a..b1f354f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -120,7 +120,9 @@
+ (FLEXCAN_ESR_ERR_BUS | FLEXCAN_ESR_ERR_STATE)
+
+ /* FLEXCAN interrupt flag register (IFLAG) bits */
+-#define FLEXCAN_TX_BUF_ID 8
++/* Errata ERR005829 step7: Reserve first valid MB */
++#define FLEXCAN_TX_BUF_RESERVED 8
++#define FLEXCAN_TX_BUF_ID 9
+ #define FLEXCAN_IFLAG_BUF(x) BIT(x)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6)
+@@ -131,6 +133,17 @@
+
+ /* FLEXCAN message buffers */
+ #define FLEXCAN_MB_CNT_CODE(x) (((x) & 0xf) << 24)
++#define FLEXCAN_MB_CODE_RX_INACTIVE (0x0 << 24)
++#define FLEXCAN_MB_CODE_RX_EMPTY (0x4 << 24)
++#define FLEXCAN_MB_CODE_RX_FULL (0x2 << 24)
++#define FLEXCAN_MB_CODE_RX_OVERRRUN (0x6 << 24)
++#define FLEXCAN_MB_CODE_RX_RANSWER (0xa << 24)
++
++#define FLEXCAN_MB_CODE_TX_INACTIVE (0x8 << 24)
++#define FLEXCAN_MB_CODE_TX_ABORT (0x9 << 24)
++#define FLEXCAN_MB_CODE_TX_DATA (0xc << 24)
++#define FLEXCAN_MB_CODE_TX_TANSWER (0xe << 24)
++
+ #define FLEXCAN_MB_CNT_SRR BIT(22)
+ #define FLEXCAN_MB_CNT_IDE BIT(21)
+ #define FLEXCAN_MB_CNT_RTR BIT(20)
+@@ -302,6 +315,14 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ flexcan_write(can_id, &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_id);
+ flexcan_write(ctrl, &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
++ /* Errata ERR005829 step8:
++ * Write twice INACTIVE(0x8) code to first MB.
++ */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
+ kfree_skb(skb);
+
+ /* tx_packets is incremented in flexcan_irq */
+@@ -611,6 +632,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ if (reg_iflag1 & (1 << FLEXCAN_TX_BUF_ID)) {
+ /* tx_bytes is incremented in flexcan_start_xmit */
+ stats->tx_packets++;
++ /* after sending a RTR frame mailbox is in RX mode */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ flexcan_write((1 << FLEXCAN_TX_BUF_ID), &regs->iflag1);
+ netif_wake_queue(dev);
+ }
+@@ -668,6 +692,7 @@ static int flexcan_chip_start(struct net_device *dev)
+ struct flexcan_regs __iomem *regs = priv->base;
+ int err;
+ u32 reg_mcr, reg_ctrl;
++ int i;
+
+ /* enable module */
+ flexcan_chip_enable(priv);
+@@ -733,8 +758,18 @@ static int flexcan_chip_start(struct net_device *dev)
+ dev_dbg(dev->dev.parent, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
+ flexcan_write(reg_ctrl, &regs->ctrl);
+
+- /* Abort any pending TX, mark Mailbox as INACTIVE */
+- flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
++ /* clear and invalidate all mailboxes first */
++ for (i = FLEXCAN_TX_BUF_ID; i < ARRAY_SIZE(regs->cantxfg); i++) {
++ flexcan_write(FLEXCAN_MB_CODE_RX_INACTIVE,
++ &regs->cantxfg[i].can_ctrl);
++ }
++
++ /* Errata ERR005829: mark first TX mailbox as INACTIVE */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
++ /* mark TX mailbox as INACTIVE */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
+ &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
+ /* acceptance mask/acceptance code (accept everything) */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index d696536..d552fa3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -440,6 +440,14 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ /* always get timestamp with Rx frame */
+ ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
+
++ /*
++ * force CTS-to-self frames protection if RTS-CTS is not preferred
++ * one aggregation protection method
++ */
++ if (!(priv->cfg->ht_params &&
++ priv->cfg->ht_params->use_rts_for_aggregation))
++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++
+ if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+ !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+ ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+@@ -872,6 +880,11 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
+ else
+ ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+
++ if (bss_conf->use_cts_prot)
++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++ else
++ ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
++
+ memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
+
+ if (vif->type == NL80211_IFTYPE_AP ||
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index c184253..1644b1f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
+ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 143bbe4..2794a30 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ return NULL;
+ }
+
++ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
++ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
++ return NULL;
++ }
++
+ task = conn->login_task;
+ } else {
+ if (session->state != ISCSI_STATE_LOGGED_IN)
+ return NULL;
+
++ if (data_size != 0) {
++ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
++ return NULL;
++ }
++
+ BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
+ BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index ab5dd16..ae4e7da 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4306,6 +4306,7 @@ static void iscsit_logout_post_handler_diffcid(
+ {
+ struct iscsi_conn *l_conn;
+ struct iscsi_session *sess = conn->sess;
++ bool conn_found = false;
+
+ if (!sess)
+ return;
+@@ -4314,12 +4315,13 @@ static void iscsit_logout_post_handler_diffcid(
+ list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {
+ if (l_conn->cid == cid) {
+ iscsit_inc_conn_usage_count(l_conn);
++ conn_found = true;
+ break;
+ }
+ }
+ spin_unlock_bh(&sess->conn_lock);
+
+- if (!l_conn)
++ if (!conn_found)
+ return;
+
+ if (l_conn->sock)
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index db313ba..e5f5bff 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -552,7 +552,7 @@ int iscsi_copy_param_list(
+ param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
+ if (!param_list) {
+ pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
+- goto err_out;
++ return -1;
+ }
+ INIT_LIST_HEAD(&param_list->param_list);
+ INIT_LIST_HEAD(&param_list->extra_response_list);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f08732b..10aec1a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3651,9 +3651,10 @@ static void hub_events(void)
+
+ hub = list_entry(tmp, struct usb_hub, event_list);
+ kref_get(&hub->kref);
++ hdev = hub->hdev;
++ usb_get_dev(hdev);
+ spin_unlock_irq(&hub_event_lock);
+
+- hdev = hub->hdev;
+ hub_dev = hub->intfdev;
+ intf = to_usb_interface(hub_dev);
+ dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
+@@ -3888,6 +3889,7 @@ static void hub_events(void)
+ usb_autopm_put_interface(intf);
+ loop_disconnected:
+ usb_unlock_device(hdev);
++ usb_put_dev(hdev);
+ kref_put(&hub->kref, hub_release);
+
+ } /* end while (1) */
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 600d823..3d9b57e 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -427,9 +427,6 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+- pm_runtime_put(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+-
+ dwc3_debugfs_exit(dwc);
+
+ if (features & DWC3_HAS_PERIPHERAL)
+@@ -440,6 +437,9 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+ iounmap(dwc->regs);
+ kfree(dwc->mem);
+
++ pm_runtime_put_sync(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 517cadb..a3b569f 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -440,7 +440,8 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
+ }
+
+ /* Updates Link Status for super Speed port */
+-static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
++static void xhci_hub_report_link_state(struct xhci_hcd *xhci,
++ u32 *status, u32 status_reg)
+ {
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+@@ -479,7 +480,8 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+ * in which sometimes the port enters compliance mode
+ * caused by a delay on the host-device negotiation.
+ */
+- if (pls == USB_SS_PORT_LS_COMP_MOD)
++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
++ (pls == USB_SS_PORT_LS_COMP_MOD))
+ pls |= USB_PORT_STAT_CONNECTION;
+ }
+
+@@ -655,7 +657,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ /* Update Port Link State for super speed ports*/
+ if (hcd->speed == HCD_USB3) {
+- xhci_hub_report_link_state(&status, temp);
++ xhci_hub_report_link_state(xhci, &status, temp);
+ /*
+ * Verify if all USB3 Ports Have entered U0 already.
+ * Delete Compliance Mode Timer if so.
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 74922b9..0f4a41d 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1723,7 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ }
+
+ num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+- for (i = 0; i < num_ports; i++) {
++ for (i = 0; i < num_ports && xhci->rh_bw; i++) {
+ struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+ for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+ struct list_head *ep = &bwt->interval_bw[j].endpoints;
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 0d34f85..8fe5c13 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -752,6 +752,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
++ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+@@ -961,6 +962,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ /* ekey Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
++ /* GE Healthcare devices */
++ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index cbcb1e6..bd509de 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -831,6 +831,12 @@
+ #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */
+
+ /*
++ * NOVITUS printers
++ */
++#define NOVITUS_VID 0x1a28
++#define NOVITUS_BONO_E_PID 0x6010
++
++/*
+ * RT Systems programming cables for various ham radios
+ */
+ #define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+@@ -1379,3 +1385,9 @@
+ * ekey biometric systems GmbH (http://ekey.net/)
+ */
+ #define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
++
++/*
++ * GE Healthcare devices
++ */
++#define GE_HEALTHCARE_VID 0x1901
++#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 0d26ab6..db9e54a 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -296,14 +296,19 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1199, 0x68A2), /* Sierra Wireless MC77xx in QMI mode */
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+- { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
++ /* Sierra Wireless Direct IP modems */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68A3, 0xFF, 0xFF, 0xFF),
++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++ },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+ /* AT&T Direct IP LTE modems */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+- { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
++ /* Airprime/Sierra Wireless Direct IP modems */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68A3, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index e588a11..a6c4c7d 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -93,6 +93,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001,
+ "PhotoSmart R707",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
+
++UNUSUAL_DEV( 0x03f3, 0x0001, 0x0000, 0x9999,
++ "Adaptec",
++ "USBConnect 2000",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
+ * and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
+ * for USB floppies that need the SINGLE_LUN enforcement.
+@@ -733,6 +739,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_SINGLE_LUN ),
+
++UNUSUAL_DEV( 0x059b, 0x0040, 0x0100, 0x0100,
++ "Iomega",
++ "Jaz USB Adapter",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by <Hendryk.Pfeiffer@gmx.de> */
+ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ "LaCie",
+@@ -1105,6 +1117,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NOT_LOCKABLE),
+
++UNUSUAL_DEV( 0x085a, 0x0026, 0x0100, 0x0133,
++ "Xircom",
++ "PortGear USB-SCSI (Mac USB Dock)",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
++UNUSUAL_DEV( 0x085a, 0x0028, 0x0100, 0x0133,
++ "Xircom",
++ "PortGear USB to SCSI Converter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Submitted by Jan De Luyck <lkml@kcore.org> */
+ UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000,
+ "CITIZEN",
+@@ -1932,6 +1956,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
++/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
++ * and Mac USB Dock USB-SCSI */
++UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
++ "Entrega Technologies",
++ "USB to SCSI Converter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Robert Schedel <r.schedel@yahoo.de>
+ * Note: this is a 'super top' device like the above 14cd/6600 device */
+ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
+@@ -1947,6 +1979,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
++UNUSUAL_DEV( 0x1822, 0x0001, 0x0000, 0x9999,
++ "Ariston Technologies",
++ "iConnect USB to SCSI adapter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These Appotech controllers are found in Picture Frames, they provide a
+ * (buggy) emulation of a cdrom drive which contains the windows software
+diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
+index 5241f1d..3c9e929 100644
+--- a/drivers/uwb/lc-dev.c
++++ b/drivers/uwb/lc-dev.c
+@@ -441,16 +441,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ uwb_dev->mac_addr = *bce->mac_addr;
+ uwb_dev->dev_addr = bce->dev_addr;
+ dev_set_name(&uwb_dev->dev, macbuf);
++
++ /* plug the beacon cache */
++ bce->uwb_dev = uwb_dev;
++ uwb_dev->bce = bce;
++ uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
++
+ result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc);
+ if (result < 0) {
+ dev_err(dev, "new device %s: cannot instantiate device\n",
+ macbuf);
+ goto error_dev_add;
+ }
+- /* plug the beacon cache */
+- bce->uwb_dev = uwb_dev;
+- uwb_dev->bce = bce;
+- uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
++
+ dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n",
+ macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,
+ dev_name(rc->uwb_dev.dev.parent));
+@@ -458,6 +461,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ return;
+
+ error_dev_add:
++ bce->uwb_dev = NULL;
++ uwb_bce_put(bce);
+ kfree(uwb_dev);
+ return;
+ }
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index c8af7e5..6548417 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -108,16 +108,11 @@ static void do_suspend(void)
+
+ shutting_down = SHUTDOWN_SUSPEND;
+
+-#ifdef CONFIG_PREEMPT
+- /* If the kernel is preemptible, we need to freeze all the processes
+- to prevent them from being in the middle of a pagetable update
+- during suspend. */
+ err = freeze_processes();
+ if (err) {
+ printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
+ goto out;
+ }
+-#endif
+
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+@@ -172,10 +167,8 @@ out_resume:
+ clock_was_set();
+
+ out_thaw:
+-#ifdef CONFIG_PREEMPT
+ thaw_processes();
+ out:
+-#endif
+ shutting_down = SHUTDOWN_INVALID;
+ }
+ #endif /* CONFIG_HIBERNATE_CALLBACKS */
+diff --git a/fs/aio.c b/fs/aio.c
+index 8cdd8ea..9acfd07 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1102,6 +1102,13 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
+ head = ring->head % info->nr;
+ if (head != ring->tail) {
+ struct io_event *evp = aio_ring_event(info, head, KM_USER1);
++
++ /*
++ * Ensure that once we've read the current tail pointer, that
++ * we also see the events that were stored up to the tail.
++ */
++ smp_rmb();
++
+ *ent = *evp;
+ head = (head + 1) % info->nr;
+ smp_mb(); /* finish reading the event before updatng the head */
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 5f4bde2..59496e7 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1021,7 +1021,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ bh = page_buffers(page);
+ if (bh->b_size == size) {
+ end_block = init_page_buffers(page, bdev,
+- index << sizebits, size);
++ (sector_t)index << sizebits,
++ size);
+ goto done;
+ }
+ if (!try_to_free_buffers(page))
+@@ -1042,7 +1043,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ */
+ spin_lock(&inode->i_mapping->private_lock);
+ link_dev_buffers(page, bh);
+- end_block = init_page_buffers(page, bdev, index << sizebits, size);
++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
++ size);
+ spin_unlock(&inode->i_mapping->private_lock);
+ done:
+ ret = (block < end_block) ? 1 : -ENXIO;
+diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
+index 91a6945..5a45b8f 100644
+--- a/fs/ext2/inode.c
++++ b/fs/ext2/inode.c
+@@ -619,6 +619,8 @@ static int ext2_get_blocks(struct inode *inode,
+ int count = 0;
+ ext2_fsblk_t first_block = 0;
+
++ BUG_ON(maxblocks == 0);
++
+ depth = ext2_block_to_path(inode,iblock,offsets,&blocks_to_boundary);
+
+ if (depth == 0)
+diff --git a/fs/ext2/xip.c b/fs/ext2/xip.c
+index 322a56b..af014bb 100644
+--- a/fs/ext2/xip.c
++++ b/fs/ext2/xip.c
+@@ -37,6 +37,7 @@ __ext2_get_block(struct inode *inode, pgoff_t pgoff, int create,
+ int rc;
+
+ memset(&tmp, 0, sizeof(struct buffer_head));
++ tmp.b_size = 1 << inode->i_blkbits;
+ rc = ext2_get_block(inode, pgoff, &tmp, create);
+ *result = tmp.b_blocknr;
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 818b43e..5baa7ba 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1312,6 +1312,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
+ void *buddy2;
+ struct super_block *sb = e4b->bd_sb;
+
++ if (WARN_ON(count == 0))
++ return;
+ BUG_ON(first + count > (sb->s_blocksize << 3));
+ assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
+ mb_check_buddy(e4b);
+@@ -3132,6 +3134,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+ int err;
+
+ if (pa == NULL) {
++ if (ac->ac_f_ex.fe_len == 0)
++ return;
+ err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
+ if (err) {
+ /*
+@@ -3146,6 +3150,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+ mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
+ ac->ac_f_ex.fe_len);
+ ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
++ ext4_mb_unload_buddy(&e4b);
+ return;
+ }
+ if (pa->pa_type == MB_INODE_PA)
+diff --git a/fs/namei.c b/fs/namei.c
+index 9680cef..dea2dab 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -554,24 +554,22 @@ static int complete_walk(struct nameidata *nd)
+
+ static __always_inline void set_root(struct nameidata *nd)
+ {
+- if (!nd->root.mnt)
+- get_fs_root(current->fs, &nd->root);
++ get_fs_root(current->fs, &nd->root);
+ }
+
+ static int link_path_walk(const char *, struct nameidata *);
+
+-static __always_inline void set_root_rcu(struct nameidata *nd)
++static __always_inline unsigned set_root_rcu(struct nameidata *nd)
+ {
+- if (!nd->root.mnt) {
+- struct fs_struct *fs = current->fs;
+- unsigned seq;
++ struct fs_struct *fs = current->fs;
++ unsigned seq, res;
+
+- do {
+- seq = read_seqcount_begin(&fs->seq);
+- nd->root = fs->root;
+- nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
+- } while (read_seqcount_retry(&fs->seq, seq));
+- }
++ do {
++ seq = read_seqcount_begin(&fs->seq);
++ nd->root = fs->root;
++ res = __read_seqcount_begin(&nd->root.dentry->d_seq);
++ } while (read_seqcount_retry(&fs->seq, seq));
++ return res;
+ }
+
+ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
+@@ -582,7 +580,8 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
+ goto fail;
+
+ if (*link == '/') {
+- set_root(nd);
++ if (!nd->root.mnt)
++ set_root(nd);
+ path_put(&nd->path);
+ nd->path = nd->root;
+ path_get(&nd->root);
+@@ -912,22 +911,11 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
+ return true;
+ }
+
+-static void follow_mount_rcu(struct nameidata *nd)
+-{
+- while (d_mountpoint(nd->path.dentry)) {
+- struct vfsmount *mounted;
+- mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
+- if (!mounted)
+- break;
+- nd->path.mnt = mounted;
+- nd->path.dentry = mounted->mnt_root;
+- nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+- }
+-}
+-
+ static int follow_dotdot_rcu(struct nameidata *nd)
+ {
+- set_root_rcu(nd);
++ struct inode *inode = nd->inode;
++ if (!nd->root.mnt)
++ set_root_rcu(nd);
+
+ while (1) {
+ if (nd->path.dentry == nd->root.dentry &&
+@@ -939,6 +927,7 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ struct dentry *parent = old->d_parent;
+ unsigned seq;
+
++ inode = parent->d_inode;
+ seq = read_seqcount_begin(&parent->d_seq);
+ if (read_seqcount_retry(&old->d_seq, nd->seq))
+ goto failed;
+@@ -948,10 +937,20 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ }
+ if (!follow_up_rcu(&nd->path))
+ break;
++ inode = nd->path.dentry->d_inode;
+ nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+ }
+- follow_mount_rcu(nd);
+- nd->inode = nd->path.dentry->d_inode;
++ while (d_mountpoint(nd->path.dentry)) {
++ struct vfsmount *mounted;
++ mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
++ if (!mounted)
++ break;
++ nd->path.mnt = mounted;
++ nd->path.dentry = mounted->mnt_root;
++ inode = nd->path.dentry->d_inode;
++ nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
++ }
++ nd->inode = inode;
+ return 0;
+
+ failed:
+@@ -1030,7 +1029,8 @@ static void follow_mount(struct path *path)
+
+ static void follow_dotdot(struct nameidata *nd)
+ {
+- set_root(nd);
++ if (!nd->root.mnt)
++ set_root(nd);
+
+ while(1) {
+ struct dentry *old = nd->path.dentry;
+@@ -1504,7 +1504,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
+ if (flags & LOOKUP_RCU) {
+ br_read_lock(vfsmount_lock);
+ rcu_read_lock();
+- set_root_rcu(nd);
++ nd->seq = set_root_rcu(nd);
+ } else {
+ set_root(nd);
+ path_get(&nd->root);
+@@ -1560,7 +1560,14 @@ static int path_init(int dfd, const char *name, unsigned int flags,
+ }
+
+ nd->inode = nd->path.dentry->d_inode;
+- return 0;
++ if (!(flags & LOOKUP_RCU))
++ return 0;
++ if (likely(!read_seqcount_retry(&nd->path.dentry->d_seq, nd->seq)))
++ return 0;
++ if (!(nd->flags & LOOKUP_ROOT))
++ nd->root.mnt = NULL;
++ rcu_read_unlock();
++ return -ECHILD;
+
+ fput_fail:
+ fput_light(file, fput_needed);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c4a2a68..61a1303 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2015,23 +2015,23 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+- /* Calculate the current open share mode */
+- calldata->arg.fmode = 0;
+- if (is_rdonly || is_rdwr)
+- calldata->arg.fmode |= FMODE_READ;
+- if (is_wronly || is_rdwr)
+- calldata->arg.fmode |= FMODE_WRITE;
+ /* Calculate the change in open mode */
++ calldata->arg.fmode = 0;
+ if (state->n_rdwr == 0) {
+- if (state->n_rdonly == 0) {
+- call_close |= is_rdonly || is_rdwr;
+- calldata->arg.fmode &= ~FMODE_READ;
+- }
+- if (state->n_wronly == 0) {
+- call_close |= is_wronly || is_rdwr;
+- calldata->arg.fmode &= ~FMODE_WRITE;
+- }
+- }
++ if (state->n_rdonly == 0)
++ call_close |= is_rdonly;
++ else if (is_rdonly)
++ calldata->arg.fmode |= FMODE_READ;
++ if (state->n_wronly == 0)
++ call_close |= is_wronly;
++ else if (is_wronly)
++ calldata->arg.fmode |= FMODE_WRITE;
++ } else if (is_rdwr)
++ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
++
++ if (calldata->arg.fmode == 0)
++ call_close |= is_rdwr;
++
+ spin_unlock(&state->owner->so_lock);
+
+ if (!call_close) {
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 11e1888..e2e7914 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -508,6 +508,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key)
+ char *buf = NULL;
+ int error = 0;
+
++ if (!pacl)
++ return vfs_setxattr(dentry, key, NULL, 0, 0);
++
+ buflen = posix_acl_xattr_size(pacl->a_count);
+ buf = kmalloc(buflen, GFP_KERNEL);
+ error = -ENOMEM;
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index edeb239..b2d8a96 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -24,6 +24,7 @@
+ #include <linux/buffer_head.h>
+ #include <linux/gfp.h>
+ #include <linux/mpage.h>
++#include <linux/pagemap.h>
+ #include <linux/writeback.h>
+ #include <linux/uio.h>
+ #include "nilfs.h"
+@@ -195,10 +196,10 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc)
+
+ static int nilfs_set_page_dirty(struct page *page)
+ {
++ struct inode *inode = page->mapping->host;
+ int ret = __set_page_dirty_nobuffers(page);
+
+ if (page_has_buffers(page)) {
+- struct inode *inode = page->mapping->host;
+ unsigned nr_dirty = 0;
+ struct buffer_head *bh, *head;
+
+@@ -221,6 +222,10 @@ static int nilfs_set_page_dirty(struct page *page)
+
+ if (nr_dirty)
+ nilfs_set_file_dirty(inode, nr_dirty);
++ } else if (ret) {
++ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
++
++ nilfs_set_file_dirty(inode, nr_dirty);
+ }
+ return ret;
+ }
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 005261c..dbc372e 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm,
+ clear_bit(bit, res->refmap);
+ }
+
+-
+-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ struct dlm_lock_resource *res)
+ {
+- assert_spin_locked(&res->spinlock);
+-
+ res->inflight_locks++;
+
+ mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
+@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ __builtin_return_address(0));
+ }
+
++void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++ struct dlm_lock_resource *res)
++{
++ assert_spin_locked(&res->spinlock);
++ __dlm_lockres_grab_inflight_ref(dlm, res);
++}
++
+ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
+ struct dlm_lock_resource *res)
+ {
+@@ -855,10 +859,8 @@ lookup:
+ /* finally add the lockres to its hash bucket */
+ __dlm_insert_lockres(dlm, res);
+
+- /* Grab inflight ref to pin the resource */
+- spin_lock(&res->spinlock);
+- dlm_lockres_grab_inflight_ref(dlm, res);
+- spin_unlock(&res->spinlock);
++ /* since this lockres is new it doesn't not require the spinlock */
++ __dlm_lockres_grab_inflight_ref(dlm, res);
+
+ /* get an extra ref on the mle in case this is a BLOCK
+ * if so, the creator of the BLOCK may try to put the last
+diff --git a/fs/partitions/check.c b/fs/partitions/check.c
+index 1ef15cc..18c58e5 100644
+--- a/fs/partitions/check.c
++++ b/fs/partitions/check.c
+@@ -361,6 +361,7 @@ static const struct attribute_group *part_attr_groups[] = {
+ static void part_release(struct device *dev)
+ {
+ struct hd_struct *p = dev_to_part(dev);
++ blk_free_devt(dev->devt);
+ free_part_stats(p);
+ free_part_info(p);
+ kfree(p);
+@@ -403,7 +404,6 @@ void delete_partition(struct gendisk *disk, int partno)
+ rcu_assign_pointer(ptbl->last_lookup, NULL);
+ kobject_put(part->holder_dir);
+ device_del(part_to_dev(part));
+- blk_free_devt(part_devt(part));
+
+ hd_struct_put(part);
+ }
+diff --git a/include/linux/alarmtimer.h b/include/linux/alarmtimer.h
+index 975009e..9a9838a 100644
+--- a/include/linux/alarmtimer.h
++++ b/include/linux/alarmtimer.h
+@@ -48,6 +48,7 @@ int alarm_try_to_cancel(struct alarm *alarm);
+ int alarm_cancel(struct alarm *alarm);
+
+ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
++ktime_t alarm_expires_remaining(const struct alarm *alarm);
+
+ /*
+ * A alarmtimer is active, when it is enqueued into timerqueue or the
+diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
+index ffbeb2c..5b6efef 100644
+--- a/include/linux/ceph/messenger.h
++++ b/include/linux/ceph/messenger.h
+@@ -92,7 +92,7 @@ struct ceph_msg {
+ bool front_is_vmalloc;
+ bool more_to_follow;
+ bool needs_out_seq;
+- int front_max;
++ int front_alloc_len;
+ unsigned long ack_stamp; /* tx: when we were acked */
+
+ struct ceph_msgpool *pool;
+diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
+index f5df3dc..f4e8578 100644
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -259,23 +259,11 @@ extern unsigned long preset_lpj;
+ #define SEC_JIFFIE_SC (32 - SHIFT_HZ)
+ #endif
+ #define NSEC_JIFFIE_SC (SEC_JIFFIE_SC + 29)
+-#define USEC_JIFFIE_SC (SEC_JIFFIE_SC + 19)
+ #define SEC_CONVERSION ((unsigned long)((((u64)NSEC_PER_SEC << SEC_JIFFIE_SC) +\
+ TICK_NSEC -1) / (u64)TICK_NSEC))
+
+ #define NSEC_CONVERSION ((unsigned long)((((u64)1 << NSEC_JIFFIE_SC) +\
+ TICK_NSEC -1) / (u64)TICK_NSEC))
+-#define USEC_CONVERSION \
+- ((unsigned long)((((u64)NSEC_PER_USEC << USEC_JIFFIE_SC) +\
+- TICK_NSEC -1) / (u64)TICK_NSEC))
+-/*
+- * USEC_ROUND is used in the timeval to jiffie conversion. See there
+- * for more details. It is the scaled resolution rounding value. Note
+- * that it is a 64-bit value. Since, when it is applied, we are already
+- * in jiffies (albit scaled), it is nothing but the bits we will shift
+- * off.
+- */
+-#define USEC_ROUND (u64)(((u64)1 << USEC_JIFFIE_SC) - 1)
+ /*
+ * The maximum jiffie value is (MAX_INT >> 1). Here we translate that
+ * into seconds. The 64-bit case will overflow if we are not careful,
+diff --git a/include/net/regulatory.h b/include/net/regulatory.h
+index eb7d3c2..c3c22e0 100644
+--- a/include/net/regulatory.h
++++ b/include/net/regulatory.h
+@@ -92,7 +92,7 @@ struct ieee80211_reg_rule {
+
+ struct ieee80211_regdomain {
+ u32 n_reg_rules;
+- char alpha2[2];
++ char alpha2[3];
+ struct ieee80211_reg_rule reg_rules[];
+ };
+
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index ad03988..e0f1c91 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -523,6 +523,11 @@ static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
+ asoc->pmtu_pending = 0;
+ }
+
++static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
++{
++ return !list_empty(&chunk->list);
++}
++
+ /* Walk through a list of TLV parameters. Don't trust the
+ * individual parameter lengths and instead depend on
+ * the chunk length to indicate when to stop. Make sure
+diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
+index 9148632..4d1be75 100644
+--- a/include/net/sctp/sm.h
++++ b/include/net/sctp/sm.h
+@@ -251,9 +251,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *,
+ int, __be16);
+ struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc,
+ union sctp_addr *addr);
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+- struct sctp_paramhdr *param_hdr, void *chunk_end,
+- struct sctp_paramhdr **errp);
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, bool addr_param_needed,
++ struct sctp_paramhdr **errp);
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ struct sctp_chunk *asconf);
+ int sctp_process_asconf_ack(struct sctp_association *asoc,
+diff --git a/init/Kconfig b/init/Kconfig
+index 43298f9..b8dc1de 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -555,6 +555,7 @@ config LOG_BUF_SHIFT
+ int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
+ range 12 21
+ default 17
++ depends on PRINTK
+ help
+ Select kernel log buffer size as a power of 2.
+ Examples:
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 93fc15e..ffcf896 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3871,6 +3871,11 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+ {
+ struct cgroup *c_parent = dentry->d_parent->d_fsdata;
+
++ /* Do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable.
++ */
++ if (strchr(dentry->d_name.name, '\n'))
++ return -EINVAL;
++
+ /* the vfs holds inode->i_mutex already */
+ return cgroup_create(c_parent, dentry, mode | S_IFDIR);
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 14c111c..4a14895 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1683,6 +1683,16 @@ retry:
+ */
+ if (ctx->is_active) {
+ raw_spin_unlock_irq(&ctx->lock);
++ /*
++ * Reload the task pointer, it might have been changed by
++ * a concurrent perf_event_context_sched_out().
++ */
++ task = ctx->task;
++ /*
++ * Reload the task pointer, it might have been changed by
++ * a concurrent perf_event_context_sched_out().
++ */
++ task = ctx->task;
+ goto retry;
+ }
+
+@@ -7071,8 +7081,10 @@ int perf_event_init_task(struct task_struct *child)
+
+ for_each_task_context_nr(ctxn) {
+ ret = perf_event_init_context(child, ctxn);
+- if (ret)
++ if (ret) {
++ perf_event_free_task(child);
+ return ret;
++ }
+ }
+
+ return 0;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 13bba30..29b4604 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1221,7 +1221,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ goto bad_fork_cleanup_policy;
+ retval = audit_alloc(p);
+ if (retval)
+- goto bad_fork_cleanup_policy;
++ goto bad_fork_cleanup_perf;
+ /* copy all the process information */
+ retval = copy_semundo(clone_flags, p);
+ if (retval)
+@@ -1406,8 +1406,9 @@ bad_fork_cleanup_semundo:
+ exit_sem(p);
+ bad_fork_cleanup_audit:
+ audit_free(p);
+-bad_fork_cleanup_policy:
++bad_fork_cleanup_perf:
+ perf_event_free_task(p);
++bad_fork_cleanup_policy:
+ #ifdef CONFIG_NUMA
+ mpol_put(p->mempolicy);
+ bad_fork_cleanup_cgroup:
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 1bb37d0..f31f190 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2460,6 +2460,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ * shared futexes. We need to compare the keys:
+ */
+ if (match_futex(&q.key, &key2)) {
++ queue_unlock(&q, hb);
+ ret = -EINVAL;
+ goto out_put_keys;
+ }
+diff --git a/kernel/time.c b/kernel/time.c
+index 73e416d..060f961 100644
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -493,17 +493,20 @@ EXPORT_SYMBOL(usecs_to_jiffies);
+ * that a remainder subtract here would not do the right thing as the
+ * resolution values don't fall on second boundries. I.e. the line:
+ * nsec -= nsec % TICK_NSEC; is NOT a correct resolution rounding.
++ * Note that due to the small error in the multiplier here, this
++ * rounding is incorrect for sufficiently large values of tv_nsec, but
++ * well formed timespecs should have tv_nsec < NSEC_PER_SEC, so we're
++ * OK.
+ *
+ * Rather, we just shift the bits off the right.
+ *
+ * The >> (NSEC_JIFFIE_SC - SEC_JIFFIE_SC) converts the scaled nsec
+ * value to a scaled second value.
+ */
+-unsigned long
+-timespec_to_jiffies(const struct timespec *value)
++static unsigned long
++__timespec_to_jiffies(unsigned long sec, long nsec)
+ {
+- unsigned long sec = value->tv_sec;
+- long nsec = value->tv_nsec + TICK_NSEC - 1;
++ nsec = nsec + TICK_NSEC - 1;
+
+ if (sec >= MAX_SEC_IN_JIFFIES){
+ sec = MAX_SEC_IN_JIFFIES;
+@@ -514,6 +517,13 @@ timespec_to_jiffies(const struct timespec *value)
+ (NSEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
+
+ }
++
++unsigned long
++timespec_to_jiffies(const struct timespec *value)
++{
++ return __timespec_to_jiffies(value->tv_sec, value->tv_nsec);
++}
++
+ EXPORT_SYMBOL(timespec_to_jiffies);
+
+ void
+@@ -530,31 +540,27 @@ jiffies_to_timespec(const unsigned long jiffies, struct timespec *value)
+ }
+ EXPORT_SYMBOL(jiffies_to_timespec);
+
+-/* Same for "timeval"
++/*
++ * We could use a similar algorithm to timespec_to_jiffies (with a
++ * different multiplier for usec instead of nsec). But this has a
++ * problem with rounding: we can't exactly add TICK_NSEC - 1 to the
++ * usec value, since it's not necessarily integral.
+ *
+- * Well, almost. The problem here is that the real system resolution is
+- * in nanoseconds and the value being converted is in micro seconds.
+- * Also for some machines (those that use HZ = 1024, in-particular),
+- * there is a LARGE error in the tick size in microseconds.
+-
+- * The solution we use is to do the rounding AFTER we convert the
+- * microsecond part. Thus the USEC_ROUND, the bits to be shifted off.
+- * Instruction wise, this should cost only an additional add with carry
+- * instruction above the way it was done above.
++ * We could instead round in the intermediate scaled representation
++ * (i.e. in units of 1/2^(large scale) jiffies) but that's also
++ * perilous: the scaling introduces a small positive error, which
++ * combined with a division-rounding-upward (i.e. adding 2^(scale) - 1
++ * units to the intermediate before shifting) leads to accidental
++ * overflow and overestimates.
++ *
++ * At the cost of one additional multiplication by a constant, just
++ * use the timespec implementation.
+ */
+ unsigned long
+ timeval_to_jiffies(const struct timeval *value)
+ {
+- unsigned long sec = value->tv_sec;
+- long usec = value->tv_usec;
+-
+- if (sec >= MAX_SEC_IN_JIFFIES){
+- sec = MAX_SEC_IN_JIFFIES;
+- usec = 0;
+- }
+- return (((u64)sec * SEC_CONVERSION) +
+- (((u64)usec * USEC_CONVERSION + USEC_ROUND) >>
+- (USEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
++ return __timespec_to_jiffies(value->tv_sec,
++ value->tv_usec * NSEC_PER_USEC);
+ }
+ EXPORT_SYMBOL(timeval_to_jiffies);
+
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index eb198a3..7eaf162 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -226,6 +226,12 @@ static enum hrtimer_restart alarmtimer_fired(struct hrtimer *timer)
+
+ }
+
++ktime_t alarm_expires_remaining(const struct alarm *alarm)
++{
++ struct alarm_base *base = &alarm_bases[alarm->type];
++ return ktime_sub(alarm->node.expires, base->gettime());
++}
++
+ #ifdef CONFIG_RTC_CLASS
+ /**
+ * alarmtimer_suspend - Suspend time callback
+@@ -442,18 +448,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ ktime_t now)
+ {
++ unsigned long flags;
+ struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ it.alarm.alarmtimer);
+- if (posix_timer_event(ptr, 0) != 0)
+- ptr->it_overrun++;
++ enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++ spin_lock_irqsave(&ptr->it_lock, flags);
++ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++ if (posix_timer_event(ptr, 0) != 0)
++ ptr->it_overrun++;
++ }
+
+ /* Re-add periodic timers */
+ if (ptr->it.alarm.interval.tv64) {
+ ptr->it_overrun += alarm_forward(alarm, now,
+ ptr->it.alarm.interval);
+- return ALARMTIMER_RESTART;
++ result = ALARMTIMER_RESTART;
+ }
+- return ALARMTIMER_NORESTART;
++ spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++ return result;
+ }
+
+ /**
+@@ -519,18 +533,22 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+ * @new_timer: k_itimer pointer
+ * @cur_setting: itimerspec data to fill
+ *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+ */
+ static void alarm_timer_get(struct k_itimer *timr,
+ struct itimerspec *cur_setting)
+ {
+- memset(cur_setting, 0, sizeof(struct itimerspec));
++ ktime_t relative_expiry_time =
++ alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
++
++ if (ktime_to_ns(relative_expiry_time) > 0) {
++ cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++ } else {
++ cur_setting->it_value.tv_sec = 0;
++ cur_setting->it_value.tv_nsec = 0;
++ }
+
+- cur_setting->it_interval =
+- ktime_to_timespec(timr->it.alarm.interval);
+- cur_setting->it_value =
+- ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+- return;
++ cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+
+ /**
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 4babd77..b252661 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2847,7 +2847,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter)
+ iter->head = cpu_buffer->reader_page->read;
+
+ iter->cache_reader_page = iter->head_page;
+- iter->cache_read = iter->head;
++ iter->cache_read = cpu_buffer->read;
+
+ if (iter->head)
+ iter->read_stamp = cpu_buffer->read_stamp;
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 09d6a9d..7d26ea5 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -141,8 +141,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
+
+ get_page(new);
+ pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
++
++ /* Recheck VMA as permissions can change since migration started */
+ if (is_write_migration_entry(entry))
+- pte = pte_mkwrite(pte);
++ pte = maybe_mkwrite(pte, vma);
++
+ #ifdef CONFIG_HUGETLB_PAGE
+ if (PageHuge(new))
+ pte = pte_mkhuge(pte);
+diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
+index 12a48a88..0539f6a 100644
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ int page_start, int page_end)
+ {
+ const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
+- unsigned int cpu;
++ unsigned int cpu, tcpu;
+ int i;
+
+ for_each_possible_cpu(cpu) {
+@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+
+ *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+- if (!*pagep) {
+- pcpu_free_pages(chunk, pages, populated,
+- page_start, page_end);
+- return -ENOMEM;
+- }
++ if (!*pagep)
++ goto err;
+ }
+ }
+ return 0;
++
++err:
++ while (--i >= page_start)
++ __free_page(pages[pcpu_page_idx(cpu, i)]);
++
++ for_each_possible_cpu(tcpu) {
++ if (tcpu == cpu)
++ break;
++ for (i = page_start; i < page_end; i++)
++ __free_page(pages[pcpu_page_idx(tcpu, i)]);
++ }
++ return -ENOMEM;
+ }
+
+ /**
+@@ -264,6 +273,7 @@ err:
+ __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
+ page_end - page_start);
+ }
++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
+ return err;
+ }
+
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 5c29750..e29a1c4 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1895,6 +1895,8 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
++
++ pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 1371021..83efac6 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1719,8 +1719,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct
+
+ if (new_dentry->d_inode) {
+ (void) shmem_unlink(new_dir, new_dentry);
+- if (they_are_dirs)
++ if (they_are_dirs) {
++ drop_nlink(new_dentry->d_inode);
+ drop_nlink(old_dir);
++ }
+ } else if (they_are_dirs) {
+ drop_nlink(old_dir);
+ inc_nlink(new_dir);
+diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
+index 1587dc6..9898d1f 100644
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -13,8 +13,6 @@
+ #include "auth_x.h"
+ #include "auth_x_protocol.h"
+
+-#define TEMP_TICKET_BUF_LEN 256
+-
+ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+
+ static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
+ }
+
+ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+- void **p, void *end, void *obuf, size_t olen)
++ void **p, void *end, void **obuf, size_t olen)
+ {
+ struct ceph_x_encrypt_header head;
+ size_t head_len = sizeof(head);
+@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+ return -EINVAL;
+
+ dout("ceph_x_decrypt len %d\n", len);
+- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+- *p, len);
++ if (*obuf == NULL) {
++ *obuf = kmalloc(len, GFP_NOFS);
++ if (!*obuf)
++ return -ENOMEM;
++ olen = len;
++ }
++
++ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
+ if (ret)
+ return ret;
+ if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+@@ -129,139 +133,120 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
+ kfree(th);
+ }
+
+-static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+- struct ceph_crypto_key *secret,
+- void *buf, void *end)
++static int process_one_ticket(struct ceph_auth_client *ac,
++ struct ceph_crypto_key *secret,
++ void **p, void *end)
+ {
+ struct ceph_x_info *xi = ac->private;
+- int num;
+- void *p = buf;
++ int type;
++ u8 tkt_struct_v, blob_struct_v;
++ struct ceph_x_ticket_handler *th;
++ void *dbuf = NULL;
++ void *dp, *dend;
++ int dlen;
++ char is_enc;
++ struct timespec validity;
++ struct ceph_crypto_key old_key;
++ void *ticket_buf = NULL;
++ void *tp, *tpend;
++ struct ceph_timespec new_validity;
++ struct ceph_crypto_key new_session_key;
++ struct ceph_buffer *new_ticket_blob;
++ unsigned long new_expires, new_renew_after;
++ u64 new_secret_id;
+ int ret;
+- char *dbuf;
+- char *ticket_buf;
+- u8 reply_struct_v;
+
+- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!dbuf)
+- return -ENOMEM;
++ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
+
+- ret = -ENOMEM;
+- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!ticket_buf)
+- goto out_dbuf;
++ type = ceph_decode_32(p);
++ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+- reply_struct_v = ceph_decode_8(&p);
+- if (reply_struct_v != 1)
++ tkt_struct_v = ceph_decode_8(p);
++ if (tkt_struct_v != 1)
+ goto bad;
+- num = ceph_decode_32(&p);
+- dout("%d tickets\n", num);
+- while (num--) {
+- int type;
+- u8 tkt_struct_v, blob_struct_v;
+- struct ceph_x_ticket_handler *th;
+- void *dp, *dend;
+- int dlen;
+- char is_enc;
+- struct timespec validity;
+- struct ceph_crypto_key old_key;
+- void *tp, *tpend;
+- struct ceph_timespec new_validity;
+- struct ceph_crypto_key new_session_key;
+- struct ceph_buffer *new_ticket_blob;
+- unsigned long new_expires, new_renew_after;
+- u64 new_secret_id;
+-
+- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+-
+- type = ceph_decode_32(&p);
+- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+-
+- tkt_struct_v = ceph_decode_8(&p);
+- if (tkt_struct_v != 1)
+- goto bad;
+-
+- th = get_ticket_handler(ac, type);
+- if (IS_ERR(th)) {
+- ret = PTR_ERR(th);
+- goto out;
+- }
+
+- /* blob for me */
+- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen <= 0) {
+- ret = dlen;
+- goto out;
+- }
+- dout(" decrypted %d bytes\n", dlen);
+- dend = dbuf + dlen;
+- dp = dbuf;
++ th = get_ticket_handler(ac, type);
++ if (IS_ERR(th)) {
++ ret = PTR_ERR(th);
++ goto out;
++ }
+
+- tkt_struct_v = ceph_decode_8(&dp);
+- if (tkt_struct_v != 1)
+- goto bad;
++ /* blob for me */
++ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
++ if (dlen <= 0) {
++ ret = dlen;
++ goto out;
++ }
++ dout(" decrypted %d bytes\n", dlen);
++ dp = dbuf;
++ dend = dp + dlen;
+
+- memcpy(&old_key, &th->session_key, sizeof(old_key));
+- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+- if (ret)
+- goto out;
++ tkt_struct_v = ceph_decode_8(&dp);
++ if (tkt_struct_v != 1)
++ goto bad;
+
+- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+- ceph_decode_timespec(&validity, &new_validity);
+- new_expires = get_seconds() + validity.tv_sec;
+- new_renew_after = new_expires - (validity.tv_sec / 4);
+- dout(" expires=%lu renew_after=%lu\n", new_expires,
+- new_renew_after);
++ memcpy(&old_key, &th->session_key, sizeof(old_key));
++ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
++ if (ret)
++ goto out;
+
+- /* ticket blob for service */
+- ceph_decode_8_safe(&p, end, is_enc, bad);
+- tp = ticket_buf;
+- if (is_enc) {
+- /* encrypted */
+- dout(" encrypted ticket\n");
+- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen < 0) {
+- ret = dlen;
+- goto out;
+- }
+- dlen = ceph_decode_32(&tp);
+- } else {
+- /* unencrypted */
+- ceph_decode_32_safe(&p, end, dlen, bad);
+- ceph_decode_need(&p, end, dlen, bad);
+- ceph_decode_copy(&p, ticket_buf, dlen);
++ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
++ ceph_decode_timespec(&validity, &new_validity);
++ new_expires = get_seconds() + validity.tv_sec;
++ new_renew_after = new_expires - (validity.tv_sec / 4);
++ dout(" expires=%lu renew_after=%lu\n", new_expires,
++ new_renew_after);
++
++ /* ticket blob for service */
++ ceph_decode_8_safe(p, end, is_enc, bad);
++ if (is_enc) {
++ /* encrypted */
++ dout(" encrypted ticket\n");
++ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
++ if (dlen < 0) {
++ ret = dlen;
++ goto out;
+ }
+- tpend = tp + dlen;
+- dout(" ticket blob is %d bytes\n", dlen);
+- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+- blob_struct_v = ceph_decode_8(&tp);
+- new_secret_id = ceph_decode_64(&tp);
+- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+- if (ret)
++ tp = ticket_buf;
++ dlen = ceph_decode_32(&tp);
++ } else {
++ /* unencrypted */
++ ceph_decode_32_safe(p, end, dlen, bad);
++ ticket_buf = kmalloc(dlen, GFP_NOFS);
++ if (!ticket_buf) {
++ ret = -ENOMEM;
+ goto out;
+-
+- /* all is well, update our ticket */
+- ceph_crypto_key_destroy(&th->session_key);
+- if (th->ticket_blob)
+- ceph_buffer_put(th->ticket_blob);
+- th->session_key = new_session_key;
+- th->ticket_blob = new_ticket_blob;
+- th->validity = new_validity;
+- th->secret_id = new_secret_id;
+- th->expires = new_expires;
+- th->renew_after = new_renew_after;
+- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+- type, ceph_entity_type_name(type), th->secret_id,
+- (int)th->ticket_blob->vec.iov_len);
+- xi->have_keys |= th->service;
++ }
++ tp = ticket_buf;
++ ceph_decode_need(p, end, dlen, bad);
++ ceph_decode_copy(p, ticket_buf, dlen);
+ }
++ tpend = tp + dlen;
++ dout(" ticket blob is %d bytes\n", dlen);
++ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
++ blob_struct_v = ceph_decode_8(&tp);
++ new_secret_id = ceph_decode_64(&tp);
++ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
++ if (ret)
++ goto out;
++
++ /* all is well, update our ticket */
++ ceph_crypto_key_destroy(&th->session_key);
++ if (th->ticket_blob)
++ ceph_buffer_put(th->ticket_blob);
++ th->session_key = new_session_key;
++ th->ticket_blob = new_ticket_blob;
++ th->validity = new_validity;
++ th->secret_id = new_secret_id;
++ th->expires = new_expires;
++ th->renew_after = new_renew_after;
++ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
++ type, ceph_entity_type_name(type), th->secret_id,
++ (int)th->ticket_blob->vec.iov_len);
++ xi->have_keys |= th->service;
+
+- ret = 0;
+ out:
+ kfree(ticket_buf);
+-out_dbuf:
+ kfree(dbuf);
+ return ret;
+
+@@ -270,6 +255,34 @@ bad:
+ goto out;
+ }
+
++static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
++ struct ceph_crypto_key *secret,
++ void *buf, void *end)
++{
++ void *p = buf;
++ u8 reply_struct_v;
++ u32 num;
++ int ret;
++
++ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
++ if (reply_struct_v != 1)
++ return -EINVAL;
++
++ ceph_decode_32_safe(&p, end, num, bad);
++ dout("%d tickets\n", num);
++
++ while (num--) {
++ ret = process_one_ticket(ac, secret, &p, end);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++
++bad:
++ return -EINVAL;
++}
++
+ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+ struct ceph_x_ticket_handler *th,
+ struct ceph_x_authorizer *au)
+@@ -563,13 +576,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+ struct ceph_x_ticket_handler *th;
+ int ret = 0;
+ struct ceph_x_authorize_reply reply;
++ void *preply = &reply;
+ void *p = au->reply_buf;
+ void *end = p + sizeof(au->reply_buf);
+
+ th = get_ticket_handler(ac, au->service);
+ if (IS_ERR(th))
+ return PTR_ERR(th);
+- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
++ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
+ if (ret < 0)
+ return ret;
+ if (ret != sizeof(reply))
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 20ba2d5..7a239f0 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2423,7 +2423,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
+ m->footer.middle_crc = 0;
+ m->footer.data_crc = 0;
+ m->footer.flags = 0;
+- m->front_max = front_len;
++ m->front_alloc_len = front_len;
+ m->front_is_vmalloc = false;
+ m->more_to_follow = false;
+ m->ack_stamp = 0;
+@@ -2594,8 +2594,8 @@ EXPORT_SYMBOL(ceph_msg_last_put);
+
+ void ceph_msg_dump(struct ceph_msg *msg)
+ {
+- pr_debug("msg_dump %p (front_max %d nr_pages %d)\n", msg,
+- msg->front_max, msg->nr_pages);
++ pr_debug("msg_dump %p (front_alloc_len %d nr_pages %d)\n", msg,
++ msg->front_alloc_len, msg->nr_pages);
+ print_hex_dump(KERN_DEBUG, "header: ",
+ DUMP_PREFIX_OFFSET, 16, 1,
+ &msg->hdr, sizeof(msg->hdr), true);
+diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
+index 0b62dea..0c0859b 100644
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -150,7 +150,7 @@ static int __open_session(struct ceph_mon_client *monc)
+ /* initiatiate authentication handshake */
+ ret = ceph_auth_build_hello(monc->auth,
+ monc->m_auth->front.iov_base,
+- monc->m_auth->front_max);
++ monc->m_auth->front_alloc_len);
+ __send_prepared_auth_request(monc, ret);
+ } else {
+ dout("open_session mon%d already open\n", monc->cur_mon);
+@@ -194,7 +194,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
+ int num;
+
+ p = msg->front.iov_base;
+- end = p + msg->front_max;
++ end = p + msg->front_alloc_len;
+
+ num = 1 + !!monc->want_next_osdmap + !!monc->want_mdsmap;
+ ceph_encode_32(&p, num);
+@@ -860,7 +860,7 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
+ ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base,
+ msg->front.iov_len,
+ monc->m_auth->front.iov_base,
+- monc->m_auth->front_max);
++ monc->m_auth->front_alloc_len);
+ if (ret < 0) {
+ monc->client->auth_err = ret;
+ wake_up_all(&monc->client->auth_wq);
+@@ -887,7 +887,7 @@ static int __validate_auth(struct ceph_mon_client *monc)
+ return 0;
+
+ ret = ceph_build_auth(monc->auth, monc->m_auth->front.iov_base,
+- monc->m_auth->front_max);
++ monc->m_auth->front_alloc_len);
+ if (ret <= 0)
+ return ret; /* either an error, or no need to authenticate */
+ __send_prepared_auth_request(monc, ret);
+@@ -987,7 +987,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
+ if (!m) {
+ pr_info("alloc_msg unknown type %d\n", type);
+ *skip = 1;
++ } else if (front_len > m->front_alloc_len) {
++ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
++ front_len, m->front_alloc_len,
++ (unsigned int)con->peer_name.type,
++ le64_to_cpu(con->peer_name.num));
++ ceph_msg_put(m);
++ m = ceph_msg_new(type, front_len, GFP_NOFS, false);
+ }
++
+ return m;
+ }
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d361dc0..8e79a9e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -151,6 +151,9 @@ static void ipv4_link_failure(struct sk_buff *skb);
+ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
+ static int rt_garbage_collect(struct dst_ops *ops);
+
++static void __rt_garbage_collect(struct work_struct *w);
++static DECLARE_WORK(rt_gc_worker, __rt_garbage_collect);
++
+ static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+ int how)
+ {
+@@ -979,12 +982,13 @@ static void rt_emergency_hash_rebuild(struct net *net)
+ and when load increases it reduces to limit cache size.
+ */
+
+-static int rt_garbage_collect(struct dst_ops *ops)
++static void __do_rt_garbage_collect(int elasticity, int min_interval)
+ {
+ static unsigned long expire = RT_GC_TIMEOUT;
+ static unsigned long last_gc;
+ static int rover;
+ static int equilibrium;
++ static DEFINE_SPINLOCK(rt_gc_lock);
+ struct rtable *rth;
+ struct rtable __rcu **rthp;
+ unsigned long now = jiffies;
+@@ -996,9 +1000,11 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ * do not make it too frequently.
+ */
+
++ spin_lock_bh(&rt_gc_lock);
++
+ RT_CACHE_STAT_INC(gc_total);
+
+- if (now - last_gc < ip_rt_gc_min_interval &&
++ if (now - last_gc < min_interval &&
+ entries < ip_rt_max_size) {
+ RT_CACHE_STAT_INC(gc_ignored);
+ goto out;
+@@ -1006,7 +1012,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+
+ entries = dst_entries_get_slow(&ipv4_dst_ops);
+ /* Calculate number of entries, which we want to expire now. */
+- goal = entries - (ip_rt_gc_elasticity << rt_hash_log);
++ goal = entries - (elasticity << rt_hash_log);
+ if (goal <= 0) {
+ if (equilibrium < ipv4_dst_ops.gc_thresh)
+ equilibrium = ipv4_dst_ops.gc_thresh;
+@@ -1023,7 +1029,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ equilibrium = entries - goal;
+ }
+
+- if (now - last_gc >= ip_rt_gc_min_interval)
++ if (now - last_gc >= min_interval)
+ last_gc = now;
+
+ if (goal <= 0) {
+@@ -1088,15 +1094,34 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ if (net_ratelimit())
+ printk(KERN_WARNING "dst cache overflow\n");
+ RT_CACHE_STAT_INC(gc_dst_overflow);
+- return 1;
++ goto out;
+
+ work_done:
+- expire += ip_rt_gc_min_interval;
++ expire += min_interval;
+ if (expire > ip_rt_gc_timeout ||
+ dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh ||
+ dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh)
+ expire = ip_rt_gc_timeout;
+-out: return 0;
++out:
++ spin_unlock_bh(&rt_gc_lock);
++}
++
++static void __rt_garbage_collect(struct work_struct *w)
++{
++ __do_rt_garbage_collect(ip_rt_gc_elasticity, ip_rt_gc_min_interval);
++}
++
++static int rt_garbage_collect(struct dst_ops *ops)
++{
++ if (!work_pending(&rt_gc_worker))
++ schedule_work(&rt_gc_worker);
++
++ if (dst_entries_get_fast(&ipv4_dst_ops) >= ip_rt_max_size ||
++ dst_entries_get_slow(&ipv4_dst_ops) >= ip_rt_max_size) {
++ RT_CACHE_STAT_INC(gc_dst_overflow);
++ return 1;
++ }
++ return 0;
+ }
+
+ /*
+@@ -1153,7 +1178,7 @@ static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt,
+ unsigned long now;
+ u32 min_score;
+ int chain_length;
+- int attempts = !in_softirq();
++ int attempts = 1;
+
+ restart:
+ chain_length = 0;
+@@ -1290,14 +1315,15 @@ restart:
+ can be released. Try to shrink route cache,
+ it is most likely it holds some neighbour records.
+ */
+- if (attempts-- > 0) {
+- int saved_elasticity = ip_rt_gc_elasticity;
+- int saved_int = ip_rt_gc_min_interval;
+- ip_rt_gc_elasticity = 1;
+- ip_rt_gc_min_interval = 0;
+- rt_garbage_collect(&ipv4_dst_ops);
+- ip_rt_gc_min_interval = saved_int;
+- ip_rt_gc_elasticity = saved_elasticity;
++ if (!in_softirq() && attempts-- > 0) {
++ static DEFINE_SPINLOCK(lock);
++
++ if (spin_trylock(&lock)) {
++ __do_rt_garbage_collect(1, 0);
++ spin_unlock(&lock);
++ } else {
++ spin_unlock_wait(&lock);
++ }
+ goto restart;
+ }
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index b9edff0..3afdd78 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2443,8 +2443,18 @@ static void init_loopback(struct net_device *dev)
+ if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+ continue;
+
+- if (sp_ifa->rt)
+- continue;
++ if (sp_ifa->rt) {
++ /* This dst has been added to garbage list when
++ * lo device down, release this obsolete dst and
++ * reallocate a new router for ifa.
++ */
++ if (sp_ifa->rt->dst.obsolete > 0) {
++ dst_release(&sp_ifa->rt->dst);
++ sp_ifa->rt = NULL;
++ } else {
++ continue;
++ }
++ }
+
+ sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index f8bec1e..d131a95 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1362,7 +1362,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
+ fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ fptr->nexthdr = nexthdr;
+ fptr->reserved = 0;
+- ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
++ fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+
+ /* Fragment the skb. ipv6 header and the remaining fields of the
+ * fragment header are updated in ipv6_gso_segment()
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 437fb59..767bf4a 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -774,7 +774,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ /* If PMTU discovery was enabled, use the MTU that was discovered */
+ dst = sk_dst_get(tunnel->sock);
+ if (dst != NULL) {
+- u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
++ u32 pmtu = dst_mtu(dst);
++
+ if (pmtu != 0)
+ session->mtu = session->mru = pmtu -
+ PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 29fa5ba..6422845 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -777,7 +777,6 @@ static void ip_vs_conn_expire(unsigned long data)
+ ip_vs_control_del(cp);
+
+ if (cp->flags & IP_VS_CONN_F_NFCT) {
+- ip_vs_conn_drop_conntrack(cp);
+ /* Do not access conntracks during subsys cleanup
+ * because nf_conntrack_find_get can not be used after
+ * conntrack cleanup for the net.
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index da54d29..5b2d8e6 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1638,6 +1638,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack(
+ * ack chunk whose serial number matches that of the request.
+ */
+ list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) {
++ if (sctp_chunk_pending(ack))
++ continue;
+ if (ack->subh.addip_hdr->serial == serial) {
+ sctp_chunk_hold(ack);
+ return ack;
+diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
+index 397296f..32421ae 100644
+--- a/net/sctp/inqueue.c
++++ b/net/sctp/inqueue.c
+@@ -152,18 +152,9 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ } else {
+ /* Nothing to do. Next chunk in the packet, please. */
+ ch = (sctp_chunkhdr_t *) chunk->chunk_end;
+-
+ /* Force chunk->skb->data to chunk->chunk_end. */
+- skb_pull(chunk->skb,
+- chunk->chunk_end - chunk->skb->data);
+-
+- /* Verify that we have at least chunk headers
+- * worth of buffer left.
+- */
+- if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) {
+- sctp_chunk_free(chunk);
+- chunk = queue->in_progress = NULL;
+- }
++ skb_pull(chunk->skb, chunk->chunk_end - chunk->skb->data);
++ /* We are guaranteed to pull a SCTP header. */
+ }
+ }
+
+@@ -199,24 +190,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
+ chunk->subh.v = NULL; /* Subheader is no longer valid. */
+
+- if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
++ if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) <
++ skb_tail_pointer(chunk->skb)) {
+ /* This is not a singleton */
+ chunk->singleton = 0;
+ } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
+- /* RFC 2960, Section 6.10 Bundling
+- *
+- * Partial chunks MUST NOT be placed in an SCTP packet.
+- * If the receiver detects a partial chunk, it MUST drop
+- * the chunk.
+- *
+- * Since the end of the chunk is past the end of our buffer
+- * (which contains the whole packet, we can freely discard
+- * the whole packet.
+- */
+- sctp_chunk_free(chunk);
+- chunk = queue->in_progress = NULL;
+-
+- return NULL;
++ /* Discard inside state machine. */
++ chunk->pdiscard = 1;
++ chunk->chunk_end = skb_tail_pointer(chunk->skb);
+ } else {
+ /* We are at the end of the packet, so mark the chunk
+ * in case we need to send a SACK.
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index c95a3f2..d8d4704 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -3068,50 +3068,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ return SCTP_ERROR_NO_ERROR;
+ }
+
+-/* Verify the ASCONF packet before we process it. */
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+- struct sctp_paramhdr *param_hdr, void *chunk_end,
+- struct sctp_paramhdr **errp) {
+- sctp_addip_param_t *asconf_param;
++/* Verify the ASCONF packet before we process it. */
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, bool addr_param_needed,
++ struct sctp_paramhdr **errp)
++{
++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr;
+ union sctp_params param;
+- int length, plen;
+-
+- param.v = (sctp_paramhdr_t *) param_hdr;
+- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) {
+- length = ntohs(param.p->length);
+- *errp = param.p;
++ bool addr_param_seen = false;
+
+- if (param.v > chunk_end - length ||
+- length < sizeof(sctp_paramhdr_t))
+- return 0;
++ sctp_walk_params(param, addip, addip_hdr.params) {
++ size_t length = ntohs(param.p->length);
+
++ *errp = param.p;
+ switch (param.p->type) {
++ case SCTP_PARAM_ERR_CAUSE:
++ break;
++ case SCTP_PARAM_IPV4_ADDRESS:
++ if (length != sizeof(sctp_ipv4addr_param_t))
++ return false;
++ addr_param_seen = true;
++ break;
++ case SCTP_PARAM_IPV6_ADDRESS:
++ if (length != sizeof(sctp_ipv6addr_param_t))
++ return false;
++ addr_param_seen = true;
++ break;
+ case SCTP_PARAM_ADD_IP:
+ case SCTP_PARAM_DEL_IP:
+ case SCTP_PARAM_SET_PRIMARY:
+- asconf_param = (sctp_addip_param_t *)param.v;
+- plen = ntohs(asconf_param->param_hdr.length);
+- if (plen < sizeof(sctp_addip_param_t) +
+- sizeof(sctp_paramhdr_t))
+- return 0;
++ /* In ASCONF chunks, these need to be first. */
++ if (addr_param_needed && !addr_param_seen)
++ return false;
++ length = ntohs(param.addip->param_hdr.length);
++ if (length < sizeof(sctp_addip_param_t) +
++ sizeof(sctp_paramhdr_t))
++ return false;
+ break;
+ case SCTP_PARAM_SUCCESS_REPORT:
+ case SCTP_PARAM_ADAPTATION_LAYER_IND:
+ if (length != sizeof(sctp_addip_param_t))
+- return 0;
+-
++ return false;
+ break;
+ default:
+- break;
++ /* This is unkown to us, reject! */
++ return false;
+ }
+-
+- param.v += WORD_ROUND(length);
+ }
+
+- if (param.v != chunk_end)
+- return 0;
++ /* Remaining sanity checks. */
++ if (addr_param_needed && !addr_param_seen)
++ return false;
++ if (!addr_param_needed && addr_param_seen)
++ return false;
++ if (param.v != chunk->chunk_end)
++ return false;
+
+- return 1;
++ return true;
+ }
+
+ /* Process an incoming ASCONF chunk with the next expected serial no. and
+@@ -3120,16 +3133,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc,
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ struct sctp_chunk *asconf)
+ {
++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr;
++ bool all_param_pass = true;
++ union sctp_params param;
+ sctp_addiphdr_t *hdr;
+ union sctp_addr_param *addr_param;
+ sctp_addip_param_t *asconf_param;
+ struct sctp_chunk *asconf_ack;
+-
+ __be16 err_code;
+ int length = 0;
+ int chunk_len;
+ __u32 serial;
+- int all_param_pass = 1;
+
+ chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
+ hdr = (sctp_addiphdr_t *)asconf->skb->data;
+@@ -3157,9 +3171,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ goto done;
+
+ /* Process the TLVs contained within the ASCONF chunk. */
+- while (chunk_len > 0) {
++ sctp_walk_params(param, addip, addip_hdr.params) {
++ /* Skip preceeding address parameters. */
++ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
++ param.p->type == SCTP_PARAM_IPV6_ADDRESS)
++ continue;
++
+ err_code = sctp_process_asconf_param(asoc, asconf,
+- asconf_param);
++ param.addip);
+ /* ADDIP 4.1 A7)
+ * If an error response is received for a TLV parameter,
+ * all TLVs with no response before the failed TLV are
+@@ -3167,28 +3186,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ * the failed response are considered unsuccessful unless
+ * a specific success indication is present for the parameter.
+ */
+- if (SCTP_ERROR_NO_ERROR != err_code)
+- all_param_pass = 0;
+-
++ if (err_code != SCTP_ERROR_NO_ERROR)
++ all_param_pass = false;
+ if (!all_param_pass)
+- sctp_add_asconf_response(asconf_ack,
+- asconf_param->crr_id, err_code,
+- asconf_param);
++ sctp_add_asconf_response(asconf_ack, param.addip->crr_id,
++ err_code, param.addip);
+
+ /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add
+ * an IP address sends an 'Out of Resource' in its response, it
+ * MUST also fail any subsequent add or delete requests bundled
+ * in the ASCONF.
+ */
+- if (SCTP_ERROR_RSRC_LOW == err_code)
++ if (err_code == SCTP_ERROR_RSRC_LOW)
+ goto done;
+-
+- /* Move to the next ASCONF param. */
+- length = ntohs(asconf_param->param_hdr.length);
+- asconf_param = (void *)asconf_param + length;
+- chunk_len -= length;
+ }
+-
+ done:
+ asoc->peer.addip_serial++;
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 5ac33b6..d02dd3c 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -163,6 +163,9 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk,
+ {
+ __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
+
++ /* Previously already marked? */
++ if (unlikely(chunk->pdiscard))
++ return 0;
+ if (unlikely(chunk_length < required_length))
+ return 0;
+
+@@ -3516,9 +3519,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ struct sctp_chunk *asconf_ack = NULL;
+ struct sctp_paramhdr *err_param = NULL;
+ sctp_addiphdr_t *hdr;
+- union sctp_addr_param *addr_param;
+ __u32 serial;
+- int length;
+
+ if (!sctp_vtag_verify(chunk, asoc)) {
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
+@@ -3543,17 +3544,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ hdr = (sctp_addiphdr_t *)chunk->skb->data;
+ serial = ntohl(hdr->serial);
+
+- addr_param = (union sctp_addr_param *)hdr->params;
+- length = ntohs(addr_param->p.length);
+- if (length < sizeof(sctp_paramhdr_t))
+- return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+- (void *)addr_param, commands);
+-
+ /* Verify the ASCONF chunk before processing it. */
+- if (!sctp_verify_asconf(asoc,
+- (sctp_paramhdr_t *)((void *)addr_param + length),
+- (void *)chunk->chunk_end,
+- &err_param))
++ if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
+ return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ (void *)err_param, commands);
+
+@@ -3670,10 +3662,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
+ rcvd_serial = ntohl(addip_hdr->serial);
+
+ /* Verify the ASCONF-ACK chunk before processing it. */
+- if (!sctp_verify_asconf(asoc,
+- (sctp_paramhdr_t *)addip_hdr->params,
+- (void *)asconf_ack->chunk_end,
+- &err_param))
++ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
+ return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ (void *)err_param, commands);
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 6d4d263..cdf77a2 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4804,6 +4804,9 @@ int cfg80211_testmode_reply(struct sk_buff *skb)
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ if (WARN_ON(!rdev->testmode_info)) {
+ kfree_skb(skb);
+ return -EINVAL;
+@@ -4830,6 +4833,9 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index cf0d46e..7f00d34 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1692,14 +1692,16 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream,
+ {
+ struct snd_pcm_hw_params *params = arg;
+ snd_pcm_format_t format;
+- int channels, width;
++ int channels;
++ ssize_t frame_size;
+
+ params->fifo_size = substream->runtime->hw.fifo_size;
+ if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) {
+ format = params_format(params);
+ channels = params_channels(params);
+- width = snd_pcm_format_physical_width(format);
+- params->fifo_size /= width * channels;
++ frame_size = snd_pcm_format_size(format, channels);
++ if (frame_size > 0)
++ params->fifo_size /= (unsigned)frame_size;
+ }
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 491cdf0..d10a6ef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -789,6 +789,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
+ case 0x10ec0885:
+ case 0x10ec0887:
+ /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
++ case 0x10ec0900:
+ alc889_coef_init(codec);
+ break;
+ case 0x10ec0888:
+@@ -4343,6 +4344,7 @@ static int patch_alc882(struct hda_codec *codec)
+ switch (codec->vendor_id) {
+ case 0x10ec0882:
+ case 0x10ec0885:
++ case 0x10ec0900:
+ break;
+ default:
+ /* ALC883 and variants */
diff --git a/3.2.63/4420_grsecurity-3.0-3.2.63-201411020808.patch b/3.2.64/4420_grsecurity-3.0-3.2.64-201411062032.patch
index ab7ff79..7cb2c8e 100644
--- a/3.2.63/4420_grsecurity-3.0-3.2.63-201411020808.patch
+++ b/3.2.64/4420_grsecurity-3.0-3.2.64-201411062032.patch
@@ -278,7 +278,7 @@ index 88fd7f5..b318a78 100644
==============================================================
diff --git a/Makefile b/Makefile
-index 6d3f2d4..8bd5807 100644
+index 2b58ffc..895bdb8 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -14092,7 +14092,7 @@ index 5478825..839e88c 100644
#define flush_insn_slot(p) do { } while (0)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index b3eb9a7..7c34d91 100644
+index 15d24cb..ee4dcd1 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -459,7 +459,7 @@ struct kvm_arch {
@@ -23595,7 +23595,7 @@ index 16204dc..0e7d4b7 100644
.smp_prepare_cpus = native_smp_prepare_cpus,
.smp_cpus_done = native_smp_cpus_done,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 6e68bd9..facb68a 100644
+index bb28f2ca..e377b54 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -252,11 +252,13 @@ notrace static void __cpuinit start_secondary(void *unused)
@@ -24907,7 +24907,7 @@ index 7110911..069da9c 100644
/*
* Encountered an error while doing the restore from the
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 638cab5..0a38f1e 100644
+index f0ac042..f6e5b65 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -249,6 +249,7 @@ struct gprefix {
@@ -25003,7 +25003,7 @@ index 9299410..ade2f9b 100644
spin_unlock(&vcpu->kvm->mmu_lock);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 2102a17..16e1531 100644
+index 82f97a5..159a0df 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3403,7 +3403,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
@@ -25030,10 +25030,10 @@ index 2102a17..16e1531 100644
local_irq_disable();
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index a4f6bda..40eb721 100644
+index 578b1c6..5a7039c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
-@@ -1099,12 +1099,12 @@ static void vmcs_write64(unsigned long field, u64 value)
+@@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
#endif
}
@@ -25048,7 +25048,7 @@ index a4f6bda..40eb721 100644
{
vmcs_writel(field, vmcs_readl(field) | mask);
}
-@@ -1305,7 +1305,11 @@ static void reload_tss(void)
+@@ -1306,7 +1306,11 @@ static void reload_tss(void)
struct desc_struct *descs;
descs = (void *)gdt->address;
@@ -25060,7 +25060,7 @@ index a4f6bda..40eb721 100644
load_TR_desc();
}
-@@ -1504,6 +1508,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+@@ -1505,6 +1509,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
vmcs_writel(HOST_TR_BASE, kvm_read_tr_base()); /* 22.2.4 */
vmcs_writel(HOST_GDTR_BASE, gdt->address); /* 22.2.4 */
@@ -25071,7 +25071,7 @@ index a4f6bda..40eb721 100644
rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
vmx->loaded_vmcs->cpu = cpu;
-@@ -2634,8 +2642,11 @@ static __init int hardware_setup(void)
+@@ -2635,8 +2643,11 @@ static __init int hardware_setup(void)
if (!cpu_has_vmx_flexpriority())
flexpriority_enabled = 0;
@@ -25085,18 +25085,18 @@ index a4f6bda..40eb721 100644
if (enable_ept && !cpu_has_vmx_ept_2m_page())
kvm_disable_largepages();
-@@ -3637,7 +3648,10 @@ static void vmx_set_constant_host_state(void)
+@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ unsigned long cr4;
vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
+
+#ifndef CONFIG_PAX_PER_CPU_PGD
vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
+#endif
- vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
- vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
-@@ -3649,7 +3663,7 @@ static void vmx_set_constant_host_state(void)
+ /* Save the most likely value for this task's CR4 in the VMCS. */
+ cr4 = read_cr4();
+@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25105,7 +25105,7 @@ index a4f6bda..40eb721 100644
rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6178,6 +6192,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
"jmp .Lkvm_vmx_return \n\t"
".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
".Lkvm_vmx_return: "
@@ -25118,7 +25118,7 @@ index a4f6bda..40eb721 100644
/* Save guest registers, load host registers, keep flags */
"mov %0, %c[wordsize](%%"R"sp) \n\t"
"pop %0 \n\t"
-@@ -6226,6 +6246,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
#endif
[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
[wordsize]"i"(sizeof(ulong))
@@ -25130,7 +25130,7 @@ index a4f6bda..40eb721 100644
: "cc", "memory"
, R"ax", R"bx", R"di", R"si"
#ifdef CONFIG_X86_64
-@@ -6254,7 +6279,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
}
}
@@ -25149,10 +25149,10 @@ index a4f6bda..40eb721 100644
vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index b9fefaf..32b0407 100644
+index 2d7d0df..4476198 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -1344,8 +1344,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1369,8 +1369,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
{
struct kvm *kvm = vcpu->kvm;
int lm = is_long_mode(vcpu);
@@ -25163,7 +25163,7 @@ index b9fefaf..32b0407 100644
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u32 page_num = data & ~PAGE_MASK;
-@@ -2162,6 +2162,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2187,6 +2187,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
@@ -25172,7 +25172,7 @@ index b9fefaf..32b0407 100644
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
-@@ -2337,15 +2339,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2362,15 +2364,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
struct kvm_cpuid2 *cpuid,
struct kvm_cpuid_entry2 __user *entries)
{
@@ -25196,7 +25196,7 @@ index b9fefaf..32b0407 100644
vcpu->arch.cpuid_nent = cpuid->nent;
kvm_apic_set_version(vcpu);
kvm_x86_ops->cpuid_update(vcpu);
-@@ -2360,15 +2367,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2385,15 +2392,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
struct kvm_cpuid2 *cpuid,
struct kvm_cpuid_entry2 __user *entries)
{
@@ -25219,7 +25219,7 @@ index b9fefaf..32b0407 100644
return 0;
out:
-@@ -2743,7 +2754,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2768,7 +2779,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
struct kvm_interrupt *irq)
{
@@ -25228,7 +25228,7 @@ index b9fefaf..32b0407 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -5184,7 +5195,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5209,7 +5220,7 @@ static void kvm_set_mmio_spte_mask(void)
kvm_mmu_set_mmio_spte_mask(mask);
}
@@ -32597,10 +32597,10 @@ index 7b72502..3d7b647 100644
err = -EFAULT;
goto out;
diff --git a/block/genhd.c b/block/genhd.c
-index 8bd4ef2..078f68b9 100644
+index 41b0435..09f9f28 100644
--- a/block/genhd.c
+++ b/block/genhd.c
-@@ -474,21 +474,24 @@ static char *bdevt_str(dev_t devt, char *buf)
+@@ -472,21 +472,24 @@ static char *bdevt_str(dev_t devt, char *buf)
/*
* Register device numbers dev..(dev+range-1)
@@ -32978,7 +32978,7 @@ index ac28db3..0848b37 100644
/*
* Buggy BIOS check
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index de0791c..d6d4ea3 100644
+index 388ba10..d509dbb 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1036,7 +1036,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
@@ -39557,7 +39557,7 @@ index 0e3fa7d..35f9ed6 100644
wait_queue_head_t fifo_queue;
int fence_queue_waiters; /* Protected by hw_mutex */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
-index a0c2f12..68ae6cb 100644
+index decca82..7968bc5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
@@ -39569,7 +39569,7 @@ index a0c2f12..68ae6cb 100644
iowrite32(dev_priv->last_read_seqno, fifo_mem + SVGA_FIFO_FENCE);
vmw_marker_queue_init(&fifo->marker_queue);
return vmw_fifo_send_fence(dev_priv, &dummy);
-@@ -355,7 +355,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
+@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
if (reserveable)
iowrite32(bytes, fifo_mem +
SVGA_FIFO_RESERVED);
@@ -39578,7 +39578,7 @@ index a0c2f12..68ae6cb 100644
} else {
need_bounce = true;
}
-@@ -475,7 +475,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
+@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
fm = vmw_fifo_reserve(dev_priv, bytes);
if (unlikely(fm == NULL)) {
@@ -39587,7 +39587,7 @@ index a0c2f12..68ae6cb 100644
ret = -ENOMEM;
(void)vmw_fallback_wait(dev_priv, false, true, *seqno,
false, 3*HZ);
-@@ -483,7 +483,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
+@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
}
do {
@@ -48153,32 +48153,6 @@ index 9de9db2..1e09660 100644
fc_frame_free(fp);
}
-diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
-index 143bbe4..2794a30 100644
---- a/drivers/scsi/libiscsi.c
-+++ b/drivers/scsi/libiscsi.c
-@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
- return NULL;
- }
-
-+ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
-+ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
-+ return NULL;
-+ }
-+
- task = conn->login_task;
- } else {
- if (session->state != ISCSI_STATE_LOGGED_IN)
- return NULL;
-
-+ if (data_size != 0) {
-+ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
-+ return NULL;
-+ }
-+
- BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
- BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
-
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 5e170e3..1e87efc 100644
--- a/drivers/scsi/libsas/sas_ata.c
@@ -50164,7 +50138,7 @@ index ed147c4..94fc3c6 100644
/* core tmem accessor functions */
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index ab5dd16..17f7bd2 100644
+index ae4e7da..46264ce 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1357,7 +1357,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
@@ -51322,7 +51296,7 @@ index 032e5a6..bc422e4 100644
wake_up(&usb_kill_urb_queue);
usb_put_urb(urb);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index f08732b..6338872 100644
+index 10aec1a..387cff3 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -25,6 +25,7 @@
@@ -55416,7 +55390,7 @@ index 356dcf0..c0046cd 100644
static const struct super_operations afs_super_ops = {
.statfs = afs_statfs,
diff --git a/fs/aio.c b/fs/aio.c
-index 8cdd8ea..64197b4 100644
+index 9acfd07..ad962e7 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -55428,7 +55402,7 @@ index 8cdd8ea..64197b4 100644
return -EINVAL;
nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1468,18 +1468,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
{
ssize_t ret;
@@ -55450,7 +55424,7 @@ index 8cdd8ea..64197b4 100644
&kiocb->ki_iovec, 1);
if (ret < 0)
goto out;
-@@ -1481,6 +1482,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+@@ -1488,6 +1489,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
if (ret < 0)
goto out;
@@ -56882,30 +56856,10 @@ index 200f63b..490b833 100644
/*
* used by btrfsctl to scan devices when no FS is mounted
diff --git a/fs/buffer.c b/fs/buffer.c
-index 5f4bde2..5df71b8 100644
+index 59496e7..5df71b8 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
-@@ -1021,7 +1021,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- bh = page_buffers(page);
- if (bh->b_size == size) {
- end_block = init_page_buffers(page, bdev,
-- index << sizebits, size);
-+ (sector_t)index << sizebits,
-+ size);
- goto done;
- }
- if (!try_to_free_buffers(page))
-@@ -1042,7 +1043,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- */
- spin_lock(&inode->i_mapping->private_lock);
- link_dev_buffers(page, bh);
-- end_block = init_page_buffers(page, bdev, index << sizebits, size);
-+ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
-+ size);
- spin_unlock(&inode->i_mapping->private_lock);
- done:
- ret = (block < end_block) ? 1 : -ENXIO;
-@@ -2256,6 +2258,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
+@@ -2258,6 +2258,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
err = 0;
balance_dirty_pages_ratelimited(mapping);
@@ -56917,7 +56871,7 @@ index 5f4bde2..5df71b8 100644
}
/* page covers the boundary, find the boundary offset */
-@@ -3316,7 +3323,7 @@ void __init buffer_init(void)
+@@ -3318,7 +3323,7 @@ void __init buffer_init(void)
bh_cachep = kmem_cache_create("buffer_head",
sizeof(struct buffer_head), 0,
(SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
@@ -59189,10 +59143,10 @@ index 40f4d06..7f3507d 100644
/* locality groups */
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 818b43e..9a76283 100644
+index 5baa7ba..917bb08 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
-@@ -1794,7 +1794,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+@@ -1796,7 +1796,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
if (EXT4_SB(sb)->s_mb_stats)
@@ -59201,7 +59155,7 @@ index 818b43e..9a76283 100644
break;
}
-@@ -2092,7 +2092,7 @@ repeat:
+@@ -2094,7 +2094,7 @@ repeat:
ac->ac_status = AC_STATUS_CONTINUE;
ac->ac_flags |= EXT4_MB_HINT_FIRST;
cr = 3;
@@ -59210,7 +59164,7 @@ index 818b43e..9a76283 100644
goto repeat;
}
}
-@@ -2599,25 +2599,25 @@ int ext4_mb_release(struct super_block *sb)
+@@ -2601,25 +2601,25 @@ int ext4_mb_release(struct super_block *sb)
if (sbi->s_mb_stats) {
ext4_msg(sb, KERN_INFO,
"mballoc: %u blocks %u reqs (%u success)",
@@ -59246,7 +59200,7 @@ index 818b43e..9a76283 100644
}
free_percpu(sbi->s_locality_groups);
-@@ -3101,16 +3101,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+@@ -3103,16 +3103,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
@@ -59269,7 +59223,7 @@ index 818b43e..9a76283 100644
}
if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3534,7 +3534,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3539,7 +3539,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
trace_ext4_mb_new_inode_pa(ac, pa);
ext4_mb_use_inode_pa(ac, pa);
@@ -59278,7 +59232,7 @@ index 818b43e..9a76283 100644
ei = EXT4_I(ac->ac_inode);
grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3594,7 +3594,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3599,7 +3599,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
trace_ext4_mb_new_group_pa(ac, pa);
ext4_mb_use_group_pa(ac, pa);
@@ -59287,7 +59241,7 @@ index 818b43e..9a76283 100644
grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
lg = ac->ac_lg;
-@@ -3683,7 +3683,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3688,7 +3688,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
* from the bitmap and continue.
*/
}
@@ -59296,7 +59250,7 @@ index 818b43e..9a76283 100644
return err;
}
-@@ -3701,7 +3701,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3706,7 +3706,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -61558,7 +61512,7 @@ index 4d46a6a..dee1cdf 100644
static int __init init_minix_fs(void)
{
diff --git a/fs/namei.c b/fs/namei.c
-index 9680cef..36c9152 100644
+index dea2dab..6452ab2 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -279,16 +279,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -61612,7 +61566,7 @@ index 9680cef..36c9152 100644
return -EACCES;
}
-@@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -652,11 +660,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
return error;
}
@@ -61642,7 +61596,7 @@ index 9680cef..36c9152 100644
put_link(nd, &link, cookie);
} while (res > 0);
-@@ -1617,6 +1635,8 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1624,6 +1642,8 @@ static int path_lookupat(int dfd, const char *name,
err = follow_link(&link, nd, &cookie);
if (!err)
err = lookup_last(nd, &path);
@@ -61651,7 +61605,7 @@ index 9680cef..36c9152 100644
put_link(nd, &link, cookie);
}
}
-@@ -1624,6 +1644,13 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1631,6 +1651,13 @@ static int path_lookupat(int dfd, const char *name,
if (!err)
err = complete_walk(nd);
@@ -61665,7 +61619,7 @@ index 9680cef..36c9152 100644
if (!err && nd->flags & LOOKUP_DIRECTORY) {
if (!nd->inode->i_op->lookup) {
path_put(&nd->path);
-@@ -1655,6 +1682,12 @@ static int do_path_lookup(int dfd, const char *name,
+@@ -1662,6 +1689,12 @@ static int do_path_lookup(int dfd, const char *name,
if (nd->path.dentry && nd->inode)
audit_inode(name, nd->path.dentry);
}
@@ -61678,7 +61632,7 @@ index 9680cef..36c9152 100644
}
return retval;
}
-@@ -1784,7 +1817,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+@@ -1791,7 +1824,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
if (!len)
return ERR_PTR(-EACCES);
@@ -61692,7 +61646,7 @@ index 9680cef..36c9152 100644
while (len--) {
c = *(const unsigned char *)name++;
if (c == '/' || c == '\0')
-@@ -2048,6 +2087,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2055,6 +2094,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
if (flag & O_NOATIME && !inode_owner_or_capable(inode))
return -EPERM;
@@ -61706,7 +61660,7 @@ index 9680cef..36c9152 100644
return 0;
}
-@@ -2083,7 +2129,7 @@ static inline int open_to_namei_flags(int flag)
+@@ -2090,7 +2136,7 @@ static inline int open_to_namei_flags(int flag)
/*
* Handle the last step of open()
*/
@@ -61715,7 +61669,7 @@ index 9680cef..36c9152 100644
const struct open_flags *op, const char *pathname)
{
struct dentry *dir = nd->path.dentry;
-@@ -2109,16 +2155,32 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2116,16 +2162,32 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
error = complete_walk(nd);
if (error)
return ERR_PTR(error);
@@ -61748,7 +61702,7 @@ index 9680cef..36c9152 100644
audit_inode(pathname, dir);
goto ok;
}
-@@ -2134,18 +2196,31 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2141,18 +2203,31 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
!symlink_ok);
if (error < 0)
return ERR_PTR(error);
@@ -61781,7 +61735,7 @@ index 9680cef..36c9152 100644
audit_inode(pathname, nd->path.dentry);
goto ok;
}
-@@ -2180,6 +2255,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2187,6 +2262,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
/* Negative dentry, just create the file */
if (!dentry->d_inode) {
int mode = op->mode;
@@ -61799,7 +61753,7 @@ index 9680cef..36c9152 100644
if (!IS_POSIXACL(dir->d_inode))
mode &= ~current_umask();
/*
-@@ -2203,6 +2289,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2210,6 +2296,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
error = vfs_create(dir->d_inode, dentry, mode, nd);
if (error)
goto exit_mutex_unlock;
@@ -61808,7 +61762,7 @@ index 9680cef..36c9152 100644
mutex_unlock(&dir->d_inode->i_mutex);
dput(nd->path.dentry);
nd->path.dentry = dentry;
-@@ -2212,6 +2300,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2219,6 +2307,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
/*
* It already exists.
*/
@@ -61828,7 +61782,7 @@ index 9680cef..36c9152 100644
mutex_unlock(&dir->d_inode->i_mutex);
audit_inode(pathname, path->dentry);
-@@ -2230,11 +2331,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2237,11 +2338,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
if (!path->dentry->d_inode)
goto exit_dput;
@@ -61847,7 +61801,7 @@ index 9680cef..36c9152 100644
/* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
error = complete_walk(nd);
if (error)
-@@ -2242,6 +2349,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2249,6 +2356,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
error = -EISDIR;
if (S_ISDIR(nd->inode->i_mode))
goto exit;
@@ -61860,7 +61814,7 @@ index 9680cef..36c9152 100644
ok:
if (!S_ISREG(nd->inode->i_mode))
will_truncate = 0;
-@@ -2314,7 +2427,7 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2321,7 +2434,7 @@ static struct file *path_openat(int dfd, const char *pathname,
if (unlikely(error))
goto out_filp;
@@ -61869,7 +61823,7 @@ index 9680cef..36c9152 100644
while (unlikely(!filp)) { /* trailing symlink */
struct path link = path;
void *cookie;
-@@ -2329,8 +2442,9 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2336,8 +2449,9 @@ static struct file *path_openat(int dfd, const char *pathname,
error = follow_link(&link, nd, &cookie);
if (unlikely(error))
filp = ERR_PTR(error);
@@ -61881,7 +61835,7 @@ index 9680cef..36c9152 100644
put_link(nd, &link, cookie);
}
out:
-@@ -2424,6 +2538,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
+@@ -2431,6 +2545,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
*path = nd.path;
return dentry;
eexist:
@@ -61893,7 +61847,7 @@ index 9680cef..36c9152 100644
dput(dentry);
dentry = ERR_PTR(-EEXIST);
fail:
-@@ -2446,6 +2565,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
+@@ -2453,6 +2572,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
}
EXPORT_SYMBOL(user_path_create);
@@ -61914,7 +61868,7 @@ index 9680cef..36c9152 100644
int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
int error = may_create(dir, dentry);
-@@ -2513,6 +2646,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2520,6 +2653,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
error = mnt_want_write(path.mnt);
if (error)
goto out_dput;
@@ -61932,7 +61886,7 @@ index 9680cef..36c9152 100644
error = security_path_mknod(&path, dentry, mode, dev);
if (error)
goto out_drop_write;
-@@ -2530,6 +2674,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2537,6 +2681,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
}
out_drop_write:
mnt_drop_write(path.mnt);
@@ -61942,7 +61896,7 @@ index 9680cef..36c9152 100644
out_dput:
dput(dentry);
mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2579,12 +2726,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
+@@ -2586,12 +2733,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
error = mnt_want_write(path.mnt);
if (error)
goto out_dput;
@@ -61964,7 +61918,7 @@ index 9680cef..36c9152 100644
out_dput:
dput(dentry);
mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2664,6 +2820,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2671,6 +2827,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
char * name;
struct dentry *dentry;
struct nameidata nd;
@@ -61973,7 +61927,7 @@ index 9680cef..36c9152 100644
error = user_path_parent(dfd, pathname, &nd, &name);
if (error)
-@@ -2692,6 +2850,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2699,6 +2857,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
error = -ENOENT;
goto exit3;
}
@@ -61989,7 +61943,7 @@ index 9680cef..36c9152 100644
error = mnt_want_write(nd.path.mnt);
if (error)
goto exit3;
-@@ -2699,6 +2866,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2706,6 +2873,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
if (error)
goto exit4;
error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
@@ -61998,7 +61952,7 @@ index 9680cef..36c9152 100644
exit4:
mnt_drop_write(nd.path.mnt);
exit3:
-@@ -2761,6 +2930,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2768,6 +2937,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
struct dentry *dentry;
struct nameidata nd;
struct inode *inode = NULL;
@@ -62007,7 +61961,7 @@ index 9680cef..36c9152 100644
error = user_path_parent(dfd, pathname, &nd, &name);
if (error)
-@@ -2783,6 +2954,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2790,6 +2961,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
if (!inode)
goto slashes;
ihold(inode);
@@ -62024,7 +61978,7 @@ index 9680cef..36c9152 100644
error = mnt_want_write(nd.path.mnt);
if (error)
goto exit2;
-@@ -2790,6 +2971,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2797,6 +2978,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
if (error)
goto exit3;
error = vfs_unlink(nd.path.dentry->d_inode, dentry);
@@ -62033,7 +61987,7 @@ index 9680cef..36c9152 100644
exit3:
mnt_drop_write(nd.path.mnt);
exit2:
-@@ -2865,10 +3048,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+@@ -2872,10 +3055,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
error = mnt_want_write(path.mnt);
if (error)
goto out_dput;
@@ -62052,7 +62006,7 @@ index 9680cef..36c9152 100644
out_drop_write:
mnt_drop_write(path.mnt);
out_dput:
-@@ -2940,6 +3131,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2947,6 +3138,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
{
struct dentry *new_dentry;
struct path old_path, new_path;
@@ -62060,7 +62014,7 @@ index 9680cef..36c9152 100644
int how = 0;
int error;
-@@ -2963,7 +3155,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2970,7 +3162,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
if (error)
return error;
@@ -62069,7 +62023,7 @@ index 9680cef..36c9152 100644
error = PTR_ERR(new_dentry);
if (IS_ERR(new_dentry))
goto out;
-@@ -2974,13 +3166,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2981,13 +3173,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
error = mnt_want_write(new_path.mnt);
if (error)
goto out_dput;
@@ -62100,7 +62054,7 @@ index 9680cef..36c9152 100644
dput(new_dentry);
mutex_unlock(&new_path.dentry->d_inode->i_mutex);
path_put(&new_path);
-@@ -3208,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3215,6 +3424,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
if (new_dentry == trap)
goto exit5;
@@ -62113,7 +62067,7 @@ index 9680cef..36c9152 100644
error = mnt_want_write(oldnd.path.mnt);
if (error)
goto exit5;
-@@ -3217,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3224,6 +3439,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
goto exit6;
error = vfs_rename(old_dir->d_inode, old_dentry,
new_dir->d_inode, new_dentry);
@@ -62123,7 +62077,7 @@ index 9680cef..36c9152 100644
exit6:
mnt_drop_write(oldnd.path.mnt);
exit5:
-@@ -3242,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -3249,6 +3467,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
@@ -62132,7 +62086,7 @@ index 9680cef..36c9152 100644
int len;
len = PTR_ERR(link);
-@@ -3251,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -3258,7 +3478,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
len = strlen(link);
if (len > (unsigned) buflen)
len = buflen;
@@ -62355,7 +62309,7 @@ index b78b5b6..c64d84f 100644
void nfs_fattr_init(struct nfs_fattr *fattr)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index c4a2a68..ec7ff6e 100644
+index 61a1303..3e0034a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1037,7 +1037,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
@@ -62476,10 +62430,10 @@ index c45a2ea..1a6bd66 100644
#ifdef CONFIG_PROC_FS
static int create_proc_exports_entry(void)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index 11e1888..216bf2f 100644
+index e2e7914..f057f88 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
-@@ -957,7 +957,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+@@ -960,7 +960,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
} else {
oldfs = get_fs();
set_fs(KERNEL_DS);
@@ -62488,7 +62442,7 @@ index 11e1888..216bf2f 100644
set_fs(oldfs);
}
-@@ -1061,7 +1061,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+@@ -1064,7 +1064,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
/* Write the data. */
oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -62497,7 +62451,7 @@ index 11e1888..216bf2f 100644
set_fs(oldfs);
if (host_err < 0)
goto out_nfserr;
-@@ -1602,7 +1602,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
+@@ -1605,7 +1605,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
*/
oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -78989,7 +78943,7 @@ index 7408af8..8d6f9dd 100644
#ifdef CONFIG_CPU_IDLE
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index 4f7a632..b9e6f95 100644
+index 4f7a6323..b9e6f95 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -117,17 +117,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
@@ -81204,10 +81158,10 @@ index e2e1ab5..1e1e417 100644
irq_flow_handler_t handle_irq;
#ifdef CONFIG_IRQ_PREFLOW_FASTEOI
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
-index f5df3dc..116cbeb 100644
+index f4e8578..cbfc9fc 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
-@@ -295,9 +295,9 @@ extern unsigned long preset_lpj;
+@@ -283,9 +283,9 @@ extern unsigned long preset_lpj;
*/
extern unsigned int jiffies_to_msecs(const unsigned long j);
extern unsigned int jiffies_to_usecs(const unsigned long j);
@@ -85502,7 +85456,7 @@ index 3702939..cf9e78e 100644
extern int __rtnl_link_register(struct rtnl_link_ops *ops);
extern void __rtnl_link_unregister(struct rtnl_link_ops *ops);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index ad03988..0c5a964 100644
+index e0f1c91..c73f85c 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -318,9 +318,9 @@ do { \
@@ -85519,7 +85473,7 @@ index ad03988..0c5a964 100644
#define SCTP_DISABLE_DEBUG
#define SCTP_ASSERT(expr, str, func)
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
-index 9148632..be3c5ac 100644
+index 4d1be75..a54d29e 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -86,7 +86,7 @@ typedef void (sctp_timer_event_t) (unsigned long);
@@ -86297,10 +86251,10 @@ index 0993a22..32ba2fe 100644
void *pmi_pal;
u8 *vbe_state_orig; /*
diff --git a/init/Kconfig b/init/Kconfig
-index 43298f9..7e4816c 100644
+index b8dc1de..e4ce6c6 100644
--- a/init/Kconfig
+++ b/init/Kconfig
-@@ -1214,7 +1214,7 @@ config SLUB_DEBUG
+@@ -1215,7 +1215,7 @@ config SLUB_DEBUG
config COMPAT_BRK
bool "Disable heap randomization"
@@ -86309,7 +86263,7 @@ index 43298f9..7e4816c 100644
help
Randomizing heap placement makes heap exploits harder, but it
also breaks ancient binaries (including anything libc5 based).
-@@ -1397,7 +1397,7 @@ config INIT_ALL_POSSIBLE
+@@ -1398,7 +1398,7 @@ config INIT_ALL_POSSIBLE
config STOP_MACHINE
bool
default y
@@ -87325,10 +87279,10 @@ index b463871..59495fd 100644
* nsown_capable - Check superior capability to one's own user_ns
* @cap: The capability in question
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 93fc15e..94e383a 100644
+index ffcf896..a88b61f 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
-@@ -4750,6 +4750,14 @@ static void cgroup_release_agent(struct work_struct *work)
+@@ -4755,6 +4755,14 @@ static void cgroup_release_agent(struct work_struct *work)
release_list);
list_del_init(&cgrp->release_list);
raw_spin_unlock(&release_list_lock);
@@ -87343,7 +87297,7 @@ index 93fc15e..94e383a 100644
pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (!pathbuf)
goto continue_free;
-@@ -5169,7 +5177,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
+@@ -5174,7 +5182,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
struct css_set *cg = link->cg;
struct task_struct *task;
int count = 0;
@@ -87767,7 +87721,7 @@ index 63786e7..0780cac 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 14c111c..98d977c 100644
+index 4a14895..e44008c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -145,8 +145,15 @@ static struct srcu_struct pmus_srcu;
@@ -87796,7 +87750,7 @@ index 14c111c..98d977c 100644
static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
enum event_type_t event_type);
-@@ -2589,7 +2596,7 @@ static void __perf_event_read(void *info)
+@@ -2599,7 +2606,7 @@ static void __perf_event_read(void *info)
static inline u64 perf_event_count(struct perf_event *event)
{
@@ -87805,7 +87759,7 @@ index 14c111c..98d977c 100644
}
static u64 perf_event_read(struct perf_event *event)
-@@ -3132,9 +3139,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3142,9 +3149,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
mutex_lock(&event->child_mutex);
total += perf_event_read(event);
*enabled += event->total_time_enabled +
@@ -87817,7 +87771,7 @@ index 14c111c..98d977c 100644
list_for_each_entry(child, &event->child_list, child_list) {
total += perf_event_read(child);
-@@ -3526,10 +3533,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -3536,10 +3543,10 @@ void perf_event_update_userpage(struct perf_event *event)
userpg->offset -= local64_read(&event->hw.prev_count);
userpg->time_enabled = enabled +
@@ -87830,7 +87784,7 @@ index 14c111c..98d977c 100644
barrier();
++userpg->lock;
-@@ -4037,11 +4044,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4047,11 +4054,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -87844,7 +87798,7 @@ index 14c111c..98d977c 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -4692,12 +4699,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+@@ -4702,12 +4709,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
* need to add enough zero bytes after the string to handle
* the 64bit alignment we do later.
*/
@@ -87859,7 +87813,7 @@ index 14c111c..98d977c 100644
if (IS_ERR(name)) {
name = strncpy(tmp, "//toolong", sizeof(tmp));
goto got_name;
-@@ -6063,7 +6070,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6073,7 +6080,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(current->nsproxy->pid_ns);
@@ -87868,7 +87822,7 @@ index 14c111c..98d977c 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -6309,6 +6316,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -6319,6 +6326,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -87880,7 +87834,7 @@ index 14c111c..98d977c 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -6607,10 +6619,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -6617,10 +6629,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -87894,18 +87848,6 @@ index 14c111c..98d977c 100644
&parent_event->child_total_time_running);
/*
-@@ -7071,8 +7083,10 @@ int perf_event_init_task(struct task_struct *child)
-
- for_each_task_context_nr(ctxn) {
- ret = perf_event_init_context(child, ctxn);
-- if (ret)
-+ if (ret) {
-+ perf_event_free_task(child);
- return ret;
-+ }
- }
-
- return 0;
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index a2101bb..f2e0354 100644
--- a/kernel/events/internal.h
@@ -88037,7 +87979,7 @@ index fde15f9..99f1b97 100644
{
struct signal_struct *sig = current->signal;
diff --git a/kernel/fork.c b/kernel/fork.c
-index 13bba30..ee14dbd 100644
+index 29b4604..ee14dbd 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -34,6 +34,7 @@
@@ -88479,15 +88421,6 @@ index 13bba30..ee14dbd 100644
goto bad_fork_free;
}
current->flags &= ~PF_NPROC_EXCEEDED;
-@@ -1221,7 +1345,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- goto bad_fork_cleanup_policy;
- retval = audit_alloc(p);
- if (retval)
-- goto bad_fork_cleanup_policy;
-+ goto bad_fork_cleanup_perf;
- /* copy all the process information */
- retval = copy_semundo(clone_flags, p);
- if (retval)
@@ -1341,6 +1465,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
goto bad_fork_free_pid;
}
@@ -88500,18 +88433,7 @@ index 13bba30..ee14dbd 100644
if (clone_flags & CLONE_THREAD) {
current->signal->nr_threads++;
atomic_inc(&current->signal->live);
-@@ -1406,8 +1535,9 @@ bad_fork_cleanup_semundo:
- exit_sem(p);
- bad_fork_cleanup_audit:
- audit_free(p);
--bad_fork_cleanup_policy:
-+bad_fork_cleanup_perf:
- perf_event_free_task(p);
-+bad_fork_cleanup_policy:
- #ifdef CONFIG_NUMA
- mpol_put(p->mempolicy);
- bad_fork_cleanup_cgroup:
-@@ -1423,6 +1553,8 @@ bad_fork_cleanup_count:
+@@ -1424,6 +1553,8 @@ bad_fork_cleanup_count:
bad_fork_free:
free_task(p);
fork_out:
@@ -88520,7 +88442,7 @@ index 13bba30..ee14dbd 100644
return ERR_PTR(retval);
}
-@@ -1509,6 +1641,7 @@ long do_fork(unsigned long clone_flags,
+@@ -1510,6 +1641,7 @@ long do_fork(unsigned long clone_flags,
p = copy_process(clone_flags, stack_start, regs, stack_size,
child_tidptr, NULL, trace);
@@ -88528,7 +88450,7 @@ index 13bba30..ee14dbd 100644
/*
* Do this prior waking up the new thread - the thread pointer
* might get invalid after that point, if the thread exits quickly.
-@@ -1525,6 +1658,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1526,6 +1658,8 @@ long do_fork(unsigned long clone_flags,
if (clone_flags & CLONE_PARENT_SETTID)
put_user(nr, parent_tidptr);
@@ -88537,7 +88459,7 @@ index 13bba30..ee14dbd 100644
if (clone_flags & CLONE_VFORK) {
p->vfork_done = &vfork;
init_completion(&vfork);
-@@ -1597,7 +1732,7 @@ void __init proc_caches_init(void)
+@@ -1598,7 +1732,7 @@ void __init proc_caches_init(void)
mm_cachep = kmem_cache_create("mm_struct",
sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
@@ -88546,7 +88468,7 @@ index 13bba30..ee14dbd 100644
mmap_init();
nsproxy_cache_init();
}
-@@ -1636,7 +1771,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1637,7 +1771,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
return 0;
/* don't need lock here; in the worst case we'll do useless copy */
@@ -88555,7 +88477,7 @@ index 13bba30..ee14dbd 100644
return 0;
*new_fsp = copy_fs_struct(fs);
-@@ -1725,7 +1860,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1726,7 +1860,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
fs = current->fs;
spin_lock(&fs->lock);
current->fs = new_fs;
@@ -88566,7 +88488,7 @@ index 13bba30..ee14dbd 100644
else
new_fs = fs;
diff --git a/kernel/futex.c b/kernel/futex.c
-index 1bb37d0..8d00f9b 100644
+index f31f190..8d00f9b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -54,6 +54,7 @@
@@ -88625,15 +88547,7 @@ index 1bb37d0..8d00f9b 100644
pagefault_disable();
ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -2460,6 +2468,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
- * shared futexes. We need to compare the keys:
- */
- if (match_futex(&q.key, &key2)) {
-+ queue_unlock(&q, hb);
- ret = -EINVAL;
- goto out_put_keys;
- }
-@@ -2877,6 +2886,7 @@ static int __init futex_init(void)
+@@ -2878,6 +2886,7 @@ static int __init futex_init(void)
{
u32 curval;
int i;
@@ -88641,7 +88555,7 @@ index 1bb37d0..8d00f9b 100644
/*
* This will fail and we want it. Some arch implementations do
-@@ -2888,8 +2898,11 @@ static int __init futex_init(void)
+@@ -2889,8 +2898,11 @@ static int __init futex_init(void)
* implementation, the non-functional ones will return
* -ENOSYS.
*/
@@ -93069,7 +92983,7 @@ index e660464..c8b9e67 100644
return cmd_attr_register_cpumask(info);
else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
diff --git a/kernel/time.c b/kernel/time.c
-index 73e416d..cfc6f69 100644
+index 060f961..fe7a19e 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
@@ -93085,82 +92999,10 @@ index 73e416d..cfc6f69 100644
sys_tz = *tz;
update_vsyscall_tz();
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
-index eb198a3..42f27b5 100644
+index 7eaf162..e2615e7 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
-@@ -442,18 +442,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
- static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
- ktime_t now)
- {
-+ unsigned long flags;
- struct k_itimer *ptr = container_of(alarm, struct k_itimer,
- it.alarm.alarmtimer);
-- if (posix_timer_event(ptr, 0) != 0)
-- ptr->it_overrun++;
-+ enum alarmtimer_restart result = ALARMTIMER_NORESTART;
-+
-+ spin_lock_irqsave(&ptr->it_lock, flags);
-+ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
-+ if (posix_timer_event(ptr, 0) != 0)
-+ ptr->it_overrun++;
-+ }
-
- /* Re-add periodic timers */
- if (ptr->it.alarm.interval.tv64) {
- ptr->it_overrun += alarm_forward(alarm, now,
- ptr->it.alarm.interval);
-- return ALARMTIMER_RESTART;
-+ result = ALARMTIMER_RESTART;
- }
-- return ALARMTIMER_NORESTART;
-+ spin_unlock_irqrestore(&ptr->it_lock, flags);
-+
-+ return result;
- }
-
- /**
-@@ -514,23 +522,33 @@ static int alarm_timer_create(struct k_itimer *new_timer)
- return 0;
- }
-
-+static ktime_t alarm_expires_remaining(const struct alarm *alarm)
-+{
-+ struct alarm_base *base = &alarm_bases[alarm->type];
-+ return ktime_sub(alarm->node.expires, base->gettime());
-+}
-+
- /**
- * alarm_timer_get - posix timer_get interface
- * @new_timer: k_itimer pointer
- * @cur_setting: itimerspec data to fill
- *
-- * Copies the itimerspec data out from the k_itimer
-+ * Copies out the current itimerspec data
- */
- static void alarm_timer_get(struct k_itimer *timr,
- struct itimerspec *cur_setting)
- {
-- memset(cur_setting, 0, sizeof(struct itimerspec));
-+ ktime_t relative_expiry_time =
-+ alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
-
-- cur_setting->it_interval =
-- ktime_to_timespec(timr->it.alarm.interval);
-- cur_setting->it_value =
-- ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
-- return;
-+ if (ktime_to_ns(relative_expiry_time) > 0) {
-+ cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
-+ } else {
-+ cur_setting->it_value.tv_sec = 0;
-+ cur_setting->it_value.tv_nsec = 0;
-+ }
-+
-+ cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
- }
-
- /**
-@@ -789,7 +807,7 @@ static int __init alarmtimer_init(void)
+@@ -807,7 +807,7 @@ static int __init alarmtimer_init(void)
struct platform_device *pdev;
int error = 0;
int i;
@@ -93445,7 +93287,7 @@ index dcbafed..9feb3de 100644
ftrace_graph_active++;
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 4babd77..3e869fd 100644
+index b252661..45b218f 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -376,9 +376,9 @@ struct buffer_data_page {
@@ -93963,6 +93805,82 @@ index c5b20a3..6b38c73 100644
return;
local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 7c75bbb..f32b331 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -309,7 +309,7 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int syscall_nr;
+
+ syscall_nr = syscall_get_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_enter_syscalls))
+ return;
+@@ -349,7 +349,7 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int syscall_nr;
+
+ syscall_nr = syscall_get_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_exit_syscalls))
+ return;
+@@ -519,6 +519,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = syscall_get_nr(current, regs);
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++ return;
+ if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ return;
+
+@@ -554,6 +556,8 @@ int perf_sysenter_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_enter)
+@@ -574,6 +578,8 @@ void perf_sysenter_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_enter--;
+@@ -593,6 +599,8 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int size;
+
+ syscall_nr = syscall_get_nr(current, regs);
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++ return;
+ if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ return;
+
+@@ -630,6 +638,8 @@ int perf_sysexit_enable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return -EINVAL;
+
+ mutex_lock(&syscall_trace_lock);
+ if (!sys_perf_refcount_exit)
+@@ -650,6 +660,8 @@ void perf_sysexit_disable(struct ftrace_event_call *call)
+ int num;
+
+ num = ((struct syscall_metadata *)call->data)->syscall_nr;
++ if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++ return;
+
+ mutex_lock(&syscall_trace_lock);
+ sys_perf_refcount_exit--;
diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
index 209b379..7f76423 100644
--- a/kernel/trace/trace_workqueue.c
@@ -96613,23 +96531,10 @@ index a72fa33..0b12a09 100644
err = -EPERM;
goto out;
diff --git a/mm/migrate.c b/mm/migrate.c
-index 09d6a9d..e2941874 100644
+index 7d26ea5..e2941874 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
-@@ -141,8 +141,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
-
- get_page(new);
- pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
-+
-+ /* Recheck VMA as permissions can change since migration started */
- if (is_write_migration_entry(entry))
-- pte = pte_mkwrite(pte);
-+ pte = maybe_mkwrite(pte, vma);
-+
- #ifdef CONFIG_HUGETLB_PAGE
- if (PageHuge(new))
- pte = pte_mkhuge(pte);
-@@ -1389,6 +1392,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1392,6 +1392,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
if (!mm)
return -EINVAL;
@@ -96644,7 +96549,7 @@ index 09d6a9d..e2941874 100644
/*
* Check if this process has the right to modify the specified
* process. The right exists if the process has administrative
-@@ -1398,8 +1409,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1401,8 +1409,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
rcu_read_lock();
tcred = __task_cred(task);
if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
@@ -98835,7 +98740,7 @@ index 62a7fa23..aaa6823 100644
if (order && (gfp_flags & __GFP_COMP))
prep_compound_page(page, order);
diff --git a/mm/percpu.c b/mm/percpu.c
-index 5c29750..99f6386 100644
+index e29a1c4..e7f90f0 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
@@ -99040,7 +98945,7 @@ index f3f6fd3..0d91a63 100644
/*
diff --git a/mm/shmem.c b/mm/shmem.c
-index 1371021..7104960 100644
+index 83efac6..7104960 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -31,7 +31,7 @@
@@ -99061,19 +98966,7 @@ index 1371021..7104960 100644
/*
* vmtruncate_range() communicates with shmem_fault via
-@@ -1719,8 +1719,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct
-
- if (new_dentry->d_inode) {
- (void) shmem_unlink(new_dir, new_dentry);
-- if (they_are_dirs)
-+ if (they_are_dirs) {
-+ drop_nlink(new_dentry->d_inode);
- drop_nlink(old_dir);
-+ }
- } else if (they_are_dirs) {
- drop_nlink(old_dir);
- inc_nlink(new_dir);
-@@ -1924,6 +1926,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+@@ -1926,6 +1926,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
static int shmem_xattr_validate(const char *name)
{
struct { const char *prefix; size_t len; } arr[] = {
@@ -99085,7 +98978,7 @@ index 1371021..7104960 100644
{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
};
-@@ -1977,6 +1984,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
+@@ -1979,6 +1984,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
if (err)
return err;
@@ -99101,7 +98994,7 @@ index 1371021..7104960 100644
if (size == 0)
value = ""; /* empty EA, do not remove */
-@@ -2310,8 +2326,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2312,8 +2326,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
int err = -ENOMEM;
/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -101690,360 +101583,6 @@ index ba873c3..3b00036 100644
if (!can_dir) {
printk(KERN_INFO "can: failed to create /proc/net/can . "
-diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
-index 1587dc6..9898d1f 100644
---- a/net/ceph/auth_x.c
-+++ b/net/ceph/auth_x.c
-@@ -13,8 +13,6 @@
- #include "auth_x.h"
- #include "auth_x_protocol.h"
-
--#define TEMP_TICKET_BUF_LEN 256
--
- static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
-
- static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
-@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
- }
-
- static int ceph_x_decrypt(struct ceph_crypto_key *secret,
-- void **p, void *end, void *obuf, size_t olen)
-+ void **p, void *end, void **obuf, size_t olen)
- {
- struct ceph_x_encrypt_header head;
- size_t head_len = sizeof(head);
-@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
- return -EINVAL;
-
- dout("ceph_x_decrypt len %d\n", len);
-- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
-- *p, len);
-+ if (*obuf == NULL) {
-+ *obuf = kmalloc(len, GFP_NOFS);
-+ if (!*obuf)
-+ return -ENOMEM;
-+ olen = len;
-+ }
-+
-+ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
- if (ret)
- return ret;
- if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
-@@ -129,145 +133,154 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
- kfree(th);
- }
-
-+static int process_one_ticket(struct ceph_auth_client *ac,
-+ struct ceph_crypto_key *secret,
-+ void **p, void *end)
-+{
-+ struct ceph_x_info *xi = ac->private;
-+ int type;
-+ u8 tkt_struct_v, blob_struct_v;
-+ struct ceph_x_ticket_handler *th;
-+ void *dbuf = NULL;
-+ void *dp, *dend;
-+ int dlen;
-+ char is_enc;
-+ struct timespec validity;
-+ struct ceph_crypto_key old_key;
-+ void *ticket_buf = NULL;
-+ void *tp, *tpend;
-+ struct ceph_timespec new_validity;
-+ struct ceph_crypto_key new_session_key;
-+ struct ceph_buffer *new_ticket_blob;
-+ unsigned long new_expires, new_renew_after;
-+ u64 new_secret_id;
-+ int ret;
-+
-+ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
-+
-+ type = ceph_decode_32(p);
-+ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
-+
-+ tkt_struct_v = ceph_decode_8(p);
-+ if (tkt_struct_v != 1)
-+ goto bad;
-+
-+ th = get_ticket_handler(ac, type);
-+ if (IS_ERR(th)) {
-+ ret = PTR_ERR(th);
-+ goto out;
-+ }
-+
-+ /* blob for me */
-+ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
-+ if (dlen <= 0) {
-+ ret = dlen;
-+ goto out;
-+ }
-+ dout(" decrypted %d bytes\n", dlen);
-+ dp = dbuf;
-+ dend = dp + dlen;
-+
-+ tkt_struct_v = ceph_decode_8(&dp);
-+ if (tkt_struct_v != 1)
-+ goto bad;
-+
-+ memcpy(&old_key, &th->session_key, sizeof(old_key));
-+ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
-+ if (ret)
-+ goto out;
-+
-+ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
-+ ceph_decode_timespec(&validity, &new_validity);
-+ new_expires = get_seconds() + validity.tv_sec;
-+ new_renew_after = new_expires - (validity.tv_sec / 4);
-+ dout(" expires=%lu renew_after=%lu\n", new_expires,
-+ new_renew_after);
-+
-+ /* ticket blob for service */
-+ ceph_decode_8_safe(p, end, is_enc, bad);
-+ if (is_enc) {
-+ /* encrypted */
-+ dout(" encrypted ticket\n");
-+ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
-+ if (dlen < 0) {
-+ ret = dlen;
-+ goto out;
-+ }
-+ tp = ticket_buf;
-+ dlen = ceph_decode_32(&tp);
-+ } else {
-+ /* unencrypted */
-+ ceph_decode_32_safe(p, end, dlen, bad);
-+ ticket_buf = kmalloc(dlen, GFP_NOFS);
-+ if (!ticket_buf) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
-+ tp = ticket_buf;
-+ ceph_decode_need(p, end, dlen, bad);
-+ ceph_decode_copy(p, ticket_buf, dlen);
-+ }
-+ tpend = tp + dlen;
-+ dout(" ticket blob is %d bytes\n", dlen);
-+ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
-+ blob_struct_v = ceph_decode_8(&tp);
-+ new_secret_id = ceph_decode_64(&tp);
-+ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
-+ if (ret)
-+ goto out;
-+
-+ /* all is well, update our ticket */
-+ ceph_crypto_key_destroy(&th->session_key);
-+ if (th->ticket_blob)
-+ ceph_buffer_put(th->ticket_blob);
-+ th->session_key = new_session_key;
-+ th->ticket_blob = new_ticket_blob;
-+ th->validity = new_validity;
-+ th->secret_id = new_secret_id;
-+ th->expires = new_expires;
-+ th->renew_after = new_renew_after;
-+ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
-+ type, ceph_entity_type_name(type), th->secret_id,
-+ (int)th->ticket_blob->vec.iov_len);
-+ xi->have_keys |= th->service;
-+
-+out:
-+ kfree(ticket_buf);
-+ kfree(dbuf);
-+ return ret;
-+
-+bad:
-+ ret = -EINVAL;
-+ goto out;
-+}
-+
- static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
- struct ceph_crypto_key *secret,
- void *buf, void *end)
- {
-- struct ceph_x_info *xi = ac->private;
-- int num;
- void *p = buf;
-- int ret;
-- char *dbuf;
-- char *ticket_buf;
- u8 reply_struct_v;
-+ u32 num;
-+ int ret;
-
-- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
-- if (!dbuf)
-- return -ENOMEM;
--
-- ret = -ENOMEM;
-- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
-- if (!ticket_buf)
-- goto out_dbuf;
--
-- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
-- reply_struct_v = ceph_decode_8(&p);
-+ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
- if (reply_struct_v != 1)
-- goto bad;
-- num = ceph_decode_32(&p);
-+ return -EINVAL;
-+
-+ ceph_decode_32_safe(&p, end, num, bad);
- dout("%d tickets\n", num);
-+
- while (num--) {
-- int type;
-- u8 tkt_struct_v, blob_struct_v;
-- struct ceph_x_ticket_handler *th;
-- void *dp, *dend;
-- int dlen;
-- char is_enc;
-- struct timespec validity;
-- struct ceph_crypto_key old_key;
-- void *tp, *tpend;
-- struct ceph_timespec new_validity;
-- struct ceph_crypto_key new_session_key;
-- struct ceph_buffer *new_ticket_blob;
-- unsigned long new_expires, new_renew_after;
-- u64 new_secret_id;
--
-- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
--
-- type = ceph_decode_32(&p);
-- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
--
-- tkt_struct_v = ceph_decode_8(&p);
-- if (tkt_struct_v != 1)
-- goto bad;
--
-- th = get_ticket_handler(ac, type);
-- if (IS_ERR(th)) {
-- ret = PTR_ERR(th);
-- goto out;
-- }
--
-- /* blob for me */
-- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
-- TEMP_TICKET_BUF_LEN);
-- if (dlen <= 0) {
-- ret = dlen;
-- goto out;
-- }
-- dout(" decrypted %d bytes\n", dlen);
-- dend = dbuf + dlen;
-- dp = dbuf;
--
-- tkt_struct_v = ceph_decode_8(&dp);
-- if (tkt_struct_v != 1)
-- goto bad;
--
-- memcpy(&old_key, &th->session_key, sizeof(old_key));
-- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
-+ ret = process_one_ticket(ac, secret, &p, end);
- if (ret)
-- goto out;
--
-- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
-- ceph_decode_timespec(&validity, &new_validity);
-- new_expires = get_seconds() + validity.tv_sec;
-- new_renew_after = new_expires - (validity.tv_sec / 4);
-- dout(" expires=%lu renew_after=%lu\n", new_expires,
-- new_renew_after);
--
-- /* ticket blob for service */
-- ceph_decode_8_safe(&p, end, is_enc, bad);
-- tp = ticket_buf;
-- if (is_enc) {
-- /* encrypted */
-- dout(" encrypted ticket\n");
-- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
-- TEMP_TICKET_BUF_LEN);
-- if (dlen < 0) {
-- ret = dlen;
-- goto out;
-- }
-- dlen = ceph_decode_32(&tp);
-- } else {
-- /* unencrypted */
-- ceph_decode_32_safe(&p, end, dlen, bad);
-- ceph_decode_need(&p, end, dlen, bad);
-- ceph_decode_copy(&p, ticket_buf, dlen);
-- }
-- tpend = tp + dlen;
-- dout(" ticket blob is %d bytes\n", dlen);
-- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
-- blob_struct_v = ceph_decode_8(&tp);
-- new_secret_id = ceph_decode_64(&tp);
-- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
-- if (ret)
-- goto out;
--
-- /* all is well, update our ticket */
-- ceph_crypto_key_destroy(&th->session_key);
-- if (th->ticket_blob)
-- ceph_buffer_put(th->ticket_blob);
-- th->session_key = new_session_key;
-- th->ticket_blob = new_ticket_blob;
-- th->validity = new_validity;
-- th->secret_id = new_secret_id;
-- th->expires = new_expires;
-- th->renew_after = new_renew_after;
-- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
-- type, ceph_entity_type_name(type), th->secret_id,
-- (int)th->ticket_blob->vec.iov_len);
-- xi->have_keys |= th->service;
-+ return ret;
- }
-
-- ret = 0;
--out:
-- kfree(ticket_buf);
--out_dbuf:
-- kfree(dbuf);
-- return ret;
-+ return 0;
-
- bad:
-- ret = -EINVAL;
-- goto out;
-+ return -EINVAL;
- }
-
- static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
-@@ -563,13 +576,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
- struct ceph_x_ticket_handler *th;
- int ret = 0;
- struct ceph_x_authorize_reply reply;
-+ void *preply = &reply;
- void *p = au->reply_buf;
- void *end = p + sizeof(au->reply_buf);
-
- th = get_ticket_handler(ac, au->service);
- if (IS_ERR(th))
- return PTR_ERR(th);
-- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
-+ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
- if (ret < 0)
- return ret;
- if (ret != sizeof(reply))
-diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
-index 0b62dea..c2b8d20 100644
---- a/net/ceph/mon_client.c
-+++ b/net/ceph/mon_client.c
-@@ -987,7 +987,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
- if (!m) {
- pr_info("alloc_msg unknown type %d\n", type);
- *skip = 1;
-+ } else if (front_len > m->front_max) {
-+ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
-+ front_len, m->front_max,
-+ (unsigned int)con->peer_name.type,
-+ le64_to_cpu(con->peer_name.num));
-+ ceph_msg_put(m);
-+ m = ceph_msg_new(type, front_len, GFP_NOFS, false);
- }
-+
- return m;
- }
-
diff --git a/net/compat.c b/net/compat.c
index 759e542..7cf6606 100644
--- a/net/compat.c
@@ -103817,10 +103356,10 @@ index 75fea1f..a26be5a 100644
.exit = raw_exit_net,
};
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index d361dc0..a814666 100644
+index 8e79a9e..3767dfd 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
-@@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
+@@ -316,7 +316,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
static inline int rt_genid(struct net *net)
{
@@ -103829,7 +103368,7 @@ index d361dc0..a814666 100644
}
#ifdef CONFIG_PROC_FS
-@@ -551,7 +551,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
+@@ -554,7 +554,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
static int rt_cpu_seq_open(struct inode *inode, struct file *file)
{
@@ -103838,7 +103377,7 @@ index d361dc0..a814666 100644
}
static const struct file_operations rt_cpu_seq_fops = {
-@@ -589,7 +589,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
+@@ -592,7 +592,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
static int rt_acct_proc_open(struct inode *inode, struct file *file)
{
@@ -103847,7 +103386,7 @@ index d361dc0..a814666 100644
}
static const struct file_operations rt_acct_proc_fops = {
-@@ -641,7 +641,7 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
+@@ -644,7 +644,7 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
#endif
}
@@ -103856,7 +103395,7 @@ index d361dc0..a814666 100644
.init = ip_rt_do_proc_init,
.exit = ip_rt_do_proc_exit,
};
-@@ -937,7 +937,7 @@ static void rt_cache_invalidate(struct net *net)
+@@ -940,7 +940,7 @@ static void rt_cache_invalidate(struct net *net)
unsigned char shuffle;
get_random_bytes(&shuffle, sizeof(shuffle));
@@ -103865,7 +103404,7 @@ index d361dc0..a814666 100644
redirect_genid++;
inetpeer_invalidate_tree(AF_INET);
}
-@@ -1346,11 +1346,11 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+@@ -1372,11 +1372,11 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
#define IP_IDENTS_SZ 2048u
struct ip_ident_bucket {
@@ -103879,7 +103418,7 @@ index d361dc0..a814666 100644
/* In order to protect privacy, we add a perturbation to identifiers
* if one generator is seldom used. This makes hard for an attacker
-@@ -1370,7 +1370,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
+@@ -1396,7 +1396,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
delta = (u32)(x >> 32);
}
@@ -103888,7 +103427,7 @@ index d361dc0..a814666 100644
}
EXPORT_SYMBOL(ip_idents_reserve);
-@@ -3228,7 +3228,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
+@@ -3254,7 +3254,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
{
if (write) {
int flush_delay;
@@ -103897,7 +103436,7 @@ index d361dc0..a814666 100644
struct net *net;
memcpy(&ctl, __ctl, sizeof(ctl));
-@@ -3377,6 +3377,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -3403,6 +3403,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
.maxlen = sizeof(int),
.mode = 0200,
.proc_handler = ipv4_sysctl_rtcache_flush,
@@ -103905,7 +103444,7 @@ index d361dc0..a814666 100644
},
{ },
};
-@@ -3390,25 +3391,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
+@@ -3416,25 +3417,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
static __net_init int sysctl_route_net_init(struct net *net)
{
@@ -103938,7 +103477,7 @@ index d361dc0..a814666 100644
err_dup:
return -ENOMEM;
}
-@@ -3423,7 +3422,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
+@@ -3449,7 +3448,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
kfree(tbl);
}
@@ -103947,7 +103486,7 @@ index d361dc0..a814666 100644
.init = sysctl_route_net_init,
.exit = sysctl_route_net_exit,
};
-@@ -3438,7 +3437,7 @@ static __net_init int rt_genid_init(struct net *net)
+@@ -3464,7 +3463,7 @@ static __net_init int rt_genid_init(struct net *net)
return 0;
}
@@ -103956,7 +103495,7 @@ index d361dc0..a814666 100644
.init = rt_genid_init,
};
-@@ -3461,11 +3460,7 @@ int __init ip_rt_init(void)
+@@ -3487,11 +3486,7 @@ int __init ip_rt_init(void)
{
int rc = 0;
@@ -104613,7 +104152,7 @@ index a0b4c5d..a5818a1 100644
}
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index b9edff0..63ad6cf 100644
+index 3afdd78..cf4a70f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2160,7 +2160,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
@@ -104625,7 +104164,7 @@ index b9edff0..63ad6cf 100644
if (ops->ndo_do_ioctl) {
mm_segment_t oldfs = get_fs();
-@@ -3227,16 +3227,23 @@ static const struct file_operations if6_fops = {
+@@ -3237,16 +3237,23 @@ static const struct file_operations if6_fops = {
.release = seq_release_net,
};
@@ -105155,7 +104694,7 @@ index c69358c..d1e5855 100644
static int tcp6_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index f8bec1e..e2c60f8 100644
+index d131a95..e2c60f8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -50,6 +50,10 @@
@@ -105206,15 +104745,6 @@ index f8bec1e..e2c60f8 100644
bh_unlock_sock(sk);
sock_put(sk);
goto discard;
-@@ -1362,7 +1369,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
- fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
- fptr->nexthdr = nexthdr;
- fptr->reserved = 0;
-- ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-+ fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-
- /* Fragment the skb. ipv6 header and the remaining fields of the
- * fragment header are updated in ipv6_gso_segment()
@@ -1409,8 +1416,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
0, 0L, 0,
sock_i_uid(sp), 0,
@@ -105831,7 +105361,7 @@ index e13095d..6617217 100644
[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
-index 29fa5ba..8debc79 100644
+index 6422845..2c19968 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
@@ -105843,7 +105373,7 @@ index 29fa5ba..8debc79 100644
if (cp->protocol != IPPROTO_UDP)
conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
/* Bind with the destination and its corresponding transmitter */
-@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
+@@ -868,7 +868,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
atomic_set(&cp->refcnt, 1);
atomic_set(&cp->n_control, 0);
@@ -105852,7 +105382,7 @@ index 29fa5ba..8debc79 100644
atomic_inc(&ipvs->conn_count);
if (flags & IP_VS_CONN_F_NO_CPORT)
-@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
+@@ -1148,7 +1148,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
/* Don't drop the entry if its number of incoming packets is not
located in [0, 8] */
diff --git a/3.2.63/4425_grsec_remove_EI_PAX.patch b/3.2.64/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.63/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.64/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.63/4427_force_XATTR_PAX_tmpfs.patch b/3.2.64/4427_force_XATTR_PAX_tmpfs.patch
index caaeed1..caaeed1 100644
--- a/3.2.63/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.64/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.63/4430_grsec-remove-localversion-grsec.patch b/3.2.64/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.63/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.64/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.63/4435_grsec-mute-warnings.patch b/3.2.64/4435_grsec-mute-warnings.patch
index da01ac7..da01ac7 100644
--- a/3.2.63/4435_grsec-mute-warnings.patch
+++ b/3.2.64/4435_grsec-mute-warnings.patch
diff --git a/3.2.63/4440_grsec-remove-protected-paths.patch b/3.2.64/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.63/4440_grsec-remove-protected-paths.patch
+++ b/3.2.64/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.63/4450_grsec-kconfig-default-gids.patch b/3.2.64/4450_grsec-kconfig-default-gids.patch
index b4a0e64..b4a0e64 100644
--- a/3.2.63/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.64/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.64/4465_selinux-avc_audit-log-curr_ip.patch
index ed1cb9b..ed1cb9b 100644
--- a/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.64/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.63/4470_disable-compat_vdso.patch b/3.2.64/4470_disable-compat_vdso.patch
index 42bc94d..42bc94d 100644
--- a/3.2.63/4470_disable-compat_vdso.patch
+++ b/3.2.64/4470_disable-compat_vdso.patch
diff --git a/3.2.63/4475_emutramp_default_on.patch b/3.2.64/4475_emutramp_default_on.patch
index 941870b..941870b 100644
--- a/3.2.63/4475_emutramp_default_on.patch
+++ b/3.2.64/4475_emutramp_default_on.patch