Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts were easy to resolve using immediate context mostly,
except the cls_u32.c one where I simply too the entire HEAD
chunk.

Signed-off-by: David S. Miller <davem@davemloft.net>

28 files changed, 255 insertions, 157 deletions

diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index b4441b0764d7..a045f3086047 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -149,7 +149,7 @@ config ARC_CPU_770
           Support for ARC770 core introduced with Rel 4.10 (Summer 2011)
           This core has a bunch of cool new features:
           -MMU-v3: Variable Page Sz (4k, 8k, 16k), bigger J-TLB (128x4)
-                   Shared Address Spaces (for sharing TLB entires in MMU)
+                   Shared Address Spaces (for sharing TLB entries in MMU)
           -Caches: New Prog Model, Region Flush
           -Insns: endian swap, load-locked/store-conditional, time-stamp-ctr
 
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 99cce77ab98f..644815c0516e 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -6,33 +6,11 @@
 # published by the Free Software Foundation.
 #
 
-ifeq ($(CROSS_COMPILE),)
-ifndef CONFIG_CPU_BIG_ENDIAN
-CROSS_COMPILE := arc-linux-
-else
-CROSS_COMPILE := arceb-linux-
-endif
-endif
-
 KBUILD_DEFCONFIG := nsim_700_defconfig
 
 cflags-y        += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
 cflags-$(CONFIG_ISA_ARCOMPACT)  += -mA7
-cflags-$(CONFIG_ISA_ARCV2)      += -mcpu=archs
-
-is_700 = $(shell $(CC) -dM -E - < /dev/null | grep -q "ARC700" && echo 1 || echo 0)
-
-ifdef CONFIG_ISA_ARCOMPACT
-ifeq ($(is_700), 0)
-    $(error Toolchain not configured for ARCompact builds)
-endif
-endif
-
-ifdef CONFIG_ISA_ARCV2
-ifeq ($(is_700), 1)
-    $(error Toolchain not configured for ARCv2 builds)
-endif
-endif
+cflags-$(CONFIG_ISA_ARCV2)      += -mcpu=hs38
 
 ifdef CONFIG_ARC_CURR_IN_REG
 # For a global register defintion, make sure it gets passed to every file
@@ -79,7 +57,7 @@ cflags-$(disable_small_data)		+= -mno-sdata -fcall-used-gp
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += -mbig-endian
 ldflags-$(CONFIG_CPU_BIG_ENDIAN)        += -EB
 
-LIBGCC  := $(shell $(CC) $(cflags-y) --print-libgcc-file-name)
+LIBGCC  = $(shell $(CC) $(cflags-y) --print-libgcc-file-name)
 
 # Modules with short calls might break for calls into builtin-kernel
 KBUILD_CFLAGS_MODULE    += -mlong-calls -mno-millicode
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 4674541eba3f..8ce6e7235915 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -241,6 +241,26 @@ int copy_thread(unsigned long clone_flags,
                 task_thread_info(current)->thr_ptr;
         }
 
+
+        /*
+         * setup usermode thread pointer #1:
+         * when child is picked by scheduler, __switch_to() uses @c_callee to
+         * populate usermode callee regs: this works (despite being in a kernel
+         * function) since special return path for child @ret_from_fork()
+         * ensures those regs are not clobbered all the way to RTIE to usermode
+         */
+        c_callee->r25 = task_thread_info(p)->thr_ptr;
+
+#ifdef CONFIG_ARC_CURR_IN_REG
+        /*
+         * setup usermode thread pointer #2:
+         * however for this special use of r25 in kernel, __switch_to() sets
+         * r25 for kernel needs and only in the final return path is usermode
+         * r25 setup, from pt_regs->user_r25. So set that up as well
+         */
+        c_regs->user_r25 = c_callee->r25;
+#endif
+
         return 0;
 }
 
diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 7423d462d1e4..50dde84b72ed 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -123,6 +123,17 @@
         };
 };
 
+&cpu0 {
+        /* CPU rated to 1GHz, not 1.2GHz as per the default settings */
+        operating-points = <
+                /* kHz   uV */
+                166666  850000
+                400000  900000
+                800000  1050000
+                1000000 1200000
+        >;
+};
+
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/kernel/vmlinux.lds.h
index ae5fdff18406..8247bc15addc 100644
--- a/arch/arm/kernel/vmlinux.lds.h
+++ b/arch/arm/kernel/vmlinux.lds.h
@@ -49,6 +49,8 @@
 #define ARM_DISCARD                                                     \
                 *(.ARM.exidx.exit.text)                                 \
                 *(.ARM.extab.exit.text)                                 \
+                *(.ARM.exidx.text.exit)                                 \
+                *(.ARM.extab.text.exit)                                 \
                 ARM_CPU_DISCARD(*(.ARM.exidx.cpuexit.text))             \
                 ARM_CPU_DISCARD(*(.ARM.extab.cpuexit.text))             \
                 ARM_EXIT_DISCARD(EXIT_TEXT)                             \
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index b2fa62922d88..49d6046ca1d0 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -13,6 +13,7 @@
 
 #include <linux/atomic.h>
 #include <linux/cpumask.h>
+#include <linux/sizes.h>
 #include <linux/threads.h>
 
 #include <asm/cachectl.h>
@@ -80,11 +81,10 @@ extern unsigned int vced_count, vcei_count;
 
 #endif
 
-/*
- * One page above the stack is used for branch delay slot "emulation".
- * See dsemul.c for details.
- */
-#define STACK_TOP       ((TASK_SIZE & PAGE_MASK) - PAGE_SIZE)
+#define VDSO_RANDOMIZE_SIZE     (TASK_IS_32BIT_ADDR ? SZ_1M : SZ_256M)
+
+extern unsigned long mips_stack_top(void);
+#define STACK_TOP               mips_stack_top()
 
 /*
  * This decides where the kernel will search for a free chunk of vm
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 8fc69891e117..d4f7fd4550e1 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -32,6 +32,7 @@
 #include <linux/nmi.h>
 #include <linux/cpu.h>
 
+#include <asm/abi.h>
 #include <asm/asm.h>
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
@@ -39,6 +40,7 @@
 #include <asm/dsp.h>
 #include <asm/fpu.h>
 #include <asm/irq.h>
+#include <asm/mips-cps.h>
 #include <asm/msa.h>
 #include <asm/pgtable.h>
 #include <asm/mipsregs.h>
@@ -645,6 +647,29 @@ out:
         return pc;
 }
 
+unsigned long mips_stack_top(void)
+{
+        unsigned long top = TASK_SIZE & PAGE_MASK;
+
+        /* One page for branch delay slot "emulation" */
+        top -= PAGE_SIZE;
+
+        /* Space for the VDSO, data page & GIC user page */
+        top -= PAGE_ALIGN(current->thread.abi->vdso->size);
+        top -= PAGE_SIZE;
+        top -= mips_gic_present() ? PAGE_SIZE : 0;
+
+        /* Space for cache colour alignment */
+        if (cpu_has_dc_aliases)
+                top -= shm_align_mask + 1;
+
+        /* Space to randomize the VDSO base */
+        if (current->flags & PF_RANDOMIZE)
+                top -= VDSO_RANDOMIZE_SIZE;
+
+        return top;
+}
+
 /*
  * Don't forget that the stack pointer must be aligned on a 8 bytes
  * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index c71d1eb7da59..8aaaa42f91ed 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -846,6 +846,34 @@ static void __init arch_mem_init(char **cmdline_p)
         struct memblock_region *reg;
         extern void plat_mem_setup(void);
 
+        /*
+         * Initialize boot_command_line to an innocuous but non-empty string in
+         * order to prevent early_init_dt_scan_chosen() from copying
+         * CONFIG_CMDLINE into it without our knowledge. We handle
+         * CONFIG_CMDLINE ourselves below & don't want to duplicate its
+         * content because repeating arguments can be problematic.
+         */
+        strlcpy(boot_command_line, " ", COMMAND_LINE_SIZE);
+
+        /* call board setup routine */
+        plat_mem_setup();
+
+        /*
+         * Make sure all kernel memory is in the maps.  The "UP" and
+         * "DOWN" are opposite for initdata since if it crosses over
+         * into another memory section you don't want that to be
+         * freed when the initdata is freed.
+         */
+        arch_mem_addpart(PFN_DOWN(__pa_symbol(&_text)) << PAGE_SHIFT,
+                         PFN_UP(__pa_symbol(&_edata)) << PAGE_SHIFT,
+                         BOOT_MEM_RAM);
+        arch_mem_addpart(PFN_UP(__pa_symbol(&__init_begin)) << PAGE_SHIFT,
+                         PFN_DOWN(__pa_symbol(&__init_end)) << PAGE_SHIFT,
+                         BOOT_MEM_INIT_RAM);
+
+        pr_info("Determined physical RAM map:\n");
+        print_memory_map();
+
 #if defined(CONFIG_CMDLINE_BOOL) && defined(CONFIG_CMDLINE_OVERRIDE)
         strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
 #else
@@ -873,26 +901,6 @@ static void __init arch_mem_init(char **cmdline_p)
         }
 #endif
 #endif
-
-        /* call board setup routine */
-        plat_mem_setup();
-
-        /*
-         * Make sure all kernel memory is in the maps.  The "UP" and
-         * "DOWN" are opposite for initdata since if it crosses over
-         * into another memory section you don't want that to be
-         * freed when the initdata is freed.
-         */
-        arch_mem_addpart(PFN_DOWN(__pa_symbol(&_text)) << PAGE_SHIFT,
-                         PFN_UP(__pa_symbol(&_edata)) << PAGE_SHIFT,
-                         BOOT_MEM_RAM);
-        arch_mem_addpart(PFN_UP(__pa_symbol(&__init_begin)) << PAGE_SHIFT,
-                         PFN_DOWN(__pa_symbol(&__init_end)) << PAGE_SHIFT,
-                         BOOT_MEM_INIT_RAM);
-
-        pr_info("Determined physical RAM map:\n");
-        print_memory_map();
-
         strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
 
         *cmdline_p = command_line;
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 8f845f6e5f42..48a9c6b90e07 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -15,6 +15,7 @@
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/random.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/timekeeper_internal.h>
@@ -97,6 +98,21 @@ void update_vsyscall_tz(void)
         }
 }
 
+static unsigned long vdso_base(void)
+{
+        unsigned long base;
+
+        /* Skip the delay slot emulation page */
+        base = STACK_TOP + PAGE_SIZE;
+
+        if (current->flags & PF_RANDOMIZE) {
+                base += get_random_int() & (VDSO_RANDOMIZE_SIZE - 1);
+                base = PAGE_ALIGN(base);
+        }
+
+        return base;
+}
+
 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 {
         struct mips_vdso_image *image = current->thread.abi->vdso;
@@ -137,7 +153,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         if (cpu_has_dc_aliases)
                 size += shm_align_mask + 1;
 
-        base = get_unmapped_area(NULL, 0, size, 0, 0);
+        base = get_unmapped_area(NULL, vdso_base(), size, 0, 0);
         if (IS_ERR_VALUE(base)) {
                 ret = base;
                 goto out;
diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
index 3a6f34ef5ffc..069acec3df9f 100644
--- a/arch/mips/lib/memset.S
+++ b/arch/mips/lib/memset.S
@@ -280,9 +280,11 @@
          * unset_bytes = end_addr - current_addr + 1
          *      a2     =    t1    -      a0      + 1
          */
+        .set            reorder
         PTR_SUBU        a2, t1, a0
+        PTR_ADDIU       a2, 1
         jr              ra
-         PTR_ADDIU      a2, 1
+        .set            noreorder
 
         .endm
 
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 913c5725cdb2..bb6ac471a784 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1306,6 +1306,16 @@ void show_user_instructions(struct pt_regs *regs)
 
         pc = regs->nip - (instructions_to_print * 3 / 4 * sizeof(int));
 
+        /*
+         * Make sure the NIP points at userspace, not kernel text/data or
+         * elsewhere.
+         */
+        if (!__access_ok(pc, instructions_to_print * sizeof(int), USER_DS)) {
+                pr_info("%s[%d]: Bad NIP, not dumping instructions.\n",
+                        current->comm, current->pid);
+                return;
+        }
+
         pr_info("%s[%d]: code: ", current->comm, current->pid);
 
         for (i = 0; i < instructions_to_print; i++) {
diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
index 6ae2777c220d..5ffee298745f 100644
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
@@ -28,12 +28,6 @@ static int __patch_instruction(unsigned int *exec_addr, unsigned int instr,
 {
         int err;
 
-        /* Make sure we aren't patching a freed init section */
-        if (init_mem_is_free && init_section_contains(exec_addr, 4)) {
-                pr_debug("Skipping init section patching addr: 0x%px\n", exec_addr);
-                return 0;
-        }
-
         __put_user_size(instr, patch_addr, 4, err);
         if (err)
                 return err;
@@ -148,7 +142,7 @@ static inline int unmap_patch_area(unsigned long addr)
         return 0;
 }
 
-int patch_instruction(unsigned int *addr, unsigned int instr)
+static int do_patch_instruction(unsigned int *addr, unsigned int instr)
 {
         int err;
         unsigned int *patch_addr = NULL;
@@ -188,12 +182,22 @@ out:
 }
 #else /* !CONFIG_STRICT_KERNEL_RWX */
 
-int patch_instruction(unsigned int *addr, unsigned int instr)
+static int do_patch_instruction(unsigned int *addr, unsigned int instr)
 {
         return raw_patch_instruction(addr, instr);
 }
 
 #endif /* CONFIG_STRICT_KERNEL_RWX */
+
+int patch_instruction(unsigned int *addr, unsigned int instr)
+{
+        /* Make sure we aren't patching a freed init section */
+        if (init_mem_is_free && init_section_contains(addr, 4)) {
+                pr_debug("Skipping init section patching addr: 0x%px\n", addr);
+                return 0;
+        }
+        return do_patch_instruction(addr, instr);
+}
 NOKPROBE_SYMBOL(patch_instruction);
 
 int patch_branch(unsigned int *addr, unsigned long target, int flags)
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 59d07bd5374a..055b211b7126 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1217,9 +1217,10 @@ int find_and_online_cpu_nid(int cpu)
                  * Need to ensure that NODE_DATA is initialized for a node from
                  * available memory (see memblock_alloc_try_nid). If unable to
                  * init the node, then default to nearest node that has memory
-                 * installed.
+                 * installed. Skip onlining a node if the subsystems are not
+                 * yet initialized.
                  */
-                if (try_online_node(new_nid))
+                if (!topology_inited || try_online_node(new_nid))
                         new_nid = first_online_node;
 #else
                 /*
diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
index 3cae9168f63c..e44a8d7959f5 100644
--- a/arch/s390/include/asm/sclp.h
+++ b/arch/s390/include/asm/sclp.h
@@ -108,7 +108,8 @@ int sclp_early_get_core_info(struct sclp_core_info *info);
 void sclp_early_get_ipl_info(struct sclp_ipl_info *info);
 void sclp_early_detect(void);
 void sclp_early_printk(const char *s);
-void __sclp_early_printk(const char *s, unsigned int len);
+void sclp_early_printk_force(const char *s);
+void __sclp_early_printk(const char *s, unsigned int len, unsigned int force);
 
 int _sclp_get_core_info(struct sclp_core_info *info);
 int sclp_core_configure(u8 core);
diff --git a/arch/s390/kernel/early_printk.c b/arch/s390/kernel/early_printk.c
index 9431784d7796..40c1dfec944e 100644
--- a/arch/s390/kernel/early_printk.c
+++ b/arch/s390/kernel/early_printk.c
@@ -10,7 +10,7 @@
 
 static void sclp_early_write(struct console *con, const char *s, unsigned int len)
 {
-        __sclp_early_printk(s, len);
+        __sclp_early_printk(s, len, 0);
 }
 
 static struct console sclp_early_console = {
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index a049a7b9d6e8..c1a080b11ae9 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -198,12 +198,10 @@ pgm_check_entry:
 
         /* Suspend CPU not available -> panic */
         larl    %r15,init_thread_union
-        ahi     %r15,1<<(PAGE_SHIFT+THREAD_SIZE_ORDER)
+        aghi    %r15,1<<(PAGE_SHIFT+THREAD_SIZE_ORDER)
+        aghi    %r15,-STACK_FRAME_OVERHEAD
         larl    %r2,.Lpanic_string
-        lghi    %r1,0
-        sam31
-        sigp    %r1,%r0,SIGP_SET_ARCHITECTURE
-        brasl   %r14,sclp_early_printk
+        brasl   %r14,sclp_early_printk_force
         larl    %r3,.Ldisabled_wait_31
         lpsw    0(%r3)
 4:
diff --git a/arch/sparc/kernel/auxio_64.c b/arch/sparc/kernel/auxio_64.c
index 4e8f56c3793c..cc42225c20f3 100644
--- a/arch/sparc/kernel/auxio_64.c
+++ b/arch/sparc/kernel/auxio_64.c
@@ -115,8 +115,8 @@ static int auxio_probe(struct platform_device *dev)
                 auxio_devtype = AUXIO_TYPE_SBUS;
                 size = 1;
         } else {
-                printk("auxio: Unknown parent bus type [%s]\n",
-                       dp->parent->name);
+                printk("auxio: Unknown parent bus type [%pOFn]\n",
+                       dp->parent);
                 return -ENODEV;
         }
         auxio_register = of_ioremap(&dev->resource[0], 0, size, "auxio");
diff --git a/arch/sparc/kernel/kgdb_32.c b/arch/sparc/kernel/kgdb_32.c
index 5868fc333ea8..639c8e54530a 100644
--- a/arch/sparc/kernel/kgdb_32.c
+++ b/arch/sparc/kernel/kgdb_32.c
@@ -122,7 +122,7 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
                         linux_regs->pc = addr;
                         linux_regs->npc = addr + 4;
                 }
-                /* fallthru */
+                /* fall through */
 
         case 'D':
         case 'k':
diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
index d5f7dc6323d5..a68bbddbdba4 100644
--- a/arch/sparc/kernel/kgdb_64.c
+++ b/arch/sparc/kernel/kgdb_64.c
@@ -148,7 +148,7 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
                         linux_regs->tpc = addr;
                         linux_regs->tnpc = addr + 4;
                 }
-                /* fallthru */
+                /* fall through */
 
         case 'D':
         case 'k':
diff --git a/arch/sparc/kernel/power.c b/arch/sparc/kernel/power.c
index 92627abce311..d941875dd718 100644
--- a/arch/sparc/kernel/power.c
+++ b/arch/sparc/kernel/power.c
@@ -41,8 +41,8 @@ static int power_probe(struct platform_device *op)
 
         power_reg = of_ioremap(res, 0, 0x4, "power");
 
-        printk(KERN_INFO "%s: Control reg at %llx\n",
-               op->dev.of_node->name, res->start);
+        printk(KERN_INFO "%pOFn: Control reg at %llx\n",
+               op->dev.of_node, res->start);
 
         if (has_button_interrupt(irq, op->dev.of_node)) {
                 if (request_irq(irq,
diff --git a/arch/sparc/kernel/prom_32.c b/arch/sparc/kernel/prom_32.c
index b51cbb9e87dc..17c87d29ff20 100644
--- a/arch/sparc/kernel/prom_32.c
+++ b/arch/sparc/kernel/prom_32.c
@@ -68,8 +68,8 @@ static void __init sparc32_path_component(struct device_node *dp, char *tmp_buf)
                 return;
 
         regs = rprop->value;
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 regs->which_io, regs->phys_addr);
 }
 
@@ -84,8 +84,8 @@ static void __init sbus_path_component(struct device_node *dp, char *tmp_buf)
                 return;
 
         regs = prop->value;
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 regs->which_io,
                 regs->phys_addr);
 }
@@ -104,13 +104,13 @@ static void __init pci_path_component(struct device_node *dp, char *tmp_buf)
         regs = prop->value;
         devfn = (regs->phys_hi >> 8) & 0xff;
         if (devfn & 0x07) {
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp,
                         devfn >> 3,
                         devfn & 0x07);
         } else {
-                sprintf(tmp_buf, "%s@%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x",
+                        dp,
                         devfn >> 3);
         }
 }
@@ -127,8 +127,8 @@ static void __init ebus_path_component(struct device_node *dp, char *tmp_buf)
 
         regs = prop->value;
 
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 regs->which_io, regs->phys_addr);
 }
 
@@ -167,8 +167,8 @@ static void __init ambapp_path_component(struct device_node *dp, char *tmp_buf)
                 return;
         device = prop->value;
 
-        sprintf(tmp_buf, "%s:%d:%d@%x,%x",
-                dp->name, *vendor, *device,
+        sprintf(tmp_buf, "%pOFn:%d:%d@%x,%x",
+                dp, *vendor, *device,
                 *intr, reg0);
 }
 
@@ -201,7 +201,7 @@ char * __init build_path_component(struct device_node *dp)
         tmp_buf[0] = '\0';
         __build_path_component(dp, tmp_buf);
         if (tmp_buf[0] == '\0')
-                strcpy(tmp_buf, dp->name);
+                snprintf(tmp_buf, sizeof(tmp_buf), "%pOFn", dp);
 
         n = prom_early_alloc(strlen(tmp_buf) + 1);
         strcpy(n, tmp_buf);
diff --git a/arch/sparc/kernel/prom_64.c b/arch/sparc/kernel/prom_64.c
index baeaeed64993..6220411ce8fc 100644
--- a/arch/sparc/kernel/prom_64.c
+++ b/arch/sparc/kernel/prom_64.c
@@ -82,8 +82,8 @@ static void __init sun4v_path_component(struct device_node *dp, char *tmp_buf)
 
         regs = rprop->value;
         if (!of_node_is_root(dp->parent)) {
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp,
                         (unsigned int) (regs->phys_addr >> 32UL),
                         (unsigned int) (regs->phys_addr & 0xffffffffUL));
                 return;
@@ -97,17 +97,17 @@ static void __init sun4v_path_component(struct device_node *dp, char *tmp_buf)
                 const char *prefix = (type == 0) ? "m" : "i";
 
                 if (low_bits)
-                        sprintf(tmp_buf, "%s@%s%x,%x",
-                                dp->name, prefix,
+                        sprintf(tmp_buf, "%pOFn@%s%x,%x",
+                                dp, prefix,
                                 high_bits, low_bits);
                 else
-                        sprintf(tmp_buf, "%s@%s%x",
-                                dp->name,
+                        sprintf(tmp_buf, "%pOFn@%s%x",
+                                dp,
                                 prefix,
                                 high_bits);
         } else if (type == 12) {
-                sprintf(tmp_buf, "%s@%x",
-                        dp->name, high_bits);
+                sprintf(tmp_buf, "%pOFn@%x",
+                        dp, high_bits);
         }
 }
 
@@ -122,8 +122,8 @@ static void __init sun4u_path_component(struct device_node *dp, char *tmp_buf)
 
         regs = prop->value;
         if (!of_node_is_root(dp->parent)) {
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp,
                         (unsigned int) (regs->phys_addr >> 32UL),
                         (unsigned int) (regs->phys_addr & 0xffffffffUL));
                 return;
@@ -138,8 +138,8 @@ static void __init sun4u_path_component(struct device_node *dp, char *tmp_buf)
                 if (tlb_type >= cheetah)
                         mask = 0x7fffff;
 
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp,
                         *(u32 *)prop->value,
                         (unsigned int) (regs->phys_addr & mask));
         }
@@ -156,8 +156,8 @@ static void __init sbus_path_component(struct device_node *dp, char *tmp_buf)
                 return;
 
         regs = prop->value;
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 regs->which_io,
                 regs->phys_addr);
 }
@@ -176,13 +176,13 @@ static void __init pci_path_component(struct device_node *dp, char *tmp_buf)
         regs = prop->value;
         devfn = (regs->phys_hi >> 8) & 0xff;
         if (devfn & 0x07) {
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp,
                         devfn >> 3,
                         devfn & 0x07);
         } else {
-                sprintf(tmp_buf, "%s@%x",
-                        dp->name,
+                sprintf(tmp_buf, "%pOFn@%x",
+                        dp,
                         devfn >> 3);
         }
 }
@@ -203,8 +203,8 @@ static void __init upa_path_component(struct device_node *dp, char *tmp_buf)
         if (!prop)
                 return;
 
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 *(u32 *) prop->value,
                 (unsigned int) (regs->phys_addr & 0xffffffffUL));
 }
@@ -221,7 +221,7 @@ static void __init vdev_path_component(struct device_node *dp, char *tmp_buf)
 
         regs = prop->value;
 
-        sprintf(tmp_buf, "%s@%x", dp->name, *regs);
+        sprintf(tmp_buf, "%pOFn@%x", dp, *regs);
 }
 
 /* "name@addrhi,addrlo" */
@@ -236,8 +236,8 @@ static void __init ebus_path_component(struct device_node *dp, char *tmp_buf)
 
         regs = prop->value;
 
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name,
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp,
                 (unsigned int) (regs->phys_addr >> 32UL),
                 (unsigned int) (regs->phys_addr & 0xffffffffUL));
 }
@@ -257,8 +257,8 @@ static void __init i2c_path_component(struct device_node *dp, char *tmp_buf)
         /* This actually isn't right... should look at the #address-cells
          * property of the i2c bus node etc. etc.
          */
-        sprintf(tmp_buf, "%s@%x,%x",
-                dp->name, regs[0], regs[1]);
+        sprintf(tmp_buf, "%pOFn@%x,%x",
+                dp, regs[0], regs[1]);
 }
 
 /* "name@reg0[,reg1]" */
@@ -274,11 +274,11 @@ static void __init usb_path_component(struct device_node *dp, char *tmp_buf)
         regs = prop->value;
 
         if (prop->length == sizeof(u32) || regs[1] == 1) {
-                sprintf(tmp_buf, "%s@%x",
-                        dp->name, regs[0]);
+                sprintf(tmp_buf, "%pOFn@%x",
+                        dp, regs[0]);
         } else {
-                sprintf(tmp_buf, "%s@%x,%x",
-                        dp->name, regs[0], regs[1]);
+                sprintf(tmp_buf, "%pOFn@%x,%x",
+                        dp, regs[0], regs[1]);
         }
 }
 
@@ -295,11 +295,11 @@ static void __init ieee1394_path_component(struct device_node *dp, char *tmp_buf
         regs = prop->value;
 
         if (regs[2] || regs[3]) {
-                sprintf(tmp_buf, "%s@%08x%08x,%04x%08x",
-                        dp->name, regs[0], regs[1], regs[2], regs[3]);
+                sprintf(tmp_buf, "%pOFn@%08x%08x,%04x%08x",
+                        dp, regs[0], regs[1], regs[2], regs[3]);
         } else {
-                sprintf(tmp_buf, "%s@%08x%08x",
-                        dp->name, regs[0], regs[1]);
+                sprintf(tmp_buf, "%pOFn@%08x%08x",
+                        dp, regs[0], regs[1]);
         }
 }
 
@@ -361,7 +361,7 @@ char * __init build_path_component(struct device_node *dp)
         tmp_buf[0] = '\0';
         __build_path_component(dp, tmp_buf);
         if (tmp_buf[0] == '\0')
-                strcpy(tmp_buf, dp->name);
+                snprintf(tmp_buf, sizeof(tmp_buf), "%pOFn", dp);
 
         n = prom_early_alloc(strlen(tmp_buf) + 1);
         strcpy(n, tmp_buf);
diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c
index 635d67ffc9a3..7db5aabe9708 100644
--- a/arch/sparc/kernel/viohs.c
+++ b/arch/sparc/kernel/viohs.c
@@ -180,11 +180,17 @@ static int send_dreg(struct vio_driver_state *vio)
                 struct vio_dring_register pkt;
                 char all[sizeof(struct vio_dring_register) +
                          (sizeof(struct ldc_trans_cookie) *
-                          dr->ncookies)];
+                          VIO_MAX_RING_COOKIES)];
         } u;
+        size_t bytes = sizeof(struct vio_dring_register) +
+                       (sizeof(struct ldc_trans_cookie) *
+                        dr->ncookies);
         int i;
 
-        memset(&u, 0, sizeof(u));
+        if (WARN_ON(bytes > sizeof(u)))
+                return -EINVAL;
+
+        memset(&u, 0, bytes);
         init_tag(&u.pkt.tag, VIO_TYPE_CTRL, VIO_SUBTYPE_INFO, VIO_DRING_REG);
         u.pkt.dring_ident = 0;
         u.pkt.num_descr = dr->num_entries;
@@ -206,7 +212,7 @@ static int send_dreg(struct vio_driver_state *vio)
                        (unsigned long long) u.pkt.cookies[i].cookie_size);
         }
 
-        return send_ctrl(vio, &u.pkt.tag, sizeof(u));
+        return send_ctrl(vio, &u.pkt.tag, bytes);
 }
 
 static int send_rdx(struct vio_driver_state *vio)
diff --git a/arch/sparc/vdso/Makefile b/arch/sparc/vdso/Makefile
index dd0b5a92ffd0..dc85570d8839 100644
--- a/arch/sparc/vdso/Makefile
+++ b/arch/sparc/vdso/Makefile
@@ -31,23 +31,21 @@ obj-y += $(vdso_img_objs)
 targets += $(vdso_img_cfiles)
 targets += $(vdso_img_sodbg) $(vdso_img-y:%=vdso%.so)
 
-export CPPFLAGS_vdso.lds += -P -C
+CPPFLAGS_vdso.lds += -P -C
 
 VDSO_LDFLAGS_vdso.lds = -m64 -Wl,-soname=linux-vdso.so.1 \
                         -Wl,--no-undefined \
                         -Wl,-z,max-page-size=8192 -Wl,-z,common-page-size=8192 \
                         $(DISABLE_LTO)
 
-$(obj)/vdso64.so.dbg: $(src)/vdso.lds $(vobjs) FORCE
+$(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE
         $(call if_changed,vdso)
 
 HOST_EXTRACFLAGS += -I$(srctree)/tools/include
 hostprogs-y                     += vdso2c
 
 quiet_cmd_vdso2c = VDSO2C  $@
-define cmd_vdso2c
-        $(obj)/vdso2c $< $(<:%.dbg=%) $@
-endef
+      cmd_vdso2c = $(obj)/vdso2c $< $(<:%.dbg=%) $@
 
 $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso%.so $(obj)/vdso2c FORCE
         $(call if_changed,vdso2c)
diff --git a/arch/x86/kernel/cpu/intel_rdt.h b/arch/x86/kernel/cpu/intel_rdt.h
index 285eb3ec4200..3736f6dc9545 100644
--- a/arch/x86/kernel/cpu/intel_rdt.h
+++ b/arch/x86/kernel/cpu/intel_rdt.h
@@ -529,14 +529,14 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
 int rdtgroup_schemata_show(struct kernfs_open_file *of,
                            struct seq_file *s, void *v);
 bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
-                           u32 _cbm, int closid, bool exclusive);
+                           unsigned long cbm, int closid, bool exclusive);
 unsigned int rdtgroup_cbm_to_size(struct rdt_resource *r, struct rdt_domain *d,
-                                  u32 cbm);
+                                  unsigned long cbm);
 enum rdtgrp_mode rdtgroup_mode_by_closid(int closid);
 int rdtgroup_tasks_assigned(struct rdtgroup *r);
 int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp);
 int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp);
-bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, u32 _cbm);
+bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, unsigned long cbm);
 bool rdtgroup_pseudo_locked_in_hierarchy(struct rdt_domain *d);
 int rdt_pseudo_lock_init(void);
 void rdt_pseudo_lock_release(void);
diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
index 40f3903ae5d9..f8c260d522ca 100644
--- a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
@@ -797,25 +797,27 @@ int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp)
 /**
  * rdtgroup_cbm_overlaps_pseudo_locked - Test if CBM or portion is pseudo-locked
  * @d: RDT domain
- * @_cbm: CBM to test
+ * @cbm: CBM to test
  *
- * @d represents a cache instance and @_cbm a capacity bitmask that is
- * considered for it. Determine if @_cbm overlaps with any existing
+ * @d represents a cache instance and @cbm a capacity bitmask that is
+ * considered for it. Determine if @cbm overlaps with any existing
  * pseudo-locked region on @d.
  *
- * Return: true if @_cbm overlaps with pseudo-locked region on @d, false
+ * @cbm is unsigned long, even if only 32 bits are used, to make the
+ * bitmap functions work correctly.
+ *
+ * Return: true if @cbm overlaps with pseudo-locked region on @d, false
  * otherwise.
  */
-bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, u32 _cbm)
+bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, unsigned long cbm)
 {
-        unsigned long *cbm = (unsigned long *)&_cbm;
-        unsigned long *cbm_b;
         unsigned int cbm_len;
+        unsigned long cbm_b;
 
         if (d->plr) {
                 cbm_len = d->plr->r->cache.cbm_len;
-                cbm_b = (unsigned long *)&d->plr->cbm;
-                if (bitmap_intersects(cbm, cbm_b, cbm_len))
+                cbm_b = d->plr->cbm;
+                if (bitmap_intersects(&cbm, &cbm_b, cbm_len))
                         return true;
         }
         return false;
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 1b8e86a5d5e1..b140c68bc14b 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -975,33 +975,34 @@ static int rdtgroup_mode_show(struct kernfs_open_file *of,
  * is false then overlaps with any resource group or hardware entities
  * will be considered.
  *
+ * @cbm is unsigned long, even if only 32 bits are used, to make the
+ * bitmap functions work correctly.
+ *
  * Return: false if CBM does not overlap, true if it does.
  */
 bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
-                           u32 _cbm, int closid, bool exclusive)
+                           unsigned long cbm, int closid, bool exclusive)
 {
-        unsigned long *cbm = (unsigned long *)&_cbm;
-        unsigned long *ctrl_b;
         enum rdtgrp_mode mode;
+        unsigned long ctrl_b;
         u32 *ctrl;
         int i;
 
         /* Check for any overlap with regions used by hardware directly */
         if (!exclusive) {
-                if (bitmap_intersects(cbm,
-                                      (unsigned long *)&r->cache.shareable_bits,
-                                      r->cache.cbm_len))
+                ctrl_b = r->cache.shareable_bits;
+                if (bitmap_intersects(&cbm, &ctrl_b, r->cache.cbm_len))
                         return true;
         }
 
         /* Check for overlap with other resource groups */
         ctrl = d->ctrl_val;
         for (i = 0; i < closids_supported(); i++, ctrl++) {
-                ctrl_b = (unsigned long *)ctrl;
+                ctrl_b = *ctrl;
                 mode = rdtgroup_mode_by_closid(i);
                 if (closid_allocated(i) && i != closid &&
                     mode != RDT_MODE_PSEUDO_LOCKSETUP) {
-                        if (bitmap_intersects(cbm, ctrl_b, r->cache.cbm_len)) {
+                        if (bitmap_intersects(&cbm, &ctrl_b, r->cache.cbm_len)) {
                                 if (exclusive) {
                                         if (mode == RDT_MODE_EXCLUSIVE)
                                                 return true;
@@ -1138,15 +1139,18 @@ out:
  * computed by first dividing the total cache size by the CBM length to
  * determine how many bytes each bit in the bitmask represents. The result
  * is multiplied with the number of bits set in the bitmask.
+ *
+ * @cbm is unsigned long, even if only 32 bits are used to make the
+ * bitmap functions work correctly.
  */
 unsigned int rdtgroup_cbm_to_size(struct rdt_resource *r,
-                                  struct rdt_domain *d, u32 cbm)
+                                  struct rdt_domain *d, unsigned long cbm)
 {
         struct cpu_cacheinfo *ci;
         unsigned int size = 0;
         int num_b, i;
 
-        num_b = bitmap_weight((unsigned long *)&cbm, r->cache.cbm_len);
+        num_b = bitmap_weight(&cbm, r->cache.cbm_len);
         ci = get_cpu_cacheinfo(cpumask_any(&d->cpu_mask));
         for (i = 0; i < ci->num_leaves; i++) {
                 if (ci->info_list[i].level == r->cache_level) {
@@ -2353,6 +2357,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
         u32 used_b = 0, unused_b = 0;
         u32 closid = rdtgrp->closid;
         struct rdt_resource *r;
+        unsigned long tmp_cbm;
         enum rdtgrp_mode mode;
         struct rdt_domain *d;
         int i, ret;
@@ -2390,9 +2395,14 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
                          * modify the CBM based on system availability.
                          */
                         cbm_ensure_valid(&d->new_ctrl, r);
-                        if (bitmap_weight((unsigned long *) &d->new_ctrl,
-                                          r->cache.cbm_len) <
-                                        r->cache.min_cbm_bits) {
+                        /*
+                         * Assign the u32 CBM to an unsigned long to ensure
+                         * that bitmap_weight() does not access out-of-bound
+                         * memory.
+                         */
+                        tmp_cbm = d->new_ctrl;
+                        if (bitmap_weight(&tmp_cbm, r->cache.cbm_len) <
+                            r->cache.min_cbm_bits) {
                                 rdt_last_cmd_printf("no space on %s:%d\n",
                                                     r->name, d->id);
                                 return -ENOSPC;
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 089e78c4effd..59274e2c1ac4 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)
 
 #define UNSHARED_PTRS_PER_PGD                           \
         (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+#define MAX_UNSHARED_PTRS_PER_PGD                       \
+        max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)
 
 
 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
  * and initialize the kernel pmds here.
  */
 #define PREALLOCATED_PMDS       UNSHARED_PTRS_PER_PGD
+#define MAX_PREALLOCATED_PMDS   MAX_UNSHARED_PTRS_PER_PGD
 
 /*
  * We allocate separate PMDs for the kernel part of the user page-table
@@ -189,6 +192,7 @@ static void pgd_dtor(pgd_t *pgd)
  */
 #define PREALLOCATED_USER_PMDS   (static_cpu_has(X86_FEATURE_PTI) ? \
                                         KERNEL_PGD_PTRS : 0)
+#define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRS
 
 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 {
@@ -210,7 +214,9 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 
 /* No need to prepopulate any pagetable entries in non-PAE modes. */
 #define PREALLOCATED_PMDS       0
+#define MAX_PREALLOCATED_PMDS   0
 #define PREALLOCATED_USER_PMDS   0
+#define MAX_PREALLOCATED_USER_PMDS 0
 #endif  /* CONFIG_X86_PAE */
 
 static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
@@ -428,8 +434,8 @@ static inline void _pgd_free(pgd_t *pgd)
 pgd_t *pgd_alloc(struct mm_struct *mm)
 {
         pgd_t *pgd;
-        pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
-        pmd_t *pmds[PREALLOCATED_PMDS];
+        pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
+        pmd_t *pmds[MAX_PREALLOCATED_PMDS];
 
         pgd = _pgd_alloc();