Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:3.14 commit in: /
Date: Sun, 31 Jan 2016 21:34:36
Message-Id: 1454276061.4f7c719b37a0e4e61832ff95467c02317d456888.mpagano@gentoo
1 commit: 4f7c719b37a0e4e61832ff95467c02317d456888
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Sun Jan 31 21:34:21 2016 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Sun Jan 31 21:34:21 2016 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4f7c719b
7
8 Linux patch 3.14.60
9
10 0000_README | 4 +
11 1059_linux-3.14.60.patch | 1651 ++++++++++++++++++++++++++++++++++++++++++++++
12 2 files changed, 1655 insertions(+)
13
14 diff --git a/0000_README b/0000_README
15 index 767949f..03a61a1 100644
16 --- a/0000_README
17 +++ b/0000_README
18 @@ -278,6 +278,10 @@ Patch: 1058_linux-3.14.59.patch
19 From: http://www.kernel.org
20 Desc: Linux 3.14.59
21
22 +Patch: 1059_linux-3.14.60.patch
23 +From: http://www.kernel.org
24 +Desc: Linux 3.14.60
25 +
26 Patch: 1500_XATTR_USER_PREFIX.patch
27 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
28 Desc: Support for namespace user.pax.* on tmpfs.
29
30 diff --git a/1059_linux-3.14.60.patch b/1059_linux-3.14.60.patch
31 new file mode 100644
32 index 0000000..967c303
33 --- /dev/null
34 +++ b/1059_linux-3.14.60.patch
35 @@ -0,0 +1,1651 @@
36 +diff --git a/Makefile b/Makefile
37 +index c2a6ec4d8803..502255cebc9a 100644
38 +--- a/Makefile
39 ++++ b/Makefile
40 +@@ -1,6 +1,6 @@
41 + VERSION = 3
42 + PATCHLEVEL = 14
43 +-SUBLEVEL = 59
44 ++SUBLEVEL = 60
45 + EXTRAVERSION =
46 + NAME = Remembering Coco
47 +
48 +diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
49 +index 91f33c2051f2..eeab71a884cb 100644
50 +--- a/arch/arm64/include/asm/kvm_emulate.h
51 ++++ b/arch/arm64/include/asm/kvm_emulate.h
52 +@@ -86,11 +86,13 @@ static inline void vcpu_set_thumb(struct kvm_vcpu *vcpu)
53 + *vcpu_cpsr(vcpu) |= COMPAT_PSR_T_BIT;
54 + }
55 +
56 ++/*
57 ++ * vcpu_reg should always be passed a register number coming from a
58 ++ * read of ESR_EL2. Otherwise, it may give the wrong result on AArch32
59 ++ * with banked registers.
60 ++ */
61 + static inline unsigned long *vcpu_reg(const struct kvm_vcpu *vcpu, u8 reg_num)
62 + {
63 +- if (vcpu_mode_is_32bit(vcpu))
64 +- return vcpu_reg32(vcpu, reg_num);
65 +-
66 + return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.regs[reg_num];
67 + }
68 +
69 +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
70 +index b1269dac1289..bfe4a42d4f1f 100644
71 +--- a/arch/arm64/kernel/ptrace.c
72 ++++ b/arch/arm64/kernel/ptrace.c
73 +@@ -51,6 +51,12 @@
74 + */
75 + void ptrace_disable(struct task_struct *child)
76 + {
77 ++ /*
78 ++ * This would be better off in core code, but PTRACE_DETACH has
79 ++ * grown its fair share of arch-specific worts and changing it
80 ++ * is likely to cause regressions on obscure architectures.
81 ++ */
82 ++ user_disable_single_step(child);
83 + }
84 +
85 + #ifdef CONFIG_HAVE_HW_BREAKPOINT
86 +diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
87 +index 1e01d80a1165..01eb88863960 100644
88 +--- a/arch/arm64/kernel/setup.c
89 ++++ b/arch/arm64/kernel/setup.c
90 +@@ -446,6 +446,10 @@ static int c_show(struct seq_file *m, void *v)
91 + seq_printf(m, "processor\t: %d\n", i);
92 + #endif
93 +
94 ++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
95 ++ loops_per_jiffy / (500000UL/HZ),
96 ++ loops_per_jiffy / (5000UL/HZ) % 100);
97 ++
98 + /*
99 + * Dump out the common processor features in a single line.
100 + * Userspace should read the hwcaps with getauxval(AT_HWCAP)
101 +diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
102 +index 86825f8883de..f527a37ac979 100644
103 +--- a/arch/arm64/kvm/inject_fault.c
104 ++++ b/arch/arm64/kvm/inject_fault.c
105 +@@ -48,7 +48,7 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
106 +
107 + /* Note: These now point to the banked copies */
108 + *vcpu_spsr(vcpu) = new_spsr_value;
109 +- *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
110 ++ *vcpu_reg32(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
111 +
112 + /* Branch to exception vector */
113 + if (sctlr & (1 << 13))
114 +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
115 +index f8dc7e8fce6f..c23c77312354 100644
116 +--- a/arch/arm64/mm/mmu.c
117 ++++ b/arch/arm64/mm/mmu.c
118 +@@ -374,6 +374,9 @@ void __init paging_init(void)
119 +
120 + empty_zero_page = virt_to_page(zero_page);
121 +
122 ++ /* Ensure the zero page is visible to the page table walker */
123 ++ dsb(ishst);
124 ++
125 + /*
126 + * TTBR0 is only used for the identity mapping at this stage. Make it
127 + * point to zero page to avoid speculatively fetching new entries.
128 +diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
129 +index a648de1b1096..b78e48fb5f45 100644
130 +--- a/arch/mn10300/Kconfig
131 ++++ b/arch/mn10300/Kconfig
132 +@@ -1,6 +1,7 @@
133 + config MN10300
134 + def_bool y
135 + select HAVE_OPROFILE
136 ++ select HAVE_UID16
137 + select GENERIC_IRQ_SHOW
138 + select ARCH_WANT_IPC_PARSE_VERSION
139 + select HAVE_ARCH_TRACEHOOK
140 +@@ -37,9 +38,6 @@ config HIGHMEM
141 + config NUMA
142 + def_bool n
143 +
144 +-config UID16
145 +- def_bool y
146 +-
147 + config RWSEM_GENERIC_SPINLOCK
148 + def_bool y
149 +
150 +diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
151 +index 9488209a5253..191cd8e8b5da 100644
152 +--- a/arch/openrisc/Kconfig
153 ++++ b/arch/openrisc/Kconfig
154 +@@ -16,6 +16,7 @@ config OPENRISC
155 + select GENERIC_IRQ_SHOW
156 + select GENERIC_IOMAP
157 + select GENERIC_CPU_DEVICES
158 ++ select HAVE_UID16
159 + select GENERIC_ATOMIC64
160 + select GENERIC_CLOCKEVENTS
161 + select GENERIC_STRNCPY_FROM_USER
162 +@@ -29,9 +30,6 @@ config MMU
163 + config HAVE_DMA_ATTRS
164 + def_bool y
165 +
166 +-config UID16
167 +- def_bool y
168 +-
169 + config RWSEM_GENERIC_SPINLOCK
170 + def_bool y
171 +
172 +diff --git a/arch/powerpc/include/asm/cmpxchg.h b/arch/powerpc/include/asm/cmpxchg.h
173 +index d463c68fe7f0..99897f6645c1 100644
174 +--- a/arch/powerpc/include/asm/cmpxchg.h
175 ++++ b/arch/powerpc/include/asm/cmpxchg.h
176 +@@ -18,12 +18,12 @@ __xchg_u32(volatile void *p, unsigned long val)
177 + unsigned long prev;
178 +
179 + __asm__ __volatile__(
180 +- PPC_RELEASE_BARRIER
181 ++ PPC_ATOMIC_ENTRY_BARRIER
182 + "1: lwarx %0,0,%2 \n"
183 + PPC405_ERR77(0,%2)
184 + " stwcx. %3,0,%2 \n\
185 + bne- 1b"
186 +- PPC_ACQUIRE_BARRIER
187 ++ PPC_ATOMIC_EXIT_BARRIER
188 + : "=&r" (prev), "+m" (*(volatile unsigned int *)p)
189 + : "r" (p), "r" (val)
190 + : "cc", "memory");
191 +@@ -61,12 +61,12 @@ __xchg_u64(volatile void *p, unsigned long val)
192 + unsigned long prev;
193 +
194 + __asm__ __volatile__(
195 +- PPC_RELEASE_BARRIER
196 ++ PPC_ATOMIC_ENTRY_BARRIER
197 + "1: ldarx %0,0,%2 \n"
198 + PPC405_ERR77(0,%2)
199 + " stdcx. %3,0,%2 \n\
200 + bne- 1b"
201 +- PPC_ACQUIRE_BARRIER
202 ++ PPC_ATOMIC_EXIT_BARRIER
203 + : "=&r" (prev), "+m" (*(volatile unsigned long *)p)
204 + : "r" (p), "r" (val)
205 + : "cc", "memory");
206 +@@ -152,14 +152,14 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned long old, unsigned long new)
207 + unsigned int prev;
208 +
209 + __asm__ __volatile__ (
210 +- PPC_RELEASE_BARRIER
211 ++ PPC_ATOMIC_ENTRY_BARRIER
212 + "1: lwarx %0,0,%2 # __cmpxchg_u32\n\
213 + cmpw 0,%0,%3\n\
214 + bne- 2f\n"
215 + PPC405_ERR77(0,%2)
216 + " stwcx. %4,0,%2\n\
217 + bne- 1b"
218 +- PPC_ACQUIRE_BARRIER
219 ++ PPC_ATOMIC_EXIT_BARRIER
220 + "\n\
221 + 2:"
222 + : "=&r" (prev), "+m" (*p)
223 +@@ -198,13 +198,13 @@ __cmpxchg_u64(volatile unsigned long *p, unsigned long old, unsigned long new)
224 + unsigned long prev;
225 +
226 + __asm__ __volatile__ (
227 +- PPC_RELEASE_BARRIER
228 ++ PPC_ATOMIC_ENTRY_BARRIER
229 + "1: ldarx %0,0,%2 # __cmpxchg_u64\n\
230 + cmpd 0,%0,%3\n\
231 + bne- 2f\n\
232 + stdcx. %4,0,%2\n\
233 + bne- 1b"
234 +- PPC_ACQUIRE_BARRIER
235 ++ PPC_ATOMIC_EXIT_BARRIER
236 + "\n\
237 + 2:"
238 + : "=&r" (prev), "+m" (*p)
239 +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
240 +index ce17815b8b55..92c538d5ed19 100644
241 +--- a/arch/powerpc/include/asm/reg.h
242 ++++ b/arch/powerpc/include/asm/reg.h
243 +@@ -108,6 +108,7 @@
244 + #define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */
245 + #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */
246 + #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
247 ++#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */
248 + #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T)
249 + #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S)
250 +
251 +diff --git a/arch/powerpc/include/asm/synch.h b/arch/powerpc/include/asm/synch.h
252 +index e682a7143edb..c50868681f9e 100644
253 +--- a/arch/powerpc/include/asm/synch.h
254 ++++ b/arch/powerpc/include/asm/synch.h
255 +@@ -44,7 +44,7 @@ static inline void isync(void)
256 + MAKE_LWSYNC_SECTION_ENTRY(97, __lwsync_fixup);
257 + #define PPC_ACQUIRE_BARRIER "\n" stringify_in_c(__PPC_ACQUIRE_BARRIER)
258 + #define PPC_RELEASE_BARRIER stringify_in_c(LWSYNC) "\n"
259 +-#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(LWSYNC) "\n"
260 ++#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(sync) "\n"
261 + #define PPC_ATOMIC_EXIT_BARRIER "\n" stringify_in_c(sync) "\n"
262 + #else
263 + #define PPC_ACQUIRE_BARRIER
264 +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
265 +index 31d021506d21..6e15abf30eb8 100644
266 +--- a/arch/powerpc/kernel/process.c
267 ++++ b/arch/powerpc/kernel/process.c
268 +@@ -545,6 +545,24 @@ static void tm_reclaim_thread(struct thread_struct *thr,
269 + msr_diff &= MSR_FP | MSR_VEC | MSR_VSX | MSR_FE0 | MSR_FE1;
270 + }
271 +
272 ++ /*
273 ++ * Use the current MSR TM suspended bit to track if we have
274 ++ * checkpointed state outstanding.
275 ++ * On signal delivery, we'd normally reclaim the checkpointed
276 ++ * state to obtain stack pointer (see:get_tm_stackpointer()).
277 ++ * This will then directly return to userspace without going
278 ++ * through __switch_to(). However, if the stack frame is bad,
279 ++ * we need to exit this thread which calls __switch_to() which
280 ++ * will again attempt to reclaim the already saved tm state.
281 ++ * Hence we need to check that we've not already reclaimed
282 ++ * this state.
283 ++ * We do this using the current MSR, rather tracking it in
284 ++ * some specific thread_struct bit, as it has the additional
285 ++ * benifit of checking for a potential TM bad thing exception.
286 ++ */
287 ++ if (!MSR_TM_SUSPENDED(mfmsr()))
288 ++ return;
289 ++
290 + tm_reclaim(thr, thr->regs->msr, cause);
291 +
292 + /* Having done the reclaim, we now have the checkpointed
293 +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
294 +index e881e3f5f0ec..da3054691d61 100644
295 +--- a/arch/powerpc/kernel/signal_32.c
296 ++++ b/arch/powerpc/kernel/signal_32.c
297 +@@ -876,6 +876,15 @@ static long restore_tm_user_regs(struct pt_regs *regs,
298 + return 1;
299 + #endif /* CONFIG_SPE */
300 +
301 ++ /* Get the top half of the MSR from the user context */
302 ++ if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
303 ++ return 1;
304 ++ msr_hi <<= 32;
305 ++ /* If TM bits are set to the reserved value, it's an invalid context */
306 ++ if (MSR_TM_RESV(msr_hi))
307 ++ return 1;
308 ++ /* Pull in the MSR TM bits from the user context */
309 ++ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
310 + /* Now, recheckpoint. This loads up all of the checkpointed (older)
311 + * registers, including FP and V[S]Rs. After recheckpointing, the
312 + * transactional versions should be loaded.
313 +@@ -885,11 +894,6 @@ static long restore_tm_user_regs(struct pt_regs *regs,
314 + current->thread.tm_texasr |= TEXASR_FS;
315 + /* This loads the checkpointed FP/VEC state, if used */
316 + tm_recheckpoint(&current->thread, msr);
317 +- /* Get the top half of the MSR */
318 +- if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
319 +- return 1;
320 +- /* Pull in MSR TM from user context */
321 +- regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
322 +
323 + /* This loads the speculative FP/VEC state, if used */
324 + if (msr & MSR_FP) {
325 +diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
326 +index d501dc4dc3e6..dd27d63e112c 100644
327 +--- a/arch/powerpc/kernel/signal_64.c
328 ++++ b/arch/powerpc/kernel/signal_64.c
329 +@@ -428,6 +428,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
330 +
331 + /* get MSR separately, transfer the LE bit if doing signal return */
332 + err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
333 ++ /* Don't allow reserved mode. */
334 ++ if (MSR_TM_RESV(msr))
335 ++ return -EINVAL;
336 ++
337 + /* pull in MSR TM from user context */
338 + regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
339 +
340 +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
341 +index 7a25d9218a05..975681b67dba 100644
342 +--- a/arch/powerpc/kvm/book3s_hv.c
343 ++++ b/arch/powerpc/kvm/book3s_hv.c
344 +@@ -166,6 +166,12 @@ static void kvmppc_core_vcpu_put_hv(struct kvm_vcpu *vcpu)
345 +
346 + static void kvmppc_set_msr_hv(struct kvm_vcpu *vcpu, u64 msr)
347 + {
348 ++ /*
349 ++ * Check for illegal transactional state bit combination
350 ++ * and if we find it, force the TS field to a safe state.
351 ++ */
352 ++ if ((msr & MSR_TS_MASK) == MSR_TS_MASK)
353 ++ msr &= ~MSR_TS_MASK;
354 + vcpu->arch.shregs.msr = msr;
355 + kvmppc_end_cede(vcpu);
356 + }
357 +diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
358 +index 4fa687a47a62..6b8d6e8cd449 100644
359 +--- a/arch/x86/include/asm/boot.h
360 ++++ b/arch/x86/include/asm/boot.h
361 +@@ -27,7 +27,7 @@
362 + #define BOOT_HEAP_SIZE 0x400000
363 + #else /* !CONFIG_KERNEL_BZIP2 */
364 +
365 +-#define BOOT_HEAP_SIZE 0x8000
366 ++#define BOOT_HEAP_SIZE 0x10000
367 +
368 + #endif /* !CONFIG_KERNEL_BZIP2 */
369 +
370 +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
371 +index a6aa91f77654..9c1f8e85e9de 100644
372 +--- a/arch/x86/kernel/reboot.c
373 ++++ b/arch/x86/kernel/reboot.c
374 +@@ -180,6 +180,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
375 + DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
376 + },
377 + },
378 ++ { /* Handle problems with rebooting on the iMac10,1. */
379 ++ .callback = set_pci_reboot,
380 ++ .ident = "Apple iMac10,1",
381 ++ .matches = {
382 ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
383 ++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac10,1"),
384 ++ },
385 ++ },
386 +
387 + /* ASRock */
388 + { /* Handle problems with rebooting on ASRock Q1900DC-ITX */
389 +diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
390 +index b88fc86309bc..5d3e60156683 100644
391 +--- a/arch/x86/kernel/signal.c
392 ++++ b/arch/x86/kernel/signal.c
393 +@@ -682,12 +682,15 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
394 + signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP));
395 + }
396 +
397 +-#ifdef CONFIG_X86_32
398 +-#define NR_restart_syscall __NR_restart_syscall
399 +-#else /* !CONFIG_X86_32 */
400 +-#define NR_restart_syscall \
401 +- test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : __NR_restart_syscall
402 +-#endif /* CONFIG_X86_32 */
403 ++static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
404 ++{
405 ++#if defined(CONFIG_X86_32) || !defined(CONFIG_X86_64)
406 ++ return __NR_restart_syscall;
407 ++#else /* !CONFIG_X86_32 && CONFIG_X86_64 */
408 ++ return test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall :
409 ++ __NR_restart_syscall | (regs->orig_ax & __X32_SYSCALL_BIT);
410 ++#endif /* CONFIG_X86_32 || !CONFIG_X86_64 */
411 ++}
412 +
413 + /*
414 + * Note that 'init' is a special process: it doesn't get signals it doesn't
415 +@@ -716,7 +719,7 @@ static void do_signal(struct pt_regs *regs)
416 + break;
417 +
418 + case -ERESTART_RESTARTBLOCK:
419 +- regs->ax = NR_restart_syscall;
420 ++ regs->ax = get_nr_restart_syscall(regs);
421 + regs->ip -= 2;
422 + break;
423 + }
424 +diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
425 +index 45329c8c226e..39e12c10b931 100644
426 +--- a/arch/x86/xen/suspend.c
427 ++++ b/arch/x86/xen/suspend.c
428 +@@ -30,7 +30,8 @@ void xen_arch_hvm_post_suspend(int suspend_cancelled)
429 + {
430 + #ifdef CONFIG_XEN_PVHVM
431 + int cpu;
432 +- xen_hvm_init_shared_info();
433 ++ if (!suspend_cancelled)
434 ++ xen_hvm_init_shared_info();
435 + xen_callback_vector();
436 + xen_unplug_emulated_devices();
437 + if (xen_feature(XENFEAT_hvm_safe_pvclock)) {
438 +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
439 +index 8b4fa2c4e661..108ddc311369 100644
440 +--- a/drivers/char/ipmi/ipmi_si_intf.c
441 ++++ b/drivers/char/ipmi/ipmi_si_intf.c
442 +@@ -1152,14 +1152,14 @@ static int smi_start_processing(void *send_info,
443 +
444 + new_smi->intf = intf;
445 +
446 +- /* Try to claim any interrupts. */
447 +- if (new_smi->irq_setup)
448 +- new_smi->irq_setup(new_smi);
449 +-
450 + /* Set up the timer that drives the interface. */
451 + setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
452 + smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
453 +
454 ++ /* Try to claim any interrupts. */
455 ++ if (new_smi->irq_setup)
456 ++ new_smi->irq_setup(new_smi);
457 ++
458 + /*
459 + * Check if the user forcefully enabled the daemon.
460 + */
461 +diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
462 +index a36749f1e44a..cc4fee674f21 100644
463 +--- a/drivers/connector/connector.c
464 ++++ b/drivers/connector/connector.c
465 +@@ -154,26 +154,21 @@ static int cn_call_callback(struct sk_buff *skb)
466 + *
467 + * It checks skb, netlink header and msg sizes, and calls callback helper.
468 + */
469 +-static void cn_rx_skb(struct sk_buff *__skb)
470 ++static void cn_rx_skb(struct sk_buff *skb)
471 + {
472 + struct nlmsghdr *nlh;
473 +- struct sk_buff *skb;
474 + int len, err;
475 +
476 +- skb = skb_get(__skb);
477 +-
478 + if (skb->len >= NLMSG_HDRLEN) {
479 + nlh = nlmsg_hdr(skb);
480 + len = nlmsg_len(nlh);
481 +
482 + if (len < (int)sizeof(struct cn_msg) ||
483 + skb->len < nlh->nlmsg_len ||
484 +- len > CONNECTOR_MAX_MSG_SIZE) {
485 +- kfree_skb(skb);
486 ++ len > CONNECTOR_MAX_MSG_SIZE)
487 + return;
488 +- }
489 +
490 +- err = cn_call_callback(skb);
491 ++ err = cn_call_callback(skb_get(skb));
492 + if (err < 0)
493 + kfree_skb(skb);
494 + }
495 +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
496 +index d92c7d9b959a..51f18bf75fa6 100644
497 +--- a/drivers/hid/hid-core.c
498 ++++ b/drivers/hid/hid-core.c
499 +@@ -1506,7 +1506,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
500 + "Multi-Axis Controller"
501 + };
502 + const char *type, *bus;
503 +- char buf[64];
504 ++ char buf[64] = "";
505 + unsigned int i;
506 + int len;
507 + int ret;
508 +diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
509 +index 38ceac5053a0..0ed6731396ef 100644
510 +--- a/drivers/isdn/i4l/isdn_ppp.c
511 ++++ b/drivers/isdn/i4l/isdn_ppp.c
512 +@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
513 + is->compflags = 0;
514 +
515 + is->reset = isdn_ppp_ccp_reset_alloc(is);
516 ++ if (!is->reset)
517 ++ return -ENOMEM;
518 +
519 + is->lp = NULL;
520 + is->mp_seqno = 0; /* MP sequence number */
521 +@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
522 + * VJ header compression init
523 + */
524 + is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
525 ++ if (IS_ERR(is->slcomp)) {
526 ++ isdn_ppp_ccp_reset_free(is);
527 ++ return PTR_ERR(is->slcomp);
528 ++ }
529 + #endif
530 + #ifdef CONFIG_IPPP_FILTER
531 + is->pass_filter = NULL;
532 +@@ -568,10 +574,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
533 + is->maxcid = val;
534 + #ifdef CONFIG_ISDN_PPP_VJ
535 + sltmp = slhc_init(16, val);
536 +- if (!sltmp) {
537 +- printk(KERN_ERR "ippp, can't realloc slhc struct\n");
538 +- return -ENOMEM;
539 +- }
540 ++ if (IS_ERR(sltmp))
541 ++ return PTR_ERR(sltmp);
542 + if (is->slcomp)
543 + slhc_free(is->slcomp);
544 + is->slcomp = sltmp;
545 +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
546 +index 0697d8f5f3cf..91b15062ffbf 100644
547 +--- a/drivers/net/bonding/bond_main.c
548 ++++ b/drivers/net/bonding/bond_main.c
549 +@@ -1181,7 +1181,6 @@ static int bond_master_upper_dev_link(struct net_device *bond_dev,
550 + err = netdev_master_upper_dev_link_private(slave_dev, bond_dev, slave);
551 + if (err)
552 + return err;
553 +- slave_dev->flags |= IFF_SLAVE;
554 + rtmsg_ifinfo(RTM_NEWLINK, slave_dev, IFF_SLAVE, GFP_KERNEL);
555 + return 0;
556 + }
557 +@@ -1363,6 +1362,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
558 + }
559 + }
560 +
561 ++ /* set slave flag before open to prevent IPv6 addrconf */
562 ++ slave_dev->flags |= IFF_SLAVE;
563 ++
564 + /* open the slave since the application closed it */
565 + res = dev_open(slave_dev);
566 + if (res) {
567 +@@ -1617,6 +1619,7 @@ err_close:
568 + dev_close(slave_dev);
569 +
570 + err_restore_mac:
571 ++ slave_dev->flags &= ~IFF_SLAVE;
572 + if (!bond->params.fail_over_mac ||
573 + bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
574 + /* XXX TODO - fom follow mode needs to change master's
575 +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
576 +index 5a1897d86e94..a2d7d5f066f1 100644
577 +--- a/drivers/net/ppp/ppp_generic.c
578 ++++ b/drivers/net/ppp/ppp_generic.c
579 +@@ -716,10 +716,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
580 + val &= 0xffff;
581 + }
582 + vj = slhc_init(val2+1, val+1);
583 +- if (!vj) {
584 +- netdev_err(ppp->dev,
585 +- "PPP: no memory (VJ compressor)\n");
586 +- err = -ENOMEM;
587 ++ if (IS_ERR(vj)) {
588 ++ err = PTR_ERR(vj);
589 + break;
590 + }
591 + ppp_lock(ppp);
592 +diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
593 +index 1252d9c726a7..b52eabc168a0 100644
594 +--- a/drivers/net/slip/slhc.c
595 ++++ b/drivers/net/slip/slhc.c
596 +@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
597 + static unsigned char * put16(unsigned char *cp, unsigned short x);
598 + static unsigned short pull16(unsigned char **cpp);
599 +
600 +-/* Initialize compression data structure
601 ++/* Allocate compression data structure
602 + * slots must be in range 0 to 255 (zero meaning no compression)
603 ++ * Returns pointer to structure or ERR_PTR() on error.
604 + */
605 + struct slcompress *
606 + slhc_init(int rslots, int tslots)
607 +@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
608 + register struct cstate *ts;
609 + struct slcompress *comp;
610 +
611 ++ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
612 ++ return ERR_PTR(-EINVAL);
613 ++
614 + comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
615 + if (! comp)
616 + goto out_fail;
617 +
618 +- if ( rslots > 0 && rslots < 256 ) {
619 ++ if (rslots > 0) {
620 + size_t rsize = rslots * sizeof(struct cstate);
621 + comp->rstate = kzalloc(rsize, GFP_KERNEL);
622 + if (! comp->rstate)
623 +@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
624 + comp->rslot_limit = rslots - 1;
625 + }
626 +
627 +- if ( tslots > 0 && tslots < 256 ) {
628 ++ if (tslots > 0) {
629 + size_t tsize = tslots * sizeof(struct cstate);
630 + comp->tstate = kzalloc(tsize, GFP_KERNEL);
631 + if (! comp->tstate)
632 +@@ -141,7 +145,7 @@ out_free2:
633 + out_free:
634 + kfree(comp);
635 + out_fail:
636 +- return NULL;
637 ++ return ERR_PTR(-ENOMEM);
638 + }
639 +
640 +
641 +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
642 +index 87526443841f..0641fccdc954 100644
643 +--- a/drivers/net/slip/slip.c
644 ++++ b/drivers/net/slip/slip.c
645 +@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
646 + if (cbuff == NULL)
647 + goto err_exit;
648 + slcomp = slhc_init(16, 16);
649 +- if (slcomp == NULL)
650 ++ if (IS_ERR(slcomp))
651 + goto err_exit;
652 + #endif
653 + spin_lock_bh(&sl->lock);
654 +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
655 +index c28e2dafb3f0..20465111984a 100644
656 +--- a/drivers/net/team/team.c
657 ++++ b/drivers/net/team/team.c
658 +@@ -1838,10 +1838,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
659 + struct team *team = netdev_priv(dev);
660 + struct team_port *port;
661 +
662 +- rcu_read_lock();
663 +- list_for_each_entry_rcu(port, &team->port_list, list)
664 ++ mutex_lock(&team->lock);
665 ++ list_for_each_entry(port, &team->port_list, list)
666 + vlan_vid_del(port->dev, proto, vid);
667 +- rcu_read_unlock();
668 ++ mutex_unlock(&team->lock);
669 +
670 + return 0;
671 + }
672 +diff --git a/drivers/net/veth.c b/drivers/net/veth.c
673 +index c0e7c64765ab..6da55394bd75 100644
674 +--- a/drivers/net/veth.c
675 ++++ b/drivers/net/veth.c
676 +@@ -116,12 +116,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
677 + kfree_skb(skb);
678 + goto drop;
679 + }
680 +- /* don't change ip_summed == CHECKSUM_PARTIAL, as that
681 +- * will cause bad checksum on forwarded packets
682 +- */
683 +- if (skb->ip_summed == CHECKSUM_NONE &&
684 +- rcv->features & NETIF_F_RXCSUM)
685 +- skb->ip_summed = CHECKSUM_UNNECESSARY;
686 +
687 + if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) {
688 + struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats);
689 +diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
690 +index 8c33491b21fe..c6aa38883466 100644
691 +--- a/drivers/parisc/iommu-helpers.h
692 ++++ b/drivers/parisc/iommu-helpers.h
693 +@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
694 + struct scatterlist *contig_sg; /* contig chunk head */
695 + unsigned long dma_offset, dma_len; /* start/len of DMA stream */
696 + unsigned int n_mappings = 0;
697 +- unsigned int max_seg_size = dma_get_max_seg_size(dev);
698 ++ unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
699 ++ (unsigned)DMA_CHUNK_SIZE);
700 ++ unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
701 ++ if (max_seg_boundary) /* check if the addition above didn't overflow */
702 ++ max_seg_size = min(max_seg_size, max_seg_boundary);
703 +
704 + while (nents > 0) {
705 +
706 +@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
707 +
708 + /*
709 + ** First make sure current dma stream won't
710 +- ** exceed DMA_CHUNK_SIZE if we coalesce the
711 ++ ** exceed max_seg_size if we coalesce the
712 + ** next entry.
713 + */
714 +- if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
715 +- IOVP_SIZE) > DMA_CHUNK_SIZE))
716 +- break;
717 +-
718 +- if (startsg->length + dma_len > max_seg_size)
719 ++ if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
720 ++ max_seg_size))
721 + break;
722 +
723 + /*
724 +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
725 +index 79c7b255e60a..c8e693c22014 100644
726 +--- a/drivers/usb/host/xhci.c
727 ++++ b/drivers/usb/host/xhci.c
728 +@@ -4696,8 +4696,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
729 + ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
730 + slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
731 + slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
732 ++ /*
733 ++ * refer to section 6.2.2: MTT should be 0 for full speed hub,
734 ++ * but it may be already set to 1 when setup an xHCI virtual
735 ++ * device, so clear it anyway.
736 ++ */
737 + if (tt->multi)
738 + slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
739 ++ else if (hdev->speed == USB_SPEED_FULL)
740 ++ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
741 ++
742 + if (xhci->hci_version > 0x95) {
743 + xhci_dbg(xhci, "xHCI version %x needs hub "
744 + "TT think time and number of ports\n",
745 +@@ -4885,6 +4893,10 @@ static int __init xhci_hcd_init(void)
746 + BUILD_BUG_ON(sizeof(struct xhci_intr_reg) != 8*32/8);
747 + /* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */
748 + BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8);
749 ++
750 ++ if (usb_disabled())
751 ++ return -ENODEV;
752 ++
753 + return 0;
754 + unreg_pci:
755 + xhci_unregister_pci();
756 +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
757 +index c2bdc5f2a4b1..b4fc4091e3f8 100644
758 +--- a/drivers/usb/serial/cp210x.c
759 ++++ b/drivers/usb/serial/cp210x.c
760 +@@ -160,6 +160,7 @@ static const struct usb_device_id id_table[] = {
761 + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
762 + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
763 + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
764 ++ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
765 + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
766 + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
767 + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
768 +diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
769 +index f51a5d52c0ed..ec1b8f2c1183 100644
770 +--- a/drivers/usb/serial/ipaq.c
771 ++++ b/drivers/usb/serial/ipaq.c
772 +@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *tty,
773 + * through. Since this has a reasonably high failure rate, we retry
774 + * several times.
775 + */
776 +- while (retries--) {
777 ++ while (retries) {
778 ++ retries--;
779 + result = usb_control_msg(serial->dev,
780 + usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
781 + 0x1, 0, NULL, 0, 100);
782 +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
783 +index 91cc44611062..7ffbb9390628 100644
784 +--- a/drivers/xen/gntdev.c
785 ++++ b/drivers/xen/gntdev.c
786 +@@ -765,7 +765,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
787 +
788 + vma->vm_ops = &gntdev_vmops;
789 +
790 +- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
791 ++ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
792 +
793 + if (use_ptemod)
794 + vma->vm_flags |= VM_DONTCOPY;
795 +diff --git a/include/linux/sched.h b/include/linux/sched.h
796 +index ec6000f66e75..7d6152a6700c 100644
797 +--- a/include/linux/sched.h
798 ++++ b/include/linux/sched.h
799 +@@ -755,6 +755,7 @@ struct user_struct {
800 + unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
801 + #endif
802 + unsigned long locked_shm; /* How many pages of mlocked shm ? */
803 ++ unsigned long unix_inflight; /* How many files in flight in unix sockets */
804 +
805 + #ifdef CONFIG_KEYS
806 + struct key *uid_keyring; /* UID specific keyring */
807 +diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
808 +index a747a77ea584..fad4082c50d9 100644
809 +--- a/include/linux/syscalls.h
810 ++++ b/include/linux/syscalls.h
811 +@@ -507,7 +507,7 @@ asmlinkage long sys_chown(const char __user *filename,
812 + asmlinkage long sys_lchown(const char __user *filename,
813 + uid_t user, gid_t group);
814 + asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group);
815 +-#ifdef CONFIG_UID16
816 ++#ifdef CONFIG_HAVE_UID16
817 + asmlinkage long sys_chown16(const char __user *filename,
818 + old_uid_t user, old_gid_t group);
819 + asmlinkage long sys_lchown16(const char __user *filename,
820 +diff --git a/include/linux/types.h b/include/linux/types.h
821 +index 4d118ba11349..83db8e5974dc 100644
822 +--- a/include/linux/types.h
823 ++++ b/include/linux/types.h
824 +@@ -35,7 +35,7 @@ typedef __kernel_gid16_t gid16_t;
825 +
826 + typedef unsigned long uintptr_t;
827 +
828 +-#ifdef CONFIG_UID16
829 ++#ifdef CONFIG_HAVE_UID16
830 + /* This is defined by include/asm-{arch}/posix_types.h */
831 + typedef __kernel_old_uid_t old_uid_t;
832 + typedef __kernel_old_gid_t old_gid_t;
833 +diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
834 +index 3bd22795c3e2..194723c2e7bb 100644
835 +--- a/include/net/inet_ecn.h
836 ++++ b/include/net/inet_ecn.h
837 +@@ -111,11 +111,24 @@ static inline void ipv4_copy_dscp(unsigned int dscp, struct iphdr *inner)
838 +
839 + struct ipv6hdr;
840 +
841 +-static inline int IP6_ECN_set_ce(struct ipv6hdr *iph)
842 ++/* Note:
843 ++ * IP_ECN_set_ce() has to tweak IPV4 checksum when setting CE,
844 ++ * meaning both changes have no effect on skb->csum if/when CHECKSUM_COMPLETE
845 ++ * In IPv6 case, no checksum compensates the change in IPv6 header,
846 ++ * so we have to update skb->csum.
847 ++ */
848 ++static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph)
849 + {
850 ++ __be32 from, to;
851 ++
852 + if (INET_ECN_is_not_ect(ipv6_get_dsfield(iph)))
853 + return 0;
854 +- *(__be32*)iph |= htonl(INET_ECN_CE << 20);
855 ++
856 ++ from = *(__be32 *)iph;
857 ++ to = from | htonl(INET_ECN_CE << 20);
858 ++ *(__be32 *)iph = to;
859 ++ if (skb->ip_summed == CHECKSUM_COMPLETE)
860 ++ skb->csum = csum_add(csum_sub(skb->csum, from), to);
861 + return 1;
862 + }
863 +
864 +@@ -142,7 +155,7 @@ static inline int INET_ECN_set_ce(struct sk_buff *skb)
865 + case cpu_to_be16(ETH_P_IPV6):
866 + if (skb_network_header(skb) + sizeof(struct ipv6hdr) <=
867 + skb_tail_pointer(skb))
868 +- return IP6_ECN_set_ce(ipv6_hdr(skb));
869 ++ return IP6_ECN_set_ce(skb, ipv6_hdr(skb));
870 + break;
871 + }
872 +
873 +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
874 +index 9a0005aee9ad..15022fdfab70 100644
875 +--- a/net/bridge/br_stp_if.c
876 ++++ b/net/bridge/br_stp_if.c
877 +@@ -128,7 +128,10 @@ static void br_stp_start(struct net_bridge *br)
878 + char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL };
879 + char *envp[] = { NULL };
880 +
881 +- r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
882 ++ if (net_eq(dev_net(br->dev), &init_net))
883 ++ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
884 ++ else
885 ++ r = -ENOENT;
886 +
887 + spin_lock_bh(&br->lock);
888 +
889 +diff --git a/net/core/dst.c b/net/core/dst.c
890 +index c07070544e3f..74d1ad1285d0 100644
891 +--- a/net/core/dst.c
892 ++++ b/net/core/dst.c
893 +@@ -280,10 +280,11 @@ void dst_release(struct dst_entry *dst)
894 + {
895 + if (dst) {
896 + int newrefcnt;
897 ++ unsigned short nocache = dst->flags & DST_NOCACHE;
898 +
899 + newrefcnt = atomic_dec_return(&dst->__refcnt);
900 + WARN_ON(newrefcnt < 0);
901 +- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
902 ++ if (!newrefcnt && unlikely(nocache))
903 + call_rcu(&dst->rcu_head, dst_destroy_rcu);
904 + }
905 + }
906 +diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
907 +index 1a8d271f994d..f9f52e75b149 100644
908 +--- a/net/ipv4/tcp_yeah.c
909 ++++ b/net/ipv4/tcp_yeah.c
910 +@@ -223,7 +223,7 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
911 + yeah->fast_count = 0;
912 + yeah->reno_count = max(yeah->reno_count>>1, 2U);
913 +
914 +- return tp->snd_cwnd - reduction;
915 ++ return max_t(int, tp->snd_cwnd - reduction, 2);
916 + }
917 +
918 + static struct tcp_congestion_ops tcp_yeah __read_mostly = {
919 +diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
920 +index b30ad3741b46..d5c918975c8c 100644
921 +--- a/net/ipv6/addrlabel.c
922 ++++ b/net/ipv6/addrlabel.c
923 +@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh)
924 +
925 + rcu_read_lock();
926 + p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
927 +- if (p && ip6addrlbl_hold(p))
928 ++ if (p && !ip6addrlbl_hold(p))
929 + p = NULL;
930 + lseq = ip6addrlbl_table.seq;
931 + rcu_read_unlock();
932 +diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
933 +index cb04f7a16b5e..c5d6a936e70c 100644
934 +--- a/net/ipv6/xfrm6_mode_tunnel.c
935 ++++ b/net/ipv6/xfrm6_mode_tunnel.c
936 +@@ -83,7 +83,7 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
937 + struct ipv6hdr *inner_iph = ipipv6_hdr(skb);
938 +
939 + if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
940 +- IP6_ECN_set_ce(inner_iph);
941 ++ IP6_ECN_set_ce(skb, inner_iph);
942 + }
943 +
944 + /* Add encapsulation header.
945 +diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
946 +index 5a940dbd74a3..f0229223bf91 100644
947 +--- a/net/phonet/af_phonet.c
948 ++++ b/net/phonet/af_phonet.c
949 +@@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
950 + struct sockaddr_pn sa;
951 + u16 len;
952 +
953 ++ skb = skb_share_check(skb, GFP_ATOMIC);
954 ++ if (!skb)
955 ++ return NET_RX_DROP;
956 ++
957 + /* check we have at least a full Phonet header */
958 + if (!pskb_pull(skb, sizeof(struct phonethdr)))
959 + goto out;
960 +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
961 +index 3e287a3fa03b..af1da3188865 100644
962 +--- a/net/sctp/sm_statefuns.c
963 ++++ b/net/sctp/sm_statefuns.c
964 +@@ -4833,7 +4833,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
965 +
966 + retval = SCTP_DISPOSITION_CONSUME;
967 +
968 +- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
969 ++ if (abort)
970 ++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
971 +
972 + /* Even if we can't send the ABORT due to low memory delete the
973 + * TCB. This is a departure from our typical NOMEM handling.
974 +@@ -4970,7 +4971,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
975 + SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
976 + retval = SCTP_DISPOSITION_CONSUME;
977 +
978 +- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
979 ++ if (abort)
980 ++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
981 +
982 + sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
983 + SCTP_STATE(SCTP_STATE_CLOSED));
984 +diff --git a/net/sctp/socket.c b/net/sctp/socket.c
985 +index a7400f65b9b5..2072600b74c9 100644
986 +--- a/net/sctp/socket.c
987 ++++ b/net/sctp/socket.c
988 +@@ -1517,8 +1517,7 @@ static void sctp_close(struct sock *sk, long timeout)
989 + struct sctp_chunk *chunk;
990 +
991 + chunk = sctp_make_abort_user(asoc, NULL, 0);
992 +- if (chunk)
993 +- sctp_primitive_ABORT(net, asoc, chunk);
994 ++ sctp_primitive_ABORT(net, asoc, chunk);
995 + } else
996 + sctp_primitive_SHUTDOWN(net, asoc, NULL);
997 + }
998 +diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
999 +index dfa532f00d88..48273d94484d 100644
1000 +--- a/net/sctp/sysctl.c
1001 ++++ b/net/sctp/sysctl.c
1002 +@@ -310,7 +310,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
1003 + struct ctl_table tbl;
1004 + bool changed = false;
1005 + char *none = "none";
1006 +- char tmp[8];
1007 ++ char tmp[8] = {0};
1008 + int ret;
1009 +
1010 + memset(&tbl, 0, sizeof(struct ctl_table));
1011 +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
1012 +index ae0d0654f8c4..0cd18c240250 100644
1013 +--- a/net/unix/af_unix.c
1014 ++++ b/net/unix/af_unix.c
1015 +@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
1016 + sock_wfree(skb);
1017 + }
1018 +
1019 ++/*
1020 ++ * The "user->unix_inflight" variable is protected by the garbage
1021 ++ * collection lock, and we just read it locklessly here. If you go
1022 ++ * over the limit, there might be a tiny race in actually noticing
1023 ++ * it across threads. Tough.
1024 ++ */
1025 ++static inline bool too_many_unix_fds(struct task_struct *p)
1026 ++{
1027 ++ struct user_struct *user = current_user();
1028 ++
1029 ++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
1030 ++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
1031 ++ return false;
1032 ++}
1033 ++
1034 + #define MAX_RECURSION_LEVEL 4
1035 +
1036 + static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1037 +@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1038 + unsigned char max_level = 0;
1039 + int unix_sock_count = 0;
1040 +
1041 ++ if (too_many_unix_fds(current))
1042 ++ return -ETOOMANYREFS;
1043 ++
1044 + for (i = scm->fp->count - 1; i >= 0; i--) {
1045 + struct sock *sk = unix_get_socket(scm->fp->fp[i]);
1046 +
1047 +@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1048 + if (!UNIXCB(skb).fp)
1049 + return -ENOMEM;
1050 +
1051 +- if (unix_sock_count) {
1052 +- for (i = scm->fp->count - 1; i >= 0; i--)
1053 +- unix_inflight(scm->fp->fp[i]);
1054 +- }
1055 ++ for (i = scm->fp->count - 1; i >= 0; i--)
1056 ++ unix_inflight(scm->fp->fp[i]);
1057 + return max_level;
1058 + }
1059 +
1060 +diff --git a/net/unix/garbage.c b/net/unix/garbage.c
1061 +index 9bc73f87f64a..06730fe6ad9d 100644
1062 +--- a/net/unix/garbage.c
1063 ++++ b/net/unix/garbage.c
1064 +@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp)
1065 + void unix_inflight(struct file *fp)
1066 + {
1067 + struct sock *s = unix_get_socket(fp);
1068 ++
1069 ++ spin_lock(&unix_gc_lock);
1070 ++
1071 + if (s) {
1072 + struct unix_sock *u = unix_sk(s);
1073 +- spin_lock(&unix_gc_lock);
1074 ++
1075 + if (atomic_long_inc_return(&u->inflight) == 1) {
1076 + BUG_ON(!list_empty(&u->link));
1077 + list_add_tail(&u->link, &gc_inflight_list);
1078 +@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp)
1079 + BUG_ON(list_empty(&u->link));
1080 + }
1081 + unix_tot_inflight++;
1082 +- spin_unlock(&unix_gc_lock);
1083 + }
1084 ++ fp->f_cred->user->unix_inflight++;
1085 ++ spin_unlock(&unix_gc_lock);
1086 + }
1087 +
1088 + void unix_notinflight(struct file *fp)
1089 + {
1090 + struct sock *s = unix_get_socket(fp);
1091 ++
1092 ++ spin_lock(&unix_gc_lock);
1093 ++
1094 + if (s) {
1095 + struct unix_sock *u = unix_sk(s);
1096 +- spin_lock(&unix_gc_lock);
1097 ++
1098 + BUG_ON(list_empty(&u->link));
1099 + if (atomic_long_dec_and_test(&u->inflight))
1100 + list_del_init(&u->link);
1101 + unix_tot_inflight--;
1102 +- spin_unlock(&unix_gc_lock);
1103 + }
1104 ++ fp->f_cred->user->unix_inflight--;
1105 ++ spin_unlock(&unix_gc_lock);
1106 + }
1107 +
1108 + static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
1109 +diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
1110 +index 513f7bd85cb7..eb341b76a489 100755
1111 +--- a/scripts/recordmcount.pl
1112 ++++ b/scripts/recordmcount.pl
1113 +@@ -265,7 +265,8 @@ if ($arch eq "x86_64") {
1114 +
1115 + } elsif ($arch eq "powerpc") {
1116 + $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
1117 +- $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?.*?)>:";
1118 ++ # See comment in the sparc64 section for why we use '\w'.
1119 ++ $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?\\w*?)>:";
1120 + $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s\\.?_mcount\$";
1121 +
1122 + if ($bits == 64) {
1123 +diff --git a/sound/core/control.c b/sound/core/control.c
1124 +index f2082a35b890..3fcead61f0ef 100644
1125 +--- a/sound/core/control.c
1126 ++++ b/sound/core/control.c
1127 +@@ -1325,6 +1325,8 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
1128 + return -EFAULT;
1129 + if (tlv.length < sizeof(unsigned int) * 2)
1130 + return -EINVAL;
1131 ++ if (!tlv.numid)
1132 ++ return -EINVAL;
1133 + down_read(&card->controls_rwsem);
1134 + kctl = snd_ctl_find_numid(card, tlv.numid);
1135 + if (kctl == NULL) {
1136 +diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
1137 +index b8b31c433d64..14d483d6b3b0 100644
1138 +--- a/sound/core/hrtimer.c
1139 ++++ b/sound/core/hrtimer.c
1140 +@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t)
1141 + struct snd_hrtimer *stime = t->private_data;
1142 +
1143 + atomic_set(&stime->running, 0);
1144 +- hrtimer_cancel(&stime->hrt);
1145 ++ hrtimer_try_to_cancel(&stime->hrt);
1146 + hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
1147 + HRTIMER_MODE_REL);
1148 + atomic_set(&stime->running, 1);
1149 +@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t)
1150 + {
1151 + struct snd_hrtimer *stime = t->private_data;
1152 + atomic_set(&stime->running, 0);
1153 ++ hrtimer_try_to_cancel(&stime->hrt);
1154 + return 0;
1155 + }
1156 +
1157 +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
1158 +index c4ac3c1e19af..1bb1a43c7d03 100644
1159 +--- a/sound/core/pcm_compat.c
1160 ++++ b/sound/core/pcm_compat.c
1161 +@@ -236,10 +236,15 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
1162 + if (! (runtime = substream->runtime))
1163 + return -ENOTTY;
1164 +
1165 +- /* only fifo_size is different, so just copy all */
1166 +- data = memdup_user(data32, sizeof(*data32));
1167 +- if (IS_ERR(data))
1168 +- return PTR_ERR(data);
1169 ++ data = kmalloc(sizeof(*data), GFP_KERNEL);
1170 ++ if (!data)
1171 ++ return -ENOMEM;
1172 ++
1173 ++ /* only fifo_size (RO from userspace) is different, so just copy all */
1174 ++ if (copy_from_user(data, data32, sizeof(*data32))) {
1175 ++ err = -EFAULT;
1176 ++ goto error;
1177 ++ }
1178 +
1179 + if (refine)
1180 + err = snd_pcm_hw_refine(substream, data);
1181 +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
1182 +index 4dc6bae80e15..ecfbf5f39d38 100644
1183 +--- a/sound/core/seq/seq_clientmgr.c
1184 ++++ b/sound/core/seq/seq_clientmgr.c
1185 +@@ -1950,7 +1950,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client,
1186 + * No restrictions so for a user client we can clear
1187 + * the whole fifo
1188 + */
1189 +- if (client->type == USER_CLIENT)
1190 ++ if (client->type == USER_CLIENT && client->data.user.fifo)
1191 + snd_seq_fifo_clear(client->data.user.fifo);
1192 + }
1193 +
1194 +diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
1195 +index 81f7c109dc46..65175902a68a 100644
1196 +--- a/sound/core/seq/seq_compat.c
1197 ++++ b/sound/core/seq/seq_compat.c
1198 +@@ -49,11 +49,12 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
1199 + struct snd_seq_port_info *data;
1200 + mm_segment_t fs;
1201 +
1202 +- data = memdup_user(data32, sizeof(*data32));
1203 +- if (IS_ERR(data))
1204 +- return PTR_ERR(data);
1205 ++ data = kmalloc(sizeof(*data), GFP_KERNEL);
1206 ++ if (!data)
1207 ++ return -ENOMEM;
1208 +
1209 +- if (get_user(data->flags, &data32->flags) ||
1210 ++ if (copy_from_user(data, data32, sizeof(*data32)) ||
1211 ++ get_user(data->flags, &data32->flags) ||
1212 + get_user(data->time_queue, &data32->time_queue))
1213 + goto error;
1214 + data->kernel = NULL;
1215 +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
1216 +index f9077361c119..4c9aa462de9b 100644
1217 +--- a/sound/core/seq/seq_queue.c
1218 ++++ b/sound/core/seq/seq_queue.c
1219 +@@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
1220 + static void queue_delete(struct snd_seq_queue *q)
1221 + {
1222 + /* stop and release the timer */
1223 ++ mutex_lock(&q->timer_mutex);
1224 + snd_seq_timer_stop(q->timer);
1225 + snd_seq_timer_close(q);
1226 ++ mutex_unlock(&q->timer_mutex);
1227 + /* wait until access free */
1228 + snd_use_lock_sync(&q->use_lock);
1229 + /* release resources... */
1230 +diff --git a/sound/core/timer.c b/sound/core/timer.c
1231 +index 6ddcf06f52f9..4e436fe53afa 100644
1232 +--- a/sound/core/timer.c
1233 ++++ b/sound/core/timer.c
1234 +@@ -73,7 +73,7 @@ struct snd_timer_user {
1235 + struct timespec tstamp; /* trigger tstamp */
1236 + wait_queue_head_t qchange_sleep;
1237 + struct fasync_struct *fasync;
1238 +- struct mutex tread_sem;
1239 ++ struct mutex ioctl_lock;
1240 + };
1241 +
1242 + /* list of timers */
1243 +@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
1244 + slave->slave_id == master->slave_id) {
1245 + list_move_tail(&slave->open_list, &master->slave_list_head);
1246 + spin_lock_irq(&slave_active_lock);
1247 ++ spin_lock(&master->timer->lock);
1248 + slave->master = master;
1249 + slave->timer = master->timer;
1250 + if (slave->flags & SNDRV_TIMER_IFLG_RUNNING)
1251 + list_add_tail(&slave->active_list,
1252 + &master->slave_active_head);
1253 ++ spin_unlock(&master->timer->lock);
1254 + spin_unlock_irq(&slave_active_lock);
1255 + }
1256 + }
1257 +@@ -345,15 +347,18 @@ int snd_timer_close(struct snd_timer_instance *timeri)
1258 + timer->hw.close)
1259 + timer->hw.close(timer);
1260 + /* remove slave links */
1261 ++ spin_lock_irq(&slave_active_lock);
1262 ++ spin_lock(&timer->lock);
1263 + list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
1264 + open_list) {
1265 +- spin_lock_irq(&slave_active_lock);
1266 +- _snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION);
1267 + list_move_tail(&slave->open_list, &snd_timer_slave_list);
1268 + slave->master = NULL;
1269 + slave->timer = NULL;
1270 +- spin_unlock_irq(&slave_active_lock);
1271 ++ list_del_init(&slave->ack_list);
1272 ++ list_del_init(&slave->active_list);
1273 + }
1274 ++ spin_unlock(&timer->lock);
1275 ++ spin_unlock_irq(&slave_active_lock);
1276 + mutex_unlock(&register_mutex);
1277 + }
1278 + out:
1279 +@@ -440,9 +445,12 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
1280 +
1281 + spin_lock_irqsave(&slave_active_lock, flags);
1282 + timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
1283 +- if (timeri->master)
1284 ++ if (timeri->master && timeri->timer) {
1285 ++ spin_lock(&timeri->timer->lock);
1286 + list_add_tail(&timeri->active_list,
1287 + &timeri->master->slave_active_head);
1288 ++ spin_unlock(&timeri->timer->lock);
1289 ++ }
1290 + spin_unlock_irqrestore(&slave_active_lock, flags);
1291 + return 1; /* delayed start */
1292 + }
1293 +@@ -488,6 +496,8 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
1294 + if (!keep_flag) {
1295 + spin_lock_irqsave(&slave_active_lock, flags);
1296 + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
1297 ++ list_del_init(&timeri->ack_list);
1298 ++ list_del_init(&timeri->active_list);
1299 + spin_unlock_irqrestore(&slave_active_lock, flags);
1300 + }
1301 + goto __end;
1302 +@@ -693,7 +703,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
1303 + } else {
1304 + ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
1305 + if (--timer->running)
1306 +- list_del(&ti->active_list);
1307 ++ list_del_init(&ti->active_list);
1308 + }
1309 + if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
1310 + (ti->flags & SNDRV_TIMER_IFLG_FAST))
1311 +@@ -1256,7 +1266,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file)
1312 + return -ENOMEM;
1313 + spin_lock_init(&tu->qlock);
1314 + init_waitqueue_head(&tu->qchange_sleep);
1315 +- mutex_init(&tu->tread_sem);
1316 ++ mutex_init(&tu->ioctl_lock);
1317 + tu->ticks = 1;
1318 + tu->queue_size = 128;
1319 + tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
1320 +@@ -1276,8 +1286,10 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
1321 + if (file->private_data) {
1322 + tu = file->private_data;
1323 + file->private_data = NULL;
1324 ++ mutex_lock(&tu->ioctl_lock);
1325 + if (tu->timeri)
1326 + snd_timer_close(tu->timeri);
1327 ++ mutex_unlock(&tu->ioctl_lock);
1328 + kfree(tu->queue);
1329 + kfree(tu->tqueue);
1330 + kfree(tu);
1331 +@@ -1515,7 +1527,6 @@ static int snd_timer_user_tselect(struct file *file,
1332 + int err = 0;
1333 +
1334 + tu = file->private_data;
1335 +- mutex_lock(&tu->tread_sem);
1336 + if (tu->timeri) {
1337 + snd_timer_close(tu->timeri);
1338 + tu->timeri = NULL;
1339 +@@ -1559,7 +1570,6 @@ static int snd_timer_user_tselect(struct file *file,
1340 + }
1341 +
1342 + __err:
1343 +- mutex_unlock(&tu->tread_sem);
1344 + return err;
1345 + }
1346 +
1347 +@@ -1772,7 +1782,7 @@ enum {
1348 + SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
1349 + };
1350 +
1351 +-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
1352 ++static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
1353 + unsigned long arg)
1354 + {
1355 + struct snd_timer_user *tu;
1356 +@@ -1789,17 +1799,11 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
1357 + {
1358 + int xarg;
1359 +
1360 +- mutex_lock(&tu->tread_sem);
1361 +- if (tu->timeri) { /* too late */
1362 +- mutex_unlock(&tu->tread_sem);
1363 ++ if (tu->timeri) /* too late */
1364 + return -EBUSY;
1365 +- }
1366 +- if (get_user(xarg, p)) {
1367 +- mutex_unlock(&tu->tread_sem);
1368 ++ if (get_user(xarg, p))
1369 + return -EFAULT;
1370 +- }
1371 + tu->tread = xarg ? 1 : 0;
1372 +- mutex_unlock(&tu->tread_sem);
1373 + return 0;
1374 + }
1375 + case SNDRV_TIMER_IOCTL_GINFO:
1376 +@@ -1832,6 +1836,18 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
1377 + return -ENOTTY;
1378 + }
1379 +
1380 ++static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
1381 ++ unsigned long arg)
1382 ++{
1383 ++ struct snd_timer_user *tu = file->private_data;
1384 ++ long ret;
1385 ++
1386 ++ mutex_lock(&tu->ioctl_lock);
1387 ++ ret = __snd_timer_user_ioctl(file, cmd, arg);
1388 ++ mutex_unlock(&tu->ioctl_lock);
1389 ++ return ret;
1390 ++}
1391 ++
1392 + static int snd_timer_user_fasync(int fd, struct file * file, int on)
1393 + {
1394 + struct snd_timer_user *tu;
1395 +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
1396 +index 84e8879cc372..305fb6174af0 100644
1397 +--- a/sound/pci/hda/hda_intel.c
1398 ++++ b/sound/pci/hda/hda_intel.c
1399 +@@ -1124,6 +1124,36 @@ static unsigned int azx_get_response(struct hda_bus *bus,
1400 + return azx_rirb_get_response(bus, addr);
1401 + }
1402 +
1403 ++#ifdef CONFIG_PM_SLEEP
1404 ++/* put codec down to D3 at hibernation for Intel SKL+;
1405 ++ * otherwise BIOS may still access the codec and screw up the driver
1406 ++ */
1407 ++#define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170)
1408 ++#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)
1409 ++#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
1410 ++#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci))
1411 ++
1412 ++static int azx_freeze_noirq(struct device *dev)
1413 ++{
1414 ++ struct pci_dev *pci = to_pci_dev(dev);
1415 ++
1416 ++ if (IS_SKL_PLUS(pci))
1417 ++ pci_set_power_state(pci, PCI_D3hot);
1418 ++
1419 ++ return 0;
1420 ++}
1421 ++
1422 ++static int azx_thaw_noirq(struct device *dev)
1423 ++{
1424 ++ struct pci_dev *pci = to_pci_dev(dev);
1425 ++
1426 ++ if (IS_SKL_PLUS(pci))
1427 ++ pci_set_power_state(pci, PCI_D0);
1428 ++
1429 ++ return 0;
1430 ++}
1431 ++#endif /* CONFIG_PM_SLEEP */
1432 ++
1433 + #ifdef CONFIG_PM
1434 + static void azx_power_notify(struct hda_bus *bus, bool power_up);
1435 + #endif
1436 +@@ -3072,6 +3102,10 @@ static int azx_runtime_idle(struct device *dev)
1437 + #ifdef CONFIG_PM
1438 + static const struct dev_pm_ops azx_pm = {
1439 + SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume)
1440 ++#ifdef CONFIG_PM_SLEEP
1441 ++ .freeze_noirq = azx_freeze_noirq,
1442 ++ .thaw_noirq = azx_thaw_noirq,
1443 ++#endif
1444 + SET_RUNTIME_PM_OPS(azx_runtime_suspend, azx_runtime_resume, azx_runtime_idle)
1445 + };
1446 +
1447 +@@ -3996,6 +4030,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
1448 + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
1449 + { PCI_DEVICE(0x8086, 0x8d21),
1450 + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
1451 ++ /* Lewisburg */
1452 ++ { PCI_DEVICE(0x8086, 0xa1f0),
1453 ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
1454 ++ { PCI_DEVICE(0x8086, 0xa270),
1455 ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
1456 + /* Lynx Point-LP */
1457 + { PCI_DEVICE(0x8086, 0x9c20),
1458 + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
1459 +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
1460 +index 08e29311e17d..bd0b986f7d50 100644
1461 +--- a/sound/pci/hda/patch_realtek.c
1462 ++++ b/sound/pci/hda/patch_realtek.c
1463 +@@ -1825,6 +1825,7 @@ enum {
1464 + ALC889_FIXUP_MBA11_VREF,
1465 + ALC889_FIXUP_MBA21_VREF,
1466 + ALC889_FIXUP_MP11_VREF,
1467 ++ ALC889_FIXUP_MP41_VREF,
1468 + ALC882_FIXUP_INV_DMIC,
1469 + ALC882_FIXUP_NO_PRIMARY_HP,
1470 + ALC887_FIXUP_ASUS_BASS,
1471 +@@ -1912,7 +1913,7 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec,
1472 + const struct hda_fixup *fix, int action)
1473 + {
1474 + struct alc_spec *spec = codec->spec;
1475 +- static hda_nid_t nids[2] = { 0x14, 0x15 };
1476 ++ static hda_nid_t nids[3] = { 0x14, 0x15, 0x19 };
1477 + int i;
1478 +
1479 + if (action != HDA_FIXUP_ACT_INIT)
1480 +@@ -2200,6 +2201,12 @@ static const struct hda_fixup alc882_fixups[] = {
1481 + .chained = true,
1482 + .chain_id = ALC885_FIXUP_MACPRO_GPIO,
1483 + },
1484 ++ [ALC889_FIXUP_MP41_VREF] = {
1485 ++ .type = HDA_FIXUP_FUNC,
1486 ++ .v.func = alc889_fixup_mbp_vref,
1487 ++ .chained = true,
1488 ++ .chain_id = ALC885_FIXUP_MACPRO_GPIO,
1489 ++ },
1490 + [ALC882_FIXUP_INV_DMIC] = {
1491 + .type = HDA_FIXUP_FUNC,
1492 + .v.func = alc_fixup_inv_dmic_0x12,
1493 +@@ -2278,7 +2285,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
1494 + SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF),
1495 + SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF),
1496 + SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF),
1497 +- SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO),
1498 ++ SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 4,1/5,1", ALC889_FIXUP_MP41_VREF),
1499 + SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
1500 + SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
1501 + SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
1502 +@@ -5337,6 +5344,7 @@ static const struct hda_fixup alc662_fixups[] = {
1503 + static const struct snd_pci_quirk alc662_fixup_tbl[] = {
1504 + SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
1505 + SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
1506 ++ SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC),
1507 + SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
1508 + SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
1509 + SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
1510 +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
1511 +index 231b26471a63..9326e586559b 100644
1512 +--- a/sound/pci/hda/patch_sigmatel.c
1513 ++++ b/sound/pci/hda/patch_sigmatel.c
1514 +@@ -723,6 +723,7 @@ static bool hp_bnb2011_with_dock(struct hda_codec *codec)
1515 + static bool hp_blike_system(u32 subsystem_id)
1516 + {
1517 + switch (subsystem_id) {
1518 ++ case 0x103c1473: /* HP ProBook 6550b */
1519 + case 0x103c1520:
1520 + case 0x103c1521:
1521 + case 0x103c1523:
1522 +diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
1523 +index 0236363c301f..8dcc834222c4 100644
1524 +--- a/sound/pci/rme96.c
1525 ++++ b/sound/pci/rme96.c
1526 +@@ -742,10 +742,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96,
1527 + {
1528 + /* change to/from double-speed: reset the DAC (if available) */
1529 + snd_rme96_reset_dac(rme96);
1530 ++ return 1; /* need to restore volume */
1531 + } else {
1532 + writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER);
1533 ++ return 0;
1534 + }
1535 +- return 0;
1536 + }
1537 +
1538 + static int
1539 +@@ -983,6 +984,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
1540 + struct rme96 *rme96 = snd_pcm_substream_chip(substream);
1541 + struct snd_pcm_runtime *runtime = substream->runtime;
1542 + int err, rate, dummy;
1543 ++ bool apply_dac_volume = false;
1544 +
1545 + runtime->dma_area = (void __force *)(rme96->iobase +
1546 + RME96_IO_PLAY_BUFFER);
1547 +@@ -996,24 +998,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
1548 + {
1549 + /* slave clock */
1550 + if ((int)params_rate(params) != rate) {
1551 +- spin_unlock_irq(&rme96->lock);
1552 +- return -EIO;
1553 +- }
1554 +- } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) {
1555 +- spin_unlock_irq(&rme96->lock);
1556 +- return err;
1557 +- }
1558 +- if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) {
1559 +- spin_unlock_irq(&rme96->lock);
1560 +- return err;
1561 ++ err = -EIO;
1562 ++ goto error;
1563 ++ }
1564 ++ } else {
1565 ++ err = snd_rme96_playback_setrate(rme96, params_rate(params));
1566 ++ if (err < 0)
1567 ++ goto error;
1568 ++ apply_dac_volume = err > 0; /* need to restore volume later? */
1569 + }
1570 ++
1571 ++ err = snd_rme96_playback_setformat(rme96, params_format(params));
1572 ++ if (err < 0)
1573 ++ goto error;
1574 + snd_rme96_setframelog(rme96, params_channels(params), 1);
1575 + if (rme96->capture_periodsize != 0) {
1576 + if (params_period_size(params) << rme96->playback_frlog !=
1577 + rme96->capture_periodsize)
1578 + {
1579 +- spin_unlock_irq(&rme96->lock);
1580 +- return -EBUSY;
1581 ++ err = -EBUSY;
1582 ++ goto error;
1583 + }
1584 + }
1585 + rme96->playback_periodsize =
1586 +@@ -1024,9 +1028,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
1587 + rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP);
1588 + writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER);
1589 + }
1590 ++
1591 ++ err = 0;
1592 ++ error:
1593 + spin_unlock_irq(&rme96->lock);
1594 +-
1595 +- return 0;
1596 ++ if (apply_dac_volume) {
1597 ++ usleep_range(3000, 10000);
1598 ++ snd_rme96_apply_dac_volume(rme96);
1599 ++ }
1600 ++
1601 ++ return err;
1602 + }
1603 +
1604 + static int
1605 +diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
1606 +index e4295fee8f13..20aa99125607 100644
1607 +--- a/sound/soc/codecs/arizona.c
1608 ++++ b/sound/soc/codecs/arizona.c
1609 +@@ -1171,7 +1171,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
1610 + int chan_limit = arizona->pdata.max_channels_clocked[dai->id - 1];
1611 + int bclk, lrclk, wl, frame, bclk_target;
1612 +
1613 +- if (params_rate(params) % 8000)
1614 ++ if (params_rate(params) % 4000)
1615 + rates = &arizona_44k1_bclk_rates[0];
1616 + else
1617 + rates = &arizona_48k_bclk_rates[0];
1618 +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
1619 +index 799348e9cdd0..c8c8f6d1e882 100644
1620 +--- a/sound/soc/codecs/wm8962.c
1621 ++++ b/sound/soc/codecs/wm8962.c
1622 +@@ -364,8 +364,8 @@ static struct reg_default wm8962_reg[] = {
1623 + { 16924, 0x0059 }, /* R16924 - HDBASS_PG_1 */
1624 + { 16925, 0x999A }, /* R16925 - HDBASS_PG_0 */
1625 +
1626 +- { 17048, 0x0083 }, /* R17408 - HPF_C_1 */
1627 +- { 17049, 0x98AD }, /* R17409 - HPF_C_0 */
1628 ++ { 17408, 0x0083 }, /* R17408 - HPF_C_1 */
1629 ++ { 17409, 0x98AD }, /* R17409 - HPF_C_0 */
1630 +
1631 + { 17920, 0x007F }, /* R17920 - ADCL_RETUNE_C1_1 */
1632 + { 17921, 0xFFFF }, /* R17921 - ADCL_RETUNE_C1_0 */
1633 +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
1634 +index 15f45c7bd833..31bd73066790 100644
1635 +--- a/sound/soc/codecs/wm8974.c
1636 ++++ b/sound/soc/codecs/wm8974.c
1637 +@@ -587,6 +587,7 @@ static const struct regmap_config wm8974_regmap = {
1638 + .max_register = WM8974_MONOMIX,
1639 + .reg_defaults = wm8974_reg_defaults,
1640 + .num_reg_defaults = ARRAY_SIZE(wm8974_reg_defaults),
1641 ++ .cache_type = REGCACHE_FLAT,
1642 + };
1643 +
1644 + static int wm8974_probe(struct snd_soc_codec *codec)
1645 +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
1646 +index 4f98ff14cf12..e5601f9a7bd7 100644
1647 +--- a/sound/soc/soc-compress.c
1648 ++++ b/sound/soc/soc-compress.c
1649 +@@ -665,17 +665,34 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
1650 + struct snd_pcm *be_pcm;
1651 + char new_name[64];
1652 + int ret = 0, direction = 0;
1653 ++ int playback = 0, capture = 0;
1654 +
1655 + /* check client and interface hw capabilities */
1656 + snprintf(new_name, sizeof(new_name), "%s %s-%d",
1657 + rtd->dai_link->stream_name, codec_dai->name, num);
1658 +
1659 + if (codec_dai->driver->playback.channels_min)
1660 ++ playback = 1;
1661 ++ if (codec_dai->driver->capture.channels_min)
1662 ++ capture = 1;
1663 ++
1664 ++ capture = capture && cpu_dai->driver->capture.channels_min;
1665 ++ playback = playback && cpu_dai->driver->playback.channels_min;
1666 ++
1667 ++ /*
1668 ++ * Compress devices are unidirectional so only one of the directions
1669 ++ * should be set, check for that (xor)
1670 ++ */
1671 ++ if (playback + capture != 1) {
1672 ++ dev_err(rtd->card->dev, "Invalid direction for compress P %d, C %d\n",
1673 ++ playback, capture);
1674 ++ return -EINVAL;
1675 ++ }
1676 ++
1677 ++ if(playback)
1678 + direction = SND_COMPRESS_PLAYBACK;
1679 +- else if (codec_dai->driver->capture.channels_min)
1680 +- direction = SND_COMPRESS_CAPTURE;
1681 + else
1682 +- return -EINVAL;
1683 ++ direction = SND_COMPRESS_CAPTURE;
1684 +
1685 + compr = kzalloc(sizeof(*compr), GFP_KERNEL);
1686 + if (compr == NULL) {