31 files changed, 243 insertions, 170 deletions

diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index 73c5c2b05f64..7f3c0a2e60cd 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1802,7 +1802,8 @@ static int kvm_ia64_sync_dirty_log(struct kvm *kvm,
 {
         struct kvm_memory_slot *memslot;
         int r, i;
-        long n, base;
+        long base;
+        unsigned long n;
         unsigned long *dirty_bitmap = (unsigned long *)(kvm->arch.vm_base +
                         offsetof(struct kvm_vm_data, kvm_mem_dirty_log));
 
@@ -1815,7 +1816,7 @@ static int kvm_ia64_sync_dirty_log(struct kvm *kvm,
         if (!memslot->dirty_bitmap)
                 goto out;
 
-        n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+        n = kvm_dirty_bitmap_bytes(memslot);
         base = memslot->base_gfn / BITS_PER_LONG;
 
         for (i = 0; i < n/sizeof(long); ++i) {
@@ -1831,7 +1832,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                 struct kvm_dirty_log *log)
 {
         int r;
-        int n;
+        unsigned long n;
         struct kvm_memory_slot *memslot;
         int is_dirty = 0;
 
@@ -1850,7 +1851,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         if (is_dirty) {
                 kvm_flush_remote_tlbs(kvm);
                 memslot = &kvm->memslots->memslots[log->slot];
-                n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+                n = kvm_dirty_bitmap_bytes(memslot);
                 memset(memslot->dirty_bitmap, 0, n);
         }
         r = 0;
diff --git a/arch/m68k/include/asm/mcfuart.h b/arch/m68k/include/asm/mcfuart.h
index ef2293873612..01a8716c5fc5 100644
--- a/arch/m68k/include/asm/mcfuart.h
+++ b/arch/m68k/include/asm/mcfuart.h
@@ -212,5 +212,10 @@ struct mcf_platform_uart {
 #define MCFUART_URF_RXS         0xc0            /* Receiver status */
 #endif
 
+#if defined(CONFIG_M5272)
+#define MCFUART_TXFIFOSIZE      25
+#else
+#define MCFUART_TXFIFOSIZE      1
+#endif
 /****************************************************************************/
 #endif  /* mcfuart_h */
diff --git a/arch/m68knommu/Makefile b/arch/m68knommu/Makefile
index ce404bc9ccbd..14042574ac21 100644
--- a/arch/m68knommu/Makefile
+++ b/arch/m68knommu/Makefile
@@ -94,7 +94,7 @@ cflags-$(CONFIG_M520x)		:= $(call cc-option,-mcpu=5208,-m5200)
 cflags-$(CONFIG_M523x)          := $(call cc-option,-mcpu=523x,-m5307)
 cflags-$(CONFIG_M5249)          := $(call cc-option,-mcpu=5249,-m5200)
 cflags-$(CONFIG_M5271)          := $(call cc-option,-mcpu=5271,-m5307)
-cflags-$(CONFIG_M5272)          := $(call cc-option,-mcpu=5271,-m5200)
+cflags-$(CONFIG_M5272)          := $(call cc-option,-mcpu=5272,-m5307)
 cflags-$(CONFIG_M5275)          := $(call cc-option,-mcpu=5275,-m5307)
 cflags-$(CONFIG_M528x)          := $(call cc-option,-m528x,-m5307)
 cflags-$(CONFIG_M5307)          := $(call cc-option,-m5307,-m5200)
diff --git a/arch/m68knommu/kernel/entry.S b/arch/m68knommu/kernel/entry.S
index 56043ade3941..aff6f57ef8b5 100644
--- a/arch/m68knommu/kernel/entry.S
+++ b/arch/m68knommu/kernel/entry.S
@@ -145,6 +145,6 @@ ENTRY(ret_from_user_signal)
         trap #0
 
 ENTRY(ret_from_user_rt_signal)
-        move #__NR_rt_sigreturn,%d0
+        movel #__NR_rt_sigreturn,%d0
         trap #0
 
diff --git a/arch/m68knommu/platform/68360/ints.c b/arch/m68knommu/platform/68360/ints.c
index 1143f77caca4..6f22970d8c20 100644
--- a/arch/m68knommu/platform/68360/ints.c
+++ b/arch/m68knommu/platform/68360/ints.c
@@ -107,7 +107,6 @@ void init_IRQ(void)
         _ramvec[vba+CPMVEC_PIO_PC7]     = inthandler;  /* pio - pc7 */
         _ramvec[vba+CPMVEC_PIO_PC6]     = inthandler;  /* pio - pc6 */
         _ramvec[vba+CPMVEC_TIMER3]      = inthandler;  /* timer 3 */
-        _ramvec[vba+CPMVEC_RISCTIMER]   = inthandler;  /* reserved */
         _ramvec[vba+CPMVEC_PIO_PC5]     = inthandler;  /* pio - pc5 */
         _ramvec[vba+CPMVEC_PIO_PC4]     = inthandler;  /* pio - pc4 */
         _ramvec[vba+CPMVEC_RESERVED2]   = inthandler;  /* reserved */
diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
index 25da07fd9f77..604af29b71ed 100644
--- a/arch/powerpc/kvm/book3s.c
+++ b/arch/powerpc/kvm/book3s.c
@@ -1004,7 +1004,8 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         struct kvm_vcpu *vcpu;
         ulong ga, ga_end;
         int is_dirty = 0;
-        int r, n;
+        int r;
+        unsigned long n;
 
         mutex_lock(&kvm->slots_lock);
 
@@ -1022,7 +1023,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                 kvm_for_each_vcpu(n, vcpu, kvm)
                         kvmppc_mmu_pte_pflush(vcpu, ga, ga_end);
 
-                n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+                n = kvm_dirty_bitmap_bytes(memslot);
                 memset(memslot->dirty_bitmap, 0, n);
         }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 48aeee8eefb0..19a8906bcaa2 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1490,8 +1490,8 @@ static int mmu_zap_unsync_children(struct kvm *kvm,
                 for_each_sp(pages, sp, parents, i) {
                         kvm_mmu_zap_page(kvm, sp);
                         mmu_pages_clear_parents(&parents);
+                        zapped++;
                 }
-                zapped += pages.nr;
                 kvm_mmu_pages_init(parent, &parents, &pages);
         }
 
@@ -1542,14 +1542,16 @@ void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages)
          */
 
         if (used_pages > kvm_nr_mmu_pages) {
-                while (used_pages > kvm_nr_mmu_pages) {
+                while (used_pages > kvm_nr_mmu_pages &&
+                        !list_empty(&kvm->arch.active_mmu_pages)) {
                         struct kvm_mmu_page *page;
 
                         page = container_of(kvm->arch.active_mmu_pages.prev,
                                             struct kvm_mmu_page, link);
-                        kvm_mmu_zap_page(kvm, page);
+                        used_pages -= kvm_mmu_zap_page(kvm, page);
                         used_pages--;
                 }
+                kvm_nr_mmu_pages = used_pages;
                 kvm->arch.n_free_mmu_pages = 0;
         }
         else
@@ -1596,7 +1598,8 @@ static void mmu_unshadow(struct kvm *kvm, gfn_t gfn)
                     && !sp->role.invalid) {
                         pgprintk("%s: zap %lx %x\n",
                                  __func__, gfn, sp->role.word);
-                        kvm_mmu_zap_page(kvm, sp);
+                        if (kvm_mmu_zap_page(kvm, sp))
+                                nn = bucket->first;
                 }
         }
 }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 445c59411ed0..2ba58206812a 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -706,29 +706,28 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
         if (err)
                 goto free_svm;
 
+        err = -ENOMEM;
         page = alloc_page(GFP_KERNEL);
-        if (!page) {
-                err = -ENOMEM;
+        if (!page)
                 goto uninit;
-        }
 
-        err = -ENOMEM;
         msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
         if (!msrpm_pages)
-                goto uninit;
+                goto free_page1;
 
         nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
         if (!nested_msrpm_pages)
-                goto uninit;
-
-        svm->msrpm = page_address(msrpm_pages);
-        svm_vcpu_init_msrpm(svm->msrpm);
+                goto free_page2;
 
         hsave_page = alloc_page(GFP_KERNEL);
         if (!hsave_page)
-                goto uninit;
+                goto free_page3;
+
         svm->nested.hsave = page_address(hsave_page);
 
+        svm->msrpm = page_address(msrpm_pages);
+        svm_vcpu_init_msrpm(svm->msrpm);
+
         svm->nested.msrpm = page_address(nested_msrpm_pages);
 
         svm->vmcb = page_address(page);
@@ -744,6 +743,12 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
 
         return &svm->vcpu;
 
+free_page3:
+        __free_pages(nested_msrpm_pages, MSRPM_ALLOC_ORDER);
+free_page2:
+        __free_pages(msrpm_pages, MSRPM_ALLOC_ORDER);
+free_page1:
+        __free_page(page);
 uninit:
         kvm_vcpu_uninit(&svm->vcpu);
 free_svm:
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 686492ed3079..bc933cfb4e66 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -77,6 +77,8 @@ module_param(emulate_invalid_guest_state, bool, S_IRUGO);
 #define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
 #define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
 
+#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
+
 /*
  * These 2 parameters are used to config the controls for Pause-Loop Exiting:
  * ple_gap:    upper bound on the amount of time between two successive
@@ -131,7 +133,7 @@ struct vcpu_vmx {
         } host_state;
         struct {
                 int vm86_active;
-                u8 save_iopl;
+                ulong save_rflags;
                 struct kvm_save_segment {
                         u16 selector;
                         unsigned long base;
@@ -818,18 +820,23 @@ static void vmx_fpu_deactivate(struct kvm_vcpu *vcpu)
 
 static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
 {
-        unsigned long rflags;
+        unsigned long rflags, save_rflags;
 
         rflags = vmcs_readl(GUEST_RFLAGS);
-        if (to_vmx(vcpu)->rmode.vm86_active)
-                rflags &= ~(unsigned long)(X86_EFLAGS_IOPL | X86_EFLAGS_VM);
+        if (to_vmx(vcpu)->rmode.vm86_active) {
+                rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+                save_rflags = to_vmx(vcpu)->rmode.save_rflags;
+                rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+        }
         return rflags;
 }
 
 static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 {
-        if (to_vmx(vcpu)->rmode.vm86_active)
+        if (to_vmx(vcpu)->rmode.vm86_active) {
+                to_vmx(vcpu)->rmode.save_rflags = rflags;
                 rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
+        }
         vmcs_writel(GUEST_RFLAGS, rflags);
 }
 
@@ -1483,8 +1490,8 @@ static void enter_pmode(struct kvm_vcpu *vcpu)
         vmcs_write32(GUEST_TR_AR_BYTES, vmx->rmode.tr.ar);
 
         flags = vmcs_readl(GUEST_RFLAGS);
-        flags &= ~(X86_EFLAGS_IOPL | X86_EFLAGS_VM);
-        flags |= (vmx->rmode.save_iopl << IOPL_SHIFT);
+        flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+        flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
         vmcs_writel(GUEST_RFLAGS, flags);
 
         vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
@@ -1557,8 +1564,7 @@ static void enter_rmode(struct kvm_vcpu *vcpu)
         vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
 
         flags = vmcs_readl(GUEST_RFLAGS);
-        vmx->rmode.save_iopl
-                = (flags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
+        vmx->rmode.save_rflags = flags;
 
         flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 24cd0ee896e9..3c4ca98ad27f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -433,8 +433,6 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 
 #ifdef CONFIG_X86_64
         if (cr0 & 0xffffffff00000000UL) {
-                printk(KERN_DEBUG "set_cr0: 0x%lx #GP, reserved bits 0x%lx\n",
-                       cr0, kvm_read_cr0(vcpu));
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
@@ -443,14 +441,11 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
         cr0 &= ~CR0_RESERVED_BITS;
 
         if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD)) {
-                printk(KERN_DEBUG "set_cr0: #GP, CD == 0 && NW == 1\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
 
         if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE)) {
-                printk(KERN_DEBUG "set_cr0: #GP, set PG flag "
-                       "and a clear PE flag\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
@@ -461,15 +456,11 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
                         int cs_db, cs_l;
 
                         if (!is_pae(vcpu)) {
-                                printk(KERN_DEBUG "set_cr0: #GP, start paging "
-                                       "in long mode while PAE is disabled\n");
                                 kvm_inject_gp(vcpu, 0);
                                 return;
                         }
                         kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
                         if (cs_l) {
-                                printk(KERN_DEBUG "set_cr0: #GP, start paging "
-                                       "in long mode while CS.L == 1\n");
                                 kvm_inject_gp(vcpu, 0);
                                 return;
 
@@ -477,8 +468,6 @@ void kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
                 } else
 #endif
                 if (is_pae(vcpu) && !load_pdptrs(vcpu, vcpu->arch.cr3)) {
-                        printk(KERN_DEBUG "set_cr0: #GP, pdptrs "
-                               "reserved bits\n");
                         kvm_inject_gp(vcpu, 0);
                         return;
                 }
@@ -505,28 +494,23 @@ void kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
         unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE;
 
         if (cr4 & CR4_RESERVED_BITS) {
-                printk(KERN_DEBUG "set_cr4: #GP, reserved bits\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
 
         if (is_long_mode(vcpu)) {
                 if (!(cr4 & X86_CR4_PAE)) {
-                        printk(KERN_DEBUG "set_cr4: #GP, clearing PAE while "
-                               "in long mode\n");
                         kvm_inject_gp(vcpu, 0);
                         return;
                 }
         } else if (is_paging(vcpu) && (cr4 & X86_CR4_PAE)
                    && ((cr4 ^ old_cr4) & pdptr_bits)
                    && !load_pdptrs(vcpu, vcpu->arch.cr3)) {
-                printk(KERN_DEBUG "set_cr4: #GP, pdptrs reserved bits\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
 
         if (cr4 & X86_CR4_VMXE) {
-                printk(KERN_DEBUG "set_cr4: #GP, setting VMXE\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
@@ -547,21 +531,16 @@ void kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 
         if (is_long_mode(vcpu)) {
                 if (cr3 & CR3_L_MODE_RESERVED_BITS) {
-                        printk(KERN_DEBUG "set_cr3: #GP, reserved bits\n");
                         kvm_inject_gp(vcpu, 0);
                         return;
                 }
         } else {
                 if (is_pae(vcpu)) {
                         if (cr3 & CR3_PAE_RESERVED_BITS) {
-                                printk(KERN_DEBUG
-                                       "set_cr3: #GP, reserved bits\n");
                                 kvm_inject_gp(vcpu, 0);
                                 return;
                         }
                         if (is_paging(vcpu) && !load_pdptrs(vcpu, cr3)) {
-                                printk(KERN_DEBUG "set_cr3: #GP, pdptrs "
-                                       "reserved bits\n");
                                 kvm_inject_gp(vcpu, 0);
                                 return;
                         }
@@ -593,7 +572,6 @@ EXPORT_SYMBOL_GPL(kvm_set_cr3);
 void kvm_set_cr8(struct kvm_vcpu *vcpu, unsigned long cr8)
 {
         if (cr8 & CR8_RESERVED_BITS) {
-                printk(KERN_DEBUG "set_cr8: #GP, reserved bits 0x%lx\n", cr8);
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
@@ -649,15 +627,12 @@ static u32 emulated_msrs[] = {
 static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
         if (efer & efer_reserved_bits) {
-                printk(KERN_DEBUG "set_efer: 0x%llx #GP, reserved bits\n",
-                       efer);
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
 
         if (is_paging(vcpu)
             && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) {
-                printk(KERN_DEBUG "set_efer: #GP, change LME while paging\n");
                 kvm_inject_gp(vcpu, 0);
                 return;
         }
@@ -667,7 +642,6 @@ static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 
                 feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
                 if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) {
-                        printk(KERN_DEBUG "set_efer: #GP, enable FFXSR w/o CPUID capability\n");
                         kvm_inject_gp(vcpu, 0);
                         return;
                 }
@@ -678,7 +652,6 @@ static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
 
                 feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
                 if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) {
-                        printk(KERN_DEBUG "set_efer: #GP, enable SVM w/o SVM\n");
                         kvm_inject_gp(vcpu, 0);
                         return;
                 }
@@ -967,9 +940,13 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 data)
                 if (msr >= MSR_IA32_MC0_CTL &&
                     msr < MSR_IA32_MC0_CTL + 4 * bank_num) {
                         u32 offset = msr - MSR_IA32_MC0_CTL;
-                        /* only 0 or all 1s can be written to IA32_MCi_CTL */
+                        /* only 0 or all 1s can be written to IA32_MCi_CTL
+                         * some Linux kernels though clear bit 10 in bank 4 to
+                         * workaround a BIOS/GART TBL issue on AMD K8s, ignore
+                         * this to avoid an uncatched #GP in the guest
+                         */
                         if ((offset & 0x3) == 0 &&
-                            data != 0 && data != ~(u64)0)
+                            data != 0 && (data | (1 << 10)) != ~(u64)0)
                                 return -1;
                         vcpu->arch.mce_banks[offset] = data;
                         break;
@@ -2635,8 +2612,9 @@ static int kvm_vm_ioctl_reinject(struct kvm *kvm,
 int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                                       struct kvm_dirty_log *log)
 {
-        int r, n, i;
+        int r, i;
         struct kvm_memory_slot *memslot;
+        unsigned long n;
         unsigned long is_dirty = 0;
         unsigned long *dirty_bitmap = NULL;
 
@@ -2651,7 +2629,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         if (!memslot->dirty_bitmap)
                 goto out;
 
-        n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+        n = kvm_dirty_bitmap_bytes(memslot);
 
         r = -ENOMEM;
         dirty_bitmap = vmalloc(n);
@@ -4483,7 +4461,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 kvm_set_cr8(vcpu, kvm_run->cr8);
 
         if (vcpu->arch.pio.cur_count) {
+                vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
                 r = complete_pio(vcpu);
+                srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
                 if (r)
                         goto out;
         }
@@ -5146,6 +5126,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
         int ret = 0;
         u32 old_tss_base = get_segment_base(vcpu, VCPU_SREG_TR);
         u16 old_tss_sel = get_segment_selector(vcpu, VCPU_SREG_TR);
+        u32 desc_limit;
 
         old_tss_base = kvm_mmu_gva_to_gpa_write(vcpu, old_tss_base, NULL);
 
@@ -5168,7 +5149,10 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
                 }
         }
 
-        if (!nseg_desc.p || get_desc_limit(&nseg_desc) < 0x67) {
+        desc_limit = get_desc_limit(&nseg_desc);
+        if (!nseg_desc.p ||
+            ((desc_limit < 0x67 && (nseg_desc.type & 8)) ||
+             desc_limit < 0x2b)) {
                 kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
                 return 1;
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e3e9a36ea3b7..20e48401910e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1650,8 +1650,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                      int previous, int *dd_idx,
                                      struct stripe_head *sh)
 {
-        long stripe;
-        unsigned long chunk_number;
+        sector_t stripe;
+        sector_t chunk_number;
         unsigned int chunk_offset;
         int pd_idx, qd_idx;
         int ddf_layout = 0;
@@ -1671,17 +1671,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
          */
         chunk_offset = sector_div(r_sector, sectors_per_chunk);
         chunk_number = r_sector;
-        BUG_ON(r_sector != chunk_number);
 
         /*
          * Compute the stripe number
          */
-        stripe = chunk_number / data_disks;
-
-        /*
-         * Compute the data disk and parity disk indexes inside the stripe
-         */
-        *dd_idx = chunk_number % data_disks;
+        stripe = chunk_number;
+        *dd_idx = sector_div(stripe, data_disks);
 
         /*
          * Select the parity disk based on the user selected algorithm.
@@ -1870,14 +1865,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                                  : conf->algorithm;
         sector_t stripe;
         int chunk_offset;
-        int chunk_number, dummy1, dd_idx = i;
+        sector_t chunk_number;
+        int dummy1, dd_idx = i;
         sector_t r_sector;
         struct stripe_head sh2;
 
 
         chunk_offset = sector_div(new_sector, sectors_per_chunk);
         stripe = new_sector;
-        BUG_ON(new_sector != stripe);
 
         if (i == sh->pd_idx)
                 return 0;
@@ -1970,7 +1965,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
         }
 
         chunk_number = stripe * data_disks + i;
-        r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
+        r_sector = chunk_number * sectors_per_chunk + chunk_offset;
 
         check = raid5_compute_sector(conf, r_sector,
                                      previous, &dummy1, &sh2);
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
index a681f5e8f786..ad036dd8da13 100644
--- a/drivers/regulator/mc13783-regulator.c
+++ b/drivers/regulator/mc13783-regulator.c
@@ -618,9 +618,12 @@ static int __devexit mc13783_regulator_remove(struct platform_device *pdev)
                 dev_get_platdata(&pdev->dev);
         int i;
 
+        platform_set_drvdata(pdev, NULL);
+
         for (i = 0; i < pdata->num_regulators; i++)
                 regulator_unregister(priv->regulators[i]);
 
+        kfree(priv);
         return 0;
 }
 
diff --git a/drivers/serial/mcf.c b/drivers/serial/mcf.c
index 7bb5fee639e3..b5aaef965f24 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/serial/mcf.c
@@ -263,6 +263,7 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
         }
 
         spin_lock_irqsave(&port->lock, flags);
+        uart_update_timeout(port, termios->c_cflag, baud);
         writeb(MCFUART_UCR_CMDRESETRX, port->membase + MCFUART_UCR);
         writeb(MCFUART_UCR_CMDRESETTX, port->membase + MCFUART_UCR);
         writeb(MCFUART_UCR_CMDRESETMRPTR, port->membase + MCFUART_UCR);
@@ -379,6 +380,7 @@ static irqreturn_t mcf_interrupt(int irq, void *data)
 static void mcf_config_port(struct uart_port *port, int flags)
 {
         port->type = PORT_MCF;
+        port->fifosize = MCFUART_TXFIFOSIZE;
 
         /* Clear mask, so no surprise interrupts. */
         writeb(0, port->membase + MCFUART_UIMR);
@@ -424,7 +426,7 @@ static int mcf_verify_port(struct uart_port *port, struct serial_struct *ser)
 /*
  *      Define the basic serial functions we support.
  */
-static struct uart_ops mcf_uart_ops = {
+static const struct uart_ops mcf_uart_ops = {
         .tx_empty       = mcf_tx_empty,
         .get_mctrl      = mcf_get_mctrl,
         .set_mctrl      = mcf_set_mctrl,
@@ -443,7 +445,7 @@ static struct uart_ops mcf_uart_ops = {
         .verify_port    = mcf_verify_port,
 };
 
-static struct mcf_uart mcf_ports[3];
+static struct mcf_uart mcf_ports[4];
 
 #define MCF_MAXPORTS    ARRAY_SIZE(mcf_ports)
 
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index 5e813a816ce4..b3feddc4f7d6 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -138,9 +138,9 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 {
         struct afs_super_info *super;
         struct vfsmount *mnt;
-        struct page *page = NULL;
+        struct page *page;
         size_t size;
-        char *buf, *devname = NULL, *options = NULL;
+        char *buf, *devname, *options;
         int ret;
 
         _enter("{%s}", mntpt->d_name.name);
@@ -150,22 +150,22 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
         ret = -EINVAL;
         size = mntpt->d_inode->i_size;
         if (size > PAGE_SIZE - 1)
-                goto error;
+                goto error_no_devname;
 
         ret = -ENOMEM;
         devname = (char *) get_zeroed_page(GFP_KERNEL);
         if (!devname)
-                goto error;
+                goto error_no_devname;
 
         options = (char *) get_zeroed_page(GFP_KERNEL);
         if (!options)
-                goto error;
+                goto error_no_options;
 
         /* read the contents of the AFS special symlink */
         page = read_mapping_page(mntpt->d_inode->i_mapping, 0, NULL);
         if (IS_ERR(page)) {
                 ret = PTR_ERR(page);
-                goto error;
+                goto error_no_page;
         }
 
         ret = -EIO;
@@ -196,12 +196,12 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
         return mnt;
 
 error:
-        if (page)
-                page_cache_release(page);
-        if (devname)
-                free_page((unsigned long) devname);
-        if (options)
-                free_page((unsigned long) options);
+        page_cache_release(page);
+error_no_page:
+        free_page((unsigned long) options);
+error_no_options:
+        free_page((unsigned long) devname);
+error_no_devname:
         _leave(" = %d", ret);
         return ERR_PTR(ret);
 }
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index e0e769bdca59..49566c1687d8 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -355,7 +355,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
 
         if (!flat_reloc_valid(r, start_brk - start_data + text_len)) {
                 printk("BINFMT_FLAT: reloc outside program 0x%x (0 - 0x%x/0x%x)",
-                       (int) r,(int)(start_brk-start_code),(int)text_len);
+                       (int) r,(int)(start_brk-start_data+text_len),(int)text_len);
                 goto failed;
         }
 
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 9dd126276c9f..ed9ba6fe04f5 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -61,7 +61,7 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
                         inode->i_op = &page_symlink_inode_operations;
                         inode->i_mapping->a_ops = &jfs_aops;
                 } else {
-                        inode->i_op = &jfs_symlink_inode_operations;
+                        inode->i_op = &jfs_fast_symlink_inode_operations;
                         /*
                          * The inline data should be null-terminated, but
                          * don't let on-disk corruption crash the kernel
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 6c4dfcbf3f55..9e2f6a721668 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -196,7 +196,7 @@ int dbMount(struct inode *ipbmap)
         bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
         bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
         bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);
-        bmp->db_agheigth = le32_to_cpu(dbmp_le->dn_agheigth);
+        bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);
         bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
         bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
         bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
@@ -288,7 +288,7 @@ int dbSync(struct inode *ipbmap)
         dbmp_le->dn_maxag = cpu_to_le32(bmp->db_maxag);
         dbmp_le->dn_agpref = cpu_to_le32(bmp->db_agpref);
         dbmp_le->dn_aglevel = cpu_to_le32(bmp->db_aglevel);
-        dbmp_le->dn_agheigth = cpu_to_le32(bmp->db_agheigth);
+        dbmp_le->dn_agheight = cpu_to_le32(bmp->db_agheight);
         dbmp_le->dn_agwidth = cpu_to_le32(bmp->db_agwidth);
         dbmp_le->dn_agstart = cpu_to_le32(bmp->db_agstart);
         dbmp_le->dn_agl2size = cpu_to_le32(bmp->db_agl2size);
@@ -1441,7 +1441,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
          * tree index of this allocation group within the control page.
          */
         agperlev =
-            (1 << (L2LPERCTL - (bmp->db_agheigth << 1))) / bmp->db_agwidth;
+            (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
         ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
 
         /* dmap control page trees fan-out by 4 and a single allocation
@@ -1460,7 +1460,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
                  * the subtree to find the leftmost leaf that describes this
                  * free space.
                  */
-                for (k = bmp->db_agheigth; k > 0; k--) {
+                for (k = bmp->db_agheight; k > 0; k--) {
                         for (n = 0, m = (ti << 2) + 1; n < 4; n++) {
                                 if (l2nb <= dcp->stree[m + n]) {
                                         ti = m + n;
@@ -3607,7 +3607,7 @@ void dbFinalizeBmap(struct inode *ipbmap)
         }
 
         /*
-         * compute db_aglevel, db_agheigth, db_width, db_agstart:
+         * compute db_aglevel, db_agheight, db_width, db_agstart:
          * an ag is covered in aglevel dmapctl summary tree,
          * at agheight level height (from leaf) with agwidth number of nodes
          * each, which starts at agstart index node of the smmary tree node
@@ -3616,9 +3616,9 @@ void dbFinalizeBmap(struct inode *ipbmap)
         bmp->db_aglevel = BMAPSZTOLEV(bmp->db_agsize);
         l2nl =
             bmp->db_agl2size - (L2BPERDMAP + bmp->db_aglevel * L2LPERCTL);
-        bmp->db_agheigth = l2nl >> 1;
-        bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheigth << 1));
-        for (i = 5 - bmp->db_agheigth, bmp->db_agstart = 0, n = 1; i > 0;
+        bmp->db_agheight = l2nl >> 1;
+        bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheight << 1));
+        for (i = 5 - bmp->db_agheight, bmp->db_agstart = 0, n = 1; i > 0;
              i--) {
                 bmp->db_agstart += n;
                 n <<= 2;
diff --git a/fs/jfs/jfs_dmap.h b/fs/jfs/jfs_dmap.h
index 1a6eb41569bc..6dcb906c55d8 100644
--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -210,7 +210,7 @@ struct dbmap_disk {
         __le32 dn_maxag;        /* 4: max active alloc group number     */
         __le32 dn_agpref;       /* 4: preferred alloc group (hint)      */
         __le32 dn_aglevel;      /* 4: dmapctl level holding the AG      */
-        __le32 dn_agheigth;     /* 4: height in dmapctl of the AG       */
+        __le32 dn_agheight;     /* 4: height in dmapctl of the AG       */
         __le32 dn_agwidth;      /* 4: width in dmapctl of the AG        */
         __le32 dn_agstart;      /* 4: start tree index at AG height     */
         __le32 dn_agl2size;     /* 4: l2 num of blks per alloc group    */
@@ -229,7 +229,7 @@ struct dbmap {
         int dn_maxag;           /* max active alloc group number        */
         int dn_agpref;          /* preferred alloc group (hint)         */
         int dn_aglevel;         /* dmapctl level holding the AG         */
-        int dn_agheigth;        /* height in dmapctl of the AG          */
+        int dn_agheight;        /* height in dmapctl of the AG          */
         int dn_agwidth;         /* width in dmapctl of the AG           */
         int dn_agstart;         /* start tree index at AG height        */
         int dn_agl2size;        /* l2 num of blks per alloc group       */
@@ -255,7 +255,7 @@ struct bmap {
 #define db_agsize       db_bmap.dn_agsize
 #define db_agl2size     db_bmap.dn_agl2size
 #define db_agwidth      db_bmap.dn_agwidth
-#define db_agheigth     db_bmap.dn_agheigth
+#define db_agheight     db_bmap.dn_agheight
 #define db_agstart      db_bmap.dn_agstart
 #define db_numag        db_bmap.dn_numag
 #define db_maxlevel     db_bmap.dn_maxlevel
diff --git a/fs/jfs/jfs_inode.h b/fs/jfs/jfs_inode.h
index 79e2c79661df..9e6bda30a6e8 100644
--- a/fs/jfs/jfs_inode.h
+++ b/fs/jfs/jfs_inode.h
@@ -48,5 +48,6 @@ extern const struct file_operations jfs_dir_operations;
 extern const struct inode_operations jfs_file_inode_operations;
 extern const struct file_operations jfs_file_operations;
 extern const struct inode_operations jfs_symlink_inode_operations;
+extern const struct inode_operations jfs_fast_symlink_inode_operations;
 extern const struct dentry_operations jfs_ci_dentry_operations;
 #endif                          /* _H_JFS_INODE */
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 4a3e9f39c21d..a9cf8e8675be 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -956,7 +956,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
          */
 
         if (ssize <= IDATASIZE) {
-                ip->i_op = &jfs_symlink_inode_operations;
+                ip->i_op = &jfs_fast_symlink_inode_operations;
 
                 i_fastsymlink = JFS_IP(ip)->i_inline;
                 memcpy(i_fastsymlink, name, ssize);
@@ -978,7 +978,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
         else {
                 jfs_info("jfs_symlink: allocate extent ip:0x%p", ip);
 
-                ip->i_op = &page_symlink_inode_operations;
+                ip->i_op = &jfs_symlink_inode_operations;
                 ip->i_mapping->a_ops = &jfs_aops;
 
                 /*
diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
index 7f24a0bb08ca..1aba0039f1c9 100644
--- a/fs/jfs/resize.c
+++ b/fs/jfs/resize.c
@@ -81,6 +81,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
         struct inode *iplist[1];
         struct jfs_superblock *j_sb, *j_sb2;
         uint old_agsize;
+        int agsizechanged = 0;
         struct buffer_head *bh, *bh2;
 
         /* If the volume hasn't grown, get out now */
@@ -333,6 +334,9 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
          */
         if ((rc = dbExtendFS(ipbmap, XAddress, nblocks)))
                 goto error_out;
+
+        agsizechanged |= (bmp->db_agsize != old_agsize);
+
         /*
          * the map now has extended to cover additional nblocks:
          * dn_mapsize = oldMapsize + nblocks;
@@ -432,7 +436,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
          * will correctly identify the new ag);
          */
         /* if new AG size the same as old AG size, done! */
-        if (bmp->db_agsize != old_agsize) {
+        if (agsizechanged) {
                 if ((rc = diExtendFS(ipimap, ipbmap)))
                         goto error_out;
 
diff --git a/fs/jfs/symlink.c b/fs/jfs/symlink.c
index 4af1a05aad0a..205b946d8e0d 100644
--- a/fs/jfs/symlink.c
+++ b/fs/jfs/symlink.c
@@ -29,9 +29,21 @@ static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         return NULL;
 }
 
-const struct inode_operations jfs_symlink_inode_operations = {
+const struct inode_operations jfs_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = jfs_follow_link,
+        .setattr        = jfs_setattr,
+        .setxattr       = jfs_setxattr,
+        .getxattr       = jfs_getxattr,
+        .listxattr      = jfs_listxattr,
+        .removexattr    = jfs_removexattr,
+};
+
+const struct inode_operations jfs_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+        .put_link       = page_put_link,
+        .setattr        = jfs_setattr,
         .setxattr       = jfs_setxattr,
         .getxattr       = jfs_getxattr,
         .listxattr      = jfs_listxattr,
diff --git a/fs/logfs/gc.c b/fs/logfs/gc.c
index 84e36f52fe95..76c242fbe1b0 100644
--- a/fs/logfs/gc.c
+++ b/fs/logfs/gc.c
@@ -459,6 +459,14 @@ static void __logfs_gc_pass(struct super_block *sb, int target)
         struct logfs_block *block;
         int round, progress, last_progress = 0;
 
+        /*
+         * Doing too many changes to the segfile at once would result
+         * in a large number of aliases.  Write the journal before
+         * things get out of hand.
+         */
+        if (super->s_shadow_tree.no_shadowed_segments >= MAX_OBJ_ALIASES)
+                logfs_write_anchor(sb);
+
         if (no_free_segments(sb) >= target &&
                         super->s_no_object_aliases < MAX_OBJ_ALIASES)
                 return;
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
index 33bd260b8309..fb0a613f885b 100644
--- a/fs/logfs/journal.c
+++ b/fs/logfs/journal.c
@@ -389,7 +389,10 @@ static void journal_get_erase_count(struct logfs_area *area)
 static int journal_erase_segment(struct logfs_area *area)
 {
         struct super_block *sb = area->a_sb;
-        struct logfs_segment_header sh;
+        union {
+                struct logfs_segment_header sh;
+                unsigned char c[ALIGN(sizeof(struct logfs_segment_header), 16)];
+        } u;
         u64 ofs;
         int err;
 
@@ -397,20 +400,21 @@ static int journal_erase_segment(struct logfs_area *area)
         if (err)
                 return err;
 
-        sh.pad = 0;
-        sh.type = SEG_JOURNAL;
-        sh.level = 0;
-        sh.segno = cpu_to_be32(area->a_segno);
-        sh.ec = cpu_to_be32(area->a_erase_count);
-        sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
-        sh.crc = logfs_crc32(&sh, sizeof(sh), 4);
+        memset(&u, 0, sizeof(u));
+        u.sh.pad = 0;
+        u.sh.type = SEG_JOURNAL;
+        u.sh.level = 0;
+        u.sh.segno = cpu_to_be32(area->a_segno);
+        u.sh.ec = cpu_to_be32(area->a_erase_count);
+        u.sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
+        u.sh.crc = logfs_crc32(&u.sh, sizeof(u.sh), 4);
 
         /* This causes a bug in segment.c.  Not yet. */
         //logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count, 0);
 
         ofs = dev_ofs(sb, area->a_segno, 0);
-        area->a_used_bytes = ALIGN(sizeof(sh), 16);
-        logfs_buf_write(area, ofs, &sh, sizeof(sh));
+        area->a_used_bytes = sizeof(u);
+        logfs_buf_write(area, ofs, &u, sizeof(u));
         return 0;
 }
 
@@ -494,6 +498,8 @@ static void account_shadows(struct super_block *sb)
 
         btree_grim_visitor64(&tree->new, (unsigned long)sb, account_shadow);
         btree_grim_visitor64(&tree->old, (unsigned long)sb, account_shadow);
+        btree_grim_visitor32(&tree->segment_map, 0, NULL);
+        tree->no_shadowed_segments = 0;
 
         if (li->li_block) {
                 /*
@@ -607,9 +613,9 @@ static size_t __logfs_write_je(struct super_block *sb, void *buf, u16 type,
         if (len == 0)
                 return logfs_write_header(super, header, 0, type);
 
+        BUG_ON(len > sb->s_blocksize);
         compr_len = logfs_compress(buf, data, len, sb->s_blocksize);
         if (compr_len < 0 || type == JE_ANCHOR) {
-                BUG_ON(len > sb->s_blocksize);
                 memcpy(data, buf, len);
                 compr_len = len;
                 compr = COMPR_NONE;
@@ -661,6 +667,7 @@ static int logfs_write_je_buf(struct super_block *sb, void *buf, u16 type,
         if (ofs < 0)
                 return ofs;
         logfs_buf_write(area, ofs, super->s_compressed_je, len);
+        BUG_ON(super->s_no_je >= MAX_JOURNAL_ENTRIES);
         super->s_je_array[super->s_no_je++] = cpu_to_be64(ofs);
         return 0;
 }
diff --git a/fs/logfs/logfs.h b/fs/logfs/logfs.h
index b84b0eec6024..0a3df1a0c936 100644
--- a/fs/logfs/logfs.h
+++ b/fs/logfs/logfs.h
@@ -257,10 +257,14 @@ struct logfs_shadow {
  * struct shadow_tree
  * @new:                        shadows where old_ofs==0, indexed by new_ofs
  * @old:                        shadows where old_ofs!=0, indexed by old_ofs
+ * @segment_map:                bitfield of segments containing shadows
+ * @no_shadowed_segment:        number of segments containing shadows
  */
 struct shadow_tree {
         struct btree_head64 new;
         struct btree_head64 old;
+        struct btree_head32 segment_map;
+        int no_shadowed_segments;
 };
 
 struct object_alias_item {
@@ -305,13 +309,14 @@ typedef int write_alias_t(struct super_block *sb, u64 ino, u64 bix,
                 level_t level, int child_no, __be64 val);
 struct logfs_block_ops {
         void    (*write_block)(struct logfs_block *block);
-        gc_level_t      (*block_level)(struct logfs_block *block);
         void    (*free_block)(struct super_block *sb, struct logfs_block*block);
         int     (*write_alias)(struct super_block *sb,
                         struct logfs_block *block,
                         write_alias_t *write_one_alias);
 };
 
+#define MAX_JOURNAL_ENTRIES 256
+
 struct logfs_super {
         struct mtd_info *s_mtd;                 /* underlying device */
         struct block_device *s_bdev;            /* underlying device */
@@ -378,7 +383,7 @@ struct logfs_super {
         u32      s_journal_ec[LOGFS_JOURNAL_SEGS]; /* journal erasecounts */
         u64      s_last_version;
         struct logfs_area *s_journal_area;      /* open journal segment */
-        __be64  s_je_array[64];
+        __be64  s_je_array[MAX_JOURNAL_ENTRIES];
         int     s_no_je;
 
         int      s_sum_index;                   /* for the 12 summaries */
@@ -722,4 +727,10 @@ static inline struct logfs_area *get_area(struct super_block *sb,
         return logfs_super(sb)->s_area[(__force u8)gc_level];
 }
 
+static inline void logfs_mempool_destroy(mempool_t *pool)
+{
+        if (pool)
+                mempool_destroy(pool);
+}
+
 #endif
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index bff40253dfb2..3159db6958e5 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -430,25 +430,6 @@ static void inode_write_block(struct logfs_block *block)
         }
 }
 
-static gc_level_t inode_block_level(struct logfs_block *block)
-{
-        BUG_ON(block->inode->i_ino == LOGFS_INO_MASTER);
-        return GC_LEVEL(LOGFS_MAX_LEVELS);
-}
-
-static gc_level_t indirect_block_level(struct logfs_block *block)
-{
-        struct page *page;
-        struct inode *inode;
-        u64 bix;
-        level_t level;
-
-        page = block->page;
-        inode = page->mapping->host;
-        logfs_unpack_index(page->index, &bix, &level);
-        return expand_level(inode->i_ino, level);
-}
-
 /*
  * This silences a false, yet annoying gcc warning.  I hate it when my editor
  * jumps into bitops.h each time I recompile this file.
@@ -587,14 +568,12 @@ static void indirect_free_block(struct super_block *sb,
 
 static struct logfs_block_ops inode_block_ops = {
         .write_block = inode_write_block,
-        .block_level = inode_block_level,
         .free_block = inode_free_block,
         .write_alias = inode_write_alias,
 };
 
 struct logfs_block_ops indirect_block_ops = {
         .write_block = indirect_write_block,
-        .block_level = indirect_block_level,
         .free_block = indirect_free_block,
         .write_alias = indirect_write_alias,
 };
@@ -1241,6 +1220,18 @@ static void free_shadow(struct inode *inode, struct logfs_shadow *shadow)
         mempool_free(shadow, super->s_shadow_pool);
 }
 
+static void mark_segment(struct shadow_tree *tree, u32 segno)
+{
+        int err;
+
+        if (!btree_lookup32(&tree->segment_map, segno)) {
+                err = btree_insert32(&tree->segment_map, segno, (void *)1,
+                                GFP_NOFS);
+                BUG_ON(err);
+                tree->no_shadowed_segments++;
+        }
+}
+
 /**
  * fill_shadow_tree - Propagate shadow tree changes due to a write
  * @inode:      Inode owning the page
@@ -1288,6 +1279,8 @@ static void fill_shadow_tree(struct inode *inode, struct page *page,
 
                 super->s_dirty_used_bytes += shadow->new_len;
                 super->s_dirty_free_bytes += shadow->old_len;
+                mark_segment(tree, shadow->old_ofs >> super->s_segshift);
+                mark_segment(tree, shadow->new_ofs >> super->s_segshift);
         }
 }
 
@@ -1845,19 +1838,37 @@ static int __logfs_truncate(struct inode *inode, u64 size)
         return logfs_truncate_direct(inode, size);
 }
 
-int logfs_truncate(struct inode *inode, u64 size)
+/*
+ * Truncate, by changing the segment file, can consume a fair amount
+ * of resources.  So back off from time to time and do some GC.
+ * 8 or 2048 blocks should be well within safety limits even if
+ * every single block resided in a different segment.
+ */
+#define TRUNCATE_STEP   (8 * 1024 * 1024)
+int logfs_truncate(struct inode *inode, u64 target)
 {
         struct super_block *sb = inode->i_sb;
-        int err;
+        u64 size = i_size_read(inode);
+        int err = 0;
 
-        logfs_get_wblocks(sb, NULL, 1);
-        err = __logfs_truncate(inode, size);
-        if (!err)
-                err = __logfs_write_inode(inode, 0);
-        logfs_put_wblocks(sb, NULL, 1);
+        size = ALIGN(size, TRUNCATE_STEP);
+        while (size > target) {
+                if (size > TRUNCATE_STEP)
+                        size -= TRUNCATE_STEP;
+                else
+                        size = 0;
+                if (size < target)
+                        size = target;
+
+                logfs_get_wblocks(sb, NULL, 1);
+                err = __logfs_truncate(inode, target);
+                if (!err)
+                        err = __logfs_write_inode(inode, 0);
+                logfs_put_wblocks(sb, NULL, 1);
+        }
 
         if (!err)
-                err = vmtruncate(inode, size);
+                err = vmtruncate(inode, target);
 
         /* I don't trust error recovery yet. */
         WARN_ON(err);
@@ -2251,8 +2262,6 @@ void logfs_cleanup_rw(struct super_block *sb)
         struct logfs_super *super = logfs_super(sb);
 
         destroy_meta_inode(super->s_segfile_inode);
-        if (super->s_block_pool)
-                mempool_destroy(super->s_block_pool);
-        if (super->s_shadow_pool)
-                mempool_destroy(super->s_shadow_pool);
+        logfs_mempool_destroy(super->s_block_pool);
+        logfs_mempool_destroy(super->s_shadow_pool);
 }
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
index 801a3a141625..f77ce2b470ba 100644
--- a/fs/logfs/segment.c
+++ b/fs/logfs/segment.c
@@ -183,14 +183,8 @@ static int btree_write_alias(struct super_block *sb, struct logfs_block *block,
         return 0;
 }
 
-static gc_level_t btree_block_level(struct logfs_block *block)
-{
-        return expand_level(block->ino, block->level);
-}
-
 static struct logfs_block_ops btree_block_ops = {
         .write_block    = btree_write_block,
-        .block_level    = btree_block_level,
         .free_block     = __free_block,
         .write_alias    = btree_write_alias,
 };
@@ -919,7 +913,7 @@ err:
         for (i--; i >= 0; i--)
                 free_area(super->s_area[i]);
         free_area(super->s_journal_area);
-        mempool_destroy(super->s_alias_pool);
+        logfs_mempool_destroy(super->s_alias_pool);
         return -ENOMEM;
 }
 
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index b60bfac3263c..5866ee6e1327 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -12,6 +12,7 @@
 #include "logfs.h"
 #include <linux/bio.h>
 #include <linux/slab.h>
+#include <linux/blkdev.h>
 #include <linux/mtd/mtd.h>
 #include <linux/statfs.h>
 #include <linux/buffer_head.h>
@@ -137,6 +138,10 @@ static int logfs_sb_set(struct super_block *sb, void *_super)
         sb->s_fs_info = super;
         sb->s_mtd = super->s_mtd;
         sb->s_bdev = super->s_bdev;
+        if (sb->s_bdev)
+                sb->s_bdi = &bdev_get_queue(sb->s_bdev)->backing_dev_info;
+        if (sb->s_mtd)
+                sb->s_bdi = sb->s_mtd->backing_dev_info;
         return 0;
 }
 
@@ -452,6 +457,8 @@ static int logfs_read_sb(struct super_block *sb, int read_only)
 
         btree_init_mempool64(&super->s_shadow_tree.new, super->s_btree_pool);
         btree_init_mempool64(&super->s_shadow_tree.old, super->s_btree_pool);
+        btree_init_mempool32(&super->s_shadow_tree.segment_map,
+                        super->s_btree_pool);
 
         ret = logfs_init_mapping(sb);
         if (ret)
@@ -516,8 +523,8 @@ static void logfs_kill_sb(struct super_block *sb)
         if (super->s_erase_page)
                 __free_page(super->s_erase_page);
         super->s_devops->put_device(sb);
-        mempool_destroy(super->s_btree_pool);
-        mempool_destroy(super->s_alias_pool);
+        logfs_mempool_destroy(super->s_btree_pool);
+        logfs_mempool_destroy(super->s_alias_pool);
         kfree(super);
         log_super("LogFS: Finished unmounting\n");
 }
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index a3fd0f91d943..169d07758ee5 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -54,7 +54,7 @@ extern struct kmem_cache *kvm_vcpu_cache;
  */
 struct kvm_io_bus {
         int                   dev_count;
-#define NR_IOBUS_DEVS 6
+#define NR_IOBUS_DEVS 200
         struct kvm_io_device *devs[NR_IOBUS_DEVS];
 };
 
@@ -119,6 +119,11 @@ struct kvm_memory_slot {
         int user_alloc;
 };
 
+static inline unsigned long kvm_dirty_bitmap_bytes(struct kvm_memory_slot *memslot)
+{
+        return ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+}
+
 struct kvm_kernel_irq_routing_entry {
         u32 gsi;
         u32 type;
diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
index 28c9fd020d39..ebd747265294 100644
--- a/include/linux/regulator/consumer.h
+++ b/include/linux/regulator/consumer.h
@@ -183,9 +183,13 @@ static inline struct regulator *__must_check regulator_get(struct device *dev,
 {
         /* Nothing except the stubbed out regulator API should be
          * looking at the value except to check if it is an error
-         * value so the actual return value doesn't matter.
+         * value. Drivers are free to handle NULL specifically by
+         * skipping all regulator API calls, but they don't have to.
+         * Drivers which don't, should make sure they properly handle
+         * corner cases of the API, such as regulator_get_voltage()
+         * returning 0.
          */
-        return (struct regulator *)id;
+        return NULL;
 }
 static inline void regulator_put(struct regulator *regulator)
 {
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 5a0cd194dce0..c82ae2492634 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -341,7 +341,11 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
                                      struct mm_struct *mm)
 {
         struct kvm *kvm = mmu_notifier_to_kvm(mn);
+        int idx;
+
+        idx = srcu_read_lock(&kvm->srcu);
         kvm_arch_flush_shadow(kvm);
+        srcu_read_unlock(&kvm->srcu, idx);
 }
 
 static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
@@ -648,7 +652,7 @@ skip_lpage:
 
         /* Allocate page dirty bitmap if needed */
         if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
-                unsigned dirty_bytes = ALIGN(npages, BITS_PER_LONG) / 8;
+                unsigned long dirty_bytes = kvm_dirty_bitmap_bytes(&new);
 
                 new.dirty_bitmap = vmalloc(dirty_bytes);
                 if (!new.dirty_bitmap)
@@ -768,7 +772,7 @@ int kvm_get_dirty_log(struct kvm *kvm,
 {
         struct kvm_memory_slot *memslot;
         int r, i;
-        int n;
+        unsigned long n;
         unsigned long any = 0;
 
         r = -EINVAL;
@@ -780,7 +784,7 @@ int kvm_get_dirty_log(struct kvm *kvm,
         if (!memslot->dirty_bitmap)
                 goto out;
 
-        n = ALIGN(memslot->npages, BITS_PER_LONG) / 8;
+        n = kvm_dirty_bitmap_bytes(memslot);
 
         for (i = 0; !any && i < n/sizeof(long); ++i)
                 any = memslot->dirty_bitmap[i];
@@ -1186,10 +1190,13 @@ void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
         memslot = gfn_to_memslot_unaliased(kvm, gfn);
         if (memslot && memslot->dirty_bitmap) {
                 unsigned long rel_gfn = gfn - memslot->base_gfn;
+                unsigned long *p = memslot->dirty_bitmap +
+                                        rel_gfn / BITS_PER_LONG;
+                int offset = rel_gfn % BITS_PER_LONG;
 
                 /* avoid RMW */
-                if (!generic_test_le_bit(rel_gfn, memslot->dirty_bitmap))
-                        generic___set_le_bit(rel_gfn, memslot->dirty_bitmap);
+                if (!generic_test_le_bit(offset, p))
+                        generic___set_le_bit(offset, p);
         }
 }