25 files changed, 398 insertions, 241 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 9e06b7f5ecf1..69a32664c289 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -353,7 +353,7 @@ config SLUB_DEBUG_ON
 config SLUB_STATS
         default n
         bool "Enable SLUB performance statistics"
-        depends on SLUB && SLUB_DEBUG && SYSFS
+        depends on SLUB && SYSFS
         help
           SLUB statistics are useful to debug SLUBs allocation behavior in
           order find ways to optimize the allocator. This should never be
@@ -461,6 +461,15 @@ config DEBUG_MUTEXES
          This feature allows mutex semantics violations to be detected and
          reported.
 
+config BKL
+        bool "Big Kernel Lock" if (SMP || PREEMPT)
+        default y
+        help
+          This is the traditional lock that is used in old code instead
+          of proper locking. All drivers that use the BKL should depend
+          on this symbol.
+          Say Y here unless you are working on removing the BKL.
+
 config DEBUG_LOCK_ALLOC
         bool "Lock debugging: detect incorrect freeing of live locks"
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
@@ -482,6 +491,7 @@ config PROVE_LOCKING
         select DEBUG_SPINLOCK
         select DEBUG_MUTEXES
         select DEBUG_LOCK_ALLOC
+        select TRACE_IRQFLAGS
         default n
         help
          This feature enables the kernel to prove that all locking
@@ -539,6 +549,23 @@ config PROVE_RCU_REPEATEDLY
          disabling, allowing multiple RCU-lockdep warnings to be printed
          on a single reboot.
 
+         Say Y to allow multiple RCU-lockdep warnings per boot.
+
+         Say N if you are unsure.
+
+config SPARSE_RCU_POINTER
+        bool "RCU debugging: sparse-based checks for pointer usage"
+        default n
+        help
+         This feature enables the __rcu sparse annotation for
+         RCU-protected pointers.  This annotation will cause sparse
+         to flag any non-RCU used of annotated pointers.  This can be
+         helpful when debugging RCU usage.  Please note that this feature
+         is not intended to enforce code cleanliness; it is instead merely
+         a debugging aid.
+
+         Say Y to make sparse flag questionable use of RCU-protected pointers
+
          Say N if you are unsure.
 
 config LOCKDEP
@@ -579,11 +606,10 @@ config DEBUG_LOCKDEP
           of more runtime overhead.
 
 config TRACE_IRQFLAGS
-        depends on DEBUG_KERNEL
         bool
-        default y
-        depends on TRACE_IRQFLAGS_SUPPORT
-        depends on PROVE_LOCKING
+        help
+          Enables hooks to interrupt enabling and disabling for
+          either tracing or lock debugging.
 
 config DEBUG_SPINLOCK_SLEEP
         bool "Spinlock debugging: sleep-inside-spinlock checking"
@@ -832,6 +858,30 @@ config RCU_CPU_STALL_DETECTOR
 
           Say Y if you are unsure.
 
+config RCU_CPU_STALL_TIMEOUT
+        int "RCU CPU stall timeout in seconds"
+        depends on RCU_CPU_STALL_DETECTOR
+        range 3 300
+        default 60
+        help
+          If a given RCU grace period extends more than the specified
+          number of seconds, a CPU stall warning is printed.  If the
+          RCU grace period persists, additional CPU stall warnings are
+          printed at more widely spaced intervals.
+
+config RCU_CPU_STALL_DETECTOR_RUNNABLE
+        bool "RCU CPU stall checking starts automatically at boot"
+        depends on RCU_CPU_STALL_DETECTOR
+        default y
+        help
+          If set, start checking for RCU CPU stalls immediately on
+          boot.  Otherwise, RCU CPU stall checking must be manually
+          enabled.
+
+          Say Y if you are unsure.
+
+          Say N if you wish to suppress RCU CPU stall checking during boot.
+
 config RCU_CPU_STALL_VERBOSE
         bool "Print additional per-task information for RCU_CPU_STALL_DETECTOR"
         depends on RCU_CPU_STALL_DETECTOR && TREE_PREEMPT_RCU
@@ -994,13 +1044,16 @@ config FAULT_INJECTION_STACKTRACE_FILTER
 
 config LATENCYTOP
         bool "Latency measuring infrastructure"
+        depends on HAVE_LATENCYTOP_SUPPORT
+        depends on DEBUG_KERNEL
+        depends on STACKTRACE_SUPPORT
+        depends on PROC_FS
         select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
         select KALLSYMS
         select KALLSYMS_ALL
         select STACKTRACE
         select SCHEDSTATS
         select SCHED_DEBUG
-        depends on HAVE_LATENCYTOP_SUPPORT
         help
           Enable this option if you want to use the LatencyTOP tool
           to find out which userspace is blocking on what kernel operations.
diff --git a/lib/bug.c b/lib/bug.c
index f13daf435211..19552096d16b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -72,8 +72,8 @@ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
         return NULL;
 }
 
-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-                        struct module *mod)
+void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+                         struct module *mod)
 {
         char *secstrings;
         unsigned int i;
@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
          * could potentially lead to deadlock and thus be counter-productive.
          */
         list_add(&mod->bug_list, &module_bug_list);
-
-        return 0;
 }
 
 void module_bug_cleanup(struct module *mod)
@@ -136,8 +134,6 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
 
         bug = find_bug(bugaddr);
 
-        printk(KERN_EMERG "------------[ cut here ]------------\n");
-
         file = NULL;
         line = 0;
         warning = 0;
@@ -156,19 +152,25 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
 
         if (warning) {
                 /* this is a WARN_ON rather than BUG/BUG_ON */
+                printk(KERN_WARNING "------------[ cut here ]------------\n");
+
                 if (file)
-                        printk(KERN_ERR "Badness at %s:%u\n",
+                        printk(KERN_WARNING "WARNING: at %s:%u\n",
                                file, line);
                 else
-                        printk(KERN_ERR "Badness at %p "
+                        printk(KERN_WARNING "WARNING: at %p "
                                "[verbose debug info unavailable]\n",
                                (void *)bugaddr);
 
+                print_modules();
                 show_regs(regs);
+                print_oops_end_marker();
                 add_taint(BUG_GET_TAINT(bug));
                 return BUG_TRAP_TYPE_WARN;
         }
 
+        printk(KERN_EMERG "------------[ cut here ]------------\n");
+
         if (file)
                 printk(KERN_CRIT "kernel BUG at %s:%u!\n",
                        file, line);
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index a4e971dee102..81c8bb1cc6aa 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -107,6 +107,8 @@ struct bunzip_data {
         unsigned char selectors[32768];         /* nSelectors = 15 bits */
         struct group_data groups[MAX_GROUPS];   /* Huffman coding tables */
         int io_error;                   /* non-zero if we have IO error */
+        int byteCount[256];
+        unsigned char symToByte[256], mtfSymbol[256];
 };
 
 
@@ -158,14 +160,16 @@ static int INIT get_next_block(struct bunzip_data *bd)
         int *base = NULL;
         int *limit = NULL;
         int dbufCount, nextSym, dbufSize, groupCount, selector,
-                i, j, k, t, runPos, symCount, symTotal, nSelectors,
-                byteCount[256];
-        unsigned char uc, symToByte[256], mtfSymbol[256], *selectors;
+                i, j, k, t, runPos, symCount, symTotal, nSelectors, *byteCount;
+        unsigned char uc, *symToByte, *mtfSymbol, *selectors;
         unsigned int *dbuf, origPtr;
 
         dbuf = bd->dbuf;
         dbufSize = bd->dbufSize;
         selectors = bd->selectors;
+        byteCount = bd->byteCount;
+        symToByte = bd->symToByte;
+        mtfSymbol = bd->mtfSymbol;
 
         /* Read in header signature and CRC, then validate signature.
            (last block signature means CRC is for whole file, return now) */
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 01e64270e246..4bfb0471f106 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -590,6 +590,7 @@ out_unlock:
 static const struct file_operations filter_fops = {
         .read  = filter_read,
         .write = filter_write,
+        .llseek = default_llseek,
 };
 
 static int dma_debug_fs_init(void)
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 02afc2533728..3094318bfea7 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -26,19 +26,11 @@
 #include <linux/dynamic_debug.h>
 #include <linux/debugfs.h>
 #include <linux/slab.h>
+#include <linux/jump_label.h>
 
 extern struct _ddebug __start___verbose[];
 extern struct _ddebug __stop___verbose[];
 
-/* dynamic_debug_enabled, and dynamic_debug_enabled2 are bitmasks in which
- * bit n is set to 1 if any modname hashes into the bucket n, 0 otherwise. They
- * use independent hash functions, to reduce the chance of false positives.
- */
-long long dynamic_debug_enabled;
-EXPORT_SYMBOL_GPL(dynamic_debug_enabled);
-long long dynamic_debug_enabled2;
-EXPORT_SYMBOL_GPL(dynamic_debug_enabled2);
-
 struct ddebug_table {
         struct list_head link;
         char *mod_name;
@@ -88,26 +80,6 @@ static char *ddebug_describe_flags(struct _ddebug *dp, char *buf,
 }
 
 /*
- * must be called with ddebug_lock held
- */
-
-static int disabled_hash(char hash, bool first_table)
-{
-        struct ddebug_table *dt;
-        char table_hash_value;
-
-        list_for_each_entry(dt, &ddebug_tables, link) {
-                if (first_table)
-                        table_hash_value = dt->ddebugs->primary_hash;
-                else
-                        table_hash_value = dt->ddebugs->secondary_hash;
-                if (dt->num_enabled && (hash == table_hash_value))
-                        return 0;
-        }
-        return 1;
-}
-
-/*
  * Search the tables for _ddebug's which match the given
  * `query' and apply the `flags' and `mask' to them.  Tells
  * the user which ddebug's were changed, or whether none
@@ -170,17 +142,9 @@ static void ddebug_change(const struct ddebug_query *query,
                                 dt->num_enabled++;
                         dp->flags = newflags;
                         if (newflags) {
-                                dynamic_debug_enabled |=
-                                                (1LL << dp->primary_hash);
-                                dynamic_debug_enabled2 |=
-                                                (1LL << dp->secondary_hash);
+                                jump_label_enable(&dp->enabled);
                         } else {
-                                if (disabled_hash(dp->primary_hash, true))
-                                        dynamic_debug_enabled &=
-                                                ~(1LL << dp->primary_hash);
-                                if (disabled_hash(dp->secondary_hash, false))
-                                        dynamic_debug_enabled2 &=
-                                                ~(1LL << dp->secondary_hash);
+                                jump_label_disable(&dp->enabled);
                         }
                         if (verbose)
                                 printk(KERN_INFO
@@ -429,6 +393,40 @@ static int ddebug_parse_flags(const char *str, unsigned int *flagsp,
         return 0;
 }
 
+static int ddebug_exec_query(char *query_string)
+{
+        unsigned int flags = 0, mask = 0;
+        struct ddebug_query query;
+#define MAXWORDS 9
+        int nwords;
+        char *words[MAXWORDS];
+
+        nwords = ddebug_tokenize(query_string, words, MAXWORDS);
+        if (nwords <= 0)
+                return -EINVAL;
+        if (ddebug_parse_query(words, nwords-1, &query))
+                return -EINVAL;
+        if (ddebug_parse_flags(words[nwords-1], &flags, &mask))
+                return -EINVAL;
+
+        /* actually go and implement the change */
+        ddebug_change(&query, flags, mask);
+        return 0;
+}
+
+static __initdata char ddebug_setup_string[1024];
+static __init int ddebug_setup_query(char *str)
+{
+        if (strlen(str) >= 1024) {
+                pr_warning("ddebug boot param string too large\n");
+                return 0;
+        }
+        strcpy(ddebug_setup_string, str);
+        return 1;
+}
+
+__setup("ddebug_query=", ddebug_setup_query);
+
 /*
  * File_ops->write method for <debugfs>/dynamic_debug/conrol.  Gathers the
  * command text from userspace, parses and executes it.
@@ -436,12 +434,8 @@ static int ddebug_parse_flags(const char *str, unsigned int *flagsp,
 static ssize_t ddebug_proc_write(struct file *file, const char __user *ubuf,
                                   size_t len, loff_t *offp)
 {
-        unsigned int flags = 0, mask = 0;
-        struct ddebug_query query;
-#define MAXWORDS 9
-        int nwords;
-        char *words[MAXWORDS];
         char tmpbuf[256];
+        int ret;
 
         if (len == 0)
                 return 0;
@@ -455,16 +449,9 @@ static ssize_t ddebug_proc_write(struct file *file, const char __user *ubuf,
                 printk(KERN_INFO "%s: read %d bytes from userspace\n",
                         __func__, (int)len);
 
-        nwords = ddebug_tokenize(tmpbuf, words, MAXWORDS);
-        if (nwords <= 0)
-                return -EINVAL;
-        if (ddebug_parse_query(words, nwords-1, &query))
-                return -EINVAL;
-        if (ddebug_parse_flags(words[nwords-1], &flags, &mask))
-                return -EINVAL;
-
-        /* actually go and implement the change */
-        ddebug_change(&query, flags, mask);
+        ret = ddebug_exec_query(tmpbuf);
+        if (ret)
+                return ret;
 
         *offp += len;
         return len;
@@ -725,13 +712,14 @@ static void ddebug_remove_all_tables(void)
         mutex_unlock(&ddebug_lock);
 }
 
-static int __init dynamic_debug_init(void)
+static __initdata int ddebug_init_success;
+
+static int __init dynamic_debug_init_debugfs(void)
 {
         struct dentry *dir, *file;
-        struct _ddebug *iter, *iter_start;
-        const char *modname = NULL;
-        int ret = 0;
-        int n = 0;
+
+        if (!ddebug_init_success)
+                return -ENODEV;
 
         dir = debugfs_create_dir("dynamic_debug", NULL);
         if (!dir)
@@ -742,6 +730,16 @@ static int __init dynamic_debug_init(void)
                 debugfs_remove(dir);
                 return -ENOMEM;
         }
+        return 0;
+}
+
+static int __init dynamic_debug_init(void)
+{
+        struct _ddebug *iter, *iter_start;
+        const char *modname = NULL;
+        int ret = 0;
+        int n = 0;
+
         if (__start___verbose != __stop___verbose) {
                 iter = __start___verbose;
                 modname = iter->modname;
@@ -759,12 +757,26 @@ static int __init dynamic_debug_init(void)
                 }
                 ret = ddebug_add_module(iter_start, n, modname);
         }
+
+        /* ddebug_query boot param got passed -> set it up */
+        if (ddebug_setup_string[0] != '\0') {
+                ret = ddebug_exec_query(ddebug_setup_string);
+                if (ret)
+                        pr_warning("Invalid ddebug boot param %s",
+                                   ddebug_setup_string);
+                else
+                        pr_info("ddebug initialized with string %s",
+                                ddebug_setup_string);
+        }
+
 out_free:
-        if (ret) {
+        if (ret)
                 ddebug_remove_all_tables();
-                debugfs_remove(dir);
-                debugfs_remove(file);
-        }
+        else
+                ddebug_init_success = 1;
         return 0;
 }
-module_init(dynamic_debug_init);
+/* Allow early initialization for boot messages via boot param */
+arch_initcall(dynamic_debug_init);
+/* Debugfs setup must be done later */
+module_init(dynamic_debug_init_debugfs);
diff --git a/lib/inflate.c b/lib/inflate.c
index 677b738c2204..013a76193481 100644
--- a/lib/inflate.c
+++ b/lib/inflate.c
@@ -103,7 +103,9 @@
       the two sets of lengths.
  */
 #include <linux/compiler.h>
+#ifdef NO_INFLATE_MALLOC
 #include <linux/slab.h>
+#endif
 
 #ifdef RCSID
 static char rcsid[] = "#Id: inflate.c,v 0.14 1993/06/10 13:27:04 jloup Exp #";
diff --git a/lib/kobject.c b/lib/kobject.c
index f07c57252e82..82dc34c095c2 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -746,17 +746,56 @@ void kset_unregister(struct kset *k)
  */
 struct kobject *kset_find_obj(struct kset *kset, const char *name)
 {
+        return kset_find_obj_hinted(kset, name, NULL);
+}
+
+/**
+ * kset_find_obj_hinted - search for object in kset given a predecessor hint.
+ * @kset: kset we're looking in.
+ * @name: object's name.
+ * @hint: hint to possible object's predecessor.
+ *
+ * Check the hint's next object and if it is a match return it directly,
+ * otherwise, fall back to the behavior of kset_find_obj().  Either way
+ * a reference for the returned object is held and the reference on the
+ * hinted object is released.
+ */
+struct kobject *kset_find_obj_hinted(struct kset *kset, const char *name,
+                                     struct kobject *hint)
+{
         struct kobject *k;
         struct kobject *ret = NULL;
 
         spin_lock(&kset->list_lock);
+
+        if (!hint)
+                goto slow_search;
+
+        /* end of list detection */
+        if (hint->entry.next == kset->list.next)
+                goto slow_search;
+
+        k = container_of(hint->entry.next, struct kobject, entry);
+        if (!kobject_name(k) || strcmp(kobject_name(k), name))
+                goto slow_search;
+
+        ret = kobject_get(k);
+        goto unlock_exit;
+
+slow_search:
         list_for_each_entry(k, &kset->list, entry) {
                 if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
                         ret = kobject_get(k);
                         break;
                 }
         }
+
+unlock_exit:
         spin_unlock(&kset->list_lock);
+
+        if (hint)
+                kobject_put(hint);
+
         return ret;
 }
 
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index b93579504dfa..70af0a7f97c0 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -123,7 +123,7 @@ static int kobj_usermode_filter(struct kobject *kobj)
  * @kobj: struct kobject that the action is happening to
  * @envp_ext: pointer to environmental data
  *
- * Returns 0 if kobject_uevent() is completed with success or the
+ * Returns 0 if kobject_uevent_env() is completed with success or the
  * corresponding error when it fails.
  */
 int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
@@ -317,7 +317,7 @@ exit:
 EXPORT_SYMBOL_GPL(kobject_uevent_env);
 
 /**
- * kobject_uevent - notify userspace by ending an uevent
+ * kobject_uevent - notify userspace by sending an uevent
  *
  * @action: action that is happening
  * @kobj: struct kobject that the action is happening to
diff --git a/lib/list_sort.c b/lib/list_sort.c
index 4b5cb794c38b..a7616fa3162e 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -70,7 +70,7 @@ static void merge_and_restore_back_links(void *priv,
                  * element comparison is needed, so the client's cmp()
                  * routine can invoke cond_resched() periodically.
                  */
-                (*cmp)(priv, tail, tail);
+                (*cmp)(priv, tail->next, tail->next);
 
                 tail->next->prev = tail;
                 tail = tail->next;
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index e907858498a6..6f412ab4c24f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -49,7 +49,7 @@ struct radix_tree_node {
         unsigned int    height;         /* Height from the bottom */
         unsigned int    count;
         struct rcu_head rcu_head;
-        void            *slots[RADIX_TREE_MAP_SIZE];
+        void __rcu      *slots[RADIX_TREE_MAP_SIZE];
         unsigned long   tags[RADIX_TREE_MAX_TAGS][RADIX_TREE_TAG_LONGS];
 };
 
@@ -174,14 +174,16 @@ static void radix_tree_node_rcu_free(struct rcu_head *head)
 {
         struct radix_tree_node *node =
                         container_of(head, struct radix_tree_node, rcu_head);
+        int i;
 
         /*
          * must only free zeroed nodes into the slab. radix_tree_shrink
          * can leave us with a non-NULL entry in the first slot, so clear
          * that here to make sure.
          */
-        tag_clear(node, 0, 0);
-        tag_clear(node, 1, 0);
+        for (i = 0; i < RADIX_TREE_MAX_TAGS; i++)
+                tag_clear(node, i, 0);
+
         node->slots[0] = NULL;
         node->count = 0;
 
@@ -623,17 +625,30 @@ EXPORT_SYMBOL(radix_tree_tag_get);
  * also settag. The function stops either after tagging nr_to_tag items or
  * after reaching last_index.
  *
+ * The tags must be set from the leaf level only and propagated back up the
+ * path to the root. We must do this so that we resolve the full path before
+ * setting any tags on intermediate nodes. If we set tags as we descend, then
+ * we can get to the leaf node and find that the index that has the iftag
+ * set is outside the range we are scanning. This reults in dangling tags and
+ * can lead to problems with later tag operations (e.g. livelocks on lookups).
+ *
  * The function returns number of leaves where the tag was set and sets
  * *first_indexp to the first unscanned index.
+ * WARNING! *first_indexp can wrap if last_index is ULONG_MAX. Caller must
+ * be prepared to handle that.
  */
 unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
                 unsigned long *first_indexp, unsigned long last_index,
                 unsigned long nr_to_tag,
                 unsigned int iftag, unsigned int settag)
 {
-        unsigned int height = root->height, shift;
-        unsigned long tagged = 0, index = *first_indexp;
-        struct radix_tree_node *open_slots[height], *slot;
+        unsigned int height = root->height;
+        struct radix_tree_path path[height];
+        struct radix_tree_path *pathp = path;
+        struct radix_tree_node *slot;
+        unsigned int shift;
+        unsigned long tagged = 0;
+        unsigned long index = *first_indexp;
 
         last_index = min(last_index, radix_tree_maxindex(height));
         if (index > last_index)
@@ -653,6 +668,13 @@ unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
         shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
         slot = radix_tree_indirect_to_ptr(root->rnode);
 
+        /*
+         * we fill the path from (root->height - 2) to 0, leaving the index at
+         * (root->height - 1) as a terminator. Zero the node in the terminator
+         * so that we can use this to end walk loops back up the path.
+         */
+        path[height - 1].node = NULL;
+
         for (;;) {
                 int offset;
 
@@ -661,21 +683,35 @@ unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
                         goto next;
                 if (!tag_get(slot, iftag, offset))
                         goto next;
+                if (height > 1) {
+                        /* Go down one level */
+                        height--;
+                        shift -= RADIX_TREE_MAP_SHIFT;
+                        path[height - 1].node = slot;
+                        path[height - 1].offset = offset;
+                        slot = slot->slots[offset];
+                        continue;
+                }
+
+                /* tag the leaf */
+                tagged++;
                 tag_set(slot, settag, offset);
-                if (height == 1) {
-                        tagged++;
-                        goto next;
+
+                /* walk back up the path tagging interior nodes */
+                pathp = &path[0];
+                while (pathp->node) {
+                        /* stop if we find a node with the tag already set */
+                        if (tag_get(pathp->node, settag, pathp->offset))
+                                break;
+                        tag_set(pathp->node, settag, pathp->offset);
+                        pathp++;
                 }
-                /* Go down one level */
-                height--;
-                shift -= RADIX_TREE_MAP_SHIFT;
-                open_slots[height] = slot;
-                slot = slot->slots[offset];
-                continue;
+
 next:
                 /* Go to next item at level determined by 'shift' */
                 index = ((index >> shift) + 1) << shift;
-                if (index > last_index)
+                /* Overflow can happen when last_index is ~0UL... */
+                if (index > last_index || !index)
                         break;
                 if (tagged >= nr_to_tag)
                         break;
@@ -685,7 +721,7 @@ next:
                          * last_index is guaranteed to be in the tree, what
                          * we do below cannot wander astray.
                          */
-                        slot = open_slots[height];
+                        slot = path[height - 1].node;
                         height++;
                         shift += RADIX_TREE_MAP_SHIFT;
                 }
diff --git a/lib/raid6/.gitignore b/lib/raid6/.gitignore
new file mode 100644
index 000000000000..162becacf97c
--- /dev/null
+++ b/lib/raid6/.gitignore
@@ -0,0 +1,4 @@
+mktables
+altivec*.c
+int*.c
+tables.c
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index 19bf32da644f..8a38102770f3 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -1,11 +1,8 @@
 obj-$(CONFIG_RAID6_PQ)  += raid6_pq.o
 
-raid6_pq-y      += raid6algos.o raid6recov.o raid6tables.o \
-                   raid6int1.o raid6int2.o raid6int4.o \
-                   raid6int8.o raid6int16.o raid6int32.o \
-                   raid6altivec1.o raid6altivec2.o raid6altivec4.o \
-                   raid6altivec8.o \
-                   raid6mmx.o raid6sse1.o raid6sse2.o
+raid6_pq-y      += algos.o recov.o tables.o int1.o int2.o int4.o \
+                   int8.o int16.o int32.o altivec1.o altivec2.o altivec4.o \
+                   altivec8.o mmx.o sse1.o sse2.o
 hostprogs-y     += mktables
 
 quiet_cmd_unroll = UNROLL  $@
@@ -16,63 +13,63 @@ ifeq ($(CONFIG_ALTIVEC),y)
 altivec_flags := -maltivec -mabi=altivec
 endif
 
-targets += raid6int1.c
-$(obj)/raid6int1.c:   UNROLL := 1
-$(obj)/raid6int1.c:   $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int1.c
+$(obj)/int1.c:   UNROLL := 1
+$(obj)/int1.c:   $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-targets += raid6int2.c
-$(obj)/raid6int2.c:   UNROLL := 2
-$(obj)/raid6int2.c:   $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int2.c
+$(obj)/int2.c:   UNROLL := 2
+$(obj)/int2.c:   $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-targets += raid6int4.c
-$(obj)/raid6int4.c:   UNROLL := 4
-$(obj)/raid6int4.c:   $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int4.c
+$(obj)/int4.c:   UNROLL := 4
+$(obj)/int4.c:   $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-targets += raid6int8.c
-$(obj)/raid6int8.c:   UNROLL := 8
-$(obj)/raid6int8.c:   $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int8.c
+$(obj)/int8.c:   UNROLL := 8
+$(obj)/int8.c:   $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-targets += raid6int16.c
-$(obj)/raid6int16.c:  UNROLL := 16
-$(obj)/raid6int16.c:  $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int16.c
+$(obj)/int16.c:  UNROLL := 16
+$(obj)/int16.c:  $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-targets += raid6int32.c
-$(obj)/raid6int32.c:  UNROLL := 32
-$(obj)/raid6int32.c:  $(src)/raid6int.uc $(src)/unroll.awk FORCE
+targets += int32.c
+$(obj)/int32.c:  UNROLL := 32
+$(obj)/int32.c:  $(src)/int.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-CFLAGS_raid6altivec1.o += $(altivec_flags)
-targets += raid6altivec1.c
-$(obj)/raid6altivec1.c:   UNROLL := 1
-$(obj)/raid6altivec1.c:   $(src)/raid6altivec.uc $(src)/unroll.awk FORCE
+CFLAGS_altivec1.o += $(altivec_flags)
+targets += altivec1.c
+$(obj)/altivec1.c:   UNROLL := 1
+$(obj)/altivec1.c:   $(src)/altivec.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-CFLAGS_raid6altivec2.o += $(altivec_flags)
-targets += raid6altivec2.c
-$(obj)/raid6altivec2.c:   UNROLL := 2
-$(obj)/raid6altivec2.c:   $(src)/raid6altivec.uc $(src)/unroll.awk FORCE
+CFLAGS_altivec2.o += $(altivec_flags)
+targets += altivec2.c
+$(obj)/altivec2.c:   UNROLL := 2
+$(obj)/altivec2.c:   $(src)/altivec.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-CFLAGS_raid6altivec4.o += $(altivec_flags)
-targets += raid6altivec4.c
-$(obj)/raid6altivec4.c:   UNROLL := 4
-$(obj)/raid6altivec4.c:   $(src)/raid6altivec.uc $(src)/unroll.awk FORCE
+CFLAGS_altivec4.o += $(altivec_flags)
+targets += altivec4.c
+$(obj)/altivec4.c:   UNROLL := 4
+$(obj)/altivec4.c:   $(src)/altivec.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
-CFLAGS_raid6altivec8.o += $(altivec_flags)
-targets += raid6altivec8.c
-$(obj)/raid6altivec8.c:   UNROLL := 8
-$(obj)/raid6altivec8.c:   $(src)/raid6altivec.uc $(src)/unroll.awk FORCE
+CFLAGS_altivec8.o += $(altivec_flags)
+targets += altivec8.c
+$(obj)/altivec8.c:   UNROLL := 8
+$(obj)/altivec8.c:   $(src)/altivec.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
 quiet_cmd_mktable = TABLE   $@
       cmd_mktable = $(obj)/mktables > $@ || ( rm -f $@ && exit 1 )
 
-targets += raid6tables.c
-$(obj)/raid6tables.c: $(obj)/mktables FORCE
+targets += tables.c
+$(obj)/tables.c: $(obj)/mktables FORCE
         $(call if_changed,mktable)
diff --git a/lib/raid6/raid6algos.c b/lib/raid6/algos.c
index 1f8784bfd44d..b595f560bee7 100644
--- a/lib/raid6/raid6algos.c
+++ b/lib/raid6/algos.c
@@ -11,17 +11,17 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6algos.c
+ * raid6/algos.c
  *
  * Algorithm list and algorithm selection for RAID-6
  */
 
 #include <linux/raid/pq.h>
-#include <linux/gfp.h>
 #ifndef __KERNEL__
 #include <sys/mman.h>
 #include <stdio.h>
 #else
+#include <linux/gfp.h>
 #if !RAID6_USE_EMPTY_ZERO_PAGE
 /* In .bss so it's zeroed */
 const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(256)));
diff --git a/lib/raid6/raid6altivec.uc b/lib/raid6/altivec.uc
index 2654d5c854be..2654d5c854be 100644
--- a/lib/raid6/raid6altivec.uc
+++ b/lib/raid6/altivec.uc
diff --git a/lib/raid6/raid6int.uc b/lib/raid6/int.uc
index d1e276a14fab..d1e276a14fab 100644
--- a/lib/raid6/raid6int.uc
+++ b/lib/raid6/int.uc
diff --git a/lib/raid6/raid6mmx.c b/lib/raid6/mmx.c
index e7f6c13132bf..279347f23094 100644
--- a/lib/raid6/raid6mmx.c
+++ b/lib/raid6/mmx.c
@@ -11,7 +11,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6mmx.c
+ * raid6/mmx.c
  *
  * MMX implementation of RAID-6 syndrome functions
  */
@@ -19,9 +19,9 @@
 #if defined(__i386__) && !defined(__arch_um__)
 
 #include <linux/raid/pq.h>
-#include "raid6x86.h"
+#include "x86.h"
 
-/* Shared with raid6sse1.c */
+/* Shared with raid6/sse1.c */
 const struct raid6_mmx_constants {
         u64 x1d;
 } raid6_mmx_constants = {
diff --git a/lib/raid6/raid6test/Makefile b/lib/raid6/raid6test/Makefile
deleted file mode 100644
index 2874cbef529d..000000000000
--- a/lib/raid6/raid6test/Makefile
+++ /dev/null
@@ -1,75 +0,0 @@
-#
-# This is a simple Makefile to test some of the RAID-6 code
-# from userspace.
-#
-
-CC       = gcc
-OPTFLAGS = -O2                  # Adjust as desired
-CFLAGS   = -I.. -I ../../../include -g $(OPTFLAGS)
-LD       = ld
-AWK      = awk
-AR       = ar
-RANLIB   = ranlib
-
-.c.o:
-        $(CC) $(CFLAGS) -c -o $@ $<
-
-%.c: ../%.c
-        cp -f $< $@
-
-%.uc: ../%.uc
-        cp -f $< $@
-
-all:    raid6.a raid6test
-
-raid6.a: raid6int1.o raid6int2.o raid6int4.o raid6int8.o raid6int16.o \
-         raid6int32.o \
-         raid6mmx.o raid6sse1.o raid6sse2.o \
-         raid6altivec1.o raid6altivec2.o raid6altivec4.o raid6altivec8.o \
-         raid6recov.o raid6algos.o \
-         raid6tables.o
-         rm -f $@
-         $(AR) cq $@ $^
-         $(RANLIB) $@
-
-raid6test: test.c raid6.a
-        $(CC) $(CFLAGS) -o raid6test $^
-
-raid6altivec1.c: raid6altivec.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=1 < raid6altivec.uc > $@
-
-raid6altivec2.c: raid6altivec.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=2 < raid6altivec.uc > $@
-
-raid6altivec4.c: raid6altivec.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=4 < raid6altivec.uc > $@
-
-raid6altivec8.c: raid6altivec.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=8 < raid6altivec.uc > $@
-
-raid6int1.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=1 < raid6int.uc > $@
-
-raid6int2.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=2 < raid6int.uc > $@
-
-raid6int4.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=4 < raid6int.uc > $@
-
-raid6int8.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=8 < raid6int.uc > $@
-
-raid6int16.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=16 < raid6int.uc > $@
-
-raid6int32.c: raid6int.uc ../unroll.awk
-        $(AWK) ../unroll.awk -vN=32 < raid6int.uc > $@
-
-raid6tables.c: mktables
-        ./mktables > raid6tables.c
-
-clean:
-        rm -f *.o *.a mktables mktables.c raid6int.uc raid6*.c raid6test
-
-spotless: clean
-        rm -f *~
diff --git a/lib/raid6/raid6recov.c b/lib/raid6/recov.c
index 2609f00e0d61..8590d19cf522 100644
--- a/lib/raid6/raid6recov.c
+++ b/lib/raid6/recov.c
@@ -11,7 +11,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6recov.c
+ * raid6/recov.c
  *
  * RAID-6 data recovery in dual failure mode.  In single failure mode,
  * use the RAID-5 algorithm (or, in the case of Q failure, just reconstruct
diff --git a/lib/raid6/raid6sse1.c b/lib/raid6/sse1.c
index b274dd5eab8f..10dd91948c07 100644
--- a/lib/raid6/raid6sse1.c
+++ b/lib/raid6/sse1.c
@@ -11,7 +11,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6sse1.c
+ * raid6/sse1.c
  *
  * SSE-1/MMXEXT implementation of RAID-6 syndrome functions
  *
@@ -24,9 +24,9 @@
 #if defined(__i386__) && !defined(__arch_um__)
 
 #include <linux/raid/pq.h>
-#include "raid6x86.h"
+#include "x86.h"
 
-/* Defined in raid6mmx.c */
+/* Defined in raid6/mmx.c */
 extern const struct raid6_mmx_constants {
         u64 x1d;
 } raid6_mmx_constants;
diff --git a/lib/raid6/raid6sse2.c b/lib/raid6/sse2.c
index 6ed6c6c0389f..bc2d57daa589 100644
--- a/lib/raid6/raid6sse2.c
+++ b/lib/raid6/sse2.c
@@ -11,7 +11,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6sse2.c
+ * raid6/sse2.c
  *
  * SSE-2 implementation of RAID-6 syndrome functions
  *
@@ -20,7 +20,7 @@
 #if (defined(__i386__) || defined(__x86_64__)) && !defined(__arch_um__)
 
 #include <linux/raid/pq.h>
-#include "raid6x86.h"
+#include "x86.h"
 
 static const struct raid6_sse_constants {
         u64 x1d[2];
diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
new file mode 100644
index 000000000000..aa651697b6dc
--- /dev/null
+++ b/lib/raid6/test/Makefile
@@ -0,0 +1,72 @@
+#
+# This is a simple Makefile to test some of the RAID-6 code
+# from userspace.
+#
+
+CC       = gcc
+OPTFLAGS = -O2                  # Adjust as desired
+CFLAGS   = -I.. -I ../../../include -g $(OPTFLAGS)
+LD       = ld
+AWK      = awk -f
+AR       = ar
+RANLIB   = ranlib
+
+.c.o:
+        $(CC) $(CFLAGS) -c -o $@ $<
+
+%.c: ../%.c
+        cp -f $< $@
+
+%.uc: ../%.uc
+        cp -f $< $@
+
+all:    raid6.a raid6test
+
+raid6.a: int1.o int2.o int4.o int8.o int16.o int32.o mmx.o sse1.o sse2.o \
+         altivec1.o altivec2.o altivec4.o altivec8.o recov.o algos.o \
+         tables.o
+         rm -f $@
+         $(AR) cq $@ $^
+         $(RANLIB) $@
+
+raid6test: test.c raid6.a
+        $(CC) $(CFLAGS) -o raid6test $^
+
+altivec1.c: altivec.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=1 < altivec.uc > $@
+
+altivec2.c: altivec.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=2 < altivec.uc > $@
+
+altivec4.c: altivec.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=4 < altivec.uc > $@
+
+altivec8.c: altivec.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=8 < altivec.uc > $@
+
+int1.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=1 < int.uc > $@
+
+int2.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=2 < int.uc > $@
+
+int4.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=4 < int.uc > $@
+
+int8.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=8 < int.uc > $@
+
+int16.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=16 < int.uc > $@
+
+int32.c: int.uc ../unroll.awk
+        $(AWK) ../unroll.awk -vN=32 < int.uc > $@
+
+tables.c: mktables
+        ./mktables > tables.c
+
+clean:
+        rm -f *.o *.a mktables mktables.c *.uc int*.c altivec*.c tables.c raid6test
+
+spotless: clean
+        rm -f *~
diff --git a/lib/raid6/raid6test/test.c b/lib/raid6/test/test.c
index 7a930318b17d..7a930318b17d 100644
--- a/lib/raid6/raid6test/test.c
+++ b/lib/raid6/test/test.c
diff --git a/lib/raid6/raid6x86.h b/lib/raid6/x86.h
index 4c22c1568558..cb2a8c91c886 100644
--- a/lib/raid6/raid6x86.h
+++ b/lib/raid6/x86.h
@@ -11,7 +11,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * raid6x86.h
+ * raid6/x86.h
  *
  * Definitions common to x86 and x86-64 RAID-6 code only
  */
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index a5ec42868f99..4ceb05d772ae 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -248,8 +248,18 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
                 left -= sg_size;
 
                 sg = alloc_fn(alloc_size, gfp_mask);
-                if (unlikely(!sg))
-                        return -ENOMEM;
+                if (unlikely(!sg)) {
+                        /*
+                         * Adjust entry count to reflect that the last
+                         * entry of the previous table won't be used for
+                         * linkage.  Without this, sg_kfree() may get
+                         * confused.
+                         */
+                        if (prv)
+                                table->nents = ++table->orig_nents;
+
+                        return -ENOMEM;
+                }
 
                 sg_init_table(sg, alloc_size);
                 table->nents = table->orig_nents += sg_size;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 34e3082632d8..7c06ee51a29a 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -70,7 +70,7 @@ static unsigned long io_tlb_nslabs;
  */
 static unsigned long io_tlb_overflow = 32*1024;
 
-void *io_tlb_overflow_buffer;
+static void *io_tlb_overflow_buffer;
 
 /*
  * This is a free list describing the number of free entries available from
@@ -147,16 +147,16 @@ void __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
          * to find contiguous free memory regions of size up to IO_TLB_SEGSIZE
          * between io_tlb_start and io_tlb_end.
          */
-        io_tlb_list = alloc_bootmem(io_tlb_nslabs * sizeof(int));
+        io_tlb_list = alloc_bootmem_pages(PAGE_ALIGN(io_tlb_nslabs * sizeof(int)));
         for (i = 0; i < io_tlb_nslabs; i++)
                 io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
         io_tlb_index = 0;
-        io_tlb_orig_addr = alloc_bootmem(io_tlb_nslabs * sizeof(phys_addr_t));
+        io_tlb_orig_addr = alloc_bootmem_pages(PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)));
 
         /*
          * Get the overflow emergency buffer
          */
-        io_tlb_overflow_buffer = alloc_bootmem_low(io_tlb_overflow);
+        io_tlb_overflow_buffer = alloc_bootmem_low_pages(PAGE_ALIGN(io_tlb_overflow));
         if (!io_tlb_overflow_buffer)
                 panic("Cannot allocate SWIOTLB overflow buffer!\n");
         if (verbose)
@@ -182,7 +182,7 @@ swiotlb_init_with_default_size(size_t default_size, int verbose)
         /*
          * Get IO TLB memory from the low pages
          */
-        io_tlb_start = alloc_bootmem_low_pages(bytes);
+        io_tlb_start = alloc_bootmem_low_pages(PAGE_ALIGN(bytes));
         if (!io_tlb_start)
                 panic("Cannot allocate SWIOTLB buffer");
 
@@ -308,13 +308,13 @@ void __init swiotlb_free(void)
                            get_order(io_tlb_nslabs << IO_TLB_SHIFT));
         } else {
                 free_bootmem_late(__pa(io_tlb_overflow_buffer),
-                                  io_tlb_overflow);
+                                  PAGE_ALIGN(io_tlb_overflow));
                 free_bootmem_late(__pa(io_tlb_orig_addr),
-                                  io_tlb_nslabs * sizeof(phys_addr_t));
+                                  PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)));
                 free_bootmem_late(__pa(io_tlb_list),
-                                  io_tlb_nslabs * sizeof(int));
+                                  PAGE_ALIGN(io_tlb_nslabs * sizeof(int)));
                 free_bootmem_late(__pa(io_tlb_start),
-                                  io_tlb_nslabs << IO_TLB_SHIFT);
+                                  PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
         }
 }