lkml.org 
[lkml]   [2015]   [Feb]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: [PATCH 3.2 000/152] 3.2.67-rc1 review
    From
    Date
    This is the combined patch for 3.2.67-rc1 relative to 3.2.66.

    Ben.

    --
    Ben Hutchings
    Never attribute to conspiracy what can adequately be explained by stupidity.
    diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
    index 1b196ea..f0001eb 100644
    --- a/Documentation/kernel-parameters.txt
    +++ b/Documentation/kernel-parameters.txt
    @@ -940,6 +940,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
    i8042.notimeout [HW] Ignore timeout condition signalled by conroller
    i8042.reset [HW] Reset the controller during init and cleanup
    i8042.unlock [HW] Unlock (ignore) the keylock
    + i8042.kbdreset [HW] Reset device connected to KBD port

    i810= [HW,DRM]

    diff --git a/Makefile b/Makefile
    index f08f8bf..3372480 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 3
    PATCHLEVEL = 2
    -SUBLEVEL = 66
    -EXTRAVERSION =
    +SUBLEVEL = 67
    +EXTRAVERSION = -rc1
    NAME = Saber-toothed Squirrel

    # *DOCUMENTATION*
    diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
    index fadd5f8..e576b91 100644
    --- a/arch/alpha/mm/fault.c
    +++ b/arch/alpha/mm/fault.c
    @@ -150,6 +150,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/arm/mach-omap2/omap_l3_noc.c b/arch/arm/mach-omap2/omap_l3_noc.c
    index d15225f..5b9631f 100644
    --- a/arch/arm/mach-omap2/omap_l3_noc.c
    +++ b/arch/arm/mach-omap2/omap_l3_noc.c
    @@ -121,11 +121,15 @@ static irqreturn_t l3_interrupt_handler(int irq, void *_l3)
    /* Nothing to be handled here as of now */
    break;
    }
    - /* Error found so break the for loop */
    - break;
    + /* Error found so break the for loop */
    + return IRQ_HANDLED;
    }
    }
    - return IRQ_HANDLED;
    +
    + dev_err(l3->dev, "L3 %s IRQ not handled!!\n",
    + inttype ? "debug" : "application");
    +
    + return IRQ_NONE;
    }

    static int __devinit omap4_l3_probe(struct platform_device *pdev)
    diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
    index f7040a1..632b649 100644
    --- a/arch/avr32/mm/fault.c
    +++ b/arch/avr32/mm/fault.c
    @@ -136,6 +136,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
    index 9dcac8e..280c8ea 100644
    --- a/arch/cris/mm/fault.c
    +++ b/arch/cris/mm/fault.c
    @@ -166,6 +166,8 @@ do_page_fault(unsigned long address, struct pt_regs *regs,
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
    index a325d57..46a3c18 100644
    --- a/arch/frv/mm/fault.c
    +++ b/arch/frv/mm/fault.c
    @@ -167,6 +167,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
    index 20b3593..1e362cd 100644
    --- a/arch/ia64/mm/fault.c
    +++ b/arch/ia64/mm/fault.c
    @@ -163,6 +163,8 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
    */
    if (fault & VM_FAULT_OOM) {
    goto out_of_memory;
    + } else if (fault & VM_FAULT_SIGSEGV) {
    + goto bad_area;
    } else if (fault & VM_FAULT_SIGBUS) {
    signal = SIGBUS;
    goto bad_area;
    diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
    index 2c9aeb4..beda9cc 100644
    --- a/arch/m32r/mm/fault.c
    +++ b/arch/m32r/mm/fault.c
    @@ -199,6 +199,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
    index 2db6099..d605b93 100644
    --- a/arch/m68k/mm/fault.c
    +++ b/arch/m68k/mm/fault.c
    @@ -147,6 +147,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto map_err;
    else if (fault & VM_FAULT_SIGBUS)
    goto bus_err;
    BUG();
    diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
    index ae97d2c..31bb381 100644
    --- a/arch/microblaze/mm/fault.c
    +++ b/arch/microblaze/mm/fault.c
    @@ -215,6 +215,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
    index 937cf33..b8314cfe 100644
    --- a/arch/mips/mm/fault.c
    +++ b/arch/mips/mm/fault.c
    @@ -149,6 +149,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
    index 0945409..fe2ceb7 100644
    --- a/arch/mn10300/mm/fault.c
    +++ b/arch/mn10300/mm/fault.c
    @@ -256,6 +256,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
    index a5dce82..162abfb 100644
    --- a/arch/openrisc/mm/fault.c
    +++ b/arch/openrisc/mm/fault.c
    @@ -163,6 +163,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
    index 18162ce..a9b765a 100644
    --- a/arch/parisc/mm/fault.c
    +++ b/arch/parisc/mm/fault.c
    @@ -210,6 +210,8 @@ good_area:
    */
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto bad_area;
    BUG();
    diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
    index 5efe8c9..7450843 100644
    --- a/arch/powerpc/mm/fault.c
    +++ b/arch/powerpc/mm/fault.c
    @@ -312,6 +312,8 @@ good_area:
    */
    ret = handle_mm_fault(mm, vma, address, is_write ? FAULT_FLAG_WRITE : 0);
    if (unlikely(ret & VM_FAULT_ERROR)) {
    + if (ret & VM_FAULT_SIGSEGV)
    + goto bad_area;
    if (ret & VM_FAULT_OOM)
    goto out_of_memory;
    else if (ret & VM_FAULT_SIGBUS)
    diff --git a/arch/powerpc/platforms/cell/spu_fault.c b/arch/powerpc/platforms/cell/spu_fault.c
    index 641e727..62f3e4e 100644
    --- a/arch/powerpc/platforms/cell/spu_fault.c
    +++ b/arch/powerpc/platforms/cell/spu_fault.c
    @@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
    if (*flt & VM_FAULT_OOM) {
    ret = -ENOMEM;
    goto out_unlock;
    - } else if (*flt & VM_FAULT_SIGBUS) {
    + } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
    ret = -EFAULT;
    goto out_unlock;
    }
    diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
    index 51fb1ef..05d08c8 100644
    --- a/arch/s390/crypto/aes_s390.c
    +++ b/arch/s390/crypto/aes_s390.c
    @@ -972,7 +972,7 @@ static void __exit aes_s390_fini(void)
    module_init(aes_s390_init);
    module_exit(aes_s390_fini);

    -MODULE_ALIAS("aes-all");
    +MODULE_ALIAS_CRYPTO("aes-all");

    MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
    MODULE_LICENSE("GPL");
    diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
    index 991fb7d..28e336a 100644
    --- a/arch/s390/crypto/des_s390.c
    +++ b/arch/s390/crypto/des_s390.c
    @@ -626,8 +626,8 @@ static void __exit des_s390_exit(void)
    module_init(des_s390_init);
    module_exit(des_s390_exit);

    -MODULE_ALIAS("des");
    -MODULE_ALIAS("des3_ede");
    +MODULE_ALIAS_CRYPTO("des");
    +MODULE_ALIAS_CRYPTO("des3_ede");

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
    diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
    index f6373f0..31086ea 100644
    --- a/arch/s390/crypto/ghash_s390.c
    +++ b/arch/s390/crypto/ghash_s390.c
    @@ -161,7 +161,7 @@ static void __exit ghash_mod_exit(void)
    module_init(ghash_mod_init);
    module_exit(ghash_mod_exit);

    -MODULE_ALIAS("ghash");
    +MODULE_ALIAS_CRYPTO("ghash");

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation");
    diff --git a/arch/s390/crypto/sha1_s390.c b/arch/s390/crypto/sha1_s390.c
    index e9868c6..484c27c 100644
    --- a/arch/s390/crypto/sha1_s390.c
    +++ b/arch/s390/crypto/sha1_s390.c
    @@ -103,6 +103,6 @@ static void __exit sha1_s390_fini(void)
    module_init(sha1_s390_init);
    module_exit(sha1_s390_fini);

    -MODULE_ALIAS("sha1");
    +MODULE_ALIAS_CRYPTO("sha1");
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
    diff --git a/arch/s390/crypto/sha256_s390.c b/arch/s390/crypto/sha256_s390.c
    index 0317a35..af31018 100644
    --- a/arch/s390/crypto/sha256_s390.c
    +++ b/arch/s390/crypto/sha256_s390.c
    @@ -143,7 +143,7 @@ static void __exit sha256_s390_fini(void)
    module_init(sha256_s390_init);
    module_exit(sha256_s390_fini);

    -MODULE_ALIAS("sha256");
    -MODULE_ALIAS("sha224");
    +MODULE_ALIAS_CRYPTO("sha256");
    +MODULE_ALIAS_CRYPTO("sha224");
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA256 and SHA224 Secure Hash Algorithm");
    diff --git a/arch/s390/crypto/sha512_s390.c b/arch/s390/crypto/sha512_s390.c
    index 32a8138..0c36989 100644
    --- a/arch/s390/crypto/sha512_s390.c
    +++ b/arch/s390/crypto/sha512_s390.c
    @@ -86,7 +86,7 @@ static struct shash_alg sha512_alg = {
    }
    };

    -MODULE_ALIAS("sha512");
    +MODULE_ALIAS_CRYPTO("sha512");

    static int sha384_init(struct shash_desc *desc)
    {
    @@ -126,7 +126,7 @@ static struct shash_alg sha384_alg = {
    }
    };

    -MODULE_ALIAS("sha384");
    +MODULE_ALIAS_CRYPTO("sha384");

    static int __init init(void)
    {
    diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
    index a5f6eff..bc486d0 100644
    --- a/arch/s390/kvm/intercept.c
    +++ b/arch/s390/kvm/intercept.c
    @@ -58,6 +58,7 @@ static int handle_lctlg(struct kvm_vcpu *vcpu)
    break;
    reg = (reg + 1) % 16;
    } while (1);
    + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
    return 0;
    }

    @@ -97,6 +98,7 @@ static int handle_lctl(struct kvm_vcpu *vcpu)
    break;
    reg = (reg + 1) % 16;
    } while (1);
    + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
    return 0;
    }

    diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
    index 0fc0a7e..b53339d 100644
    --- a/arch/s390/mm/fault.c
    +++ b/arch/s390/mm/fault.c
    @@ -249,6 +249,13 @@ static noinline void do_fault_error(struct pt_regs *regs, long int_code,
    do_no_context(regs, int_code, trans_exc_code);
    else
    pagefault_out_of_memory();
    + } else if (fault & VM_FAULT_SIGSEGV) {
    + /* Kernel mode? Handle exceptions or die */
    + if (!user_mode(regs))
    + do_no_context(regs, int_code, trans_exc_code);
    + else
    + do_sigsegv(regs, int_code, SEGV_MAPERR,
    + trans_exc_code);
    } else if (fault & VM_FAULT_SIGBUS) {
    /* Kernel mode? Handle exceptions or die */
    if (!(regs->psw.mask & PSW_MASK_PSTATE))
    diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
    index 47b600e..b3744ca 100644
    --- a/arch/score/mm/fault.c
    +++ b/arch/score/mm/fault.c
    @@ -110,6 +110,8 @@ survive:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c
    index 7bebd04..db14482 100644
    --- a/arch/sh/mm/fault_32.c
    +++ b/arch/sh/mm/fault_32.c
    @@ -206,6 +206,8 @@ good_area:
    goto out_of_memory;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    BUG();
    }
    if (fault & VM_FAULT_MAJOR) {
    diff --git a/arch/sh/mm/tlbflush_64.c b/arch/sh/mm/tlbflush_64.c
    index e3430e0..43eef7b 100644
    --- a/arch/sh/mm/tlbflush_64.c
    +++ b/arch/sh/mm/tlbflush_64.c
    @@ -195,6 +195,8 @@ good_area:
    goto out_of_memory;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    BUG();
    }

    diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
    index 8023fd7..802b806 100644
    --- a/arch/sparc/mm/fault_32.c
    +++ b/arch/sparc/mm/fault_32.c
    @@ -294,6 +294,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
    index 2c0b966..bfd7c02 100644
    --- a/arch/sparc/mm/fault_64.c
    +++ b/arch/sparc/mm/fault_64.c
    @@ -435,6 +435,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
    index 25b7b90..c796ce44 100644
    --- a/arch/tile/mm/fault.c
    +++ b/arch/tile/mm/fault.c
    @@ -424,6 +424,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
    index dafc947..f79ffc9 100644
    --- a/arch/um/kernel/trap.c
    +++ b/arch/um/kernel/trap.c
    @@ -69,6 +69,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM) {
    goto out_of_memory;
    + } else if (fault & VM_FAULT_SIGSEGV) {
    + goto out;
    } else if (fault & VM_FAULT_SIGBUS) {
    err = -EACCES;
    goto out;
    diff --git a/arch/x86/crypto/aes_glue.c b/arch/x86/crypto/aes_glue.c
    index 8efcf42..8950e0c 100644
    --- a/arch/x86/crypto/aes_glue.c
    +++ b/arch/x86/crypto/aes_glue.c
    @@ -67,5 +67,5 @@ module_exit(aes_fini);

    MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, asm optimized");
    MODULE_LICENSE("GPL");
    -MODULE_ALIAS("aes");
    -MODULE_ALIAS("aes-asm");
    +MODULE_ALIAS_CRYPTO("aes");
    +MODULE_ALIAS_CRYPTO("aes-asm");
    diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
    index 545d0ce..16acf68 100644
    --- a/arch/x86/crypto/aesni-intel_glue.c
    +++ b/arch/x86/crypto/aesni-intel_glue.c
    @@ -1380,4 +1380,4 @@ module_exit(aesni_exit);

    MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, Intel AES-NI instructions optimized");
    MODULE_LICENSE("GPL");
    -MODULE_ALIAS("aes");
    +MODULE_ALIAS_CRYPTO("aes");
    diff --git a/arch/x86/crypto/blowfish_glue.c b/arch/x86/crypto/blowfish_glue.c
    index b05aa16..f8350d2 100644
    --- a/arch/x86/crypto/blowfish_glue.c
    +++ b/arch/x86/crypto/blowfish_glue.c
    @@ -488,5 +488,5 @@ module_exit(fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Blowfish Cipher Algorithm, asm optimized");
    -MODULE_ALIAS("blowfish");
    -MODULE_ALIAS("blowfish-asm");
    +MODULE_ALIAS_CRYPTO("blowfish");
    +MODULE_ALIAS_CRYPTO("blowfish-asm");
    diff --git a/arch/x86/crypto/crc32c-intel.c b/arch/x86/crypto/crc32c-intel.c
    index b9d0026..7dad700 100644
    --- a/arch/x86/crypto/crc32c-intel.c
    +++ b/arch/x86/crypto/crc32c-intel.c
    @@ -194,5 +194,5 @@ MODULE_AUTHOR("Austin Zhang <austin.zhang@intel.com>, Kent Liu <kent.liu@intel.c
    MODULE_DESCRIPTION("CRC32c (Castagnoli) optimization using Intel Hardware.");
    MODULE_LICENSE("GPL");

    -MODULE_ALIAS("crc32c");
    -MODULE_ALIAS("crc32c-intel");
    +MODULE_ALIAS_CRYPTO("crc32c");
    +MODULE_ALIAS_CRYPTO("crc32c-intel");
    diff --git a/arch/x86/crypto/fpu.c b/arch/x86/crypto/fpu.c
    index 98d7a18..f368ba2 100644
    --- a/arch/x86/crypto/fpu.c
    +++ b/arch/x86/crypto/fpu.c
    @@ -17,6 +17,7 @@
    #include <linux/kernel.h>
    #include <linux/module.h>
    #include <linux/slab.h>
    +#include <linux/crypto.h>
    #include <asm/i387.h>

    struct crypto_fpu_ctx {
    @@ -159,3 +160,5 @@ void __exit crypto_fpu_exit(void)
    {
    crypto_unregister_template(&crypto_fpu_tmpl);
    }
    +
    +MODULE_ALIAS_CRYPTO("fpu");
    diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
    index 294a264..f781251 100644
    --- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
    +++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
    @@ -339,4 +339,4 @@ module_exit(ghash_pclmulqdqni_mod_exit);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("GHASH Message Digest Algorithm, "
    "acclerated by PCLMULQDQ-NI");
    -MODULE_ALIAS("ghash");
    +MODULE_ALIAS_CRYPTO("ghash");
    diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c
    index bccb76d..ae1ee37 100644
    --- a/arch/x86/crypto/salsa20_glue.c
    +++ b/arch/x86/crypto/salsa20_glue.c
    @@ -125,5 +125,5 @@ module_exit(fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly version)");
    -MODULE_ALIAS("salsa20");
    -MODULE_ALIAS("salsa20-asm");
    +MODULE_ALIAS_CRYPTO("salsa20");
    +MODULE_ALIAS_CRYPTO("salsa20-asm");
    diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
    index f916499..49b112e 100644
    --- a/arch/x86/crypto/sha1_ssse3_glue.c
    +++ b/arch/x86/crypto/sha1_ssse3_glue.c
    @@ -237,4 +237,4 @@ module_exit(sha1_ssse3_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, Supplemental SSE3 accelerated");

    -MODULE_ALIAS("sha1");
    +MODULE_ALIAS_CRYPTO("sha1");
    diff --git a/arch/x86/crypto/twofish_glue.c b/arch/x86/crypto/twofish_glue.c
    index dc6b3fb..7ec12d9 100644
    --- a/arch/x86/crypto/twofish_glue.c
    +++ b/arch/x86/crypto/twofish_glue.c
    @@ -97,5 +97,5 @@ module_exit(fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION ("Twofish Cipher Algorithm, asm optimized");
    -MODULE_ALIAS("twofish");
    -MODULE_ALIAS("twofish-asm");
    +MODULE_ALIAS_CRYPTO("twofish");
    +MODULE_ALIAS_CRYPTO("twofish-asm");
    diff --git a/arch/x86/crypto/twofish_glue_3way.c b/arch/x86/crypto/twofish_glue_3way.c
    index 5ede9c4..09ed353 100644
    --- a/arch/x86/crypto/twofish_glue_3way.c
    +++ b/arch/x86/crypto/twofish_glue_3way.c
    @@ -468,5 +468,5 @@ module_exit(fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Twofish Cipher Algorithm, 3-way parallel asm optimized");
    -MODULE_ALIAS("twofish");
    -MODULE_ALIAS("twofish-asm");
    +MODULE_ALIAS_CRYPTO("twofish");
    +MODULE_ALIAS_CRYPTO("twofish-asm");
    diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
    index 41935fa..3225868 100644
    --- a/arch/x86/include/asm/desc.h
    +++ b/arch/x86/include/asm/desc.h
    @@ -248,7 +248,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
    gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
    }

    -#define _LDT_empty(info) \
    +/* This intentionally ignores lm, since 32-bit apps don't have that field. */
    +#define LDT_empty(info) \
    ((info)->base_addr == 0 && \
    (info)->limit == 0 && \
    (info)->contents == 0 && \
    @@ -258,11 +259,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
    (info)->seg_not_present == 1 && \
    (info)->useable == 0)

    -#ifdef CONFIG_X86_64
    -#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
    -#else
    -#define LDT_empty(info) (_LDT_empty(info))
    -#endif
    +/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
    +static inline bool LDT_zero(const struct user_desc *info)
    +{
    + return (info->base_addr == 0 &&
    + info->limit == 0 &&
    + info->contents == 0 &&
    + info->read_exec_only == 0 &&
    + info->seg_32bit == 0 &&
    + info->limit_in_pages == 0 &&
    + info->seg_not_present == 0 &&
    + info->useable == 0);
    +}

    static inline void clear_LDT(void)
    {
    diff --git a/arch/x86/include/asm/ldt.h b/arch/x86/include/asm/ldt.h
    index 46727eb..6e1aaf7 100644
    --- a/arch/x86/include/asm/ldt.h
    +++ b/arch/x86/include/asm/ldt.h
    @@ -28,6 +28,13 @@ struct user_desc {
    unsigned int seg_not_present:1;
    unsigned int useable:1;
    #ifdef __x86_64__
    + /*
    + * Because this bit is not present in 32-bit user code, user
    + * programs can pass uninitialized values here. Therefore, in
    + * any context in which a user_desc comes from a 32-bit program,
    + * the kernel must act as though lm == 0, regardless of the
    + * actual value.
    + */
    unsigned int lm:1;
    #endif
    };
    diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
    index a6962d9..5538b13 100644
    --- a/arch/x86/include/asm/msr-index.h
    +++ b/arch/x86/include/asm/msr-index.h
    @@ -123,6 +123,7 @@
    #define MSR_AMD64_PATCH_LOADER 0xc0010020
    #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
    #define MSR_AMD64_OSVW_STATUS 0xc0010141
    +#define MSR_AMD64_LS_CFG 0xc0011020
    #define MSR_AMD64_DC_CFG 0xc0011022
    #define MSR_AMD64_IBSFETCHCTL 0xc0011030
    #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
    diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
    index 2d44a28..60d4c33 100644
    --- a/arch/x86/kernel/cpu/amd.c
    +++ b/arch/x86/kernel/cpu/amd.c
    @@ -408,6 +408,16 @@ static void __cpuinit early_init_amd_mc(struct cpuinfo_x86 *c)

    c->x86_coreid_bits = bits;
    #endif
    +
    + /* F16h erratum 793, CVE-2013-6885 */
    + if (c->x86 == 0x16 && c->x86_model <= 0xf) {
    + u64 val;
    +
    + if (!rdmsrl_amd_safe(MSR_AMD64_LS_CFG, &val) &&
    + !(val & BIT(15)))
    + wrmsrl_amd_safe(MSR_AMD64_LS_CFG, val | BIT(15));
    + }
    +
    }

    static void __cpuinit bsp_init_amd(struct cpuinfo_x86 *c)
    diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
    index 1a3cf6e..d1582b6 100644
    --- a/arch/x86/kernel/cpu/mshyperv.c
    +++ b/arch/x86/kernel/cpu/mshyperv.c
    @@ -56,6 +56,7 @@ static struct clocksource hyperv_cs = {
    .rating = 400, /* use this when running on Hyperv*/
    .read = read_hv_clock,
    .mask = CLOCKSOURCE_MASK(64),
    + .flags = CLOCK_SOURCE_IS_CONTINUOUS,
    };

    static void __init ms_hyperv_init_platform(void)
    diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
    index 7da647d..083848f 100644
    --- a/arch/x86/kernel/kprobes.c
    +++ b/arch/x86/kernel/kprobes.c
    @@ -1058,6 +1058,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
    regs->flags &= ~X86_EFLAGS_IF;
    trace_hardirqs_off();
    regs->ip = (unsigned long)(jp->entry);
    +
    + /*
    + * jprobes use jprobe_return() which skips the normal return
    + * path of the function, and this messes up the accounting of the
    + * function graph tracer to get messed up.
    + *
    + * Pause function graph tracing while performing the jprobe function.
    + */
    + pause_graph_tracing();
    return 1;
    }

    @@ -1083,24 +1092,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
    struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
    u8 *addr = (u8 *) (regs->ip - 1);
    struct jprobe *jp = container_of(p, struct jprobe, kp);
    + void *saved_sp = kcb->jprobe_saved_sp;

    if ((addr > (u8 *) jprobe_return) &&
    (addr < (u8 *) jprobe_return_end)) {
    - if (stack_addr(regs) != kcb->jprobe_saved_sp) {
    + if (stack_addr(regs) != saved_sp) {
    struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
    printk(KERN_ERR
    "current sp %p does not match saved sp %p\n",
    - stack_addr(regs), kcb->jprobe_saved_sp);
    + stack_addr(regs), saved_sp);
    printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
    show_registers(saved_regs);
    printk(KERN_ERR "Current registers\n");
    show_registers(regs);
    BUG();
    }
    + /* It's OK to start function graph tracing again */
    + unpause_graph_tracing();
    *regs = kcb->jprobe_saved_regs;
    - memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
    - kcb->jprobes_stack,
    - MIN_STACK_SIZE(kcb->jprobe_saved_sp));
    + memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
    preempt_enable_no_resched();
    return 1;
    }
    diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
    index 6a364a6..e361095 100644
    --- a/arch/x86/kernel/process_64.c
    +++ b/arch/x86/kernel/process_64.c
    @@ -385,24 +385,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)

    fpu = switch_fpu_prepare(prev_p, next_p);

    - /*
    - * Reload esp0, LDT and the page table pointer:
    - */
    + /* Reload esp0 and ss1. */
    load_sp0(tss, next);

    - /*
    - * Switch DS and ES.
    - * This won't pick up thread selector changes, but I guess that is ok.
    - */
    - savesegment(es, prev->es);
    - if (unlikely(next->es | prev->es))
    - loadsegment(es, next->es);
    -
    - savesegment(ds, prev->ds);
    - if (unlikely(next->ds | prev->ds))
    - loadsegment(ds, next->ds);
    -
    -
    /* We must save %fs and %gs before load_TLS() because
    * %fs and %gs may be cleared by load_TLS().
    *
    @@ -411,41 +396,101 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
    savesegment(fs, fsindex);
    savesegment(gs, gsindex);

    + /*
    + * Load TLS before restoring any segments so that segment loads
    + * reference the correct GDT entries.
    + */
    load_TLS(next, cpu);

    /*
    - * Leave lazy mode, flushing any hypercalls made here.
    - * This must be done before restoring TLS segments so
    - * the GDT and LDT are properly updated, and must be
    - * done before math_state_restore, so the TS bit is up
    - * to date.
    + * Leave lazy mode, flushing any hypercalls made here. This
    + * must be done after loading TLS entries in the GDT but before
    + * loading segments that might reference them, and and it must
    + * be done before math_state_restore, so the TS bit is up to
    + * date.
    */
    arch_end_context_switch(next_p);

    + /* Switch DS and ES.
    + *
    + * Reading them only returns the selectors, but writing them (if
    + * nonzero) loads the full descriptor from the GDT or LDT. The
    + * LDT for next is loaded in switch_mm, and the GDT is loaded
    + * above.
    + *
    + * We therefore need to write new values to the segment
    + * registers on every context switch unless both the new and old
    + * values are zero.
    + *
    + * Note that we don't need to do anything for CS and SS, as
    + * those are saved and restored as part of pt_regs.
    + */
    + savesegment(es, prev->es);
    + if (unlikely(next->es | prev->es))
    + loadsegment(es, next->es);
    +
    + savesegment(ds, prev->ds);
    + if (unlikely(next->ds | prev->ds))
    + loadsegment(ds, next->ds);
    +
    /*
    * Switch FS and GS.
    *
    - * Segment register != 0 always requires a reload. Also
    - * reload when it has changed. When prev process used 64bit
    - * base always reload to avoid an information leak.
    + * These are even more complicated than FS and GS: they have
    + * 64-bit bases are that controlled by arch_prctl. Those bases
    + * only differ from the values in the GDT or LDT if the selector
    + * is 0.
    + *
    + * Loading the segment register resets the hidden base part of
    + * the register to 0 or the value from the GDT / LDT. If the
    + * next base address zero, writing 0 to the segment register is
    + * much faster than using wrmsr to explicitly zero the base.
    + *
    + * The thread_struct.fs and thread_struct.gs values are 0
    + * if the fs and gs bases respectively are not overridden
    + * from the values implied by fsindex and gsindex. They
    + * are nonzero, and store the nonzero base addresses, if
    + * the bases are overridden.
    + *
    + * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should
    + * be impossible.
    + *
    + * Therefore we need to reload the segment registers if either
    + * the old or new selector is nonzero, and we need to override
    + * the base address if next thread expects it to be overridden.
    + *
    + * This code is unnecessarily slow in the case where the old and
    + * new indexes are zero and the new base is nonzero -- it will
    + * unnecessarily write 0 to the selector before writing the new
    + * base address.
    + *
    + * Note: This all depends on arch_prctl being the only way that
    + * user code can override the segment base. Once wrfsbase and
    + * wrgsbase are enabled, most of this code will need to change.
    */
    if (unlikely(fsindex | next->fsindex | prev->fs)) {
    loadsegment(fs, next->fsindex);
    +
    /*
    - * Check if the user used a selector != 0; if yes
    - * clear 64bit base, since overloaded base is always
    - * mapped to the Null selector
    + * If user code wrote a nonzero value to FS, then it also
    + * cleared the overridden base address.
    + *
    + * XXX: if user code wrote 0 to FS and cleared the base
    + * address itself, we won't notice and we'll incorrectly
    + * restore the prior base address next time we reschdule
    + * the process.
    */
    if (fsindex)
    prev->fs = 0;
    }
    - /* when next process has a 64bit base use it */
    if (next->fs)
    wrmsrl(MSR_FS_BASE, next->fs);
    prev->fsindex = fsindex;

    if (unlikely(gsindex | next->gsindex | prev->gs)) {
    load_gs_index(next->gsindex);
    +
    + /* This works (and fails) the same way as fsindex above. */
    if (gsindex)
    prev->gs = 0;
    }
    diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
    index 7af7338..0c38d06 100644
    --- a/arch/x86/kernel/tls.c
    +++ b/arch/x86/kernel/tls.c
    @@ -30,7 +30,28 @@ static int get_free_idx(void)

    static bool tls_desc_okay(const struct user_desc *info)
    {
    - if (LDT_empty(info))
    + /*
    + * For historical reasons (i.e. no one ever documented how any
    + * of the segmentation APIs work), user programs can and do
    + * assume that a struct user_desc that's all zeros except for
    + * entry_number means "no segment at all". This never actually
    + * worked. In fact, up to Linux 3.19, a struct user_desc like
    + * this would create a 16-bit read-write segment with base and
    + * limit both equal to zero.
    + *
    + * That was close enough to "no segment at all" until we
    + * hardened this function to disallow 16-bit TLS segments. Fix
    + * it up by interpreting these zeroed segments the way that they
    + * were almost certainly intended to be interpreted.
    + *
    + * The correct way to ask for "no segment at all" is to specify
    + * a user_desc that satisfies LDT_empty. To keep everything
    + * working, we accept both.
    + *
    + * Note that there's a similar kludge in modify_ldt -- look at
    + * the distinction between modes 1 and 0x11.
    + */
    + if (LDT_empty(info) || LDT_zero(info))
    return true;

    /*
    @@ -40,6 +61,22 @@ static bool tls_desc_okay(const struct user_desc *info)
    if (!info->seg_32bit)
    return false;

    + /* Only allow data segments in the TLS array. */
    + if (info->contents > 1)
    + return false;
    +
    + /*
    + * Non-present segments with DPL 3 present an interesting attack
    + * surface. The kernel should handle such segments correctly,
    + * but TLS is very difficult to protect in a sandbox, so prevent
    + * such segments from being created.
    + *
    + * If userspace needs to remove a TLS entry, it can still delete
    + * it outright.
    + */
    + if (info->seg_not_present)
    + return false;
    +
    return true;
    }

    @@ -56,7 +93,7 @@ static void set_tls_desc(struct task_struct *p, int idx,
    cpu = get_cpu();

    while (n-- > 0) {
    - if (LDT_empty(info))
    + if (LDT_empty(info) || LDT_zero(info))
    desc->a = desc->b = 0;
    else
    fill_ldt(desc, info);
    diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    index f0ac042..bdad489 100644
    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -1952,6 +1952,17 @@ setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
    ss->p = 1;
    }

    +static bool vendor_intel(struct x86_emulate_ctxt *ctxt)
    +{
    + u32 eax, ebx, ecx, edx;
    +
    + eax = ecx = 0;
    + return ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx)
    + && ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx
    + && ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx
    + && edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx;
    +}
    +
    static bool em_syscall_is_enabled(struct x86_emulate_ctxt *ctxt)
    {
    struct x86_emulate_ops *ops = ctxt->ops;
    @@ -2068,6 +2079,14 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
    if (ctxt->mode == X86EMUL_MODE_REAL)
    return emulate_gp(ctxt, 0);

    + /*
    + * Not recognized on AMD in compat mode (but is recognized in legacy
    + * mode).
    + */
    + if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
    + && !vendor_intel(ctxt))
    + return emulate_ud(ctxt);
    +
    /* XXX sysenter/sysexit have not been tested in 64bit mode.
    * Therefore, we inject an #UD.
    */
    @@ -2077,23 +2096,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
    setup_syscalls_segments(ctxt, &cs, &ss);

    ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
    - switch (ctxt->mode) {
    - case X86EMUL_MODE_PROT32:
    - if ((msr_data & 0xfffc) == 0x0)
    - return emulate_gp(ctxt, 0);
    - break;
    - case X86EMUL_MODE_PROT64:
    - if (msr_data == 0x0)
    - return emulate_gp(ctxt, 0);
    - break;
    - }
    + if ((msr_data & 0xfffc) == 0x0)
    + return emulate_gp(ctxt, 0);

    ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
    - cs_sel = (u16)msr_data;
    - cs_sel &= ~SELECTOR_RPL_MASK;
    + cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
    ss_sel = cs_sel + 8;
    - ss_sel &= ~SELECTOR_RPL_MASK;
    - if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
    + if (efer & EFER_LMA) {
    cs.d = 0;
    cs.l = 1;
    }
    @@ -2102,10 +2111,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
    ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);

    ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
    - ctxt->_eip = msr_data;
    + ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;

    ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
    - ctxt->regs[VCPU_REGS_RSP] = msr_data;
    + ctxt->regs[VCPU_REGS_RSP] = (efer & EFER_LMA) ? msr_data :
    + (u32)msr_data;

    return X86EMUL_CONTINUE;
    }
    diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
    index 53a7b69..8cac088 100644
    --- a/arch/x86/mm/fault.c
    +++ b/arch/x86/mm/fault.c
    @@ -877,6 +877,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
    if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
    VM_FAULT_HWPOISON_LARGE))
    do_sigbus(regs, error_code, address, fault);
    + else if (fault & VM_FAULT_SIGSEGV)
    + bad_area_nosemaphore(regs, error_code, address);
    else
    BUG();
    }
    diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
    index 266f717..44b93da 100644
    --- a/arch/x86/mm/init_64.c
    +++ b/arch/x86/mm/init_64.c
    @@ -778,7 +778,6 @@ void mark_rodata_ro(void)
    unsigned long text_end = PAGE_ALIGN((unsigned long) &__stop___ex_table);
    unsigned long rodata_end = PAGE_ALIGN((unsigned long) &__end_rodata);
    unsigned long data_start = (unsigned long) &_sdata;
    - unsigned long all_end;

    printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
    (end - start) >> 10);
    @@ -787,19 +786,10 @@ void mark_rodata_ro(void)
    kernel_set_to_readonly = 1;

    /*
    - * The rodata/data/bss/brk section (but not the kernel text!)
    - * should also be not-executable.
    - *
    - * We align all_end to PMD_SIZE because the existing mapping
    - * is a full PMD. If we would align _brk_end to PAGE_SIZE we
    - * split the PMD and the reminder between _brk_end and the end
    - * of the PMD will remain mapped executable.
    - *
    - * Any PMD which was setup after the one which covers _brk_end
    - * has been zapped already via cleanup_highmem().
    + * The rodata section (but not the kernel text!) should also be
    + * not-executable.
    */
    - all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
    - set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
    + set_memory_nx(rodata_start, (end - rodata_start) >> PAGE_SHIFT);

    rodata_test();

    diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
    index 153407c..0ff8815 100644
    --- a/arch/x86/vdso/vma.c
    +++ b/arch/x86/vdso/vma.c
    @@ -72,30 +72,43 @@ subsys_initcall(init_vdso);

    struct linux_binprm;

    -/* Put the vdso above the (randomized) stack with another randomized offset.
    - This way there is no hole in the middle of address space.
    - To save memory make sure it is still in the same PTE as the stack top.
    - This doesn't give that many random bits */
    +/*
    + * Put the vdso above the (randomized) stack with another randomized
    + * offset. This way there is no hole in the middle of address space.
    + * To save memory make sure it is still in the same PTE as the stack
    + * top. This doesn't give that many random bits.
    + *
    + * Note that this algorithm is imperfect: the distribution of the vdso
    + * start address within a PMD is biased toward the end.
    + */
    static unsigned long vdso_addr(unsigned long start, unsigned len)
    {
    unsigned long addr, end;
    unsigned offset;
    - end = (start + PMD_SIZE - 1) & PMD_MASK;
    +
    + /*
    + * Round up the start address. It can start out unaligned as a result
    + * of stack start randomization.
    + */
    + start = PAGE_ALIGN(start);
    +
    + /* Round the lowest possible end address up to a PMD boundary. */
    + end = (start + len + PMD_SIZE - 1) & PMD_MASK;
    if (end >= TASK_SIZE_MAX)
    end = TASK_SIZE_MAX;
    end -= len;
    - /* This loses some more bits than a modulo, but is cheaper */
    - offset = get_random_int() & (PTRS_PER_PTE - 1);
    - addr = start + (offset << PAGE_SHIFT);
    - if (addr >= end)
    - addr = end;
    +
    + if (end > start) {
    + offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
    + addr = start + (offset << PAGE_SHIFT);
    + } else {
    + addr = start;
    + }

    /*
    - * page-align it here so that get_unmapped_area doesn't
    - * align it wrongfully again to the next page. addr can come in 4K
    - * unaligned here as a result of stack start randomization.
    + * Forcibly align the final address in case we have a hardware
    + * issue that requires alignment for performance reasons.
    */
    - addr = PAGE_ALIGN(addr);
    addr = align_addr(addr, NULL, ALIGN_VDSO);

    return addr;
    diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
    index e367e30..4439a1d 100644
    --- a/arch/xtensa/mm/fault.c
    +++ b/arch/xtensa/mm/fault.c
    @@ -109,6 +109,8 @@ good_area:
    if (unlikely(fault & VM_FAULT_ERROR)) {
    if (fault & VM_FAULT_OOM)
    goto out_of_memory;
    + else if (fault & VM_FAULT_SIGSEGV)
    + goto bad_area;
    else if (fault & VM_FAULT_SIGBUS)
    goto do_sigbus;
    BUG();
    diff --git a/block/genhd.c b/block/genhd.c
    index 41b0435..424d1fa 100644
    --- a/block/genhd.c
    +++ b/block/genhd.c
    @@ -1070,9 +1070,16 @@ int disk_expand_part_tbl(struct gendisk *disk, int partno)
    struct disk_part_tbl *old_ptbl = disk->part_tbl;
    struct disk_part_tbl *new_ptbl;
    int len = old_ptbl ? old_ptbl->len : 0;
    - int target = partno + 1;
    + int i, target;
    size_t size;
    - int i;
    +
    + /*
    + * check for int overflow, since we can get here from blkpg_ioctl()
    + * with a user passed 'partno'.
    + */
    + target = partno + 1;
    + if (target < 0)
    + return -EINVAL;

    /* disk_max_parts() is zero during initialization, ignore if so */
    if (disk_max_parts(disk) && target > disk_max_parts(disk))
    diff --git a/crypto/aes_generic.c b/crypto/aes_generic.c
    index a68c73d..bd776be 100644
    --- a/crypto/aes_generic.c
    +++ b/crypto/aes_generic.c
    @@ -1475,4 +1475,5 @@ module_exit(aes_fini);

    MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
    MODULE_LICENSE("Dual BSD/GPL");
    -MODULE_ALIAS("aes");
    +MODULE_ALIAS_CRYPTO("aes");
    +MODULE_ALIAS_CRYPTO("aes-generic");
    diff --git a/crypto/af_alg.c b/crypto/af_alg.c
    index bf948e1..6ef6e2a 100644
    --- a/crypto/af_alg.c
    +++ b/crypto/af_alg.c
    @@ -449,6 +449,9 @@ void af_alg_complete(struct crypto_async_request *req, int err)
    {
    struct af_alg_completion *completion = req->data;

    + if (err == -EINPROGRESS)
    + return;
    +
    completion->err = err;
    complete(&completion->completion);
    }
    diff --git a/crypto/algapi.c b/crypto/algapi.c
    index dc9991f..3b9ef92 100644
    --- a/crypto/algapi.c
    +++ b/crypto/algapi.c
    @@ -477,8 +477,8 @@ static struct crypto_template *__crypto_lookup_template(const char *name)

    struct crypto_template *crypto_lookup_template(const char *name)
    {
    - return try_then_request_module(__crypto_lookup_template(name), "%s",
    - name);
    + return try_then_request_module(__crypto_lookup_template(name),
    + "crypto-%s", name);
    }
    EXPORT_SYMBOL_GPL(crypto_lookup_template);

    diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
    index 6056178..f112ca2 100644
    --- a/crypto/ansi_cprng.c
    +++ b/crypto/ansi_cprng.c
    @@ -485,4 +485,5 @@ module_param(dbg, int, 0);
    MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");
    module_init(prng_mod_init);
    module_exit(prng_mod_fini);
    -MODULE_ALIAS("stdrng");
    +MODULE_ALIAS_CRYPTO("stdrng");
    +MODULE_ALIAS_CRYPTO("ansi_cprng");
    diff --git a/crypto/anubis.c b/crypto/anubis.c
    index 77530d5..523ed52 100644
    --- a/crypto/anubis.c
    +++ b/crypto/anubis.c
    @@ -705,3 +705,4 @@ module_exit(anubis_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Anubis Cryptographic Algorithm");
    +MODULE_ALIAS_CRYPTO("anubis");
    diff --git a/crypto/api.c b/crypto/api.c
    index cea3cf6..ac80794 100644
    --- a/crypto/api.c
    +++ b/crypto/api.c
    @@ -222,11 +222,11 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask)

    alg = crypto_alg_lookup(name, type, mask);
    if (!alg) {
    - request_module("%s", name);
    + request_module("crypto-%s", name);

    if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
    CRYPTO_ALG_NEED_FALLBACK))
    - request_module("%s-all", name);
    + request_module("crypto-%s-all", name);

    alg = crypto_alg_lookup(name, type, mask);
    }
    diff --git a/crypto/arc4.c b/crypto/arc4.c
    index 0d12a96..c404623 100644
    --- a/crypto/arc4.c
    +++ b/crypto/arc4.c
    @@ -101,3 +101,4 @@ module_exit(arc4_exit);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("ARC4 Cipher Algorithm");
    MODULE_AUTHOR("Jon Oberheide <jon@oberheide.org>");
    +MODULE_ALIAS_CRYPTO("arc4");
    diff --git a/crypto/authenc.c b/crypto/authenc.c
    index d21da2f..112b4e3 100644
    --- a/crypto/authenc.c
    +++ b/crypto/authenc.c
    @@ -710,3 +710,4 @@ module_exit(crypto_authenc_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
    +MODULE_ALIAS_CRYPTO("authenc");
    diff --git a/crypto/authencesn.c b/crypto/authencesn.c
    index 136b68b..dd1f303 100644
    --- a/crypto/authencesn.c
    +++ b/crypto/authencesn.c
    @@ -833,3 +833,4 @@ module_exit(crypto_authenc_esn_module_exit);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
    MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
    +MODULE_ALIAS_CRYPTO("authencesn");
    diff --git a/crypto/blowfish_generic.c b/crypto/blowfish_generic.c
    index 6f269b5..0938609 100644
    --- a/crypto/blowfish_generic.c
    +++ b/crypto/blowfish_generic.c
    @@ -139,4 +139,5 @@ module_exit(blowfish_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Blowfish Cipher Algorithm");
    -MODULE_ALIAS("blowfish");
    +MODULE_ALIAS_CRYPTO("blowfish");
    +MODULE_ALIAS_CRYPTO("blowfish-generic");
    diff --git a/crypto/camellia.c b/crypto/camellia.c
    index 64cff46..18024da 100644
    --- a/crypto/camellia.c
    +++ b/crypto/camellia.c
    @@ -1114,3 +1114,4 @@ module_exit(camellia_fini);

    MODULE_DESCRIPTION("Camellia Cipher Algorithm");
    MODULE_LICENSE("GPL");
    +MODULE_ALIAS_CRYPTO("camellia");
    diff --git a/crypto/cast5.c b/crypto/cast5.c
    index 4a230dd..b5f7ee5 100644
    --- a/crypto/cast5.c
    +++ b/crypto/cast5.c
    @@ -806,4 +806,5 @@ module_exit(cast5_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Cast5 Cipher Algorithm");
    +MODULE_ALIAS_CRYPTO("cast5");

    diff --git a/crypto/cast6.c b/crypto/cast6.c
    index e0c15a6..6839587 100644
    --- a/crypto/cast6.c
    +++ b/crypto/cast6.c
    @@ -545,3 +545,4 @@ module_exit(cast6_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Cast6 Cipher Algorithm");
    +MODULE_ALIAS_CRYPTO("cast6");
    diff --git a/crypto/cbc.c b/crypto/cbc.c
    index 61ac42e..780ee27 100644
    --- a/crypto/cbc.c
    +++ b/crypto/cbc.c
    @@ -289,3 +289,4 @@ module_exit(crypto_cbc_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("CBC block cipher algorithm");
    +MODULE_ALIAS_CRYPTO("cbc");
    diff --git a/crypto/ccm.c b/crypto/ccm.c
    index 2002ca7..aa8d4f5 100644
    --- a/crypto/ccm.c
    +++ b/crypto/ccm.c
    @@ -888,5 +888,6 @@ module_exit(crypto_ccm_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Counter with CBC MAC");
    -MODULE_ALIAS("ccm_base");
    -MODULE_ALIAS("rfc4309");
    +MODULE_ALIAS_CRYPTO("ccm_base");
    +MODULE_ALIAS_CRYPTO("rfc4309");
    +MODULE_ALIAS_CRYPTO("ccm");
    diff --git a/crypto/chainiv.c b/crypto/chainiv.c
    index ba200b0..3bf2eb0 100644
    --- a/crypto/chainiv.c
    +++ b/crypto/chainiv.c
    @@ -360,3 +360,4 @@ module_exit(chainiv_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Chain IV Generator");
    +MODULE_ALIAS_CRYPTO("chainiv");
    diff --git a/crypto/crc32c.c b/crypto/crc32c.c
    index 3f9ad28..b2c030b 100644
    --- a/crypto/crc32c.c
    +++ b/crypto/crc32c.c
    @@ -258,3 +258,4 @@ module_exit(crc32c_mod_fini);
    MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
    MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
    MODULE_LICENSE("GPL");
    +MODULE_ALIAS_CRYPTO("crc32c");
    diff --git a/crypto/cryptd.c b/crypto/cryptd.c
    index 7bdd61b..75c415d 100644
    --- a/crypto/cryptd.c
    +++ b/crypto/cryptd.c
    @@ -955,3 +955,4 @@ module_exit(cryptd_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Software async crypto daemon");
    +MODULE_ALIAS_CRYPTO("cryptd");
    diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c
    index 07a8a96..7a2fbf6 100644
    --- a/crypto/crypto_null.c
    +++ b/crypto/crypto_null.c
    @@ -156,9 +156,9 @@ static struct crypto_alg skcipher_null = {
    .decrypt = skcipher_null_crypt } }
    };

    -MODULE_ALIAS("compress_null");
    -MODULE_ALIAS("digest_null");
    -MODULE_ALIAS("cipher_null");
    +MODULE_ALIAS_CRYPTO("compress_null");
    +MODULE_ALIAS_CRYPTO("digest_null");
    +MODULE_ALIAS_CRYPTO("cipher_null");

    static int __init crypto_null_mod_init(void)
    {
    diff --git a/crypto/ctr.c b/crypto/ctr.c
    index 4ca7222..ff7b3a3 100644
    --- a/crypto/ctr.c
    +++ b/crypto/ctr.c
    @@ -421,4 +421,5 @@ module_exit(crypto_ctr_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("CTR Counter block mode");
    -MODULE_ALIAS("rfc3686");
    +MODULE_ALIAS_CRYPTO("rfc3686");
    +MODULE_ALIAS_CRYPTO("ctr");
    diff --git a/crypto/cts.c b/crypto/cts.c
    index ccf9c5d..714283d 100644
    --- a/crypto/cts.c
    +++ b/crypto/cts.c
    @@ -351,3 +351,4 @@ module_exit(crypto_cts_module_exit);

    MODULE_LICENSE("Dual BSD/GPL");
    MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC");
    +MODULE_ALIAS_CRYPTO("cts");
    diff --git a/crypto/deflate.c b/crypto/deflate.c
    index b0165ec..467423a 100644
    --- a/crypto/deflate.c
    +++ b/crypto/deflate.c
    @@ -223,4 +223,4 @@ module_exit(deflate_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Deflate Compression Algorithm for IPCOMP");
    MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
    -
    +MODULE_ALIAS_CRYPTO("deflate");
    diff --git a/crypto/des_generic.c b/crypto/des_generic.c
    index 873818d..e404201 100644
    --- a/crypto/des_generic.c
    +++ b/crypto/des_generic.c
    @@ -975,8 +975,6 @@ static struct crypto_alg des3_ede_alg = {
    .cia_decrypt = des3_ede_decrypt } }
    };

    -MODULE_ALIAS("des3_ede");
    -
    static int __init des_generic_mod_init(void)
    {
    int ret = 0;
    @@ -1004,4 +1002,7 @@ module_exit(des_generic_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
    MODULE_AUTHOR("Dag Arne Osvik <da@osvik.no>");
    -MODULE_ALIAS("des");
    +MODULE_ALIAS_CRYPTO("des");
    +MODULE_ALIAS_CRYPTO("des-generic");
    +MODULE_ALIAS_CRYPTO("des3_ede");
    +MODULE_ALIAS_CRYPTO("des3_ede-generic");
    diff --git a/crypto/ecb.c b/crypto/ecb.c
    index 935cfef..12011af 100644
    --- a/crypto/ecb.c
    +++ b/crypto/ecb.c
    @@ -185,3 +185,4 @@ module_exit(crypto_ecb_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("ECB block cipher algorithm");
    +MODULE_ALIAS_CRYPTO("ecb");
    diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
    index 42ce9f5..388f582 100644
    --- a/crypto/eseqiv.c
    +++ b/crypto/eseqiv.c
    @@ -267,3 +267,4 @@ module_exit(eseqiv_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Encrypted Sequence Number IV Generator");
    +MODULE_ALIAS_CRYPTO("eseqiv");
    diff --git a/crypto/fcrypt.c b/crypto/fcrypt.c
    index c33107e..d99a67d 100644
    --- a/crypto/fcrypt.c
    +++ b/crypto/fcrypt.c
    @@ -421,3 +421,4 @@ module_exit(fcrypt_mod_fini);
    MODULE_LICENSE("Dual BSD/GPL");
    MODULE_DESCRIPTION("FCrypt Cipher Algorithm");
    MODULE_AUTHOR("David Howells <dhowells@redhat.com>");
    +MODULE_ALIAS_CRYPTO("fcrypt");
    diff --git a/crypto/gcm.c b/crypto/gcm.c
    index b97b186..1e33561 100644
    --- a/crypto/gcm.c
    +++ b/crypto/gcm.c
    @@ -1374,6 +1374,7 @@ module_exit(crypto_gcm_module_exit);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Galois/Counter Mode");
    MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");
    -MODULE_ALIAS("gcm_base");
    -MODULE_ALIAS("rfc4106");
    -MODULE_ALIAS("rfc4543");
    +MODULE_ALIAS_CRYPTO("gcm_base");
    +MODULE_ALIAS_CRYPTO("rfc4106");
    +MODULE_ALIAS_CRYPTO("rfc4543");
    +MODULE_ALIAS_CRYPTO("gcm");
    diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
    index 7835b8f..bf5f8d7 100644
    --- a/crypto/ghash-generic.c
    +++ b/crypto/ghash-generic.c
    @@ -173,4 +173,5 @@ module_exit(ghash_mod_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
    -MODULE_ALIAS("ghash");
    +MODULE_ALIAS_CRYPTO("ghash");
    +MODULE_ALIAS_CRYPTO("ghash-generic");
    diff --git a/crypto/hmac.c b/crypto/hmac.c
    index 8d9544c..ade790b 100644
    --- a/crypto/hmac.c
    +++ b/crypto/hmac.c
    @@ -271,3 +271,4 @@ module_exit(hmac_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("HMAC hash algorithm");
    +MODULE_ALIAS_CRYPTO("hmac");
    diff --git a/crypto/khazad.c b/crypto/khazad.c
    index 527e4e3..ea82051 100644
    --- a/crypto/khazad.c
    +++ b/crypto/khazad.c
    @@ -881,3 +881,4 @@ module_exit(khazad_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Khazad Cryptographic Algorithm");
    +MODULE_ALIAS_CRYPTO("khazad");
    diff --git a/crypto/krng.c b/crypto/krng.c
    index 4328bb3..85418d6 100644
    --- a/crypto/krng.c
    +++ b/crypto/krng.c
    @@ -63,4 +63,5 @@ module_exit(krng_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Kernel Random Number Generator");
    -MODULE_ALIAS("stdrng");
    +MODULE_ALIAS_CRYPTO("stdrng");
    +MODULE_ALIAS_CRYPTO("krng");
    diff --git a/crypto/lrw.c b/crypto/lrw.c
    index 358f80b..567c195 100644
    --- a/crypto/lrw.c
    +++ b/crypto/lrw.c
    @@ -312,3 +312,4 @@ module_exit(crypto_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("LRW block cipher mode");
    +MODULE_ALIAS_CRYPTO("lrw");
    diff --git a/crypto/lzo.c b/crypto/lzo.c
    index b5e7707..6b21152 100644
    --- a/crypto/lzo.c
    +++ b/crypto/lzo.c
    @@ -104,3 +104,4 @@ module_exit(lzo_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("LZO Compression Algorithm");
    +MODULE_ALIAS_CRYPTO("lzo");
    diff --git a/crypto/md4.c b/crypto/md4.c
    index 0477a6a..3515af4 100644
    --- a/crypto/md4.c
    +++ b/crypto/md4.c
    @@ -255,4 +255,4 @@ module_exit(md4_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("MD4 Message Digest Algorithm");
    -
    +MODULE_ALIAS_CRYPTO("md4");
    diff --git a/crypto/md5.c b/crypto/md5.c
    index 7febeaa..36f5e5b 100644
    --- a/crypto/md5.c
    +++ b/crypto/md5.c
    @@ -168,3 +168,4 @@ module_exit(md5_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("MD5 Message Digest Algorithm");
    +MODULE_ALIAS_CRYPTO("md5");
    diff --git a/crypto/michael_mic.c b/crypto/michael_mic.c
    index 079b761..46195e0 100644
    --- a/crypto/michael_mic.c
    +++ b/crypto/michael_mic.c
    @@ -184,3 +184,4 @@ module_exit(michael_mic_exit);
    MODULE_LICENSE("GPL v2");
    MODULE_DESCRIPTION("Michael MIC");
    MODULE_AUTHOR("Jouni Malinen <j@w1.fi>");
    +MODULE_ALIAS_CRYPTO("michael_mic");
    diff --git a/crypto/pcbc.c b/crypto/pcbc.c
    index d1b8bdf..f654965 100644
    --- a/crypto/pcbc.c
    +++ b/crypto/pcbc.c
    @@ -295,3 +295,4 @@ module_exit(crypto_pcbc_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("PCBC block cipher algorithm");
    +MODULE_ALIAS_CRYPTO("pcbc");
    diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
    index 29a89da..ba92046 100644
    --- a/crypto/pcrypt.c
    +++ b/crypto/pcrypt.c
    @@ -565,3 +565,4 @@ module_exit(pcrypt_exit);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
    MODULE_DESCRIPTION("Parallel crypto wrapper");
    +MODULE_ALIAS_CRYPTO("pcrypt");
    diff --git a/crypto/rmd128.c b/crypto/rmd128.c
    index 8a0f68b..049486e 100644
    --- a/crypto/rmd128.c
    +++ b/crypto/rmd128.c
    @@ -327,3 +327,4 @@ module_exit(rmd128_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
    MODULE_DESCRIPTION("RIPEMD-128 Message Digest");
    +MODULE_ALIAS_CRYPTO("rmd128");
    diff --git a/crypto/rmd160.c b/crypto/rmd160.c
    index 525d7bb..de585e5 100644
    --- a/crypto/rmd160.c
    +++ b/crypto/rmd160.c
    @@ -371,3 +371,4 @@ module_exit(rmd160_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
    MODULE_DESCRIPTION("RIPEMD-160 Message Digest");
    +MODULE_ALIAS_CRYPTO("rmd160");
    diff --git a/crypto/rmd256.c b/crypto/rmd256.c
    index 69293d9..4ec02a7 100644
    --- a/crypto/rmd256.c
    +++ b/crypto/rmd256.c
    @@ -346,3 +346,4 @@ module_exit(rmd256_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
    MODULE_DESCRIPTION("RIPEMD-256 Message Digest");
    +MODULE_ALIAS_CRYPTO("rmd256");
    diff --git a/crypto/rmd320.c b/crypto/rmd320.c
    index 09f97df..770f2cb 100644
    --- a/crypto/rmd320.c
    +++ b/crypto/rmd320.c
    @@ -395,3 +395,4 @@ module_exit(rmd320_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
    MODULE_DESCRIPTION("RIPEMD-320 Message Digest");
    +MODULE_ALIAS_CRYPTO("rmd320");
    diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
    index eac10c1..f5e5a33 100644
    --- a/crypto/salsa20_generic.c
    +++ b/crypto/salsa20_generic.c
    @@ -249,4 +249,5 @@ module_exit(salsa20_generic_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm");
    -MODULE_ALIAS("salsa20");
    +MODULE_ALIAS_CRYPTO("salsa20");
    +MODULE_ALIAS_CRYPTO("salsa20-generic");
    diff --git a/crypto/seed.c b/crypto/seed.c
    index d3e422f..3e40f5f 100644
    --- a/crypto/seed.c
    +++ b/crypto/seed.c
    @@ -477,3 +477,4 @@ module_exit(seed_fini);
    MODULE_DESCRIPTION("SEED Cipher Algorithm");
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Hye-Shik Chang <perky@FreeBSD.org>, Kim Hyun <hkim@kisa.or.kr>");
    +MODULE_ALIAS_CRYPTO("seed");
    diff --git a/crypto/seqiv.c b/crypto/seqiv.c
    index 4c44912..385895f 100644
    --- a/crypto/seqiv.c
    +++ b/crypto/seqiv.c
    @@ -363,3 +363,4 @@ module_exit(seqiv_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Sequence Number IV Generator");
    +MODULE_ALIAS_CRYPTO("seqiv");
    diff --git a/crypto/serpent.c b/crypto/serpent.c
    index b651a55..db6beb6 100644
    --- a/crypto/serpent.c
    +++ b/crypto/serpent.c
    @@ -584,4 +584,5 @@ module_exit(serpent_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Cipher Algorithm");
    MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");
    -MODULE_ALIAS("tnepres");
    +MODULE_ALIAS_CRYPTO("tnepres");
    +MODULE_ALIAS_CRYPTO("serpent");
    diff --git a/crypto/sha1_generic.c b/crypto/sha1_generic.c
    index 4279480..fdf7c00 100644
    --- a/crypto/sha1_generic.c
    +++ b/crypto/sha1_generic.c
    @@ -153,4 +153,5 @@ module_exit(sha1_generic_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");

    -MODULE_ALIAS("sha1");
    +MODULE_ALIAS_CRYPTO("sha1");
    +MODULE_ALIAS_CRYPTO("sha1-generic");
    diff --git a/crypto/sha256_generic.c b/crypto/sha256_generic.c
    index c48459e..dcad5ce 100644
    --- a/crypto/sha256_generic.c
    +++ b/crypto/sha256_generic.c
    @@ -398,5 +398,7 @@ module_exit(sha256_generic_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm");

    -MODULE_ALIAS("sha224");
    -MODULE_ALIAS("sha256");
    +MODULE_ALIAS_CRYPTO("sha224");
    +MODULE_ALIAS_CRYPTO("sha224-generic");
    +MODULE_ALIAS_CRYPTO("sha256");
    +MODULE_ALIAS_CRYPTO("sha256-generic");
    diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
    index dd30f40..7a54cb4 100644
    --- a/crypto/sha512_generic.c
    +++ b/crypto/sha512_generic.c
    @@ -294,5 +294,7 @@ module_exit(sha512_generic_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("SHA-512 and SHA-384 Secure Hash Algorithms");

    -MODULE_ALIAS("sha384");
    -MODULE_ALIAS("sha512");
    +MODULE_ALIAS_CRYPTO("sha384");
    +MODULE_ALIAS_CRYPTO("sha384-generic");
    +MODULE_ALIAS_CRYPTO("sha512");
    +MODULE_ALIAS_CRYPTO("sha512-generic");
    diff --git a/crypto/tea.c b/crypto/tea.c
    index 412bc74..b8f7001 100644
    --- a/crypto/tea.c
    +++ b/crypto/tea.c
    @@ -299,8 +299,9 @@ static void __exit tea_mod_fini(void)
    crypto_unregister_alg(&xeta_alg);
    }

    -MODULE_ALIAS("xtea");
    -MODULE_ALIAS("xeta");
    +MODULE_ALIAS_CRYPTO("tea");
    +MODULE_ALIAS_CRYPTO("xtea");
    +MODULE_ALIAS_CRYPTO("xeta");

    module_init(tea_mod_init);
    module_exit(tea_mod_fini);
    diff --git a/crypto/tgr192.c b/crypto/tgr192.c
    index cbca4f20..35dbd59 100644
    --- a/crypto/tgr192.c
    +++ b/crypto/tgr192.c
    @@ -702,8 +702,9 @@ static void __exit tgr192_mod_fini(void)
    crypto_unregister_shash(&tgr128);
    }

    -MODULE_ALIAS("tgr160");
    -MODULE_ALIAS("tgr128");
    +MODULE_ALIAS_CRYPTO("tgr192");
    +MODULE_ALIAS_CRYPTO("tgr160");
    +MODULE_ALIAS_CRYPTO("tgr128");

    module_init(tgr192_mod_init);
    module_exit(tgr192_mod_fini);
    diff --git a/crypto/twofish_generic.c b/crypto/twofish_generic.c
    index 1f07b84..c8c35c5 100644
    --- a/crypto/twofish_generic.c
    +++ b/crypto/twofish_generic.c
    @@ -212,4 +212,5 @@ module_exit(twofish_mod_fini);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION ("Twofish Cipher Algorithm");
    -MODULE_ALIAS("twofish");
    +MODULE_ALIAS_CRYPTO("twofish");
    +MODULE_ALIAS_CRYPTO("twofish-generic");
    diff --git a/crypto/vmac.c b/crypto/vmac.c
    index 4243905..8979bc8 100644
    --- a/crypto/vmac.c
    +++ b/crypto/vmac.c
    @@ -673,4 +673,5 @@ module_exit(vmac_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("VMAC hash algorithm");
    +MODULE_ALIAS_CRYPTO("vmac");

    diff --git a/crypto/wp512.c b/crypto/wp512.c
    index 71719a2be..1bf7f07 100644
    --- a/crypto/wp512.c
    +++ b/crypto/wp512.c
    @@ -1194,8 +1194,9 @@ static void __exit wp512_mod_fini(void)
    crypto_unregister_shash(&wp256);
    }

    -MODULE_ALIAS("wp384");
    -MODULE_ALIAS("wp256");
    +MODULE_ALIAS_CRYPTO("wp512");
    +MODULE_ALIAS_CRYPTO("wp384");
    +MODULE_ALIAS_CRYPTO("wp256");

    module_init(wp512_mod_init);
    module_exit(wp512_mod_fini);
    diff --git a/crypto/xcbc.c b/crypto/xcbc.c
    index a5fbdf3..df90b33 100644
    --- a/crypto/xcbc.c
    +++ b/crypto/xcbc.c
    @@ -286,3 +286,4 @@ module_exit(crypto_xcbc_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("XCBC keyed hash algorithm");
    +MODULE_ALIAS_CRYPTO("xcbc");
    diff --git a/crypto/xts.c b/crypto/xts.c
    index 8517054..6a09b72 100644
    --- a/crypto/xts.c
    +++ b/crypto/xts.c
    @@ -289,3 +289,4 @@ module_exit(crypto_module_exit);

    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("XTS block cipher mode");
    +MODULE_ALIAS_CRYPTO("xts");
    diff --git a/crypto/zlib.c b/crypto/zlib.c
    index 06b62e5..d980788 100644
    --- a/crypto/zlib.c
    +++ b/crypto/zlib.c
    @@ -378,3 +378,4 @@ module_exit(zlib_mod_fini);
    MODULE_LICENSE("GPL");
    MODULE_DESCRIPTION("Zlib Compression Algorithm");
    MODULE_AUTHOR("Sony Corporation");
    +MODULE_ALIAS_CRYPTO("zlib");
    diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    index 05df096..30229af 100644
    --- a/drivers/acpi/ec.c
    +++ b/drivers/acpi/ec.c
    @@ -129,6 +129,7 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
    static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
    static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
    static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
    +static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */

    /* --------------------------------------------------------------------------
    Transaction Management
    @@ -206,13 +207,8 @@ static bool advance_transaction(struct acpi_ec *ec)
    }
    return wakeup;
    } else {
    - /*
    - * There is firmware refusing to respond QR_EC when SCI_EVT
    - * is not set, for which case, we complete the QR_EC
    - * without issuing it to the firmware.
    - * https://bugzilla.kernel.org/show_bug.cgi?id=86211
    - */
    - if (!(status & ACPI_EC_FLAG_SCI) &&
    + if (EC_FLAGS_QUERY_HANDSHAKE &&
    + !(status & ACPI_EC_FLAG_SCI) &&
    (t->command == ACPI_EC_COMMAND_QUERY)) {
    t->flags |= ACPI_EC_COMMAND_POLL;
    t->rdata[t->ri++] = 0x00;
    @@ -987,6 +983,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
    }

    /*
    + * Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for
    + * which case, we complete the QR_EC without issuing it to the firmware.
    + * https://bugzilla.kernel.org/show_bug.cgi?id=86211
    + */
    +static int ec_flag_query_handshake(const struct dmi_system_id *id)
    +{
    + pr_debug("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n");
    + EC_FLAGS_QUERY_HANDSHAKE = 1;
    + return 0;
    +}
    +
    +/*
    * On some hardware it is necessary to clear events accumulated by the EC during
    * sleep. These ECs stop reporting GPEs until they are manually polled, if too
    * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
    @@ -1052,6 +1060,9 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
    {
    ec_clear_on_resume, "Samsung hardware", {
    DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
    + {
    + ec_flag_query_handshake, "Acer hardware", {
    + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL},
    {},
    };

    diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    index 2ddf736..5d8fc3d 100644
    --- a/drivers/ata/libata-core.c
    +++ b/drivers/ata/libata-core.c
    @@ -4730,7 +4730,10 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
    return NULL;

    for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
    - tag = tag < max_queue ? tag : 0;
    + if (ap->flags & ATA_FLAG_LOWTAG)
    + tag = i;
    + else
    + tag = tag < max_queue ? tag : 0;

    /* the last tag is reserved for internal command. */
    if (tag == ATA_TAG_INTERNAL)
    diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
    index 8eae157..22edc92 100644
    --- a/drivers/ata/libata-sff.c
    +++ b/drivers/ata/libata-sff.c
    @@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap)
    DPRINTK("ENTER\n");

    cancel_delayed_work_sync(&ap->sff_pio_task);
    +
    + /*
    + * We wanna reset the HSM state to IDLE. If we do so without
    + * grabbing the port lock, critical sections protected by it which
    + * expect the HSM state to stay stable may get surprised. For
    + * example, we may set IDLE in between the time
    + * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
    + * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
    + */
    + spin_lock_irq(ap->lock);
    ap->hsm_task_state = HSM_ST_IDLE;
    + spin_unlock_irq(ap->lock);
    +
    ap->sff_pio_task_link = NULL;

    if (ata_msg_ctl(ap))
    diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
    index 5c42374..0bec79e 100644
    --- a/drivers/ata/sata_dwc_460ex.c
    +++ b/drivers/ata/sata_dwc_460ex.c
    @@ -791,7 +791,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
    if (err) {
    dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns"
    " %d\n", __func__, err);
    - goto error_out;
    + return err;
    }

    /* Enabe DMA */
    @@ -802,11 +802,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
    sata_dma_regs);

    return 0;
    -
    -error_out:
    - dma_dwc_exit(hsdev);
    -
    - return err;
    }

    static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val)
    @@ -1634,7 +1629,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
    char *ver = (char *)&versionr;
    u8 *base = NULL;
    int err = 0;
    - int irq, rc;
    + int irq;
    struct ata_host *host;
    struct ata_port_info pi = sata_dwc_port_info[0];
    const struct ata_port_info *ppi[] = { &pi, NULL };
    @@ -1688,7 +1683,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
    if (irq == NO_IRQ) {
    dev_err(&ofdev->dev, "no SATA DMA irq\n");
    err = -ENODEV;
    - goto error_out;
    + goto error_iomap;
    }

    /* Get physical SATA DMA register base address */
    @@ -1697,14 +1692,16 @@ static int sata_dwc_probe(struct platform_device *ofdev)
    dev_err(&ofdev->dev, "ioremap failed for AHBDMA register"
    " address\n");
    err = -ENODEV;
    - goto error_out;
    + goto error_iomap;
    }

    /* Save dev for later use in dev_xxx() routines */
    host_pvt.dwc_dev = &ofdev->dev;

    /* Initialize AHB DMAC */
    - dma_dwc_init(hsdev, irq);
    + err = dma_dwc_init(hsdev, irq);
    + if (err)
    + goto error_dma_iomap;

    /* Enable SATA Interrupts */
    sata_dwc_enable_interrupts(hsdev);
    @@ -1722,9 +1719,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
    * device discovery process, invoking our port_start() handler &
    * error_handler() to execute a dummy Softreset EH session
    */
    - rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
    -
    - if (rc != 0)
    + err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
    + if (err)
    dev_err(&ofdev->dev, "failed to activate host");

    dev_set_drvdata(&ofdev->dev, host);
    @@ -1733,7 +1729,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
    error_out:
    /* Free SATA DMA resources */
    dma_dwc_exit(hsdev);
    -
    +error_dma_iomap:
    + iounmap((void __iomem *)host_pvt.sata_dma_regs);
    error_iomap:
    iounmap(base);
    error_kmalloc:
    @@ -1754,6 +1751,7 @@ static int sata_dwc_remove(struct platform_device *ofdev)
    /* Free SATA DMA resources */
    dma_dwc_exit(hsdev);

    + iounmap((void __iomem *)host_pvt.sata_dma_regs);
    iounmap(hsdev->reg_base);
    kfree(hsdev);
    kfree(host);
    diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
    index 1e91406..2178022 100644
    --- a/drivers/ata/sata_sil24.c
    +++ b/drivers/ata/sata_sil24.c
    @@ -246,7 +246,7 @@ enum {
    /* host flags */
    SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
    ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
    - ATA_FLAG_AN | ATA_FLAG_PMP,
    + ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
    SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */

    IRQ_STAT_4PORTS = 0xf,
    diff --git a/drivers/base/bus.c b/drivers/base/bus.c
    index 8b8e8c0..b802cfc 100644
    --- a/drivers/base/bus.c
    +++ b/drivers/base/bus.c
    @@ -240,13 +240,15 @@ static ssize_t store_drivers_probe(struct bus_type *bus,
    const char *buf, size_t count)
    {
    struct device *dev;
    + int err = -EINVAL;

    dev = bus_find_device_by_name(bus, NULL, buf);
    if (!dev)
    return -ENODEV;
    - if (bus_rescan_devices_helper(dev, NULL) != 0)
    - return -EINVAL;
    - return count;
    + if (bus_rescan_devices_helper(dev, NULL) == 0)
    + err = count;
    + put_device(dev);
    + return err;
    }
    #endif

    diff --git a/drivers/base/core.c b/drivers/base/core.c
    index 919daa7..81e0e87 100644
    --- a/drivers/base/core.c
    +++ b/drivers/base/core.c
    @@ -1417,34 +1417,11 @@ static void device_create_release(struct device *dev)
    kfree(dev);
    }

    -/**
    - * device_create_vargs - creates a device and registers it with sysfs
    - * @class: pointer to the struct class that this device should be registered to
    - * @parent: pointer to the parent struct device of this new device, if any
    - * @devt: the dev_t for the char device to be added
    - * @drvdata: the data to be added to the device for callbacks
    - * @fmt: string for the device's name
    - * @args: va_list for the device's name
    - *
    - * This function can be used by char device classes. A struct device
    - * will be created in sysfs, registered to the specified class.
    - *
    - * A "dev" file will be created, showing the dev_t for the device, if
    - * the dev_t is not 0,0.
    - * If a pointer to a parent struct device is passed in, the newly created
    - * struct device will be a child of that device in sysfs.
    - * The pointer to the struct device will be returned from the call.
    - * Any further sysfs files that might be required can be created using this
    - * pointer.
    - *
    - * Returns &struct device pointer on success, or ERR_PTR() on error.
    - *
    - * Note: the struct class passed to this function must have previously
    - * been created with a call to class_create().
    - */
    -struct device *device_create_vargs(struct class *class, struct device *parent,
    - dev_t devt, void *drvdata, const char *fmt,
    - va_list args)
    +static struct device *
    +device_create_groups_vargs(struct class *class, struct device *parent,
    + dev_t devt, void *drvdata,
    + const struct attribute_group **groups,
    + const char *fmt, va_list args)
    {
    struct device *dev = NULL;
    int retval = -ENODEV;
    @@ -1461,6 +1438,7 @@ struct device *device_create_vargs(struct class *class, struct device *parent,
    dev->devt = devt;
    dev->class = class;
    dev->parent = parent;
    + dev->groups = groups;
    dev->release = device_create_release;
    dev_set_drvdata(dev, drvdata);

    @@ -1478,6 +1456,39 @@ error:
    put_device(dev);
    return ERR_PTR(retval);
    }
    +
    +/**
    + * device_create_vargs - creates a device and registers it with sysfs
    + * @class: pointer to the struct class that this device should be registered to
    + * @parent: pointer to the parent struct device of this new device, if any
    + * @devt: the dev_t for the char device to be added
    + * @drvdata: the data to be added to the device for callbacks
    + * @fmt: string for the device's name
    + * @args: va_list for the device's name
    + *
    + * This function can be used by char device classes. A struct device
    + * will be created in sysfs, registered to the specified class.
    + *
    + * A "dev" file will be created, showing the dev_t for the device, if
    + * the dev_t is not 0,0.
    + * If a pointer to a parent struct device is passed in, the newly created
    + * struct device will be a child of that device in sysfs.
    + * The pointer to the struct device will be returned from the call.
    + * Any further sysfs files that might be required can be created using this
    + * pointer.
    + *
    + * Returns &struct device pointer on success, or ERR_PTR() on error.
    + *
    + * Note: the struct class passed to this function must have previously
    + * been created with a call to class_create().
    + */
    +struct device *device_create_vargs(struct class *class, struct device *parent,
    + dev_t devt, void *drvdata, const char *fmt,
    + va_list args)
    +{
    + return device_create_groups_vargs(class, parent, devt, drvdata, NULL,
    + fmt, args);
    +}
    EXPORT_SYMBOL_GPL(device_create_vargs);

    /**
    @@ -1517,6 +1528,50 @@ struct device *device_create(struct class *class, struct device *parent,
    }
    EXPORT_SYMBOL_GPL(device_create);

    +/**
    + * device_create_with_groups - creates a device and registers it with sysfs
    + * @class: pointer to the struct class that this device should be registered to
    + * @parent: pointer to the parent struct device of this new device, if any
    + * @devt: the dev_t for the char device to be added
    + * @drvdata: the data to be added to the device for callbacks
    + * @groups: NULL-terminated list of attribute groups to be created
    + * @fmt: string for the device's name
    + *
    + * This function can be used by char device classes. A struct device
    + * will be created in sysfs, registered to the specified class.
    + * Additional attributes specified in the groups parameter will also
    + * be created automatically.
    + *
    + * A "dev" file will be created, showing the dev_t for the device, if
    + * the dev_t is not 0,0.
    + * If a pointer to a parent struct device is passed in, the newly created
    + * struct device will be a child of that device in sysfs.
    + * The pointer to the struct device will be returned from the call.
    + * Any further sysfs files that might be required can be created using this
    + * pointer.
    + *
    + * Returns &struct device pointer on success, or ERR_PTR() on error.
    + *
    + * Note: the struct class passed to this function must have previously
    + * been created with a call to class_create().
    + */
    +struct device *device_create_with_groups(struct class *class,
    + struct device *parent, dev_t devt,
    + void *drvdata,
    + const struct attribute_group **groups,
    + const char *fmt, ...)
    +{
    + va_list vargs;
    + struct device *dev;
    +
    + va_start(vargs, fmt);
    + dev = device_create_groups_vargs(class, parent, devt, drvdata, groups,
    + fmt, vargs);
    + va_end(vargs);
    + return dev;
    +}
    +EXPORT_SYMBOL_GPL(device_create_with_groups);
    +
    static int __match_devt(struct device *dev, void *data)
    {
    dev_t *devt = data;
    diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
    index be984e0..43da226 100644
    --- a/drivers/block/drbd/drbd_req.c
    +++ b/drivers/block/drbd/drbd_req.c
    @@ -1184,6 +1184,7 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct
    struct request_queue * const b =
    mdev->ldev->backing_bdev->bd_disk->queue;
    if (b->merge_bvec_fn) {
    + bvm->bi_bdev = mdev->ldev->backing_bdev;
    backing_limit = b->merge_bvec_fn(b, bvm, bvec);
    limit = min(limit, backing_limit);
    }
    diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
    index 6fe003a..10e442b 100644
    --- a/drivers/bluetooth/ath3k.c
    +++ b/drivers/bluetooth/ath3k.c
    @@ -61,48 +61,59 @@ static struct usb_device_id ath3k_table[] = {
    { USB_DEVICE(0x0CF3, 0x3000) },

    /* Atheros AR3011 with sflash firmware*/
    + { USB_DEVICE(0x0489, 0xE027) },
    + { USB_DEVICE(0x0489, 0xE03D) },
    + { USB_DEVICE(0x0930, 0x0215) },
    { USB_DEVICE(0x0CF3, 0x3002) },
    { USB_DEVICE(0x0CF3, 0xE019) },
    { USB_DEVICE(0x13d3, 0x3304) },
    - { USB_DEVICE(0x0930, 0x0215) },
    - { USB_DEVICE(0x0489, 0xE03D) },
    - { USB_DEVICE(0x0489, 0xE027) },

    /* Atheros AR9285 Malbec with sflash firmware */
    { USB_DEVICE(0x03F0, 0x311D) },

    /* Atheros AR3012 with sflash firmware*/
    - { USB_DEVICE(0x0CF3, 0x0036) },
    - { USB_DEVICE(0x0CF3, 0x3004) },
    - { USB_DEVICE(0x0CF3, 0x3008) },
    - { USB_DEVICE(0x0CF3, 0x311D) },
    - { USB_DEVICE(0x0CF3, 0x817a) },
    - { USB_DEVICE(0x13d3, 0x3375) },
    + { USB_DEVICE(0x0489, 0xe04d) },
    + { USB_DEVICE(0x0489, 0xe04e) },
    + { USB_DEVICE(0x0489, 0xe057) },
    + { USB_DEVICE(0x0489, 0xe056) },
    + { USB_DEVICE(0x0489, 0xe05f) },
    + { USB_DEVICE(0x0489, 0xe078) },
    + { USB_DEVICE(0x04c5, 0x1330) },
    { USB_DEVICE(0x04CA, 0x3004) },
    { USB_DEVICE(0x04CA, 0x3005) },
    { USB_DEVICE(0x04CA, 0x3006) },
    { USB_DEVICE(0x04CA, 0x3007) },
    { USB_DEVICE(0x04CA, 0x3008) },
    - { USB_DEVICE(0x13d3, 0x3362) },
    + { USB_DEVICE(0x04CA, 0x300b) },
    + { USB_DEVICE(0x04CA, 0x3010) },
    + { USB_DEVICE(0x0930, 0x0219) },
    + { USB_DEVICE(0x0930, 0x0220) },
    + { USB_DEVICE(0x0930, 0x0227) },
    + { USB_DEVICE(0x0b05, 0x17d0) },
    + { USB_DEVICE(0x0CF3, 0x0036) },
    + { USB_DEVICE(0x0CF3, 0x3004) },
    + { USB_DEVICE(0x0CF3, 0x3008) },
    + { USB_DEVICE(0x0CF3, 0x311D) },
    + { USB_DEVICE(0x0CF3, 0x311E) },
    + { USB_DEVICE(0x0CF3, 0x311F) },
    + { USB_DEVICE(0x0cf3, 0x3121) },
    + { USB_DEVICE(0x0CF3, 0x817a) },
    + { USB_DEVICE(0x0cf3, 0xe003) },
    { USB_DEVICE(0x0CF3, 0xE004) },
    { USB_DEVICE(0x0CF3, 0xE005) },
    - { USB_DEVICE(0x0930, 0x0219) },
    - { USB_DEVICE(0x0489, 0xe057) },
    + { USB_DEVICE(0x13d3, 0x3362) },
    + { USB_DEVICE(0x13d3, 0x3375) },
    { USB_DEVICE(0x13d3, 0x3393) },
    - { USB_DEVICE(0x0489, 0xe04e) },
    - { USB_DEVICE(0x0489, 0xe056) },
    - { USB_DEVICE(0x0489, 0xe04d) },
    - { USB_DEVICE(0x04c5, 0x1330) },
    { USB_DEVICE(0x13d3, 0x3402) },
    - { USB_DEVICE(0x0cf3, 0x3121) },
    - { USB_DEVICE(0x0cf3, 0xe003) },
    + { USB_DEVICE(0x13d3, 0x3408) },
    + { USB_DEVICE(0x13d3, 0x3432) },

    /* Atheros AR5BBU12 with sflash firmware */
    { USB_DEVICE(0x0489, 0xE02C) },

    /* Atheros AR5BBU22 with sflash firmware */
    - { USB_DEVICE(0x0489, 0xE03C) },
    { USB_DEVICE(0x0489, 0xE036) },
    + { USB_DEVICE(0x0489, 0xE03C) },

    { } /* Terminating entry */
    };
    @@ -115,34 +126,45 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
    static struct usb_device_id ath3k_blist_tbl[] = {

    /* Atheros AR3012 with sflash firmware*/
    - { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },

    /* Atheros AR5BBU22 with sflash firmware */
    - { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },

    { } /* Terminating entry */
    };
    diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    index 8750d52..2b479d6 100644
    --- a/drivers/bluetooth/btusb.c
    +++ b/drivers/bluetooth/btusb.c
    @@ -55,6 +55,7 @@ static struct usb_driver btusb_driver;
    #define BTUSB_BROKEN_ISOC 0x20
    #define BTUSB_WRONG_SCO_MTU 0x40
    #define BTUSB_ATH3012 0x80
    +#define BTUSB_INTEL_BOOT 0x200

    static struct usb_device_id btusb_table[] = {
    /* Generic Bluetooth USB device */
    @@ -107,18 +108,31 @@ static struct usb_device_id btusb_table[] = {
    { USB_DEVICE(0x0c10, 0x0000) },

    /* Broadcom BCM20702A0 */
    + { USB_DEVICE(0x0489, 0xe042) },
    + { USB_DEVICE(0x04ca, 0x2003) },
    { USB_DEVICE(0x0b05, 0x17b5) },
    { USB_DEVICE(0x0b05, 0x17cb) },
    - { USB_DEVICE(0x04ca, 0x2003) },
    - { USB_DEVICE(0x0489, 0xe042) },
    { USB_DEVICE(0x413c, 0x8197) },

    /* Foxconn - Hon Hai */
    { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },

    - /*Broadcom devices with vendor specific id */
    + /* Broadcom devices with vendor specific id */
    { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },

    + /* ASUSTek Computer - Broadcom based */
    + { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
    +
    + /* Belkin F8065bf - Broadcom based */
    + { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
    +
    + /* IMC Networks - Broadcom based */
    + { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
    +
    + /* Intel Bluetooth USB Bootloader (RAM module) */
    + { USB_DEVICE(0x8087, 0x0a5a),
    + .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
    +
    { } /* Terminating entry */
    };

    @@ -132,53 +146,64 @@ static struct usb_device_id blacklist_table[] = {
    { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },

    /* Atheros 3011 with sflash firmware */
    + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
    + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
    + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
    - { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
    - { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
    - { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },

    /* Atheros AR9285 Malbec with sflash firmware */
    { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },

    /* Atheros 3012 with sflash firmware */
    - { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
    - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },

    /* Atheros AR5BBU12 with sflash firmware */
    { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },

    /* Atheros AR5BBU12 with sflash firmware */
    - { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },

    /* Broadcom BCM2035 */
    - { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
    - { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
    { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
    + { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
    + { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },

    /* Broadcom BCM2045 */
    { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
    @@ -1058,6 +1083,9 @@ static int btusb_probe(struct usb_interface *intf,

    hdev->owner = THIS_MODULE;

    + if (id->driver_info & BTUSB_INTEL_BOOT)
    + set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
    +
    /* Interface numbers are hardcoded in the specification */
    data->isoc = usb_ifnum_to_if(data->udev, 1);

    diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
    index 29b9469..87500e6 100644
    --- a/drivers/crypto/padlock-aes.c
    +++ b/drivers/crypto/padlock-aes.c
    @@ -559,4 +559,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Michal Ludvig");

    -MODULE_ALIAS("aes");
    +MODULE_ALIAS_CRYPTO("aes");
    diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
    index 06bdb4b..710f3cb 100644
    --- a/drivers/crypto/padlock-sha.c
    +++ b/drivers/crypto/padlock-sha.c
    @@ -593,7 +593,7 @@ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA256 algorithms support.");
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Michal Ludvig");

    -MODULE_ALIAS("sha1-all");
    -MODULE_ALIAS("sha256-all");
    -MODULE_ALIAS("sha1-padlock");
    -MODULE_ALIAS("sha256-padlock");
    +MODULE_ALIAS_CRYPTO("sha1-all");
    +MODULE_ALIAS_CRYPTO("sha256-all");
    +MODULE_ALIAS_CRYPTO("sha1-padlock");
    +MODULE_ALIAS_CRYPTO("sha256-padlock");
    diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
    index a971e3d..51e5ee8 100644
    --- a/drivers/gpio/gpiolib.c
    +++ b/drivers/gpio/gpiolib.c
    @@ -58,6 +58,7 @@ struct gpio_desc {
    #define FLAG_TRIG_FALL 5 /* trigger on falling edge */
    #define FLAG_TRIG_RISE 6 /* trigger on rising edge */
    #define FLAG_ACTIVE_LOW 7 /* sysfs value has active low */
    +#define FLAG_SYSFS_DIR 10 /* show sysfs direction attribute */

    #define ID_SHIFT 16 /* add new flags before this one */

    @@ -317,7 +318,7 @@ static ssize_t gpio_value_store(struct device *dev,
    return status;
    }

    -static const DEVICE_ATTR(value, 0644,
    +static DEVICE_ATTR(value, 0644,
    gpio_value_show, gpio_value_store);

    static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
    @@ -540,17 +541,47 @@ static ssize_t gpio_active_low_store(struct device *dev,
    return status ? : size;
    }

    -static const DEVICE_ATTR(active_low, 0644,
    +static DEVICE_ATTR(active_low, 0644,
    gpio_active_low_show, gpio_active_low_store);

    -static const struct attribute *gpio_attrs[] = {
    +static mode_t gpio_is_visible(struct kobject *kobj, struct attribute *attr,
    + int n)
    +{
    + struct device *dev = container_of(kobj, struct device, kobj);
    + struct gpio_desc *desc = dev_get_drvdata(dev);
    + unsigned gpio = desc - gpio_desc;
    + mode_t mode = attr->mode;
    + bool show_direction = test_bit(FLAG_SYSFS_DIR, &desc->flags);
    +
    + if (attr == &dev_attr_direction.attr) {
    + if (!show_direction)
    + mode = 0;
    + } else if (attr == &dev_attr_edge.attr) {
    + if (gpio_to_irq(gpio) < 0)
    + mode = 0;
    + if (!show_direction && test_bit(FLAG_IS_OUT, &desc->flags))
    + mode = 0;
    + }
    +
    + return mode;
    +}
    +
    +static struct attribute *gpio_attrs[] = {
    + &dev_attr_direction.attr,
    + &dev_attr_edge.attr,
    &dev_attr_value.attr,
    &dev_attr_active_low.attr,
    NULL,
    };

    -static const struct attribute_group gpio_attr_group = {
    - .attrs = (struct attribute **) gpio_attrs,
    +static const struct attribute_group gpio_group = {
    + .attrs = gpio_attrs,
    + .is_visible = gpio_is_visible,
    +};
    +
    +static const struct attribute_group *gpio_groups[] = {
    + &gpio_group,
    + NULL
    };

    /*
    @@ -587,16 +618,13 @@ static ssize_t chip_ngpio_show(struct device *dev,
    }
    static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);

    -static const struct attribute *gpiochip_attrs[] = {
    +static struct attribute *gpiochip_attrs[] = {
    &dev_attr_base.attr,
    &dev_attr_label.attr,
    &dev_attr_ngpio.attr,
    NULL,
    };
    -
    -static const struct attribute_group gpiochip_attr_group = {
    - .attrs = (struct attribute **) gpiochip_attrs,
    -};
    +ATTRIBUTE_GROUPS(gpiochip);

    /*
    * /sys/class/gpio/export ... write-only
    @@ -700,8 +728,9 @@ int gpio_export(unsigned gpio, bool direction_may_change)
    {
    unsigned long flags;
    struct gpio_desc *desc;
    - int status = -EINVAL;
    + int status;
    const char *ioname = NULL;
    + struct device *dev;

    /* can't export until sysfs is available ... */
    if (!gpio_class.p) {
    @@ -709,59 +738,50 @@ int gpio_export(unsigned gpio, bool direction_may_change)
    return -ENOENT;
    }

    - if (!gpio_is_valid(gpio))
    - goto done;
    + if (!gpio_is_valid(gpio)) {
    + pr_debug("%s: gpio %d is not valid\n", __func__, gpio);
    + return -EINVAL;
    + }

    mutex_lock(&sysfs_lock);

    spin_lock_irqsave(&gpio_lock, flags);
    desc = &gpio_desc[gpio];
    - if (test_bit(FLAG_REQUESTED, &desc->flags)
    - && !test_bit(FLAG_EXPORT, &desc->flags)) {
    - status = 0;
    - if (!desc->chip->direction_input
    - || !desc->chip->direction_output)
    - direction_may_change = false;
    + if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
    + test_bit(FLAG_EXPORT, &desc->flags)) {
    + spin_unlock_irqrestore(&gpio_lock, flags);
    + pr_debug("%s: gpio %d unavailable (requested=%d, exported=%d)\n",
    + __func__, gpio,
    + test_bit(FLAG_REQUESTED, &desc->flags),
    + test_bit(FLAG_EXPORT, &desc->flags));
    + return -EPERM;
    + }
    +
    + if (desc->chip->direction_input && desc->chip->direction_output &&
    + direction_may_change) {
    + set_bit(FLAG_SYSFS_DIR, &desc->flags);
    }
    +
    spin_unlock_irqrestore(&gpio_lock, flags);

    if (desc->chip->names && desc->chip->names[gpio - desc->chip->base])
    ioname = desc->chip->names[gpio - desc->chip->base];

    - if (status == 0) {
    - struct device *dev;
    -
    - dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
    - desc, ioname ? ioname : "gpio%u", gpio);
    - if (!IS_ERR(dev)) {
    - status = sysfs_create_group(&dev->kobj,
    - &gpio_attr_group);
    -
    - if (!status && direction_may_change)
    - status = device_create_file(dev,
    - &dev_attr_direction);
    -
    - if (!status && gpio_to_irq(gpio) >= 0
    - && (direction_may_change
    - || !test_bit(FLAG_IS_OUT,
    - &desc->flags)))
    - status = device_create_file(dev,
    - &dev_attr_edge);
    -
    - if (status != 0)
    - device_unregister(dev);
    - } else
    - status = PTR_ERR(dev);
    - if (status == 0)
    - set_bit(FLAG_EXPORT, &desc->flags);
    + dev = device_create_with_groups(&gpio_class, desc->chip->dev,
    + MKDEV(0, 0), desc, gpio_groups,
    + ioname ? ioname : "gpio%u", gpio);
    + if (IS_ERR(dev)) {
    + status = PTR_ERR(dev);
    + goto fail_unlock;
    }

    + set_bit(FLAG_EXPORT, &desc->flags);
    mutex_unlock(&sysfs_lock);
    + return 0;

    -done:
    - if (status)
    - pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
    -
    +fail_unlock:
    + mutex_unlock(&sysfs_lock);
    + pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
    return status;
    }
    EXPORT_SYMBOL_GPL(gpio_export);
    @@ -873,6 +893,7 @@ void gpio_unexport(unsigned gpio)
    {
    struct gpio_desc *desc;
    int status = 0;
    + struct device *dev = NULL;

    if (!gpio_is_valid(gpio)) {
    status = -EINVAL;
    @@ -884,19 +905,21 @@ void gpio_unexport(unsigned gpio)
    desc = &gpio_desc[gpio];

    if (test_bit(FLAG_EXPORT, &desc->flags)) {
    - struct device *dev = NULL;

    dev = class_find_device(&gpio_class, NULL, desc, match_export);
    if (dev) {
    gpio_setup_irq(desc, dev, 0);
    + clear_bit(FLAG_SYSFS_DIR, &desc->flags);
    clear_bit(FLAG_EXPORT, &desc->flags);
    - put_device(dev);
    - device_unregister(dev);
    } else
    status = -ENODEV;
    }

    mutex_unlock(&sysfs_lock);
    + if (dev) {
    + device_unregister(dev);
    + put_device(dev);
    + }
    done:
    if (status)
    pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
    @@ -918,13 +941,13 @@ static int gpiochip_export(struct gpio_chip *chip)

    /* use chip->base for the ID; it's already known to be unique */
    mutex_lock(&sysfs_lock);
    - dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
    - "gpiochip%d", chip->base);
    - if (!IS_ERR(dev)) {
    - status = sysfs_create_group(&dev->kobj,
    - &gpiochip_attr_group);
    - } else
    + dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
    + chip, gpiochip_groups,
    + "gpiochip%d", chip->base);
    + if (IS_ERR(dev))
    status = PTR_ERR(dev);
    + else
    + status = 0;
    chip->exported = (status == 0);
    mutex_unlock(&sysfs_lock);

    @@ -1075,9 +1098,9 @@ int gpiochip_add(struct gpio_chip *chip)
    ? (1 << FLAG_IS_OUT)
    : 0;
    }
    - }

    - of_gpiochip_add(chip);
    + of_gpiochip_add(chip);
    + }

    unlock:
    spin_unlock_irqrestore(&gpio_lock, flags);
    @@ -1086,8 +1109,10 @@ unlock:
    goto fail;

    status = gpiochip_export(chip);
    - if (status)
    + if (status) {
    + of_gpiochip_remove(chip);
    goto fail;
    + }

    return 0;
    fail:
    diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
    index 2865b44..315a49e 100644
    --- a/drivers/gpu/drm/i915/i915_gem.c
    +++ b/drivers/gpu/drm/i915/i915_gem.c
    @@ -2248,6 +2248,13 @@ static int sandybridge_write_fence_reg(struct drm_i915_gem_object *obj,
    int regnum = obj->fence_reg;
    uint64_t val;

    + /* Adjust fence size to match tiled area */
    + if (obj->tiling_mode != I915_TILING_NONE) {
    + uint32_t row_size = obj->stride *
    + (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
    + size = (size / row_size) * row_size;
    + }
    +
    val = (uint64_t)((obj->gtt_offset + size - 4096) &
    0xfffff000) << 32;
    val |= obj->gtt_offset & 0xfffff000;
    @@ -2285,6 +2292,13 @@ static int i965_write_fence_reg(struct drm_i915_gem_object *obj,
    int regnum = obj->fence_reg;
    uint64_t val;

    + /* Adjust fence size to match tiled area */
    + if (obj->tiling_mode != I915_TILING_NONE) {
    + uint32_t row_size = obj->stride *
    + (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
    + size = (size / row_size) * row_size;
    + }
    +
    val = (uint64_t)((obj->gtt_offset + size - 4096) &
    0xfffff000) << 32;
    val |= obj->gtt_offset & 0xfffff000;
    diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    index 15fb260..1ed5a1c 100644
    --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    @@ -484,14 +484,7 @@ void vmw_fence_obj_flush(struct vmw_fence_obj *fence)

    static void vmw_fence_destroy(struct vmw_fence_obj *fence)
    {
    - struct vmw_fence_manager *fman = fence->fman;
    -
    kfree(fence);
    - /*
    - * Free kernel space accounting.
    - */
    - ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
    - fman->fence_size);
    }

    int vmw_fence_create(struct vmw_fence_manager *fman,
    @@ -499,20 +492,12 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
    uint32_t mask,
    struct vmw_fence_obj **p_fence)
    {
    - struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
    struct vmw_fence_obj *fence;
    int ret;

    - ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
    - false, false);
    - if (unlikely(ret != 0))
    - return ret;
    -
    fence = kzalloc(sizeof(*fence), GFP_KERNEL);
    - if (unlikely(fence == NULL)) {
    - ret = -ENOMEM;
    - goto out_no_object;
    - }
    + if (unlikely(fence == NULL))
    + return -ENOMEM;

    ret = vmw_fence_obj_init(fman, fence, seqno, mask,
    vmw_fence_destroy);
    @@ -524,8 +509,6 @@ int vmw_fence_create(struct vmw_fence_manager *fman,

    out_err_init:
    kfree(fence);
    -out_no_object:
    - ttm_mem_global_free(mem_glob, fman->fence_size);
    return ret;
    }

    diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
    index df05c1b1..13b40a0 100644
    --- a/drivers/hid/hid-roccat-pyra.c
    +++ b/drivers/hid/hid-roccat-pyra.c
    @@ -35,6 +35,8 @@ static struct class *pyra_class;
    static void profile_activated(struct pyra_device *pyra,
    unsigned int new_profile)
    {
    + if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
    + return;
    pyra->actual_profile = new_profile;
    pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
    }
    @@ -303,6 +305,10 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp,
    if (off != 0 || count != sizeof(struct pyra_settings))
    return -EINVAL;

    + if (((struct pyra_settings const *)buf)->startup_profile >=
    + ARRAY_SIZE(pyra->profile_settings))
    + return -EINVAL;
    +
    mutex_lock(&pyra->pyra_lock);
    difference = memcmp(buf, &pyra->settings, sizeof(struct pyra_settings));
    if (difference) {
    diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    index a5c6a8c..858b0e3 100644
    --- a/drivers/input/serio/i8042-x86ia64io.h
    +++ b/drivers/input/serio/i8042-x86ia64io.h
    @@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
    },
    },
    {
    + /* Medion Akoya E7225 */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
    + DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
    + },
    + },
    + {
    /* Blue FB5601 */
    .matches = {
    DMI_MATCH(DMI_SYS_VENDOR, "blue"),
    @@ -408,6 +416,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
    },
    },
    {
    + /* Acer Aspire 7738 */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
    + },
    + },
    + {
    /* Gericom Bellagio */
    .matches = {
    DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
    @@ -714,6 +729,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
    { }
    };

    +/*
    + * Some laptops need keyboard reset before probing for the trackpad to get
    + * it detected, initialised & finally work.
    + */
    +static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
    + {
    + /* Gigabyte P35 v2 - Elantech touchpad */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
    + },
    + },
    + {
    + /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
    + },
    + },
    + {
    + /* Gigabyte P34 - Elantech touchpad */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
    + },
    + },
    + { }
    +};
    +
    #endif /* CONFIG_X86 */

    #ifdef CONFIG_PNP
    @@ -992,6 +1036,9 @@ static int __init i8042_platform_init(void)
    if (dmi_check_system(i8042_dmi_dritek_table))
    i8042_dritek = true;

    + if (dmi_check_system(i8042_dmi_kbdreset_table))
    + i8042_kbdreset = true;
    +
    /*
    * A20 was already enabled during early kernel init. But some buggy
    * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
    diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
    index 8656441..178e75d 100644
    --- a/drivers/input/serio/i8042.c
    +++ b/drivers/input/serio/i8042.c
    @@ -67,6 +67,10 @@ static bool i8042_notimeout;
    module_param_named(notimeout, i8042_notimeout, bool, 0);
    MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");

    +static bool i8042_kbdreset;
    +module_param_named(kbdreset, i8042_kbdreset, bool, 0);
    +MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
    +
    #ifdef CONFIG_X86
    static bool i8042_dritek;
    module_param_named(dritek, i8042_dritek, bool, 0);
    @@ -783,6 +787,16 @@ static int __init i8042_check_aux(void)
    return -1;

    /*
    + * Reset keyboard (needed on some laptops to successfully detect
    + * touchpad, e.g., some Gigabyte laptop models with Elantech
    + * touchpads).
    + */
    + if (i8042_kbdreset) {
    + pr_warn("Attempting to reset device connected to KBD port\n");
    + i8042_kbd_write(NULL, (unsigned char) 0xff);
    + }
    +
    +/*
    * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
    * used it for a PCI card or somethig else.
    */
    diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    index e83aa8e..d3da166 100644
    --- a/drivers/iommu/intel-iommu.c
    +++ b/drivers/iommu/intel-iommu.c
    @@ -1763,7 +1763,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
    struct dma_pte *first_pte = NULL, *pte = NULL;
    phys_addr_t uninitialized_var(pteval);
    int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
    - unsigned long sg_res;
    + unsigned long sg_res = 0;
    unsigned int largepage_lvl = 0;
    unsigned long lvl_pages = 0;

    @@ -1774,10 +1774,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,

    prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;

    - if (sg)
    - sg_res = 0;
    - else {
    - sg_res = nr_pages + 1;
    + if (!sg) {
    + sg_res = nr_pages;
    pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
    }

    diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
    index e89ae5e..955db34 100644
    --- a/drivers/md/persistent-data/dm-space-map-metadata.c
    +++ b/drivers/md/persistent-data/dm-space-map-metadata.c
    @@ -419,7 +419,9 @@ static int sm_bootstrap_get_nr_blocks(struct dm_space_map *sm, dm_block_t *count
    {
    struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);

    - return smm->ll.nr_blocks;
    + *count = smm->ll.nr_blocks;
    +
    + return 0;
    }

    static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
    diff --git a/drivers/media/dvb/dvb-usb/af9005.c b/drivers/media/dvb/dvb-usb/af9005.c
    index bd51a76..0b3ef9f 100644
    --- a/drivers/media/dvb/dvb-usb/af9005.c
    +++ b/drivers/media/dvb/dvb-usb/af9005.c
    @@ -1072,9 +1072,12 @@ static int __init af9005_usb_module_init(void)
    err("usb_register failed. (%d)", result);
    return result;
    }
    +#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
    + /* FIXME: convert to todays kernel IR infrastructure */
    rc_decode = symbol_request(af9005_rc_decode);
    rc_keys = symbol_request(rc_map_af9005_table);
    rc_keys_size = symbol_request(rc_map_af9005_table_size);
    +#endif
    if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
    err("af9005_rc_decode function not found, disabling remote");
    af9005_properties.rc.legacy.rc_query = NULL;
    diff --git a/drivers/media/video/au0828/au0828-cards.c b/drivers/media/video/au0828/au0828-cards.c
    index 1c6015a..d6adee6 100644
    --- a/drivers/media/video/au0828/au0828-cards.c
    +++ b/drivers/media/video/au0828/au0828-cards.c
    @@ -36,6 +36,11 @@ void hvr950q_cs5340_audio(void *priv, int enable)
    au0828_clear(dev, REG_000, 0x10);
    }

    +/*
    + * WARNING: There's a quirks table at sound/usb/quirks-table.h
    + * that should also be updated every time a new device with V4L2 support
    + * is added here.
    + */
    struct au0828_board au0828_boards[] = {
    [AU0828_BOARD_UNKNOWN] = {
    .name = "Unknown board",
    diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
    index 8fd00e8..135e3ca 100644
    --- a/drivers/media/video/uvc/uvc_driver.c
    +++ b/drivers/media/video/uvc/uvc_driver.c
    @@ -1597,12 +1597,12 @@ static void uvc_delete(struct uvc_device *dev)
    {
    struct list_head *p, *n;

    - usb_put_intf(dev->intf);
    - usb_put_dev(dev->udev);
    -
    uvc_status_cleanup(dev);
    uvc_ctrl_cleanup_device(dev);

    + usb_put_intf(dev->intf);
    + usb_put_dev(dev->udev);
    +
    if (dev->vdev.dev)
    v4l2_device_unregister(&dev->vdev);
    #ifdef CONFIG_MEDIA_CONTROLLER
    diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
    index 9612264..b69d91b 100644
    --- a/drivers/mfd/tc6393xb.c
    +++ b/drivers/mfd/tc6393xb.c
    @@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct platform_device *dev)
    return 0;
    }

    +static int tc6393xb_ohci_suspend(struct platform_device *dev)
    +{
    + struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent);
    +
    + /* We can't properly store/restore OHCI state, so fail here */
    + if (tcpd->resume_restore)
    + return -EBUSY;
    +
    + return tc6393xb_ohci_disable(dev);
    +}
    +
    static int tc6393xb_fb_enable(struct platform_device *dev)
    {
    struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent);
    @@ -403,7 +414,7 @@ static struct mfd_cell __devinitdata tc6393xb_cells[] = {
    .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources),
    .resources = tc6393xb_ohci_resources,
    .enable = tc6393xb_ohci_enable,
    - .suspend = tc6393xb_ohci_disable,
    + .suspend = tc6393xb_ohci_suspend,
    .resume = tc6393xb_ohci_enable,
    .disable = tc6393xb_ohci_disable,
    },
    diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
    index 425bf5a..068a246 100644
    --- a/drivers/mtd/ubi/upd.c
    +++ b/drivers/mtd/ubi/upd.c
    @@ -135,6 +135,10 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
    ubi_assert(!vol->updating && !vol->changing_leb);
    vol->updating = 1;

    + vol->upd_buf = vmalloc(ubi->leb_size);
    + if (!vol->upd_buf)
    + return -ENOMEM;
    +
    err = set_update_marker(ubi, vol);
    if (err)
    return err;
    @@ -154,14 +158,12 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
    err = clear_update_marker(ubi, vol, 0);
    if (err)
    return err;
    +
    + vfree(vol->upd_buf);
    vol->updating = 0;
    return 0;
    }

    - vol->upd_buf = vmalloc(ubi->leb_size);
    - if (!vol->upd_buf)
    - return -ENOMEM;
    -
    vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
    vol->usable_leb_size);
    vol->upd_bytes = bytes;
    diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    index 1eac27f..a25442e 100644
    --- a/drivers/net/can/dev.c
    +++ b/drivers/net/can/dev.c
    @@ -605,10 +605,14 @@ static int can_changelink(struct net_device *dev,
    if (dev->flags & IFF_UP)
    return -EBUSY;
    cm = nla_data(data[IFLA_CAN_CTRLMODE]);
    - if (cm->flags & ~priv->ctrlmode_supported)
    +
    + /* check whether changed bits are allowed to be modified */
    + if (cm->mask & ~priv->ctrlmode_supported)
    return -EOPNOTSUPP;
    +
    + /* clear bits to be modified and copy the flag values */
    priv->ctrlmode &= ~cm->mask;
    - priv->ctrlmode |= cm->flags;
    + priv->ctrlmode |= (cm->flags & cm->mask);
    }

    if (data[IFLA_CAN_BITTIMING]) {
    diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    index 2615433..2ec19e7 100644
    --- a/drivers/net/ethernet/broadcom/tg3.c
    +++ b/drivers/net/ethernet/broadcom/tg3.c
    @@ -15647,23 +15647,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
    goto err_out_apeunmap;
    }

    - /*
    - * Reset chip in case UNDI or EFI driver did not shutdown
    - * DMA self test will enable WDMAC and we'll see (spurious)
    - * pending DMA on the PCI bus at that point.
    - */
    - if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    - (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    - tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    - }
    -
    - err = tg3_test_dma(tp);
    - if (err) {
    - dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    - goto err_out_apeunmap;
    - }
    -
    intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
    rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
    sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
    @@ -15708,6 +15691,23 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
    sndmbx += 0xc;
    }

    + /*
    + * Reset chip in case UNDI or EFI driver did not shutdown
    + * DMA self test will enable WDMAC and we'll see (spurious)
    + * pending DMA on the PCI bus at that point.
    + */
    + if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    + (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    + tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    + }
    +
    + err = tg3_test_dma(tp);
    + if (err) {
    + dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    + goto err_out_apeunmap;
    + }
    +
    tg3_init_coal(tp);

    pci_set_drvdata(pdev, dev);
    diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
    index c3786fd..b9dcd0f 100644
    --- a/drivers/net/ethernet/cisco/enic/enic_main.c
    +++ b/drivers/net/ethernet/cisco/enic/enic_main.c
    @@ -1272,10 +1272,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
    skb_put(skb, bytes_written);
    skb->protocol = eth_type_trans(skb, netdev);

    - if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
    - skb->csum = htons(checksum);
    - skb->ip_summed = CHECKSUM_COMPLETE;
    - }
    + /* Hardware does not provide whole packet checksum. It only
    + * provides pseudo checksum. Since hw validates the packet
    + * checksum but not provide us the checksum value. use
    + * CHECSUM_UNNECESSARY.
    + */
    + if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
    + ipv4_csum_ok)
    + skb->ip_summed = CHECKSUM_UNNECESSARY;

    skb->dev = netdev;

    diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
    index 7766542..ff3d348 100644
    --- a/drivers/net/wireless/ath/ath5k/qcu.c
    +++ b/drivers/net/wireless/ath/ath5k/qcu.c
    @@ -167,13 +167,7 @@ int ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type,
    } else {
    switch (queue_type) {
    case AR5K_TX_QUEUE_DATA:
    - for (queue = AR5K_TX_QUEUE_ID_DATA_MIN;
    - ah->ah_txq[queue].tqi_type !=
    - AR5K_TX_QUEUE_INACTIVE; queue++) {
    -
    - if (queue > AR5K_TX_QUEUE_ID_DATA_MAX)
    - return -EINVAL;
    - }
    + queue = queue_info->tqi_subtype;
    break;
    case AR5K_TX_QUEUE_UAPSD:
    queue = AR5K_TX_QUEUE_ID_UAPSD;
    diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
    index dc774cd..8b1123d 100644
    --- a/drivers/net/wireless/ath/ath9k/hw.h
    +++ b/drivers/net/wireless/ath/ath9k/hw.h
    @@ -174,8 +174,8 @@
    #define PAPRD_IDEAL_AGC2_PWR_RANGE 0xe0

    enum ath_hw_txq_subtype {
    - ATH_TXQ_AC_BE = 0,
    - ATH_TXQ_AC_BK = 1,
    + ATH_TXQ_AC_BK = 0,
    + ATH_TXQ_AC_BE = 1,
    ATH_TXQ_AC_VI = 2,
    ATH_TXQ_AC_VO = 3,
    };
    diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
    index bbcb777..167c7f6 100644
    --- a/drivers/net/wireless/ath/ath9k/mac.c
    +++ b/drivers/net/wireless/ath/ath9k/mac.c
    @@ -311,14 +311,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
    q = ATH9K_NUM_TX_QUEUES - 3;
    break;
    case ATH9K_TX_QUEUE_DATA:
    - for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
    - if (ah->txq[q].tqi_type ==
    - ATH9K_TX_QUEUE_INACTIVE)
    - break;
    - if (q == ATH9K_NUM_TX_QUEUES) {
    - ath_err(common, "No available TX queue\n");
    - return -1;
    - }
    + q = qinfo->tqi_subtype;
    break;
    default:
    ath_err(common, "Invalid TX queue type: %u\n", type);
    diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    index 9005380..bc92c47 100644
    --- a/drivers/pci/probe.c
    +++ b/drivers/pci/probe.c
    @@ -175,14 +175,17 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
    res->flags |= IORESOURCE_SIZEALIGN;
    if (res->flags & IORESOURCE_IO) {
    l &= PCI_BASE_ADDRESS_IO_MASK;
    + sz &= PCI_BASE_ADDRESS_IO_MASK;
    mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
    } else {
    l &= PCI_BASE_ADDRESS_MEM_MASK;
    + sz &= PCI_BASE_ADDRESS_MEM_MASK;
    mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
    }
    } else {
    res->flags |= (l & IORESOURCE_ROM_ENABLE);
    l &= PCI_ROM_ADDRESS_MASK;
    + sz &= PCI_ROM_ADDRESS_MASK;
    mask = (u32)PCI_ROM_ADDRESS_MASK;
    }

    diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
    index 0076fea..be6b648 100644
    --- a/drivers/platform/x86/hp_accel.c
    +++ b/drivers/platform/x86/hp_accel.c
    @@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
    AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
    AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
    AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
    + AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
    { NULL, }
    /* Laptop models without axis info (yet):
    * "NC6910" "HP Compaq 6910"
    diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
    index 6ec610c..adba3d6 100644
    --- a/drivers/regulator/core.c
    +++ b/drivers/regulator/core.c
    @@ -1314,12 +1314,14 @@ void regulator_put(struct regulator *regulator)
    device_remove_file(regulator->dev, &regulator->dev_attr);
    kfree(regulator->dev_attr.attr.name);
    }
    + mutex_lock(&rdev->mutex);
    kfree(regulator->supply_name);
    list_del(&regulator->list);
    kfree(regulator);

    rdev->open_count--;
    rdev->exclusive = 0;
    + mutex_unlock(&rdev->mutex);

    module_put(rdev->owner);
    mutex_unlock(&regulator_list_mutex);
    diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
    index 934458a..2c8d79c 100644
    --- a/drivers/s390/char/con3215.c
    +++ b/drivers/s390/char/con3215.c
    @@ -993,12 +993,26 @@ static int tty3215_write(struct tty_struct * tty,
    const unsigned char *buf, int count)
    {
    struct raw3215_info *raw;
    + int i, written;

    if (!tty)
    return 0;
    raw = (struct raw3215_info *) tty->driver_data;
    - raw3215_write(raw, buf, count);
    - return count;
    + written = count;
    + while (count > 0) {
    + for (i = 0; i < count; i++)
    + if (buf[i] == '\t' || buf[i] == '\n')
    + break;
    + raw3215_write(raw, buf, i);
    + count -= i;
    + buf += i;
    + if (count > 0) {
    + raw3215_putchar(raw, *buf);
    + count--;
    + buf++;
    + }
    + }
    + return written;
    }

    /*
    @@ -1146,7 +1160,7 @@ static int __init tty3215_init(void)
    driver->subtype = SYSTEM_TYPE_TTY;
    driver->init_termios = tty_std_termios;
    driver->init_termios.c_iflag = IGNBRK | IGNPAR;
    - driver->init_termios.c_oflag = ONLCR | XTABS;
    + driver->init_termios.c_oflag = ONLCR;
    driver->init_termios.c_lflag = ISIG;
    driver->flags = TTY_DRIVER_REAL_RAW;
    tty_set_operations(driver, &tty3215_ops);
    diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
    index 165e4dd86..a57f85a 100644
    --- a/drivers/scsi/NCR5380.c
    +++ b/drivers/scsi/NCR5380.c
    @@ -2662,14 +2662,14 @@ static void NCR5380_dma_complete(NCR5380_instance * instance) {
    *
    * Purpose : abort a command
    *
    - * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
    - * host byte of the result field to, if zero DID_ABORTED is
    + * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
    + * host byte of the result field to, if zero DID_ABORTED is
    * used.
    *
    - * Returns : 0 - success, -1 on failure.
    + * Returns : SUCCESS - success, FAILED on failure.
    *
    - * XXX - there is no way to abort the command that is currently
    - * connected, you have to wait for it to complete. If this is
    + * XXX - there is no way to abort the command that is currently
    + * connected, you have to wait for it to complete. If this is
    * a problem, we could implement longjmp() / setjmp(), setjmp()
    * called where the loop started in NCR5380_main().
    *
    @@ -2719,7 +2719,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd) {
    * aborted flag and get back into our main loop.
    */

    - return 0;
    + return SUCCESS;
    }
    #endif

    diff --git a/drivers/scsi/aha1740.c b/drivers/scsi/aha1740.c
    index 1c10b79..7f7dc2b 100644
    --- a/drivers/scsi/aha1740.c
    +++ b/drivers/scsi/aha1740.c
    @@ -551,7 +551,7 @@ static int aha1740_eh_abort_handler (Scsi_Cmnd *dummy)
    * quiet as possible...
    */

    - return 0;
    + return SUCCESS;
    }

    static struct scsi_host_template aha1740_template = {
    diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
    index 2db79b4..589c2a3 100644
    --- a/drivers/scsi/atari_NCR5380.c
    +++ b/drivers/scsi/atari_NCR5380.c
    @@ -2638,7 +2638,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
    * host byte of the result field to, if zero DID_ABORTED is
    * used.
    *
    - * Returns : 0 - success, -1 on failure.
    + * Returns : SUCCESS - success, FAILED on failure.
    *
    * XXX - there is no way to abort the command that is currently
    * connected, you have to wait for it to complete. If this is
    diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
    index 5c17764..04240a4 100644
    --- a/drivers/scsi/megaraid.c
    +++ b/drivers/scsi/megaraid.c
    @@ -1964,7 +1964,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
    cmd->device->id, cmd->device->lun);

    if(list_empty(&adapter->pending_list))
    - return FALSE;
    + return FAILED;

    list_for_each_safe(pos, next, &adapter->pending_list) {

    @@ -1987,7 +1987,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
    (aor==SCB_ABORT) ? "ABORTING":"RESET",
    scb->idx);

    - return FALSE;
    + return FAILED;
    }
    else {

    @@ -2012,12 +2012,12 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
    list_add_tail(SCSI_LIST(cmd),
    &adapter->completed_list);

    - return TRUE;
    + return SUCCESS;
    }
    }
    }

    - return FALSE;
    + return FAILED;
    }

    static inline int
    diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
    index 7e12a2e..9aaf084 100644
    --- a/drivers/scsi/sun3_NCR5380.c
    +++ b/drivers/scsi/sun3_NCR5380.c
    @@ -2624,15 +2624,15 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
    * Purpose : abort a command
    *
    * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
    - * host byte of the result field to, if zero DID_ABORTED is
    + * host byte of the result field to, if zero DID_ABORTED is
    * used.
    *
    - * Returns : 0 - success, -1 on failure.
    + * Returns : SUCCESS - success, FAILED on failure.
    *
    - * XXX - there is no way to abort the command that is currently
    - * connected, you have to wait for it to complete. If this is
    + * XXX - there is no way to abort the command that is currently
    + * connected, you have to wait for it to complete. If this is
    * a problem, we could implement longjmp() / setjmp(), setjmp()
    - * called where the loop started in NCR5380_main().
    + * called where the loop started in NCR5380_main().
    */

    static int NCR5380_abort(struct scsi_cmnd *cmd)
    diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
    index c0ca0ee..e6a1bd3 100644
    --- a/drivers/spi/spi-dw-mid.c
    +++ b/drivers/spi/spi-dw-mid.c
    @@ -219,7 +219,6 @@ int dw_spi_mid_init(struct dw_spi *dws)
    iounmap(clk_reg);

    dws->num_cs = 16;
    - dws->fifo_len = 40; /* FIFO has 40 words buffer */

    #ifdef CONFIG_SPI_DW_MID_DMA
    dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
    diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
    index 9eddaab..bbdf0cf 100644
    --- a/drivers/spi/spi-dw.c
    +++ b/drivers/spi/spi-dw.c
    @@ -786,13 +786,13 @@ static void spi_hw_init(struct dw_spi *dws)
    */
    if (!dws->fifo_len) {
    u32 fifo;
    - for (fifo = 2; fifo <= 257; fifo++) {
    + for (fifo = 2; fifo <= 256; fifo++) {
    dw_writew(dws, DW_SPI_TXFLTR, fifo);
    if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
    break;
    }

    - dws->fifo_len = (fifo == 257) ? 0 : fifo;
    + dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
    dw_writew(dws, DW_SPI_TXFLTR, 0);
    }
    }
    diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
    index e612722..f0d1c9c 100644
    --- a/drivers/target/iscsi/iscsi_target_util.c
    +++ b/drivers/target/iscsi/iscsi_target_util.c
    @@ -1483,15 +1483,15 @@ static int iscsit_do_tx_data(
    struct iscsi_conn *conn,
    struct iscsi_data_count *count)
    {
    - int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
    + int ret, iov_len;
    struct kvec *iov_p;
    struct msghdr msg;

    if (!conn || !conn->sock || !conn->conn_ops)
    return -1;

    - if (data <= 0) {
    - pr_err("Data length is: %d\n", data);
    + if (count->data_length <= 0) {
    + pr_err("Data length is: %d\n", count->data_length);
    return -1;
    }

    @@ -1500,20 +1500,16 @@ static int iscsit_do_tx_data(
    iov_p = count->iov;
    iov_len = count->iov_count;

    - while (total_tx < data) {
    - tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    - (data - total_tx));
    - if (tx_loop <= 0) {
    - pr_debug("tx_loop: %d total_tx %d\n",
    - tx_loop, total_tx);
    - return tx_loop;
    - }
    - total_tx += tx_loop;
    - pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
    - tx_loop, total_tx, data);
    + ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    + count->data_length);
    + if (ret != count->data_length) {
    + pr_err("Unexpected ret: %d send data %d\n",
    + ret, count->data_length);
    + return -EPIPE;
    }
    + pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);

    - return total_tx;
    + return ret;
    }

    int rx_data(
    diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
    index b31f1c3..626e75b 100644
    --- a/drivers/tty/serial/samsung.c
    +++ b/drivers/tty/serial/samsung.c
    @@ -519,11 +519,15 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
    unsigned int old)
    {
    struct s3c24xx_uart_port *ourport = to_ourport(port);
    + int timeout = 10000;

    ourport->pm_level = level;

    switch (level) {
    case 3:
    + while (--timeout && !s3c24xx_serial_txempty_nofifo(port))
    + udelay(100);
    +
    if (!IS_ERR(ourport->baudclk) && ourport->baudclk != NULL)
    clk_disable(ourport->baudclk);

    diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    index 6647081..d38d88e 100644
    --- a/drivers/usb/class/cdc-acm.c
    +++ b/drivers/usb/class/cdc-acm.c
    @@ -1011,10 +1011,11 @@ next_desc:
    } else {
    control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
    data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
    - if (!control_interface || !data_interface) {
    - dev_dbg(&intf->dev, "no interfaces\n");
    - return -ENODEV;
    - }
    + }
    +
    + if (!control_interface || !data_interface) {
    + dev_dbg(&intf->dev, "no interfaces\n");
    + return -ENODEV;
    }

    if (data_interface_num != call_interface_num)
    diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    index 1e3e211..0276db3 100644
    --- a/drivers/usb/core/config.c
    +++ b/drivers/usb/core/config.c
    @@ -201,6 +201,17 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
    if (n == 0)
    n = 9; /* 32 ms = 2^(9-1) uframes */
    j = 16;
    +
    + /*
    + * Adjust bInterval for quirked devices.
    + * This quirk fixes bIntervals reported in
    + * linear microframes.
    + */
    + if (to_usb_device(ddev)->quirks &
    + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) {
    + n = clamp(fls(d->bInterval), i, j);
    + i = j = n;
    + }
    break;
    default: /* USB_SPEED_FULL or _LOW */
    /* For low-speed, 10 ms is the official minimum.
    diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
    index e8cdce5..2753cec 100644
    --- a/drivers/usb/core/otg_whitelist.h
    +++ b/drivers/usb/core/otg_whitelist.h
    @@ -59,6 +59,11 @@ static int is_targeted(struct usb_device *dev)
    le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
    return 0;

    + /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
    + if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
    + le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
    + return 1;
    +
    /* NOTE: can't use usb_match_id() since interface caches
    * aren't set up yet. this is cut/paste from that code.
    */
    diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    index 3dbb18c..ad4540e 100644
    --- a/drivers/usb/core/quirks.c
    +++ b/drivers/usb/core/quirks.c
    @@ -150,6 +150,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    /* SKYMEDI USB_DRIVE */
    { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },

    + /* Razer - Razer Blade Keyboard */
    + { USB_DEVICE(0x1532, 0x0116), .driver_info =
    + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    +
    /* BUILDWIN Photo Frame */
    { USB_DEVICE(0x1908, 0x1315), .driver_info =
    USB_QUIRK_HONOR_BNUMINTERFACES },
    @@ -164,6 +168,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
    USB_QUIRK_IGNORE_REMOTE_WAKEUP },

    + /* Protocol and OTG Electrical Test Device */
    + { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    +
    { } /* terminating entry must be last */
    };

    diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
    index b299c32..9ba3114 100644
    --- a/drivers/usb/gadget/atmel_usba_udc.c
    +++ b/drivers/usb/gadget/atmel_usba_udc.c
    @@ -739,10 +739,10 @@ static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,

    req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
    | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
    - | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
    + | USBA_DMA_END_BUF_EN;

    - if (ep->is_in)
    - req->ctrl |= USBA_DMA_END_BUF_EN;
    + if (!ep->is_in)
    + req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;

    /*
    * Add this request to the queue and submit for DMA if
    @@ -850,7 +850,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
    {
    struct usba_ep *ep = to_usba_ep(_ep);
    struct usba_udc *udc = ep->udc;
    - struct usba_request *req = to_usba_req(_req);
    + struct usba_request *req;
    unsigned long flags;
    u32 status;

    @@ -859,6 +859,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)

    spin_lock_irqsave(&udc->lock, flags);

    + list_for_each_entry(req, &ep->queue, queue) {
    + if (&req->req == _req)
    + break;
    + }
    +
    + if (&req->req != _req) {
    + spin_unlock_irqrestore(&udc->lock, flags);
    + return -EINVAL;
    + }
    +
    if (req->using_dma) {
    /*
    * If this request is currently being transferred,
    @@ -1597,7 +1607,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
    if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
    DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
    receive_data(ep);
    - usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
    }
    }

    diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    index eae35c1..d5cb148 100644
    --- a/drivers/usb/host/pci-quirks.c
    +++ b/drivers/usb/host/pci-quirks.c
    @@ -470,7 +470,8 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
    {
    void __iomem *base;
    u32 control;
    - u32 fminterval;
    + u32 fminterval = 0;
    + bool no_fminterval = false;
    int cnt;

    if (!mmio_resource_enabled(pdev, 0))
    @@ -480,6 +481,13 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
    if (base == NULL)
    return;

    + /*
    + * ULi M5237 OHCI controller locks the whole system when accessing
    + * the OHCI_FMINTERVAL offset.
    + */
    + if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
    + no_fminterval = true;
    +
    control = readl(base + OHCI_CONTROL);

    /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
    @@ -518,7 +526,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
    }

    /* software reset of the controller, preserving HcFmInterval */
    - fminterval = readl(base + OHCI_FMINTERVAL);
    + if (!no_fminterval)
    + fminterval = readl(base + OHCI_FMINTERVAL);
    +
    writel(OHCI_HCR, base + OHCI_CMDSTATUS);

    /* reset requires max 10 us delay */
    @@ -527,7 +537,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
    break;
    udelay(1);
    }
    - writel(fminterval, base + OHCI_FMINTERVAL);
    +
    + if (!no_fminterval)
    + writel(fminterval, base + OHCI_FMINTERVAL);

    /* Now the controller is safely in SUSPEND and nothing can wake it up */
    iounmap(base);
    diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
    index db5128b7e..501ab4f 100644
    --- a/drivers/usb/misc/adutux.c
    +++ b/drivers/usb/misc/adutux.c
    @@ -865,15 +865,11 @@ static void adu_disconnect(struct usb_interface *interface)
    usb_set_intfdata(interface, NULL);

    /* if the device is not opened, then we clean up right now */
    - dbg(2," %s : open count %d", __func__, dev->open_count);
    if (!dev->open_count)
    adu_delete(dev);

    mutex_unlock(&adutux_mutex);

    - dev_info(&interface->dev, "ADU device adutux%d now disconnected\n",
    - (minor - ADU_MINOR_BASE));
    -
    dbg(2," %s : leave", __func__);
    }

    diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
    index aa0d183..0b1fc07 100644
    --- a/drivers/usb/renesas_usbhs/mod_gadget.c
    +++ b/drivers/usb/renesas_usbhs/mod_gadget.c
    @@ -514,6 +514,10 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
    static int usbhsg_ep_disable(struct usb_ep *ep)
    {
    struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
    + struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
    +
    + if (!pipe)
    + return -EINVAL;

    return usbhsg_pipe_disable(uep);
    }
    diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
    index 1ee6b2a..87302dd 100644
    --- a/drivers/usb/serial/console.c
    +++ b/drivers/usb/serial/console.c
    @@ -47,6 +47,8 @@ static struct console usbcons;
    * ------------------------------------------------------------
    */

    +static const struct tty_operations usb_console_fake_tty_ops = {
    +};

    /*
    * The parsing of the command line works exactly like the
    @@ -141,14 +143,17 @@ static int usb_console_setup(struct console *co, char *options)
    goto reset_open_count;
    }
    kref_init(&tty->kref);
    - tty_port_tty_set(&port->port, tty);
    tty->driver = usb_serial_tty_driver;
    tty->index = co->index;
    + INIT_LIST_HEAD(&tty->tty_files);
    + kref_get(&tty->driver->kref);
    + tty->ops = &usb_console_fake_tty_ops;
    if (tty_init_termios(tty)) {
    retval = -ENOMEM;
    err("no more memory");
    - goto free_tty;
    + goto put_tty;
    }
    + tty_port_tty_set(&port->port, tty);
    }

    /* only call the device specific open if this
    @@ -170,7 +175,7 @@ static int usb_console_setup(struct console *co, char *options)
    serial->type->set_termios(tty, port, &dummy);

    tty_port_tty_set(&port->port, NULL);
    - kfree(tty);
    + tty_kref_put(tty);
    }
    set_bit(ASYNCB_INITIALIZED, &port->port.flags);
    }
    @@ -186,8 +191,8 @@ static int usb_console_setup(struct console *co, char *options)

    fail:
    tty_port_tty_set(&port->port, NULL);
    - free_tty:
    - kfree(tty);
    + put_tty:
    + tty_kref_put(tty);
    reset_open_count:
    port->port.count = 0;
    usb_autopm_put_interface(serial->interface);
    diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    index da92d2d..e795a4c 100644
    --- a/drivers/usb/serial/cp210x.c
    +++ b/drivers/usb/serial/cp210x.c
    @@ -126,10 +126,12 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
    { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
    { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
    - { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
    + { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
    + { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
    { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
    { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
    + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
    { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    index a6c4c7d..0e2c2de 100644
    --- a/drivers/usb/storage/unusual_devs.h
    +++ b/drivers/usb/storage/unusual_devs.h
    @@ -1956,6 +1956,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
    USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),

    +/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
    +UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114,
    + "JMicron",
    + "USB to ATA/ATAPI Bridge",
    + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    + US_FL_BROKEN_FUA ),
    +
    /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
    * and Mac USB Dock USB-SCSI */
    UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
    diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
    index c27e153..8a3d51f 100644
    --- a/drivers/video/fb_defio.c
    +++ b/drivers/video/fb_defio.c
    @@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
    cancel_delayed_work_sync(&info->deferred_work);

    /* Run it immediately */
    - err = schedule_delayed_work(&info->deferred_work, 0);
    + schedule_delayed_work(&info->deferred_work, 0);
    mutex_unlock(&inode->i_mutex);
    - return err;
    +
    + return 0;
    }
    EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);

    diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
    index ea7a8cc..4bbe1b0 100644
    --- a/drivers/video/logo/logo.c
    +++ b/drivers/video/logo/logo.c
    @@ -25,6 +25,21 @@ static int nologo;
    module_param(nologo, bool, 0);
    MODULE_PARM_DESC(nologo, "Disables startup logo");

    +/*
    + * Logos are located in the initdata, and will be freed in kernel_init.
    + * Use late_init to mark the logos as freed to prevent any further use.
    + */
    +
    +static bool logos_freed;
    +
    +static int __init fb_logo_late_init(void)
    +{
    + logos_freed = true;
    + return 0;
    +}
    +
    +late_initcall(fb_logo_late_init);
    +
    /* logo's are marked __initdata. Use __init_refok to tell
    * modpost that it is intended that this function uses data
    * marked __initdata.
    @@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
    {
    const struct linux_logo *logo = NULL;

    - if (nologo)
    + if (nologo || logos_freed)
    return NULL;

    if (depth >= 1) {
    diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
    index 984c501..cc02a9b 100644
    --- a/drivers/virtio/virtio.c
    +++ b/drivers/virtio/virtio.c
    @@ -9,33 +9,32 @@ static unsigned int dev_index;
    static ssize_t device_show(struct device *_d,
    struct device_attribute *attr, char *buf)
    {
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    return sprintf(buf, "0x%04x\n", dev->id.device);
    }
    static ssize_t vendor_show(struct device *_d,
    struct device_attribute *attr, char *buf)
    {
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    return sprintf(buf, "0x%04x\n", dev->id.vendor);
    }
    static ssize_t status_show(struct device *_d,
    struct device_attribute *attr, char *buf)
    {
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    return sprintf(buf, "0x%08x\n", dev->config->get_status(dev));
    }
    static ssize_t modalias_show(struct device *_d,
    struct device_attribute *attr, char *buf)
    {
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    -
    + struct virtio_device *dev = dev_to_virtio(_d);
    return sprintf(buf, "virtio:d%08Xv%08X\n",
    dev->id.device, dev->id.vendor);
    }
    static ssize_t features_show(struct device *_d,
    struct device_attribute *attr, char *buf)
    {
    - struct virtio_device *dev = container_of(_d, struct virtio_device, dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    unsigned int i;
    ssize_t len = 0;

    @@ -70,7 +69,7 @@ static inline int virtio_id_match(const struct virtio_device *dev,
    static int virtio_dev_match(struct device *_dv, struct device_driver *_dr)
    {
    unsigned int i;
    - struct virtio_device *dev = container_of(_dv,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_dv);
    const struct virtio_device_id *ids;

    ids = container_of(_dr, struct virtio_driver, driver)->id_table;
    @@ -82,7 +81,7 @@ static int virtio_dev_match(struct device *_dv, struct device_driver *_dr)

    static int virtio_uevent(struct device *_dv, struct kobj_uevent_env *env)
    {
    - struct virtio_device *dev = container_of(_dv,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_dv);

    return add_uevent_var(env, "MODALIAS=virtio:d%08Xv%08X",
    dev->id.device, dev->id.vendor);
    @@ -110,7 +109,7 @@ EXPORT_SYMBOL_GPL(virtio_check_driver_offered_feature);
    static int virtio_dev_probe(struct device *_d)
    {
    int err, i;
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    struct virtio_driver *drv = container_of(dev->dev.driver,
    struct virtio_driver, driver);
    u32 device_features;
    @@ -148,7 +147,7 @@ static int virtio_dev_probe(struct device *_d)

    static int virtio_dev_remove(struct device *_d)
    {
    - struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
    + struct virtio_device *dev = dev_to_virtio(_d);
    struct virtio_driver *drv = container_of(dev->dev.driver,
    struct virtio_driver, driver);

    diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
    index 03d1984..13f6cd8 100644
    --- a/drivers/virtio/virtio_pci.c
    +++ b/drivers/virtio/virtio_pci.c
    @@ -612,11 +612,13 @@ static struct virtio_config_ops virtio_pci_config_ops = {

    static void virtio_pci_release_dev(struct device *_d)
    {
    - /*
    - * No need for a release method as we allocate/free
    - * all devices together with the pci devices.
    - * Provide an empty one to avoid getting a warning from core.
    - */
    + struct virtio_device *vdev = dev_to_virtio(_d);
    + struct virtio_pci_device *vp_dev = to_vp_device(vdev);
    +
    + /* As struct device is a kobject, it's not safe to
    + * free the memory (including the reference counter itself)
    + * until it's release callback. */
    + kfree(vp_dev);
    }

    /* the PCI probing function */
    @@ -704,7 +706,6 @@ static void __devexit virtio_pci_remove(struct pci_dev *pci_dev)
    pci_iounmap(pci_dev, vp_dev->ioaddr);
    pci_release_regions(pci_dev);
    pci_disable_device(pci_dev);
    - kfree(vp_dev);
    }

    #ifdef CONFIG_PM
    diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
    index cfdf6fe..b8fc473 100644
    --- a/fs/btrfs/disk-io.c
    +++ b/fs/btrfs/disk-io.c
    @@ -3481,12 +3481,6 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
    if (ret)
    break;

    - /* opt_discard */
    - if (btrfs_test_opt(root, DISCARD))
    - ret = btrfs_error_discard_extent(root, start,
    - end + 1 - start,
    - NULL);
    -
    clear_extent_dirty(unpin, start, end, GFP_NOFS);
    btrfs_error_unpin_extent_range(root, start, end);
    cond_resched();
    diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
    index f63719a..a694317 100644
    --- a/fs/btrfs/extent-tree.c
    +++ b/fs/btrfs/extent-tree.c
    @@ -4611,7 +4611,8 @@ int btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
    return 0;
    }

    -static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
    +static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end,
    + const bool return_free_space)
    {
    struct btrfs_fs_info *fs_info = root->fs_info;
    struct btrfs_block_group_cache *cache = NULL;
    @@ -4631,7 +4632,8 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)

    if (start < cache->last_byte_to_unpin) {
    len = min(len, cache->last_byte_to_unpin - start);
    - btrfs_add_free_space(cache, start, len);
    + if (return_free_space)
    + btrfs_add_free_space(cache, start, len);
    }

    start += len;
    @@ -4676,7 +4678,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
    end + 1 - start, NULL);

    clear_extent_dirty(unpin, start, end, GFP_NOFS);
    - unpin_extent_range(root, start, end);
    + unpin_extent_range(root, start, end, true);
    cond_resched();
    }

    @@ -7650,7 +7652,7 @@ out:

    int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
    {
    - return unpin_extent_range(root, start, end);
    + return unpin_extent_range(root, start, end, false);
    }

    int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr,
    diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
    index e5206fc..d5df940 100644
    --- a/fs/ceph/snap.c
    +++ b/fs/ceph/snap.c
    @@ -288,6 +288,9 @@ static int cmpu64_rev(const void *a, const void *b)
    return 0;
    }

    +
    +static struct ceph_snap_context *empty_snapc;
    +
    /*
    * build the snap context for a given realm.
    */
    @@ -329,6 +332,12 @@ static int build_snap_context(struct ceph_snap_realm *realm)
    return 0;
    }

    + if (num == 0 && realm->seq == empty_snapc->seq) {
    + ceph_get_snap_context(empty_snapc);
    + snapc = empty_snapc;
    + goto done;
    + }
    +
    /* alloc new snap context */
    err = -ENOMEM;
    if (num > (SIZE_MAX - sizeof(*snapc)) / sizeof(u64))
    @@ -364,6 +373,7 @@ static int build_snap_context(struct ceph_snap_realm *realm)
    dout("build_snap_context %llx %p: %p seq %lld (%d snaps)\n",
    realm->ino, realm, snapc, snapc->seq, snapc->num_snaps);

    +done:
    if (realm->cached_context)
    ceph_put_snap_context(realm->cached_context);
    realm->cached_context = snapc;
    @@ -465,6 +475,9 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
    cap_snap. lucky us. */
    dout("queue_cap_snap %p already pending\n", inode);
    kfree(capsnap);
    + } else if (ci->i_snap_realm->cached_context == empty_snapc) {
    + dout("queue_cap_snap %p empty snapc\n", inode);
    + kfree(capsnap);
    } else if (dirty & (CEPH_CAP_AUTH_EXCL|CEPH_CAP_XATTR_EXCL|
    CEPH_CAP_FILE_EXCL|CEPH_CAP_FILE_WR)) {
    struct ceph_snap_context *snapc = ci->i_head_snapc;
    @@ -927,5 +940,17 @@ out:
    return;
    }

    +int __init ceph_snap_init(void)
    +{
    + empty_snapc = kzalloc(sizeof(struct ceph_snap_context), GFP_NOFS);
    + if (!empty_snapc)
    + return -ENOMEM;
    + atomic_set(&empty_snapc->nref, 1);
    + empty_snapc->seq = 1;
    + return 0;
    +}

    -
    +void ceph_snap_exit(void)
    +{
    + ceph_put_snap_context(empty_snapc);
    +}
    diff --git a/fs/ceph/super.c b/fs/ceph/super.c
    index de268a8..3c981db 100644
    --- a/fs/ceph/super.c
    +++ b/fs/ceph/super.c
    @@ -911,14 +911,20 @@ static int __init init_ceph(void)
    if (ret)
    goto out;

    - ret = register_filesystem(&ceph_fs_type);
    + ret = ceph_snap_init();
    if (ret)
    goto out_icache;

    + ret = register_filesystem(&ceph_fs_type);
    + if (ret)
    + goto out_snap;
    +
    pr_info("loaded (mds proto %d)\n", CEPH_MDSC_PROTOCOL);

    return 0;

    +out_snap:
    + ceph_snap_exit();
    out_icache:
    destroy_caches();
    out:
    @@ -929,6 +935,7 @@ static void __exit exit_ceph(void)
    {
    dout("exit_ceph\n");
    unregister_filesystem(&ceph_fs_type);
    + ceph_snap_exit();
    destroy_caches();
    }

    diff --git a/fs/ceph/super.h b/fs/ceph/super.h
    index a097817..242df58 100644
    --- a/fs/ceph/super.h
    +++ b/fs/ceph/super.h
    @@ -677,6 +677,8 @@ extern void ceph_queue_cap_snap(struct ceph_inode_info *ci);
    extern int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
    struct ceph_cap_snap *capsnap);
    extern void ceph_cleanup_empty_realms(struct ceph_mds_client *mdsc);
    +extern int ceph_snap_init(void);
    +extern void ceph_snap_exit(void);

    /*
    * a cap_snap is "pending" if it is still awaiting an in-progress
    diff --git a/fs/dcache.c b/fs/dcache.c
    index 3f65742..8bc98af 100644
    --- a/fs/dcache.c
    +++ b/fs/dcache.c
    @@ -1035,7 +1035,7 @@ ascend:
    return 0; /* No mount points found in tree */
    positive:
    if (!locked && read_seqretry(&rename_lock, seq))
    - goto rename_retry;
    + goto rename_retry_unlocked;
    if (locked)
    write_sequnlock(&rename_lock);
    return 1;
    @@ -1045,6 +1045,7 @@ rename_retry:
    rcu_read_unlock();
    if (locked)
    goto again;
    +rename_retry_unlocked:
    locked = 1;
    write_seqlock(&rename_lock);
    goto again;
    @@ -1109,6 +1110,7 @@ resume:
    */
    if (found && need_resched()) {
    spin_unlock(&dentry->d_lock);
    + rcu_read_lock();
    goto out;
    }

    diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
    index 68b19ab..dceedec 100644
    --- a/fs/ecryptfs/crypto.c
    +++ b/fs/ecryptfs/crypto.c
    @@ -2038,7 +2038,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size,
    break;
    case 2:
    dst[dst_byte_offset++] |= (src_byte);
    - dst[dst_byte_offset] = 0;
    current_bit_offset = 0;
    break;
    }
    diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
    index 841f24f..80fc876 100644
    --- a/fs/ecryptfs/file.c
    +++ b/fs/ecryptfs/file.c
    @@ -196,24 +196,12 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
    {
    int rc = 0;
    struct ecryptfs_crypt_stat *crypt_stat = NULL;
    - struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
    struct dentry *ecryptfs_dentry = file->f_path.dentry;
    /* Private value of ecryptfs_dentry allocated in
    * ecryptfs_lookup() */
    struct dentry *lower_dentry;
    struct ecryptfs_file_info *file_info;

    - mount_crypt_stat = &ecryptfs_superblock_to_private(
    - ecryptfs_dentry->d_sb)->mount_crypt_stat;
    - if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
    - && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
    - || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
    - || (file->f_flags & O_APPEND))) {
    - printk(KERN_WARNING "Mount has encrypted view enabled; "
    - "files may only be read\n");
    - rc = -EPERM;
    - goto out;
    - }
    /* Released in ecryptfs_release or end of function if failure */
    file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
    ecryptfs_set_file_private(file, file_info);
    diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
    index 94afdfd..62b8ddc 100644
    --- a/fs/ecryptfs/main.c
    +++ b/fs/ecryptfs/main.c
    @@ -494,6 +494,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
    {
    struct super_block *s;
    struct ecryptfs_sb_info *sbi;
    + struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
    struct ecryptfs_dentry_info *root_info;
    const char *err = "Getting sb failed";
    struct inode *inode;
    @@ -512,6 +513,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
    err = "Error parsing options";
    goto out;
    }
    + mount_crypt_stat = &sbi->mount_crypt_stat;

    s = sget(fs_type, NULL, set_anon_super, NULL);
    if (IS_ERR(s)) {
    @@ -557,11 +559,19 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags

    /**
    * Set the POSIX ACL flag based on whether they're enabled in the lower
    - * mount. Force a read-only eCryptfs mount if the lower mount is ro.
    - * Allow a ro eCryptfs mount even when the lower mount is rw.
    + * mount.
    */
    s->s_flags = flags & ~MS_POSIXACL;
    - s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
    + s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL;
    +
    + /**
    + * Force a read-only eCryptfs mount when:
    + * 1) The lower mount is ro
    + * 2) The ecryptfs_encrypted_view mount option is specified
    + */
    + if (path.dentry->d_sb->s_flags & MS_RDONLY ||
    + mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
    + s->s_flags |= MS_RDONLY;

    s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
    s->s_blocksize = path.dentry->d_sb->s_blocksize;
    diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
    index 13bfa07..7286eb4 100644
    --- a/fs/fs-writeback.c
    +++ b/fs/fs-writeback.c
    @@ -396,7 +396,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,

    /* Set I_SYNC, reset I_DIRTY_PAGES */
    inode->i_state |= I_SYNC;
    - inode->i_state &= ~I_DIRTY_PAGES;
    spin_unlock(&inode->i_lock);
    spin_unlock(&wb->list_lock);

    @@ -419,9 +418,28 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
    * write_inode()
    */
    spin_lock(&inode->i_lock);
    +
    dirty = inode->i_state & I_DIRTY;
    - inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC);
    + inode->i_state &= ~I_DIRTY;
    +
    + /*
    + * Paired with smp_mb() in __mark_inode_dirty(). This allows
    + * __mark_inode_dirty() to test i_state without grabbing i_lock -
    + * either they see the I_DIRTY bits cleared or we see the dirtied
    + * inode.
    + *
    + * I_DIRTY_PAGES is always cleared together above even if @mapping
    + * still has dirty pages. The flag is reinstated after smp_mb() if
    + * necessary. This guarantees that either __mark_inode_dirty()
    + * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY.
    + */
    + smp_mb();
    +
    + if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
    + inode->i_state |= I_DIRTY_PAGES;
    +
    spin_unlock(&inode->i_lock);
    +
    /* Don't write the inode if only I_DIRTY_PAGES was set */
    if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
    int err = write_inode(inode, wbc);
    @@ -447,7 +465,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
    * We didn't write back all the pages. nfs_writepages()
    * sometimes bales out without doing anything.
    */
    - inode->i_state |= I_DIRTY_PAGES;
    if (wbc->nr_to_write <= 0) {
    /*
    * slice used up: queue for next turn
    @@ -1064,12 +1081,11 @@ void __mark_inode_dirty(struct inode *inode, int flags)
    }

    /*
    - * make sure that changes are seen by all cpus before we test i_state
    - * -- mikulas
    + * Paired with smp_mb() in __writeback_single_inode() for the
    + * following lockless i_state test. See there for details.
    */
    smp_mb();

    - /* avoid the locking if we can */
    if ((inode->i_state & flags) == flags)
    return;

    diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
    index ee62cc0..1780949 100644
    --- a/fs/isofs/rock.c
    +++ b/fs/isofs/rock.c
    @@ -30,6 +30,7 @@ struct rock_state {
    int cont_size;
    int cont_extent;
    int cont_offset;
    + int cont_loops;
    struct inode *inode;
    };

    @@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
    rs->inode = inode;
    }

    +/* Maximum number of Rock Ridge continuation entries */
    +#define RR_MAX_CE_ENTRIES 32
    +
    /*
    * Returns 0 if the caller should continue scanning, 1 if the scan must end
    * and -ve on error.
    @@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs)
    goto out;
    }
    ret = -EIO;
    + if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
    + goto out;
    bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
    if (bh) {
    memcpy(rs->buffer, bh->b_data + rs->cont_offset,
    @@ -356,6 +362,9 @@ repeat:
    rs.cont_size = isonum_733(rr->u.CE.size);
    break;
    case SIG('E', 'R'):
    + /* Invalid length of ER tag id? */
    + if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
    + goto out;
    ISOFS_SB(inode->i_sb)->s_rock = 1;
    printk(KERN_DEBUG "ISO 9660 Extensions: ");
    {
    diff --git a/fs/namei.c b/fs/namei.c
    index dea2dab..c8b13a9 100644
    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -1567,6 +1567,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
    if (!(nd->flags & LOOKUP_ROOT))
    nd->root.mnt = NULL;
    rcu_read_unlock();
    + br_read_unlock(vfsmount_lock);
    return -ECHILD;

    fput_fail:
    diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
    index 790e92a..ea6f706 100644
    --- a/fs/ncpfs/ioctl.c
    +++ b/fs/ncpfs/ioctl.c
    @@ -445,7 +445,6 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg
    result = -EIO;
    }
    }
    - result = 0;
    }
    mutex_unlock(&server->root_setup_lock);

    diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
    index b13c00a..df6dacc 100644
    --- a/fs/notify/inode_mark.c
    +++ b/fs/notify/inode_mark.c
    @@ -282,20 +282,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
    spin_unlock(&inode->i_lock);

    /* In case the dropping of a reference would nuke next_i. */
    - if ((&next_i->i_sb_list != list) &&
    - atomic_read(&next_i->i_count)) {
    + while (&next_i->i_sb_list != list) {
    spin_lock(&next_i->i_lock);
    - if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
    + if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
    + atomic_read(&next_i->i_count)) {
    __iget(next_i);
    need_iput = next_i;
    + spin_unlock(&next_i->i_lock);
    + break;
    }
    spin_unlock(&next_i->i_lock);
    + next_i = list_entry(next_i->i_sb_list.next,
    + struct inode, i_sb_list);
    }

    /*
    - * We can safely drop inode_sb_list_lock here because we hold
    - * references on both inode and next_i. Also no new inodes
    - * will be added since the umount has begun.
    + * We can safely drop inode_sb_list_lock here because either
    + * we actually hold references on both inode and next_i or
    + * end of list. Also no new inodes will be added since the
    + * umount has begun.
    */
    spin_unlock(&inode_sb_list_lock);

    diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
    index 4402b18..16653b2 100644
    --- a/fs/ocfs2/aops.c
    +++ b/fs/ocfs2/aops.c
    @@ -917,7 +917,7 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
    }
    }

    -static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
    +static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc)
    {
    int i;

    @@ -938,7 +938,11 @@ static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
    page_cache_release(wc->w_target_page);
    }
    ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
    +}

    +static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
    +{
    + ocfs2_unlock_pages(wc);
    brelse(wc->w_di_bh);
    kfree(wc);
    }
    @@ -2059,11 +2063,19 @@ out_write_size:
    di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
    ocfs2_journal_dirty(handle, wc->w_di_bh);

    + /* unlock pages before dealloc since it needs acquiring j_trans_barrier
    + * lock, or it will cause a deadlock since journal commit threads holds
    + * this lock and will ask for the page lock when flushing the data.
    + * put it here to preserve the unlock order.
    + */
    + ocfs2_unlock_pages(wc);
    +
    ocfs2_commit_trans(osb, handle);

    ocfs2_run_deallocs(osb, &wc->w_dealloc);

    - ocfs2_free_write_ctxt(wc);
    + brelse(wc->w_di_bh);
    + kfree(wc);

    return copied;
    }
    diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
    index d20d64c..0de24a2 100644
    --- a/fs/ocfs2/file.c
    +++ b/fs/ocfs2/file.c
    @@ -2468,9 +2468,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };

    @@ -2480,6 +2478,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    out->f_path.dentry->d_name.len,
    out->f_path.dentry->d_name.name, len);

    + ret = generic_write_checks(out, ppos, &len, 0);
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    if (pipe->inode)
    mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);

    diff --git a/fs/proc/stat.c b/fs/proc/stat.c
    index 4c9a859..81a48d1 100644
    --- a/fs/proc/stat.c
    +++ b/fs/proc/stat.c
    @@ -141,7 +141,7 @@ static int show_stat(struct seq_file *p, void *v)

    /* sum again ? it could be updated? */
    for_each_irq_nr(j)
    - seq_printf(p, " %u", kstat_irqs(j));
    + seq_printf(p, " %u", kstat_irqs_usr(j));

    seq_printf(p,
    "\nctxt %llu\n"
    diff --git a/fs/splice.c b/fs/splice.c
    index 714471d..34c2b2b 100644
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -1013,13 +1013,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };
    ssize_t ret;

    + ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    pipe_lock(pipe);

    splice_from_pipe_begin(&sd);
    diff --git a/fs/udf/dir.c b/fs/udf/dir.c
    index eb8bfe2..56341af 100644
    --- a/fs/udf/dir.c
    +++ b/fs/udf/dir.c
    @@ -163,7 +163,8 @@ static int do_udf_readdir(struct inode *dir, struct file *filp,
    struct kernel_lb_addr tloc = lelb_to_cpu(cfi.icb.extLocation);

    iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);
    - flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
    + flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
    + UDF_NAME_LEN);
    dt_type = DT_UNKNOWN;
    }

    diff --git a/fs/udf/inode.c b/fs/udf/inode.c
    index a0f6ded..2a706bb 100644
    --- a/fs/udf/inode.c
    +++ b/fs/udf/inode.c
    @@ -1403,6 +1403,24 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
    iinfo->i_lenEAttr;
    }

    + /* Sanity checks for files in ICB so that we don't get confused later */
    + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
    + /*
    + * For file in ICB data is stored in allocation descriptor
    + * so sizes should match
    + */
    + if (iinfo->i_lenAlloc != inode->i_size) {
    + make_bad_inode(inode);
    + return;
    + }
    + /* File in ICB has to fit in there... */
    + if (inode->i_size > inode->i_sb->s_blocksize -
    + udf_file_entry_alloc_offset(inode)) {
    + make_bad_inode(inode);
    + return;
    + }
    + }
    +
    switch (fe->icbTag.fileType) {
    case ICBTAG_FILE_TYPE_DIRECTORY:
    inode->i_op = &udf_dir_inode_operations;
    diff --git a/fs/udf/namei.c b/fs/udf/namei.c
    index 71c97fb..483d662 100644
    --- a/fs/udf/namei.c
    +++ b/fs/udf/namei.c
    @@ -235,7 +235,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
    if (!lfi)
    continue;

    - flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
    + flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
    + UDF_NAME_LEN);
    if (flen && udf_match(flen, fname, child->len, child->name))
    goto out_ok;
    }
    diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
    index b1d4488..0422b7b 100644
    --- a/fs/udf/symlink.c
    +++ b/fs/udf/symlink.c
    @@ -30,43 +30,73 @@
    #include <linux/buffer_head.h>
    #include "udf_i.h"

    -static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
    - int fromlen, unsigned char *to)
    +static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
    + int fromlen, unsigned char *to, int tolen)
    {
    struct pathComponent *pc;
    int elen = 0;
    + int comp_len;
    unsigned char *p = to;

    + /* Reserve one byte for terminating \0 */
    + tolen--;
    while (elen < fromlen) {
    pc = (struct pathComponent *)(from + elen);
    + elen += sizeof(struct pathComponent);
    switch (pc->componentType) {
    case 1:
    - if (pc->lengthComponentIdent == 0) {
    - p = to;
    - *p++ = '/';
    + /*
    + * Symlink points to some place which should be agreed
    + * upon between originator and receiver of the media. Ignore.
    + */
    + if (pc->lengthComponentIdent > 0) {
    + elen += pc->lengthComponentIdent;
    + break;
    }
    + /* Fall through */
    + case 2:
    + if (tolen == 0)
    + return -ENAMETOOLONG;
    + p = to;
    + *p++ = '/';
    + tolen--;
    break;
    case 3:
    + if (tolen < 3)
    + return -ENAMETOOLONG;
    memcpy(p, "../", 3);
    p += 3;
    + tolen -= 3;
    break;
    case 4:
    + if (tolen < 2)
    + return -ENAMETOOLONG;
    memcpy(p, "./", 2);
    p += 2;
    + tolen -= 2;
    /* that would be . - just ignore */
    break;
    case 5:
    - p += udf_get_filename(sb, pc->componentIdent, p,
    - pc->lengthComponentIdent);
    + elen += pc->lengthComponentIdent;
    + if (elen > fromlen)
    + return -EIO;
    + comp_len = udf_get_filename(sb, pc->componentIdent,
    + pc->lengthComponentIdent,
    + p, tolen);
    + p += comp_len;
    + tolen -= comp_len;
    + if (tolen == 0)
    + return -ENAMETOOLONG;
    *p++ = '/';
    + tolen--;
    break;
    }
    - elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
    }
    if (p > to + 1)
    p[-1] = '\0';
    else
    p[0] = '\0';
    + return 0;
    }

    static int udf_symlink_filler(struct file *file, struct page *page)
    @@ -74,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
    struct inode *inode = page->mapping->host;
    struct buffer_head *bh = NULL;
    unsigned char *symlink;
    - int err = -EIO;
    + int err;
    unsigned char *p = kmap(page);
    struct udf_inode_info *iinfo;
    uint32_t pos;

    + /* We don't support symlinks longer than one block */
    + if (inode->i_size > inode->i_sb->s_blocksize) {
    + err = -ENAMETOOLONG;
    + goto out_unmap;
    + }
    +
    iinfo = UDF_I(inode);
    pos = udf_block_map(inode, 0);

    @@ -88,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
    } else {
    bh = sb_bread(inode->i_sb, pos);

    - if (!bh)
    - goto out;
    + if (!bh) {
    + err = -EIO;
    + goto out_unlock_inode;
    + }

    symlink = bh->b_data;
    }

    - udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
    + err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
    brelse(bh);
    + if (err)
    + goto out_unlock_inode;

    up_read(&iinfo->i_data_sem);
    SetPageUptodate(page);
    @@ -103,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
    unlock_page(page);
    return 0;

    -out:
    +out_unlock_inode:
    up_read(&iinfo->i_data_sem);
    SetPageError(page);
    +out_unmap:
    kunmap(page);
    unlock_page(page);
    return err;
    diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
    index f34e6fc..8775ab23 100644
    --- a/fs/udf/udfdecl.h
    +++ b/fs/udf/udfdecl.h
    @@ -207,7 +207,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
    }

    /* unicode.c */
    -extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
    +extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
    + int);
    extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
    int);
    extern int udf_build_ustr(struct ustr *, dstring *, int);
    diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
    index 44b815e..d29c06f 100644
    --- a/fs/udf/unicode.c
    +++ b/fs/udf/unicode.c
    @@ -28,7 +28,8 @@

    #include "udf_sb.h"

    -static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
    +static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
    + int);

    static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
    {
    @@ -333,8 +334,8 @@ try_again:
    return u_len + 1;
    }

    -int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
    - int flen)
    +int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
    + uint8_t *dname, int dlen)
    {
    struct ustr *filename, *unifilename;
    int len = 0;
    @@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
    if (!unifilename)
    goto out1;

    - if (udf_build_ustr_exact(unifilename, sname, flen))
    + if (udf_build_ustr_exact(unifilename, sname, slen))
    goto out2;

    if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
    @@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
    } else
    goto out2;

    - len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
    + len = udf_translate_to_linux(dname, dlen,
    + filename->u_name, filename->u_len,
    unifilename->u_name, unifilename->u_len);
    out2:
    kfree(unifilename);
    @@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
    #define EXT_MARK '.'
    #define CRC_MARK '#'
    #define EXT_SIZE 5
    +/* Number of chars we need to store generated CRC to make filename unique */
    +#define CRC_LEN 5

    -static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
    - int udfLen, uint8_t *fidName,
    - int fidNameLen)
    +static int udf_translate_to_linux(uint8_t *newName, int newLen,
    + uint8_t *udfName, int udfLen,
    + uint8_t *fidName, int fidNameLen)
    {
    int index, newIndex = 0, needsCRC = 0;
    int extIndex = 0, newExtIndex = 0, hasExt = 0;
    @@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
    newExtIndex = newIndex;
    }
    }
    - if (newIndex < 256)
    + if (newIndex < newLen)
    newName[newIndex++] = curr;
    else
    needsCRC = 1;
    @@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
    }
    ext[localExtIndex++] = curr;
    }
    - maxFilenameLen = 250 - localExtIndex;
    + maxFilenameLen = newLen - CRC_LEN - localExtIndex;
    if (newIndex > maxFilenameLen)
    newIndex = maxFilenameLen;
    else
    newIndex = newExtIndex;
    - } else if (newIndex > 250)
    - newIndex = 250;
    + } else if (newIndex > newLen - CRC_LEN)
    + newIndex = newLen - CRC_LEN;
    newName[newIndex++] = CRC_MARK;
    valueCRC = crc_itu_t(0, fidName, fidNameLen);
    newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12];
    diff --git a/include/linux/crypto.h b/include/linux/crypto.h
    index 8a94217..ca01ea8 100644
    --- a/include/linux/crypto.h
    +++ b/include/linux/crypto.h
    @@ -25,6 +25,19 @@
    #include <linux/uaccess.h>

    /*
    + * Autoloaded crypto modules should only use a prefixed name to avoid allowing
    + * arbitrary modules to be loaded. Loading from userspace may still need the
    + * unprefixed names, so retains those aliases as well.
    + * This uses __MODULE_INFO directly instead of MODULE_ALIAS because pre-4.3
    + * gcc (e.g. avr32 toolchain) uses __LINE__ for uniqueness, and this macro
    + * expands twice on the same line. Instead, use a separate base name for the
    + * alias.
    + */
    +#define MODULE_ALIAS_CRYPTO(name) \
    + __MODULE_INFO(alias, alias_userspace, name); \
    + __MODULE_INFO(alias, alias_crypto, "crypto-" name)
    +
    +/*
    * Algorithm masks and types.
    */
    #define CRYPTO_ALG_TYPE_MASK 0x0000000f
    diff --git a/include/linux/device.h b/include/linux/device.h
    index 3136ede..a31c5d0 100644
    --- a/include/linux/device.h
    +++ b/include/linux/device.h
    @@ -767,6 +767,11 @@ extern __printf(5, 6)
    struct device *device_create(struct class *cls, struct device *parent,
    dev_t devt, void *drvdata,
    const char *fmt, ...);
    +extern __printf(6, 7)
    +struct device *device_create_with_groups(struct class *cls,
    + struct device *parent, dev_t devt, void *drvdata,
    + const struct attribute_group **groups,
    + const char *fmt, ...);
    extern void device_destroy(struct class *cls, dev_t devt);

    /*
    diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
    index 0cce2db..3256aee 100644
    --- a/include/linux/kernel_stat.h
    +++ b/include/linux/kernel_stat.h
    @@ -96,8 +96,13 @@ static inline unsigned int kstat_irqs(unsigned int irq)

    return sum;
    }
    +static inline unsigned int kstat_irqs_usr(unsigned int irq)
    +{
    + return kstat_irqs(irq);
    +}
    #else
    extern unsigned int kstat_irqs(unsigned int irq);
    +extern unsigned int kstat_irqs_usr(unsigned int irq);
    #endif

    /*
    diff --git a/include/linux/libata.h b/include/linux/libata.h
    index d773b21..42ac6ad 100644
    --- a/include/linux/libata.h
    +++ b/include/linux/libata.h
    @@ -207,6 +207,7 @@ enum {
    ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity
    * led */
    ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */
    + ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */

    /* bits 24:31 of ap->flags are reserved for LLD specific flags */

    diff --git a/include/linux/mm.h b/include/linux/mm.h
    index 7f40120..e5ee683 100644
    --- a/include/linux/mm.h
    +++ b/include/linux/mm.h
    @@ -840,6 +840,7 @@ static inline int page_mapped(struct page *page)
    #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */
    #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */
    #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */
    +#define VM_FAULT_SIGSEGV 0x0040

    #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */
    #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */
    @@ -847,8 +848,8 @@ static inline int page_mapped(struct page *page)

    #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */

    -#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
    - VM_FAULT_HWPOISON_LARGE)
    +#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
    + VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)

    /* Encode hstate index for a hwpoisoned large page */
    #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
    @@ -1470,7 +1471,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
    #if VM_GROWSUP
    extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
    #else
    - #define expand_upwards(vma, address) do { } while (0)
    + #define expand_upwards(vma, address) (0)
    #endif

    /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */
    diff --git a/include/linux/rmap.h b/include/linux/rmap.h
    index 2148b12..b0df05a 100644
    --- a/include/linux/rmap.h
    +++ b/include/linux/rmap.h
    @@ -37,6 +37,16 @@ struct anon_vma {
    atomic_t refcount;

    /*
    + * Count of child anon_vmas and VMAs which points to this anon_vma.
    + *
    + * This counter is used for making decision about reusing anon_vma
    + * instead of forking new one. See comments in function anon_vma_clone.
    + */
    + unsigned degree;
    +
    + struct anon_vma *parent; /* Parent of this anon_vma */
    +
    + /*
    * NOTE: the LSB of the head.next is set by
    * mm_take_all_locks() _after_ taking the above lock. So the
    * head must only be read/written after taking the above lock
    diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
    index dac0859..2b9cd8d 100644
    --- a/include/linux/sysfs.h
    +++ b/include/linux/sysfs.h
    @@ -80,6 +80,15 @@ struct attribute_group {

    #define __ATTR_NULL { .attr = { .name = NULL } }

    +#define ATTRIBUTE_GROUPS(name) \
    +static const struct attribute_group name##_group = { \
    + .attrs = name##_attrs, \
    +}; \
    +static const struct attribute_group *name##_groups[] = { \
    + &name##_group, \
    + NULL, \
    +}
    +
    #define attr_name(_attr) (_attr).attr.name

    struct file;
    diff --git a/include/linux/time.h b/include/linux/time.h
    index 8c0216e..a87b440 100644
    --- a/include/linux/time.h
    +++ b/include/linux/time.h
    @@ -138,6 +138,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts)
    return true;
    }

    +static inline bool timeval_valid(const struct timeval *tv)
    +{
    + /* Dates before 1970 are bogus */
    + if (tv->tv_sec < 0)
    + return false;
    +
    + /* Can't have more microseconds then a second */
    + if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
    + return false;
    +
    + return true;
    +}
    +
    extern void read_persistent_clock(struct timespec *ts);
    extern void read_boot_clock(struct timespec *ts);
    extern int update_persistent_clock(struct timespec now);
    diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
    index 8eeeb87..142252c 100644
    --- a/include/linux/usb/quirks.h
    +++ b/include/linux/usb/quirks.h
    @@ -30,6 +30,17 @@
    descriptor */
    #define USB_QUIRK_DELAY_INIT 0x00000040

    +/*
    + * For high speed and super speed interupt endpoints, the USB 2.0 and
    + * USB 3.0 spec require the interval in microframes
    + * (1 microframe = 125 microseconds) to be calculated as
    + * interval = 2 ^ (bInterval-1).
    + *
    + * Devices with this quirk report their bInterval as the result of this
    + * calculation instead of the exponent variable used in the calculation.
    + */
    +#define USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL 0x00000080
    +
    /* device generates spurious wakeup, ignore remote wakeup capability */
    #define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200

    diff --git a/include/linux/virtio.h b/include/linux/virtio.h
    index 96c7843..e4807af 100644
    --- a/include/linux/virtio.h
    +++ b/include/linux/virtio.h
    @@ -127,7 +127,11 @@ struct virtio_device {
    void *priv;
    };

    -#define dev_to_virtio(dev) container_of(dev, struct virtio_device, dev)
    +static inline struct virtio_device *dev_to_virtio(struct device *_dev)
    +{
    + return container_of(_dev, struct virtio_device, dev);
    +}
    +
    int register_virtio_device(struct virtio_device *dev);
    void unregister_virtio_device(struct virtio_device *dev);

    diff --git a/include/linux/writeback.h b/include/linux/writeback.h
    index 7e85d45..9f149dd 100644
    --- a/include/linux/writeback.h
    +++ b/include/linux/writeback.h
    @@ -190,7 +190,6 @@ int write_cache_pages(struct address_space *mapping,
    struct writeback_control *wbc, writepage_t writepage,
    void *data);
    int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
    -void set_page_dirty_balance(struct page *page, int page_mkwrite);
    void writeback_set_ratelimit(void);
    void tag_pages_for_writeback(struct address_space *mapping,
    pgoff_t start, pgoff_t end);
    diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
    index 2124004..6e4569f 100644
    --- a/include/net/ip_fib.h
    +++ b/include/net/ip_fib.h
    @@ -175,8 +175,8 @@ extern void fib_free_table(struct fib_table *tb);

    #ifndef CONFIG_IP_MULTIPLE_TABLES

    -#define TABLE_LOCAL_INDEX 0
    -#define TABLE_MAIN_INDEX 1
    +#define TABLE_LOCAL_INDEX (RT_TABLE_LOCAL & (FIB_TABLE_HASHSZ - 1))
    +#define TABLE_MAIN_INDEX (RT_TABLE_MAIN & (FIB_TABLE_HASHSZ - 1))

    static inline struct fib_table *fib_get_table(struct net *net, u32 id)
    {
    diff --git a/include/net/sock.h b/include/net/sock.h
    index e6454b6..c8dcbb8 100644
    --- a/include/net/sock.h
    +++ b/include/net/sock.h
    @@ -194,7 +194,6 @@ struct sock_common {
    * @sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK)
    * @sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
    * @sk_gso_max_size: Maximum GSO segment size to build
    - * @sk_gso_max_segs: Maximum number of GSO segments
    * @sk_lingertime: %SO_LINGER l_linger setting
    * @sk_backlog: always used with the per-socket spinlock held
    * @sk_callback_lock: used with the callbacks in the end of this struct
    @@ -311,7 +310,6 @@ struct sock {
    int sk_route_nocaps;
    int sk_gso_type;
    unsigned int sk_gso_max_size;
    - u16 sk_gso_max_segs;
    int sk_rcvlowat;
    unsigned long sk_lingertime;
    struct sk_buff_head sk_error_queue;
    diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
    index e1a8b64..f69e37ce 100644
    --- a/kernel/irq/internals.h
    +++ b/kernel/irq/internals.h
    @@ -76,6 +76,13 @@ extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu);
    extern void mask_irq(struct irq_desc *desc);
    extern void unmask_irq(struct irq_desc *desc);

    +#ifdef CONFIG_SPARSE_IRQ
    +extern void irq_lock_sparse(void);
    +extern void irq_unlock_sparse(void);
    +#else
    +static inline void irq_lock_sparse(void) { }
    +static inline void irq_unlock_sparse(void) { }
    +#endif
    extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);

    irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action);
    diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
    index d86e254..f497ff7 100644
    --- a/kernel/irq/irqdesc.c
    +++ b/kernel/irq/irqdesc.c
    @@ -130,6 +130,16 @@ static void free_masks(struct irq_desc *desc)
    static inline void free_masks(struct irq_desc *desc) { }
    #endif

    +void irq_lock_sparse(void)
    +{
    + mutex_lock(&sparse_irq_lock);
    +}
    +
    +void irq_unlock_sparse(void)
    +{
    + mutex_unlock(&sparse_irq_lock);
    +}
    +
    static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
    {
    struct irq_desc *desc;
    @@ -166,6 +176,12 @@ static void free_desc(unsigned int irq)

    unregister_irq_proc(irq, desc);

    + /*
    + * sparse_irq_lock protects also show_interrupts() and
    + * kstat_irq_usr(). Once we deleted the descriptor from the
    + * sparse tree we can free it. Access in proc will fail to
    + * lookup the descriptor.
    + */
    mutex_lock(&sparse_irq_lock);
    delete_irq_desc(irq);
    mutex_unlock(&sparse_irq_lock);
    @@ -487,6 +503,15 @@ void dynamic_irq_cleanup(unsigned int irq)
    raw_spin_unlock_irqrestore(&desc->lock, flags);
    }

    +/**
    + * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu
    + * @irq: The interrupt number
    + * @cpu: The cpu number
    + *
    + * Returns the sum of interrupt counts on @cpu since boot for
    + * @irq. The caller must ensure that the interrupt is not removed
    + * concurrently.
    + */
    unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
    {
    struct irq_desc *desc = irq_to_desc(irq);
    @@ -495,6 +520,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
    *per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
    }

    +/**
    + * kstat_irqs - Get the statistics for an interrupt
    + * @irq: The interrupt number
    + *
    + * Returns the sum of interrupt counts on all cpus since boot for
    + * @irq. The caller must ensure that the interrupt is not removed
    + * concurrently.
    + */
    unsigned int kstat_irqs(unsigned int irq)
    {
    struct irq_desc *desc = irq_to_desc(irq);
    @@ -507,3 +540,22 @@ unsigned int kstat_irqs(unsigned int irq)
    sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
    return sum;
    }
    +
    +/**
    + * kstat_irqs_usr - Get the statistics for an interrupt
    + * @irq: The interrupt number
    + *
    + * Returns the sum of interrupt counts on all cpus since boot for
    + * @irq. Contrary to kstat_irqs() this can be called from any
    + * preemptible context. It's protected against concurrent removal of
    + * an interrupt descriptor when sparse irqs are enabled.
    + */
    +unsigned int kstat_irqs_usr(unsigned int irq)
    +{
    + int sum;
    +
    + irq_lock_sparse();
    + sum = kstat_irqs(irq);
    + irq_unlock_sparse();
    + return sum;
    +}
    diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
    index 4bd4faa..fb655f5f 100644
    --- a/kernel/irq/proc.c
    +++ b/kernel/irq/proc.c
    @@ -15,6 +15,23 @@

    #include "internals.h"

    +/*
    + * Access rules:
    + *
    + * procfs protects read/write of /proc/irq/N/ files against a
    + * concurrent free of the interrupt descriptor. remove_proc_entry()
    + * immediately prevents new read/writes to happen and waits for
    + * already running read/write functions to complete.
    + *
    + * We remove the proc entries first and then delete the interrupt
    + * descriptor from the radix tree and free it. So it is guaranteed
    + * that irq_to_desc(N) is valid as long as the read/writes are
    + * permitted by procfs.
    + *
    + * The read from /proc/interrupts is a different problem because there
    + * is no protection. So the lookup and the access to irqdesc
    + * information must be protected by sparse_irq_lock.
    + */
    static struct proc_dir_entry *root_irq_dir;

    #ifdef CONFIG_SMP
    @@ -441,9 +458,10 @@ int show_interrupts(struct seq_file *p, void *v)
    seq_putc(p, '\n');
    }

    + irq_lock_sparse();
    desc = irq_to_desc(i);
    if (!desc)
    - return 0;
    + goto outsparse;

    raw_spin_lock_irqsave(&desc->lock, flags);
    for_each_online_cpu(j)
    @@ -481,6 +499,8 @@ int show_interrupts(struct seq_file *p, void *v)
    seq_putc(p, '\n');
    out:
    raw_spin_unlock_irqrestore(&desc->lock, flags);
    +outsparse:
    + irq_unlock_sparse();
    return 0;
    }
    #endif
    diff --git a/kernel/time.c b/kernel/time.c
    index 060f961..f64e88b 100644
    --- a/kernel/time.c
    +++ b/kernel/time.c
    @@ -192,6 +192,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
    if (tv) {
    if (copy_from_user(&user_tv, tv, sizeof(*tv)))
    return -EFAULT;
    +
    + if (!timeval_valid(&user_tv))
    + return -EINVAL;
    +
    new_ts.tv_sec = user_tv.tv_sec;
    new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
    }
    diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
    index f1eb182..bca743d 100644
    --- a/kernel/time/ntp.c
    +++ b/kernel/time/ntp.c
    @@ -608,6 +608,13 @@ int do_adjtimex(struct timex *txc)
    return -EINVAL;
    }

    + if (txc->modes & ADJ_FREQUENCY) {
    + if (LONG_MIN / PPM_SCALE > txc->freq)
    + return -EINVAL;
    + if (LONG_MAX / PPM_SCALE < txc->freq)
    + return -EINVAL;
    + }
    +
    if (txc->modes & ADJ_SETOFFSET) {
    struct timespec delta;
    delta.tv_sec = txc->time.tv_sec;
    diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
    index a7b80c1..6a110e2 100644
    --- a/lib/decompress_bunzip2.c
    +++ b/lib/decompress_bunzip2.c
    @@ -185,7 +185,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
    if (get_bits(bd, 1))
    return RETVAL_OBSOLETE_INPUT;
    origPtr = get_bits(bd, 24);
    - if (origPtr > dbufSize)
    + if (origPtr >= dbufSize)
    return RETVAL_DATA_ERROR;
    /* mapping table: if some byte values are never used (encoding things
    like ascii text), the compression code removes the gaps to have fewer
    diff --git a/mm/ksm.c b/mm/ksm.c
    index 310544a..6741c9d 100644
    --- a/mm/ksm.c
    +++ b/mm/ksm.c
    @@ -342,7 +342,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
    else
    ret = VM_FAULT_WRITE;
    put_page(page);
    - } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
    + } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
    /*
    * We must loop because handle_mm_fault() may back out if there's
    * any difficulty e.g. if pte accessed bit gets updated concurrently.
    diff --git a/mm/memory.c b/mm/memory.c
    index 628cadc..0a7bb38 100644
    --- a/mm/memory.c
    +++ b/mm/memory.c
    @@ -1767,7 +1767,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
    else
    return -EFAULT;
    }
    - if (ret & VM_FAULT_SIGBUS)
    + if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
    return i ? i : -EFAULT;
    BUG();
    }
    @@ -1871,7 +1871,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
    return -ENOMEM;
    if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
    return -EHWPOISON;
    - if (ret & VM_FAULT_SIGBUS)
    + if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
    return -EFAULT;
    BUG();
    }
    @@ -2661,17 +2661,24 @@ reuse:
    if (!dirty_page)
    return ret;

    - /*
    - * Yes, Virginia, this is actually required to prevent a race
    - * with clear_page_dirty_for_io() from clearing the page dirty
    - * bit after it clear all dirty ptes, but before a racing
    - * do_wp_page installs a dirty pte.
    - *
    - * __do_fault is protected similarly.
    - */
    if (!page_mkwrite) {
    - wait_on_page_locked(dirty_page);
    - set_page_dirty_balance(dirty_page, page_mkwrite);
    + struct address_space *mapping;
    + int dirtied;
    +
    + lock_page(dirty_page);
    + dirtied = set_page_dirty(dirty_page);
    + VM_BUG_ON(PageAnon(dirty_page));
    + mapping = dirty_page->mapping;
    + unlock_page(dirty_page);
    +
    + if (dirtied && mapping) {
    + /*
    + * Some device drivers do not set page.mapping
    + * but still dirty their pages
    + */
    + balance_dirty_pages_ratelimited(mapping);
    + }
    +
    }
    put_page(dirty_page);
    if (page_mkwrite) {
    @@ -3117,7 +3124,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
    if (prev && prev->vm_end == address)
    return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;

    - expand_downwards(vma, address - PAGE_SIZE);
    + return expand_downwards(vma, address - PAGE_SIZE);
    }
    if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
    struct vm_area_struct *next = vma->vm_next;
    @@ -3126,7 +3133,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
    if (next && next->vm_start == address + PAGE_SIZE)
    return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;

    - expand_upwards(vma, address + PAGE_SIZE);
    + return expand_upwards(vma, address + PAGE_SIZE);
    }
    return 0;
    }
    @@ -3148,7 +3155,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,

    /* Check if we need to add a guard page to the stack */
    if (check_stack_guard_page(vma, address) < 0)
    - return VM_FAULT_SIGBUS;
    + return VM_FAULT_SIGSEGV;

    /* Use the zero-page for reads */
    if (!(flags & FAULT_FLAG_WRITE)) {
    diff --git a/mm/mmap.c b/mm/mmap.c
    index f2badbf..13b5685 100644
    --- a/mm/mmap.c
    +++ b/mm/mmap.c
    @@ -537,9 +537,14 @@ again: remove_next = 1 + (end > next->vm_end);
    * shrinking vma had, to cover any anon pages imported.
    */
    if (exporter && exporter->anon_vma && !importer->anon_vma) {
    - if (anon_vma_clone(importer, exporter))
    - return -ENOMEM;
    + int error;
    +
    importer->anon_vma = exporter->anon_vma;
    + error = anon_vma_clone(importer, exporter);
    + if (error) {
    + importer->anon_vma = NULL;
    + return error;
    + }
    }
    }

    @@ -1648,14 +1653,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
    {
    struct mm_struct *mm = vma->vm_mm;
    struct rlimit *rlim = current->signal->rlim;
    - unsigned long new_start;
    + unsigned long new_start, actual_size;

    /* address space limit tests */
    if (!may_expand_vm(mm, grow))
    return -ENOMEM;

    /* Stack limit test */
    - if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
    + actual_size = size;
    + if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
    + actual_size -= PAGE_SIZE;
    + if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
    return -ENOMEM;

    /* mlock limit tests */
    diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    index d2ac057..aad22aa 100644
    --- a/mm/page-writeback.c
    +++ b/mm/page-writeback.c
    @@ -1202,16 +1202,6 @@ pause:
    bdi_start_background_writeback(bdi);
    }

    -void set_page_dirty_balance(struct page *page, int page_mkwrite)
    -{
    - if (set_page_dirty(page) || page_mkwrite) {
    - struct address_space *mapping = page_mapping(page);
    -
    - if (mapping)
    - balance_dirty_pages_ratelimited(mapping);
    - }
    -}
    -
    static DEFINE_PER_CPU(int, bdp_ratelimits);

    /**
    @@ -1764,32 +1754,25 @@ EXPORT_SYMBOL(account_page_writeback);
    * page dirty in that case, but not all the buffers. This is a "bottom-up"
    * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
    *
    - * Most callers have locked the page, which pins the address_space in memory.
    - * But zap_pte_range() does not lock the page, however in that case the
    - * mapping is pinned by the vma's ->vm_file reference.
    - *
    - * We take care to handle the case where the page was truncated from the
    - * mapping by re-checking page_mapping() inside tree_lock.
    + * The caller must ensure this doesn't race with truncation. Most will simply
    + * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
    + * the pte lock held, which also locks out truncation.
    */
    int __set_page_dirty_nobuffers(struct page *page)
    {
    if (!TestSetPageDirty(page)) {
    struct address_space *mapping = page_mapping(page);
    - struct address_space *mapping2;
    unsigned long flags;

    if (!mapping)
    return 1;

    spin_lock_irqsave(&mapping->tree_lock, flags);
    - mapping2 = page_mapping(page);
    - if (mapping2) { /* Race with truncate? */
    - BUG_ON(mapping2 != mapping);
    - WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
    - account_page_dirtied(page, mapping);
    - radix_tree_tag_set(&mapping->page_tree,
    - page_index(page), PAGECACHE_TAG_DIRTY);
    - }
    + BUG_ON(page_mapping(page) != mapping);
    + WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
    + account_page_dirtied(page, mapping);
    + radix_tree_tag_set(&mapping->page_tree, page_index(page),
    + PAGECACHE_TAG_DIRTY);
    spin_unlock_irqrestore(&mapping->tree_lock, flags);
    if (mapping->host) {
    /* !PageAnon && !swapper_space */
    @@ -1946,12 +1929,10 @@ int clear_page_dirty_for_io(struct page *page)
    /*
    * We carefully synchronise fault handlers against
    * installing a dirty pte and marking the page dirty
    - * at this point. We do this by having them hold the
    - * page lock at some point after installing their
    - * pte, but before marking the page dirty.
    - * Pages are always locked coming in here, so we get
    - * the desired exclusion. See mm/memory.c:do_wp_page()
    - * for more comments.
    + * at this point. We do this by having them hold the
    + * page lock while dirtying the page, and pages are
    + * always locked coming in here, so we get the desired
    + * exclusion.
    */
    if (TestClearPageDirty(page)) {
    dec_zone_page_state(page, NR_FILE_DIRTY);
    diff --git a/mm/rmap.c b/mm/rmap.c
    index f3f6fd3..2c4ee3e 100644
    --- a/mm/rmap.c
    +++ b/mm/rmap.c
    @@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
    anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
    if (anon_vma) {
    atomic_set(&anon_vma->refcount, 1);
    + anon_vma->degree = 1; /* Reference for first vma */
    + anon_vma->parent = anon_vma;
    /*
    * Initialise the anon_vma root to point to itself. If called
    * from fork, the root will be reset to the parents anon_vma.
    @@ -181,6 +183,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
    avc->vma = vma;
    list_add(&avc->same_vma, &vma->anon_vma_chain);
    list_add_tail(&avc->same_anon_vma, &anon_vma->head);
    + /* vma reference or self-parent link for new root */
    + anon_vma->degree++;
    allocated = NULL;
    avc = NULL;
    }
    @@ -244,6 +248,14 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
    /*
    * Attach the anon_vmas from src to dst.
    * Returns 0 on success, -ENOMEM on failure.
    + *
    + * If dst->anon_vma is NULL this function tries to find and reuse existing
    + * anon_vma which has no vmas and only one child anon_vma. This prevents
    + * degradation of anon_vma hierarchy to endless linear chain in case of
    + * constantly forking task. On the other hand, an anon_vma with more than one
    + * child isn't reused even if there was no alive vma, thus rmap walker has a
    + * good chance of avoiding scanning the whole hierarchy when it searches where
    + * page is mapped.
    */
    int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
    {
    @@ -264,7 +276,21 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
    anon_vma = pavc->anon_vma;
    root = lock_anon_vma_root(root, anon_vma);
    anon_vma_chain_link(dst, avc, anon_vma);
    +
    + /*
    + * Reuse existing anon_vma if its degree lower than two,
    + * that means it has no vma and only one anon_vma child.
    + *
    + * Do not chose parent anon_vma, otherwise first child
    + * will always reuse it. Root anon_vma is never reused:
    + * it has self-parent reference and at least one child.
    + */
    + if (!dst->anon_vma && anon_vma != src->anon_vma &&
    + anon_vma->degree < 2)
    + dst->anon_vma = anon_vma;
    }
    + if (dst->anon_vma)
    + dst->anon_vma->degree++;
    unlock_anon_vma_root(root);
    return 0;

    @@ -287,6 +313,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    if (!pvma->anon_vma)
    return 0;

    + /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
    + vma->anon_vma = NULL;
    +
    /*
    * First, attach the new VMA to the parent VMA's anon_vmas,
    * so rmap can find non-COWed pages in child processes.
    @@ -294,6 +323,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    if (anon_vma_clone(vma, pvma))
    return -ENOMEM;

    + /* An existing anon_vma has been reused, all done then. */
    + if (vma->anon_vma)
    + return 0;
    +
    /* Then add our own anon_vma. */
    anon_vma = anon_vma_alloc();
    if (!anon_vma)
    @@ -307,6 +340,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    * lock any of the anon_vmas in this anon_vma tree.
    */
    anon_vma->root = pvma->anon_vma->root;
    + anon_vma->parent = pvma->anon_vma;
    /*
    * With refcounts, an anon_vma can stay around longer than the
    * process it belongs to. The root anon_vma needs to be pinned until
    @@ -317,6 +351,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    vma->anon_vma = anon_vma;
    anon_vma_lock(anon_vma);
    anon_vma_chain_link(vma, avc, anon_vma);
    + anon_vma->parent->degree++;
    anon_vma_unlock(anon_vma);

    return 0;
    @@ -347,12 +382,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
    * Leave empty anon_vmas on the list - we'll need
    * to free them outside the lock.
    */
    - if (list_empty(&anon_vma->head))
    + if (list_empty(&anon_vma->head)) {
    + anon_vma->parent->degree--;
    continue;
    + }

    list_del(&avc->same_vma);
    anon_vma_chain_free(avc);
    }
    + if (vma->anon_vma)
    + vma->anon_vma->degree--;
    unlock_anon_vma_root(root);

    /*
    @@ -363,6 +402,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
    list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
    struct anon_vma *anon_vma = avc->anon_vma;

    + BUG_ON(anon_vma->degree);
    put_anon_vma(anon_vma);

    list_del(&avc->same_vma);
    diff --git a/net/core/dev.c b/net/core/dev.c
    index 854da15..fcb5133 100644
    --- a/net/core/dev.c
    +++ b/net/core/dev.c
    @@ -1616,6 +1616,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
    skb->tstamp.tv64 = 0;
    skb->pkt_type = PACKET_HOST;
    skb->protocol = eth_type_trans(skb, dev);
    + skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
    skb->mark = 0;
    secpath_reset(skb);
    nf_reset(skb);
    @@ -2128,11 +2129,13 @@ u32 netif_skb_features(struct sk_buff *skb)
    if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
    features &= ~NETIF_F_GSO_MASK;

    - if (protocol == htons(ETH_P_8021Q)) {
    - struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
    - protocol = veh->h_vlan_encapsulated_proto;
    - } else if (!vlan_tx_tag_present(skb)) {
    - return harmonize_features(skb, protocol, features);
    + if (!vlan_tx_tag_present(skb)) {
    + if (unlikely(protocol == htons(ETH_P_8021Q))) {
    + struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
    + protocol = veh->h_vlan_encapsulated_proto;
    + } else {
    + return harmonize_features(skb, protocol, features);
    + }
    }

    features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX);
    diff --git a/net/core/sock.c b/net/core/sock.c
    index 8a2c2dd..e093528 100644
    --- a/net/core/sock.c
    +++ b/net/core/sock.c
    @@ -1311,7 +1311,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
    } else {
    sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
    sk->sk_gso_max_size = dst->dev->gso_max_size;
    - sk->sk_gso_max_segs = dst->dev->gso_max_segs;
    }
    }
    }
    diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
    index 59a7041..d1f56e1 100644
    --- a/net/ipv4/arp.c
    +++ b/net/ipv4/arp.c
    @@ -592,16 +592,18 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
    struct sk_buff *skb;
    struct arphdr *arp;
    unsigned char *arp_ptr;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;

    /*
    * Allocate a buffer
    */

    - skb = alloc_skb(arp_hdr_len(dev) + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
    + skb = alloc_skb(arp_hdr_len(dev) + hlen + tlen, GFP_ATOMIC);
    if (skb == NULL)
    return NULL;

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb_reserve(skb, hlen);
    skb_reset_network_header(skb);
    arp = (struct arphdr *) skb_put(skb, arp_hdr_len(dev));
    skb->dev = dev;
    diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
    index 7fe66d9..03e9486 100644
    --- a/net/ipv4/igmp.c
    +++ b/net/ipv4/igmp.c
    @@ -294,9 +294,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
    return scount;
    }

    -#define igmp_skb_size(skb) (*(unsigned int *)((skb)->cb))
    -
    -static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
    +static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
    {
    struct sk_buff *skb;
    struct rtable *rt;
    @@ -304,9 +302,12 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
    struct igmpv3_report *pig;
    struct net *net = dev_net(dev);
    struct flowi4 fl4;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;
    + unsigned int size = mtu;

    while (1) {
    - skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev),
    + skb = alloc_skb(size + hlen + tlen,
    GFP_ATOMIC | __GFP_NOWARN);
    if (skb)
    break;
    @@ -314,7 +315,6 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
    if (size < 256)
    return NULL;
    }
    - igmp_skb_size(skb) = size;

    rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
    0, 0,
    @@ -327,7 +327,9 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
    skb_dst_set(skb, &rt->dst);
    skb->dev = dev;

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb->reserved_tailroom = skb_end_offset(skb) -
    + min(mtu, skb_end_offset(skb));
    + skb_reserve(skb, hlen);

    skb_reset_network_header(skb);
    pip = ip_hdr(skb);
    @@ -396,8 +398,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
    return skb;
    }

    -#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? igmp_skb_size(skb) - (skb)->len : \
    - skb_tailroom(skb)) : 0)
    +#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)

    static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
    int type, int gdeleted, int sdeleted)
    @@ -647,6 +648,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
    __be32 group = pmc ? pmc->multiaddr : 0;
    struct flowi4 fl4;
    __be32 dst;
    + int hlen, tlen;

    if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
    return igmpv3_send_report(in_dev, pmc);
    @@ -661,7 +663,9 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
    if (IS_ERR(rt))
    return -1;

    - skb = alloc_skb(IGMP_SIZE+LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
    + hlen = LL_RESERVED_SPACE(dev);
    + tlen = dev->needed_tailroom;
    + skb = alloc_skb(IGMP_SIZE + hlen + tlen, GFP_ATOMIC);
    if (skb == NULL) {
    ip_rt_put(rt);
    return -1;
    @@ -669,7 +673,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,

    skb_dst_set(skb, &rt->dst);

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb_reserve(skb, hlen);

    skb_reset_network_header(skb);
    iph = ip_hdr(skb);
    diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
    index 99ec116..efb1ff5 100644
    --- a/net/ipv4/ipconfig.c
    +++ b/net/ipv4/ipconfig.c
    @@ -767,13 +767,15 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
    struct sk_buff *skb;
    struct bootp_pkt *b;
    struct iphdr *h;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;

    /* Allocate packet */
    - skb = alloc_skb(sizeof(struct bootp_pkt) + LL_ALLOCATED_SPACE(dev) + 15,
    + skb = alloc_skb(sizeof(struct bootp_pkt) + hlen + tlen + 15,
    GFP_KERNEL);
    if (!skb)
    return;
    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb_reserve(skb, hlen);
    b = (struct bootp_pkt *) skb_put(skb, sizeof(struct bootp_pkt));
    memset(b, 0, sizeof(struct bootp_pkt));

    diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    index 75fea1f..063bcd5 100644
    --- a/net/ipv4/raw.c
    +++ b/net/ipv4/raw.c
    @@ -329,6 +329,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
    unsigned int iphlen;
    int err;
    struct rtable *rt = *rtp;
    + int hlen, tlen;

    if (length > rt->dst.dev->mtu) {
    ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
    @@ -338,12 +339,14 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
    if (flags&MSG_PROBE)
    goto out;

    + hlen = LL_RESERVED_SPACE(rt->dst.dev);
    + tlen = rt->dst.dev->needed_tailroom;
    skb = sock_alloc_send_skb(sk,
    - length + LL_ALLOCATED_SPACE(rt->dst.dev) + 15,
    + length + hlen + tlen + 15,
    flags & MSG_DONTWAIT, &err);
    if (skb == NULL)
    goto error;
    - skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));
    + skb_reserve(skb, hlen);

    skb->priority = sk->sk_priority;
    skb->mark = sk->sk_mark;
    diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    index 32c9e83..9a7c01e 100644
    --- a/net/ipv4/tcp.c
    +++ b/net/ipv4/tcp.c
    @@ -738,9 +738,7 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
    old_size_goal + mss_now > xmit_size_goal)) {
    xmit_size_goal = old_size_goal;
    } else {
    - tp->xmit_size_goal_segs =
    - min_t(u16, xmit_size_goal / mss_now,
    - sk->sk_gso_max_segs);
    + tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
    xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
    }
    }
    diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
    index 6cebfd2..850c737 100644
    --- a/net/ipv4/tcp_cong.c
    +++ b/net/ipv4/tcp_cong.c
    @@ -290,8 +290,7 @@ int tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
    left = tp->snd_cwnd - in_flight;
    if (sk_can_gso(sk) &&
    left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
    - left * tp->mss_cache < sk->sk_gso_max_size &&
    - left < sk->sk_gso_max_segs)
    + left * tp->mss_cache < sk->sk_gso_max_size)
    return 1;
    return left <= tcp_max_burst(tp);
    }
    diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    index 0d5a118..3a37f54 100644
    --- a/net/ipv4/tcp_output.c
    +++ b/net/ipv4/tcp_output.c
    @@ -1320,21 +1320,21 @@ static void tcp_cwnd_validate(struct sock *sk)
    * when we would be allowed to send the split-due-to-Nagle skb fully.
    */
    static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
    - unsigned int mss_now, unsigned int max_segs)
    + unsigned int mss_now, unsigned int cwnd)
    {
    const struct tcp_sock *tp = tcp_sk(sk);
    - u32 needed, window, max_len;
    + u32 needed, window, cwnd_len;

    window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
    - max_len = mss_now * max_segs;
    + cwnd_len = mss_now * cwnd;

    - if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
    - return max_len;
    + if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
    + return cwnd_len;

    needed = min(skb->len, window);

    - if (max_len <= needed)
    - return max_len;
    + if (cwnd_len <= needed)
    + return cwnd_len;

    return needed - needed % mss_now;
    }
    @@ -1562,8 +1562,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
    limit = min(send_win, cong_win);

    /* If a full-sized TSO skb can be sent, do it. */
    - if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
    - sk->sk_gso_max_segs * tp->mss_cache))
    + if (limit >= sk->sk_gso_max_size)
    goto send_now;

    /* Middle in queue won't get any more data, full sendable already? */
    @@ -1792,9 +1791,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
    limit = mss_now;
    if (tso_segs > 1 && !tcp_urg_mode(tp))
    limit = tcp_mss_split_point(sk, skb, mss_now,
    - min_t(unsigned int,
    - cwnd_quota,
    - sk->sk_gso_max_segs));
    + cwnd_quota);

    if (skb->len > limit &&
    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
    diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    index 46fc6a3..2215d6b 100644
    --- a/net/ipv6/ip6_output.c
    +++ b/net/ipv6/ip6_output.c
    @@ -623,6 +623,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
    struct ipv6hdr *tmp_hdr;
    struct frag_hdr *fh;
    unsigned int mtu, hlen, left, len;
    + int hroom, troom;
    __be32 frag_id = 0;
    int ptr, offset = 0, err=0;
    u8 *prevhdr, nexthdr = 0;
    @@ -789,6 +790,8 @@ slow_path:
    */

    *prevhdr = NEXTHDR_FRAGMENT;
    + hroom = LL_RESERVED_SPACE(rt->dst.dev);
    + troom = rt->dst.dev->needed_tailroom;

    /*
    * Keep copying data until we run out.
    @@ -807,7 +810,8 @@ slow_path:
    * Allocate buffer.
    */

    - if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->dst.dev), GFP_ATOMIC)) == NULL) {
    + if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
    + hroom + troom, GFP_ATOMIC)) == NULL) {
    NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
    IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
    IPSTATS_MIB_FRAGFAILS);
    @@ -820,7 +824,7 @@ slow_path:
    */

    ip6_copy_metadata(frag, skb);
    - skb_reserve(frag, LL_RESERVED_SPACE(rt->dst.dev));
    + skb_reserve(frag, hroom);
    skb_put(frag, len + hlen + sizeof(struct frag_hdr));
    skb_reset_network_header(frag);
    fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
    diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
    index 4f12b66..7bb6644 100644
    --- a/net/ipv6/mcast.c
    +++ b/net/ipv6/mcast.c
    @@ -1334,7 +1334,7 @@ mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
    return scount;
    }

    -static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
    +static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
    {
    struct net_device *dev = idev->dev;
    struct net *net = dev_net(dev);
    @@ -1343,13 +1343,15 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
    struct mld2_report *pmr;
    struct in6_addr addr_buf;
    const struct in6_addr *saddr;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;
    + unsigned int size = mtu + hlen + tlen;
    int err;
    u8 ra[8] = { IPPROTO_ICMPV6, 0,
    IPV6_TLV_ROUTERALERT, 2, 0, 0,
    IPV6_TLV_PADN, 0 };

    /* we assume size > sizeof(ra) here */
    - size += LL_ALLOCATED_SPACE(dev);
    /* limit our allocations to order-0 page */
    size = min_t(int, size, SKB_MAX_ORDER(0, 0));
    skb = sock_alloc_send_skb(sk, size, 1, &err);
    @@ -1357,7 +1359,9 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
    if (!skb)
    return NULL;

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb->reserved_tailroom = skb_end_offset(skb) -
    + min(mtu, skb_end_offset(skb));
    + skb_reserve(skb, hlen);

    if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
    /* <draft-ietf-magma-mld-source-05.txt>:
    @@ -1477,8 +1481,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    return skb;
    }

    -#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
    - skb_tailroom(skb)) : 0)
    +#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)

    static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    int type, int gdeleted, int sdeleted)
    @@ -1725,6 +1728,8 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
    struct mld_msg *hdr;
    const struct in6_addr *snd_addr, *saddr;
    struct in6_addr addr_buf;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;
    int err, len, payload_len, full_len;
    u8 ra[8] = { IPPROTO_ICMPV6, 0,
    IPV6_TLV_ROUTERALERT, 2, 0, 0,
    @@ -1746,7 +1751,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
    IPSTATS_MIB_OUT, full_len);
    rcu_read_unlock();

    - skb = sock_alloc_send_skb(sk, LL_ALLOCATED_SPACE(dev) + full_len, 1, &err);
    + skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);

    if (skb == NULL) {
    rcu_read_lock();
    @@ -1756,7 +1761,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
    return;
    }

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb_reserve(skb, hlen);

    if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
    /* <draft-ietf-magma-mld-source-05.txt>:
    diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    index bc55358..62096d8 100644
    --- a/net/ipv6/ndisc.c
    +++ b/net/ipv6/ndisc.c
    @@ -446,6 +446,8 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    struct sock *sk = net->ipv6.ndisc_sk;
    struct sk_buff *skb;
    struct icmp6hdr *hdr;
    + int hlen = LL_RESERVED_SPACE(dev);
    + int tlen = dev->needed_tailroom;
    int len;
    u8 *opt;

    @@ -457,7 +459,7 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    len += ndisc_opt_addr_space(dev);

    skb = alloc_skb((MAX_HEADER + sizeof(struct ipv6hdr) +
    - len + LL_ALLOCATED_SPACE(dev)), GFP_ATOMIC);
    + len + hlen + tlen), GFP_ATOMIC);
    if (!skb) {
    ND_PRINTK0(KERN_ERR
    "ICMPv6 ND: %s() failed to allocate an skb.\n",
    @@ -465,7 +467,7 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    return NULL;
    }

    - skb_reserve(skb, LL_RESERVED_SPACE(dev));
    + skb_reserve(skb, hlen);
    ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);

    skb->transport_header = skb->tail;
    @@ -1534,6 +1536,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
    struct inet6_dev *idev;
    struct flowi6 fl6;
    u8 *opt;
    + int hlen, tlen;
    int rd_len;
    int err;
    u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
    @@ -1591,9 +1594,11 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
    rd_len &= ~0x7;
    len += rd_len;

    + hlen = LL_RESERVED_SPACE(dev);
    + tlen = dev->needed_tailroom;
    buff = sock_alloc_send_skb(sk,
    (MAX_HEADER + sizeof(struct ipv6hdr) +
    - len + LL_ALLOCATED_SPACE(dev)),
    + len + hlen + tlen),
    1, &err);
    if (buff == NULL) {
    ND_PRINTK0(KERN_ERR
    @@ -1602,7 +1607,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
    goto release;
    }

    - skb_reserve(buff, LL_RESERVED_SPACE(dev));
    + skb_reserve(buff, hlen);
    ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
    IPPROTO_ICMPV6, len);

    diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
    index 9ecbc84..9287f3e 100644
    --- a/net/ipv6/raw.c
    +++ b/net/ipv6/raw.c
    @@ -607,6 +607,8 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
    struct sk_buff *skb;
    int err;
    struct rt6_info *rt = (struct rt6_info *)*dstp;
    + int hlen = LL_RESERVED_SPACE(rt->dst.dev);
    + int tlen = rt->dst.dev->needed_tailroom;

    if (length > rt->dst.dev->mtu) {
    ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
    @@ -616,11 +618,11 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
    goto out;

    skb = sock_alloc_send_skb(sk,
    - length + LL_ALLOCATED_SPACE(rt->dst.dev) + 15,
    + length + hlen + tlen + 15,
    flags & MSG_DONTWAIT, &err);
    if (skb == NULL)
    goto error;
    - skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));
    + skb_reserve(skb, hlen);

    skb->priority = sk->sk_priority;
    skb->mark = sk->sk_mark;
    diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    index 2064612..c0444a0 100644
    --- a/net/mac80211/rx.c
    +++ b/net/mac80211/rx.c
    @@ -1470,14 +1470,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
    sc = le16_to_cpu(hdr->seq_ctrl);
    frag = sc & IEEE80211_SCTL_FRAG;

    - if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
    - goto out;
    -
    if (is_multicast_ether_addr(hdr->addr1)) {
    rx->local->dot11MulticastReceivedFrameCount++;
    - goto out;
    + goto out_no_led;
    }

    + if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
    + goto out;
    +
    I802_DEBUG_INC(rx->local->rx_handlers_fragments);

    if (skb_linearize(rx->skb))
    @@ -1568,9 +1568,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
    status->rx_flags |= IEEE80211_RX_FRAGMENTED;

    out:
    + ieee80211_led_rx(rx->local);
    + out_no_led:
    if (rx->sta)
    rx->sta->rx_packets++;
    - ieee80211_led_rx(rx->local);
    return RX_CONTINUE;
    }

    diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
    index 86137b5..b88dcec 100644
    --- a/net/netfilter/ipset/ip_set_core.c
    +++ b/net/netfilter/ipset/ip_set_core.c
    @@ -1615,6 +1615,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
    if (*op < IP_SET_OP_VERSION) {
    /* Check the version at the beginning of operations */
    struct ip_set_req_version *req_version = data;
    +
    + if (*len < sizeof(struct ip_set_req_version)) {
    + ret = -EINVAL;
    + goto done;
    + }
    +
    if (req_version->version != IPSET_PROTOCOL) {
    ret = -EPROTO;
    goto done;
    diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
    index e2091d0..53bf12a 100644
    --- a/net/netfilter/nf_conntrack_proto_generic.c
    +++ b/net/netfilter/nf_conntrack_proto_generic.c
    @@ -14,6 +14,30 @@

    static unsigned int nf_ct_generic_timeout __read_mostly = 600*HZ;

    +static bool nf_generic_should_process(u8 proto)
    +{
    + switch (proto) {
    +#ifdef CONFIG_NF_CT_PROTO_SCTP_MODULE
    + case IPPROTO_SCTP:
    + return false;
    +#endif
    +#ifdef CONFIG_NF_CT_PROTO_DCCP_MODULE
    + case IPPROTO_DCCP:
    + return false;
    +#endif
    +#ifdef CONFIG_NF_CT_PROTO_GRE_MODULE
    + case IPPROTO_GRE:
    + return false;
    +#endif
    +#ifdef CONFIG_NF_CT_PROTO_UDPLITE_MODULE
    + case IPPROTO_UDPLITE:
    + return false;
    +#endif
    + default:
    + return true;
    + }
    +}
    +
    static bool generic_pkt_to_tuple(const struct sk_buff *skb,
    unsigned int dataoff,
    struct nf_conntrack_tuple *tuple)
    @@ -56,7 +80,7 @@ static int packet(struct nf_conn *ct,
    static bool new(struct nf_conn *ct, const struct sk_buff *skb,
    unsigned int dataoff)
    {
    - return true;
    + return nf_generic_should_process(nf_ct_protonum(ct));
    }

    #ifdef CONFIG_SYSCTL
    diff --git a/net/sctp/associola.c b/net/sctp/associola.c
    index 5b2d8e6..d014b05 100644
    --- a/net/sctp/associola.c
    +++ b/net/sctp/associola.c
    @@ -1272,7 +1272,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
    asoc->peer.peer_hmacs = new->peer.peer_hmacs;
    new->peer.peer_hmacs = NULL;

    - sctp_auth_key_put(asoc->asoc_shared_key);
    sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
    }

    diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    index c28eb7b..fc63664 100644
    --- a/net/sctp/socket.c
    +++ b/net/sctp/socket.c
    @@ -1611,6 +1611,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
    sctp_scope_t scope;
    long timeo;
    __u16 sinfo_flags = 0;
    + bool wait_connect = false;
    struct sctp_datamsg *datamsg;
    int msg_flags = msg->msg_flags;

    @@ -1929,6 +1930,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
    err = sctp_primitive_ASSOCIATE(asoc, NULL);
    if (err < 0)
    goto out_free;
    + wait_connect = true;
    SCTP_DEBUG_PRINTK("We associated primitively.\n");
    }

    @@ -1968,6 +1970,11 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
    else
    err = msg_len;

    + if (unlikely(wait_connect)) {
    + timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
    + sctp_wait_for_connect(asoc, &timeo);
    + }
    +
    /* If we are already past ASSOCIATE, the lower
    * layers are responsible for association cleanup.
    */
    diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    index cdf77a2..cb4168e 100644
    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -1815,6 +1815,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
    if (!rdev->ops->get_key)
    return -EOPNOTSUPP;

    + if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    + return -ENOENT;
    +
    msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
    if (!msg)
    return -ENOMEM;
    @@ -1832,10 +1835,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
    if (mac_addr)
    NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);

    - if (pairwise && mac_addr &&
    - !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    - return -ENOENT;
    -
    err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
    mac_addr, &cookie, get_key_callback);

    @@ -2007,7 +2006,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
    wdev_lock(dev->ieee80211_ptr);
    err = nl80211_key_allowed(dev->ieee80211_ptr);

    - if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
    + if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
    err = -ENOENT;

    diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
    index 858966a..679218b 100755
    --- a/scripts/recordmcount.pl
    +++ b/scripts/recordmcount.pl
    @@ -262,7 +262,6 @@ if ($arch eq "x86_64") {
    # force flags for this arch
    $ld .= " -m shlelf_linux";
    $objcopy .= " -O elf32-sh-linux";
    - $cc .= " -m32";

    } elsif ($arch eq "powerpc") {
    $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
    diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
    index 41144f7..7c5d1d8 100644
    --- a/security/keys/encrypted-keys/encrypted.c
    +++ b/security/keys/encrypted-keys/encrypted.c
    @@ -1016,10 +1016,13 @@ static int __init init_encrypted(void)
    ret = encrypted_shash_alloc();
    if (ret < 0)
    return ret;
    + ret = aes_get_sizes();
    + if (ret < 0)
    + goto out;
    ret = register_key_type(&key_type_encrypted);
    if (ret < 0)
    goto out;
    - return aes_get_sizes();
    + return 0;
    out:
    encrypted_shash_release();
    return ret;
    diff --git a/security/keys/gc.c b/security/keys/gc.c
    index bf4d8da..2e2395d 100644
    --- a/security/keys/gc.c
    +++ b/security/keys/gc.c
    @@ -186,12 +186,12 @@ static noinline void key_gc_unused_key(struct key *key)
    if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
    atomic_dec(&key->user->nikeys);

    - key_user_put(key->user);
    -
    /* now throw away the key memory */
    if (key->type->destroy)
    key->type->destroy(key);

    + key_user_put(key->user);
    +
    kfree(key->description);

    #ifdef KEY_DEBUGGING
    diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c
    index b9b2235..5b41e04 100644
    --- a/sound/core/seq/seq_dummy.c
    +++ b/sound/core/seq/seq_dummy.c
    @@ -82,36 +82,6 @@ struct snd_seq_dummy_port {
    static int my_client = -1;

    /*
    - * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
    - * to subscribers.
    - * Note: this callback is called only after all subscribers are removed.
    - */
    -static int
    -dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
    -{
    - struct snd_seq_dummy_port *p;
    - int i;
    - struct snd_seq_event ev;
    -
    - p = private_data;
    - memset(&ev, 0, sizeof(ev));
    - if (p->duplex)
    - ev.source.port = p->connect;
    - else
    - ev.source.port = p->port;
    - ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
    - ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
    - for (i = 0; i < 16; i++) {
    - ev.data.control.channel = i;
    - ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
    - snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
    - ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
    - snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
    - }
    - return 0;
    -}
    -
    -/*
    * event input callback - just redirect events to subscribers
    */
    static int
    @@ -175,7 +145,6 @@ create_port(int idx, int type)
    | SNDRV_SEQ_PORT_TYPE_PORT;
    memset(&pcb, 0, sizeof(pcb));
    pcb.owner = THIS_MODULE;
    - pcb.unuse = dummy_unuse;
    pcb.event_input = dummy_input;
    pcb.private_free = dummy_free;
    pcb.private_data = rec;
    diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
    index faabaa5..ee95618 100644
    --- a/sound/pci/hda/hda_codec.c
    +++ b/sound/pci/hda/hda_codec.c
    @@ -311,8 +311,10 @@ int snd_hda_get_sub_nodes(struct hda_codec *codec, hda_nid_t nid,
    unsigned int parm;

    parm = snd_hda_param_read(codec, nid, AC_PAR_NODE_COUNT);
    - if (parm == -1)
    + if (parm == -1) {
    + *start_id = 0;
    return 0;
    + }
    *start_id = (parm >> 16) & 0x7fff;
    return (int)(parm & 0x7fff);
    }
    diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
    index 467a73b..240658b 100644
    --- a/sound/pci/hda/patch_sigmatel.c
    +++ b/sound/pci/hda/patch_sigmatel.c
    @@ -4309,9 +4309,9 @@ static void stac_store_hints(struct hda_codec *codec)
    spec->gpio_mask;
    }
    if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
    - spec->gpio_mask &= spec->gpio_mask;
    - if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
    spec->gpio_dir &= spec->gpio_mask;
    + if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
    + spec->gpio_data &= spec->gpio_mask;
    if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
    spec->eapd_mask &= spec->gpio_mask;
    if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
    diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
    index ef96ca6..3551705 100644
    --- a/sound/soc/codecs/wm8960.c
    +++ b/sound/soc/codecs/wm8960.c
    @@ -499,7 +499,7 @@ static struct {
    { 22050, 2 },
    { 24000, 2 },
    { 16000, 3 },
    - { 11250, 4 },
    + { 11025, 4 },
    { 12000, 4 },
    { 8000, 5 },
    };
    diff --git a/sound/usb/midi.c b/sound/usb/midi.c
    index e5fee18..de86e74 100644
    --- a/sound/usb/midi.c
    +++ b/sound/usb/midi.c
    @@ -364,6 +364,8 @@ static void snd_usbmidi_error_timer(unsigned long data)
    if (in && in->error_resubmit) {
    in->error_resubmit = 0;
    for (j = 0; j < INPUT_URBS; ++j) {
    + if (atomic_read(&in->urbs[j]->use_count))
    + continue;
    in->urbs[j]->dev = umidi->dev;
    snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC);
    }
    diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
    index 4f7b330..88160b7 100644
    --- a/sound/usb/mixer.c
    +++ b/sound/usb/mixer.c
    @@ -834,6 +834,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
    case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
    case USB_ID(0x046d, 0x0808):
    case USB_ID(0x046d, 0x0809):
    + case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
    case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
    case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
    case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
    diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
    index 0e4e909..1e0798f 100644
    --- a/sound/usb/mixer_maps.c
    +++ b/sound/usb/mixer_maps.c
    @@ -304,8 +304,11 @@ static struct usbmix_name_map hercules_usb51_map[] = {
    { 0 } /* terminator */
    };

    -static const struct usbmix_name_map kef_x300a_map[] = {
    - { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
    +/* some (all?) SCMS USB3318 devices are affected by a firmware lock up
    + * when anything attempts to access FU 10 (control)
    + */
    +static const struct usbmix_name_map scms_usb3318_map[] = {
    + { 10, NULL },
    { 0 }
    };

    @@ -377,8 +380,14 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
    .ignore_ctl_error = 1,
    },
    {
    + /* KEF X300A */
    .id = USB_ID(0x27ac, 0x1000),
    - .map = kef_x300a_map,
    + .map = scms_usb3318_map,
    + },
    + {
    + /* Arcam rPAC */
    + .id = USB_ID(0x25c4, 0x0003),
    + .map = scms_usb3318_map,
    },
    { 0 } /* terminator */
    };
    diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
    index e467a58..2aacb96 100644
    --- a/sound/usb/quirks-table.h
    +++ b/sound/usb/quirks-table.h
    @@ -2540,133 +2540,45 @@ YAMAHA_DEVICE(0x7010, "UB99"),
    }
    },

    -/* Hauppauge HVR-950Q and HVR-850 */
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-850",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    -{
    - USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008),
    - .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    - USB_DEVICE_ID_MATCH_INT_CLASS |
    - USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    - .bInterfaceClass = USB_CLASS_AUDIO,
    - .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    - .vendor_name = "Hauppauge",
    - .product_name = "HVR-950Q",
    - .ifnum = QUIRK_ANY_INTERFACE,
    - .type = QUIRK_AUDIO_ALIGN_TRANSFER,
    - }
    -},
    +/*
    + * Auvitek au0828 devices with audio interface.
    + * This should be kept in sync with drivers/media/video/au0828/au0828-cards.c
    + * Please notice that some drivers are DVB only, and don't need to be
    + * here. That's the case, for example, of DVICO_FUSIONHDTV7.
    + */
    +
    +#define AU0828_DEVICE(vid, pid, vname, pname) { \
    + USB_DEVICE_VENDOR_SPEC(vid, pid), \
    + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
    + USB_DEVICE_ID_MATCH_INT_CLASS | \
    + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
    + .bInterfaceClass = USB_CLASS_AUDIO, \
    + .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \
    + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \
    + .vendor_name = vname, \
    + .product_name = pname, \
    + .ifnum = QUIRK_ANY_INTERFACE, \
    + .type = QUIRK_AUDIO_ALIGN_TRANSFER, \
    + } \
    +}
    +
    +AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
    +AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"),
    +AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"),
    +AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"),
    +AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"),
    +AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"),
    +AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
    +AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),

    /* Digidesign Mbox */
    {[unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2015-02-17 04:41    [W:4.645 / U:0.588 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site