Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0176-3.10.77-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.10/0176-3.10.77-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2664 - (show annotations) (download)
    Tue Jul 21 16:20:24 2015 UTC (8 years, 9 months ago) by niro
    File size: 63477 byte(s) 
    -linux-3.10.77
    1 diff --git a/Makefile b/Makefile
    2 index 019a6a4b386d..923ad8a64e3b 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 10
    8 -SUBLEVEL = 76
    9 +SUBLEVEL = 77
    10 EXTRAVERSION =
    11 NAME = TOSSUG Baby Fish
    12
    13 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
    14 index 56211f2084ef..ce6e30628cc1 100644
    15 --- a/arch/arm/include/asm/elf.h
    16 +++ b/arch/arm/include/asm/elf.h
    17 @@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
    18 the loader. We need to make sure that it is out of the way of the program
    19 that it will "exec", and that there is sufficient room for the brk. */
    20
    21 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
    22 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
    23
    24 /* When the program starts, a1 contains a pointer to a function to be
    25 registered with atexit, as per the SVR4 ABI. A value of 0 means we
    26 diff --git a/arch/arm/mach-s3c64xx/crag6410.h b/arch/arm/mach-s3c64xx/crag6410.h
    27 index 4c3c9994fc2c..81dc722ced57 100644
    28 --- a/arch/arm/mach-s3c64xx/crag6410.h
    29 +++ b/arch/arm/mach-s3c64xx/crag6410.h
    30 @@ -14,6 +14,7 @@
    31 #include <linux/gpio.h>
    32
    33 #define GLENFARCLAS_PMIC_IRQ_BASE IRQ_BOARD_START
    34 +#define BANFF_PMIC_IRQ_BASE (IRQ_BOARD_START + 64)
    35
    36 #define PCA935X_GPIO_BASE GPIO_BOARD_START
    37 #define CODEC_GPIO_BASE (GPIO_BOARD_START + 8)
    38 diff --git a/arch/arm/mach-s3c64xx/mach-crag6410.c b/arch/arm/mach-s3c64xx/mach-crag6410.c
    39 index 8ad88ace795a..5fa9ac9104e1 100644
    40 --- a/arch/arm/mach-s3c64xx/mach-crag6410.c
    41 +++ b/arch/arm/mach-s3c64xx/mach-crag6410.c
    42 @@ -558,6 +558,7 @@ static struct wm831x_touch_pdata touch_pdata = {
    43
    44 static struct wm831x_pdata crag_pmic_pdata = {
    45 .wm831x_num = 1,
    46 + .irq_base = BANFF_PMIC_IRQ_BASE,
    47 .gpio_base = BANFF_PMIC_GPIO_BASE,
    48 .soft_shutdown = true,
    49
    50 diff --git a/arch/arm64/include/asm/timex.h b/arch/arm64/include/asm/timex.h
    51 index b24a31a7e2c9..81a076eb37fa 100644
    52 --- a/arch/arm64/include/asm/timex.h
    53 +++ b/arch/arm64/include/asm/timex.h
    54 @@ -16,14 +16,14 @@
    55 #ifndef __ASM_TIMEX_H
    56 #define __ASM_TIMEX_H
    57
    58 +#include <asm/arch_timer.h>
    59 +
    60 /*
    61 * Use the current timer as a cycle counter since this is what we use for
    62 * the delay loop.
    63 */
    64 -#define get_cycles() ({ cycles_t c; read_current_timer(&c); c; })
    65 +#define get_cycles() arch_counter_get_cntvct()
    66
    67 #include <asm-generic/timex.h>
    68
    69 -#define ARCH_HAS_READ_CURRENT_TIMER
    70 -
    71 #endif
    72 diff --git a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c
    73 index a551f88ae2c1..03dc3718eb13 100644
    74 --- a/arch/arm64/kernel/time.c
    75 +++ b/arch/arm64/kernel/time.c
    76 @@ -68,12 +68,6 @@ unsigned long long notrace sched_clock(void)
    77 return arch_timer_read_counter() * sched_clock_mult;
    78 }
    79
    80 -int read_current_timer(unsigned long *timer_value)
    81 -{
    82 - *timer_value = arch_timer_read_counter();
    83 - return 0;
    84 -}
    85 -
    86 void __init time_init(void)
    87 {
    88 u32 arch_timer_rate;
    89 diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c
    90 index 356ee84cad95..04845aaf5985 100644
    91 --- a/arch/c6x/kernel/time.c
    92 +++ b/arch/c6x/kernel/time.c
    93 @@ -49,7 +49,7 @@ u64 sched_clock(void)
    94 return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT;
    95 }
    96
    97 -void time_init(void)
    98 +void __init time_init(void)
    99 {
    100 u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT;
    101
    102 diff --git a/arch/mips/include/asm/suspend.h b/arch/mips/include/asm/suspend.h
    103 deleted file mode 100644
    104 index 3adac3b53d19..000000000000
    105 --- a/arch/mips/include/asm/suspend.h
    106 +++ /dev/null
    107 @@ -1,7 +0,0 @@
    108 -#ifndef __ASM_SUSPEND_H
    109 -#define __ASM_SUSPEND_H
    110 -
    111 -/* References to section boundaries */
    112 -extern const void __nosave_begin, __nosave_end;
    113 -
    114 -#endif /* __ASM_SUSPEND_H */
    115 diff --git a/arch/mips/power/cpu.c b/arch/mips/power/cpu.c
    116 index 521e5963df05..2129e67723ff 100644
    117 --- a/arch/mips/power/cpu.c
    118 +++ b/arch/mips/power/cpu.c
    119 @@ -7,7 +7,7 @@
    120 * Author: Hu Hongbing <huhb@lemote.com>
    121 * Wu Zhangjin <wuzhangjin@gmail.com>
    122 */
    123 -#include <asm/suspend.h>
    124 +#include <asm/sections.h>
    125 #include <asm/fpu.h>
    126 #include <asm/dsp.h>
    127
    128 diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
    129 index 32a7c828f073..e7567c8a9e79 100644
    130 --- a/arch/mips/power/hibernate.S
    131 +++ b/arch/mips/power/hibernate.S
    132 @@ -30,6 +30,8 @@ LEAF(swsusp_arch_suspend)
    133 END(swsusp_arch_suspend)
    134
    135 LEAF(swsusp_arch_resume)
    136 + /* Avoid TLB mismatch during and after kernel resume */
    137 + jal local_flush_tlb_all
    138 PTR_L t0, restore_pblist
    139 0:
    140 PTR_L t1, PBE_ADDRESS(t0) /* source */
    141 @@ -43,7 +45,6 @@ LEAF(swsusp_arch_resume)
    142 bne t1, t3, 1b
    143 PTR_L t0, PBE_NEXT(t0)
    144 bnez t0, 0b
    145 - jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
    146 PTR_LA t0, saved_regs
    147 PTR_L ra, PT_R31(t0)
    148 PTR_L sp, PT_R29(t0)
    149 diff --git a/arch/powerpc/kernel/suspend.c b/arch/powerpc/kernel/suspend.c
    150 index 0167d53da30c..a531154cc0f3 100644
    151 --- a/arch/powerpc/kernel/suspend.c
    152 +++ b/arch/powerpc/kernel/suspend.c
    153 @@ -9,9 +9,7 @@
    154
    155 #include <linux/mm.h>
    156 #include <asm/page.h>
    157 -
    158 -/* References to section boundaries */
    159 -extern const void __nosave_begin, __nosave_end;
    160 +#include <asm/sections.h>
    161
    162 /*
    163 * pfn_is_nosave - check if given pfn is in the 'nosave' section
    164 diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c
    165 index 2396dda282cd..ead55351b254 100644
    166 --- a/arch/powerpc/perf/callchain.c
    167 +++ b/arch/powerpc/perf/callchain.c
    168 @@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
    169 sp = regs->gpr[1];
    170 perf_callchain_store(entry, next_ip);
    171
    172 - for (;;) {
    173 + while (entry->nr < PERF_MAX_STACK_DEPTH) {
    174 fp = (unsigned long __user *) sp;
    175 if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
    176 return;
    177 diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
    178 index c479d2f9605b..58cbb75e89e9 100644
    179 --- a/arch/s390/kernel/suspend.c
    180 +++ b/arch/s390/kernel/suspend.c
    181 @@ -9,12 +9,9 @@
    182 #include <linux/pfn.h>
    183 #include <linux/suspend.h>
    184 #include <linux/mm.h>
    185 +#include <asm/sections.h>
    186 #include <asm/ctl_reg.h>
    187 -
    188 -/*
    189 - * References to section boundaries
    190 - */
    191 -extern const void __nosave_begin, __nosave_end;
    192 +#include <asm/ipl.h>
    193
    194 /*
    195 * The restore of the saved pages in an hibernation image will set
    196 @@ -138,6 +135,8 @@ int pfn_is_nosave(unsigned long pfn)
    197 {
    198 unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
    199 unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
    200 + unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
    201 + unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
    202
    203 /* Always save lowcore pages (LC protection might be enabled). */
    204 if (pfn <= LC_PAGES)
    205 @@ -145,6 +144,8 @@ int pfn_is_nosave(unsigned long pfn)
    206 if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
    207 return 1;
    208 /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
    209 + if (pfn >= stext_pfn && pfn <= eshared_pfn)
    210 + return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
    211 if (tprot(PFN_PHYS(pfn)))
    212 return 1;
    213 return 0;
    214 diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
    215 index 6bbd7b5a0bbe..0220c2ba7590 100644
    216 --- a/arch/s390/kvm/priv.c
    217 +++ b/arch/s390/kvm/priv.c
    218 @@ -328,6 +328,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
    219 for (n = mem->count - 1; n > 0 ; n--)
    220 memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
    221
    222 + memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
    223 mem->vm[0].cpus_total = cpus;
    224 mem->vm[0].cpus_configured = cpus;
    225 mem->vm[0].cpus_standby = 0;
    226 diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h
    227 index 1b6199740e98..7a99e6af6372 100644
    228 --- a/arch/sh/include/asm/sections.h
    229 +++ b/arch/sh/include/asm/sections.h
    230 @@ -3,7 +3,6 @@
    231
    232 #include <asm-generic/sections.h>
    233
    234 -extern long __nosave_begin, __nosave_end;
    235 extern long __machvec_start, __machvec_end;
    236 extern char __uncached_start, __uncached_end;
    237 extern char __start_eh_frame[], __stop_eh_frame[];
    238 diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c
    239 index 42b0b8ce699a..17bd2e167e07 100644
    240 --- a/arch/sparc/power/hibernate.c
    241 +++ b/arch/sparc/power/hibernate.c
    242 @@ -9,11 +9,9 @@
    243 #include <asm/hibernate.h>
    244 #include <asm/visasm.h>
    245 #include <asm/page.h>
    246 +#include <asm/sections.h>
    247 #include <asm/tlb.h>
    248
    249 -/* References to section boundaries */
    250 -extern const void __nosave_begin, __nosave_end;
    251 -
    252 struct saved_context saved_context;
    253
    254 /*
    255 diff --git a/arch/unicore32/include/mach/pm.h b/arch/unicore32/include/mach/pm.h
    256 index 4dcd34ae194c..77b522694e74 100644
    257 --- a/arch/unicore32/include/mach/pm.h
    258 +++ b/arch/unicore32/include/mach/pm.h
    259 @@ -36,8 +36,5 @@ extern int puv3_pm_enter(suspend_state_t state);
    260 /* Defined in hibernate_asm.S */
    261 extern int restore_image(pgd_t *resume_pg_dir, struct pbe *restore_pblist);
    262
    263 -/* References to section boundaries */
    264 -extern const void __nosave_begin, __nosave_end;
    265 -
    266 extern struct pbe *restore_pblist;
    267 #endif
    268 diff --git a/arch/unicore32/kernel/hibernate.c b/arch/unicore32/kernel/hibernate.c
    269 index d75ef8b6cb56..9969ec374abb 100644
    270 --- a/arch/unicore32/kernel/hibernate.c
    271 +++ b/arch/unicore32/kernel/hibernate.c
    272 @@ -18,6 +18,7 @@
    273 #include <asm/page.h>
    274 #include <asm/pgtable.h>
    275 #include <asm/pgalloc.h>
    276 +#include <asm/sections.h>
    277 #include <asm/suspend.h>
    278
    279 #include "mach/pm.h"
    280 diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
    281 index 7d28c885d238..291226b952a9 100644
    282 --- a/arch/x86/power/hibernate_32.c
    283 +++ b/arch/x86/power/hibernate_32.c
    284 @@ -13,13 +13,11 @@
    285 #include <asm/page.h>
    286 #include <asm/pgtable.h>
    287 #include <asm/mmzone.h>
    288 +#include <asm/sections.h>
    289
    290 /* Defined in hibernate_asm_32.S */
    291 extern int restore_image(void);
    292
    293 -/* References to section boundaries */
    294 -extern const void __nosave_begin, __nosave_end;
    295 -
    296 /* Pointer to the temporary resume page tables */
    297 pgd_t *resume_pg_dir;
    298
    299 diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
    300 index a0fde91c16cf..8ecaed127634 100644
    301 --- a/arch/x86/power/hibernate_64.c
    302 +++ b/arch/x86/power/hibernate_64.c
    303 @@ -17,11 +17,9 @@
    304 #include <asm/page.h>
    305 #include <asm/pgtable.h>
    306 #include <asm/mtrr.h>
    307 +#include <asm/sections.h>
    308 #include <asm/suspend.h>
    309
    310 -/* References to section boundaries */
    311 -extern const void __nosave_begin, __nosave_end;
    312 -
    313 /* Defined in hibernate_asm_64.S */
    314 extern int restore_image(void);
    315
    316 diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
    317 index 0a1b95f81a32..2b086a6ae6c7 100644
    318 --- a/arch/xtensa/Kconfig
    319 +++ b/arch/xtensa/Kconfig
    320 @@ -287,6 +287,36 @@ menu "Executable file formats"
    321
    322 source "fs/Kconfig.binfmt"
    323
    324 +config XTFPGA_LCD
    325 + bool "Enable XTFPGA LCD driver"
    326 + depends on XTENSA_PLATFORM_XTFPGA
    327 + default n
    328 + help
    329 + There's a 2x16 LCD on most of XTFPGA boards, kernel may output
    330 + progress messages there during bootup/shutdown. It may be useful
    331 + during board bringup.
    332 +
    333 + If unsure, say N.
    334 +
    335 +config XTFPGA_LCD_BASE_ADDR
    336 + hex "XTFPGA LCD base address"
    337 + depends on XTFPGA_LCD
    338 + default "0x0d0c0000"
    339 + help
    340 + Base address of the LCD controller inside KIO region.
    341 + Different boards from XTFPGA family have LCD controller at different
    342 + addresses. Please consult prototyping user guide for your board for
    343 + the correct address. Wrong address here may lead to hardware lockup.
    344 +
    345 +config XTFPGA_LCD_8BIT_ACCESS
    346 + bool "Use 8-bit access to XTFPGA LCD"
    347 + depends on XTFPGA_LCD
    348 + default n
    349 + help
    350 + LCD may be connected with 4- or 8-bit interface, 8-bit access may
    351 + only be used with 8-bit interface. Please consult prototyping user
    352 + guide for your board for the correct interface width.
    353 +
    354 endmenu
    355
    356 source "net/Kconfig"
    357 diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
    358 index 513effd48060..d07c1886bc8f 100644
    359 --- a/arch/xtensa/include/uapi/asm/unistd.h
    360 +++ b/arch/xtensa/include/uapi/asm/unistd.h
    361 @@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6)
    362 __SYSCALL(324, sys_name_to_handle_at, 5)
    363 #define __NR_open_by_handle_at 325
    364 __SYSCALL(325, sys_open_by_handle_at, 3)
    365 -#define __NR_sync_file_range 326
    366 +#define __NR_sync_file_range2 326
    367 __SYSCALL(326, sys_sync_file_range2, 6)
    368 #define __NR_perf_event_open 327
    369 __SYSCALL(327, sys_perf_event_open, 5)
    370 diff --git a/arch/xtensa/platforms/xtfpga/Makefile b/arch/xtensa/platforms/xtfpga/Makefile
    371 index b9ae206340cd..7839d38b2337 100644
    372 --- a/arch/xtensa/platforms/xtfpga/Makefile
    373 +++ b/arch/xtensa/platforms/xtfpga/Makefile
    374 @@ -6,4 +6,5 @@
    375 #
    376 # Note 2! The CFLAGS definitions are in the main makefile...
    377
    378 -obj-y = setup.o lcd.o
    379 +obj-y += setup.o
    380 +obj-$(CONFIG_XTFPGA_LCD) += lcd.o
    381 diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
    382 index 4416773cbde5..b39fbcf5c611 100644
    383 --- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
    384 +++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
    385 @@ -44,9 +44,6 @@
    386
    387 /* UART */
    388 #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020)
    389 -/* LCD instruction and data addresses. */
    390 -#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000))
    391 -#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004))
    392
    393 /* Misc. */
    394 #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000)
    395 diff --git a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
    396 index 0e435645af5a..4c8541ed1139 100644
    397 --- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
    398 +++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
    399 @@ -11,10 +11,25 @@
    400 #ifndef __XTENSA_XTAVNET_LCD_H
    401 #define __XTENSA_XTAVNET_LCD_H
    402
    403 +#ifdef CONFIG_XTFPGA_LCD
    404 /* Display string STR at position POS on the LCD. */
    405 void lcd_disp_at_pos(char *str, unsigned char pos);
    406
    407 /* Shift the contents of the LCD display left or right. */
    408 void lcd_shiftleft(void);
    409 void lcd_shiftright(void);
    410 +#else
    411 +static inline void lcd_disp_at_pos(char *str, unsigned char pos)
    412 +{
    413 +}
    414 +
    415 +static inline void lcd_shiftleft(void)
    416 +{
    417 +}
    418 +
    419 +static inline void lcd_shiftright(void)
    420 +{
    421 +}
    422 +#endif
    423 +
    424 #endif
    425 diff --git a/arch/xtensa/platforms/xtfpga/lcd.c b/arch/xtensa/platforms/xtfpga/lcd.c
    426 index 2872301598df..4dc0c1b43f4b 100644
    427 --- a/arch/xtensa/platforms/xtfpga/lcd.c
    428 +++ b/arch/xtensa/platforms/xtfpga/lcd.c
    429 @@ -1,50 +1,63 @@
    430 /*
    431 - * Driver for the LCD display on the Tensilica LX60 Board.
    432 + * Driver for the LCD display on the Tensilica XTFPGA board family.
    433 + * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf
    434 *
    435 * This file is subject to the terms and conditions of the GNU General Public
    436 * License. See the file "COPYING" in the main directory of this archive
    437 * for more details.
    438 *
    439 * Copyright (C) 2001, 2006 Tensilica Inc.
    440 + * Copyright (C) 2015 Cadence Design Systems Inc.
    441 */
    442
    443 -/*
    444 - *
    445 - * FIXME: this code is from the examples from the LX60 user guide.
    446 - *
    447 - * The lcd_pause function does busy waiting, which is probably not
    448 - * great. Maybe the code could be changed to use kernel timers, or
    449 - * change the hardware to not need to wait.
    450 - */
    451 -
    452 +#include <linux/delay.h>
    453 #include <linux/init.h>
    454 #include <linux/io.h>
    455
    456 #include <platform/hardware.h>
    457 #include <platform/lcd.h>
    458 -#include <linux/delay.h>
    459
    460 -#define LCD_PAUSE_ITERATIONS 4000
    461 +/* LCD instruction and data addresses. */
    462 +#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR))
    463 +#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4)
    464 +
    465 #define LCD_CLEAR 0x1
    466 #define LCD_DISPLAY_ON 0xc
    467
    468 /* 8bit and 2 lines display */
    469 #define LCD_DISPLAY_MODE8BIT 0x38
    470 +#define LCD_DISPLAY_MODE4BIT 0x28
    471 #define LCD_DISPLAY_POS 0x80
    472 #define LCD_SHIFT_LEFT 0x18
    473 #define LCD_SHIFT_RIGHT 0x1c
    474
    475 +static void lcd_put_byte(u8 *addr, u8 data)
    476 +{
    477 +#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS
    478 + ACCESS_ONCE(*addr) = data;
    479 +#else
    480 + ACCESS_ONCE(*addr) = data & 0xf0;
    481 + ACCESS_ONCE(*addr) = (data << 4) & 0xf0;
    482 +#endif
    483 +}
    484 +
    485 static int __init lcd_init(void)
    486 {
    487 - *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
    488 + ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
    489 mdelay(5);
    490 - *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
    491 + ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
    492 udelay(200);
    493 - *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
    494 + ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
    495 + udelay(50);
    496 +#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS
    497 + ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT;
    498 + udelay(50);
    499 + lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT);
    500 udelay(50);
    501 - *LCD_INSTR_ADDR = LCD_DISPLAY_ON;
    502 +#endif
    503 + lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON);
    504 udelay(50);
    505 - *LCD_INSTR_ADDR = LCD_CLEAR;
    506 + lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR);
    507 mdelay(10);
    508 lcd_disp_at_pos("XTENSA LINUX", 0);
    509 return 0;
    510 @@ -52,10 +65,10 @@ static int __init lcd_init(void)
    511
    512 void lcd_disp_at_pos(char *str, unsigned char pos)
    513 {
    514 - *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos;
    515 + lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos);
    516 udelay(100);
    517 while (*str != 0) {
    518 - *LCD_DATA_ADDR = *str;
    519 + lcd_put_byte(LCD_DATA_ADDR, *str);
    520 udelay(200);
    521 str++;
    522 }
    523 @@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned char pos)
    524
    525 void lcd_shiftleft(void)
    526 {
    527 - *LCD_INSTR_ADDR = LCD_SHIFT_LEFT;
    528 + lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT);
    529 udelay(50);
    530 }
    531
    532 void lcd_shiftright(void)
    533 {
    534 - *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT;
    535 + lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT);
    536 udelay(50);
    537 }
    538
    539 diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
    540 index 7695b5dd9d2d..35287ab445cd 100644
    541 --- a/drivers/gpu/drm/i915/i915_reg.h
    542 +++ b/drivers/gpu/drm/i915/i915_reg.h
    543 @@ -909,6 +909,7 @@
    544 #define GMBUS_CYCLE_INDEX (2<<25)
    545 #define GMBUS_CYCLE_STOP (4<<25)
    546 #define GMBUS_BYTE_COUNT_SHIFT 16
    547 +#define GMBUS_BYTE_COUNT_MAX 256U
    548 #define GMBUS_SLAVE_INDEX_SHIFT 8
    549 #define GMBUS_SLAVE_ADDR_SHIFT 1
    550 #define GMBUS_SLAVE_READ (1<<0)
    551 diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
    552 index 639fe192997c..4a21e13cc58c 100644
    553 --- a/drivers/gpu/drm/i915/intel_i2c.c
    554 +++ b/drivers/gpu/drm/i915/intel_i2c.c
    555 @@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv)
    556 }
    557
    558 static int
    559 -gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
    560 - u32 gmbus1_index)
    561 +gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv,
    562 + unsigned short addr, u8 *buf, unsigned int len,
    563 + u32 gmbus1_index)
    564 {
    565 int reg_offset = dev_priv->gpio_mmio_base;
    566 - u16 len = msg->len;
    567 - u8 *buf = msg->buf;
    568
    569 I915_WRITE(GMBUS1 + reg_offset,
    570 gmbus1_index |
    571 GMBUS_CYCLE_WAIT |
    572 (len << GMBUS_BYTE_COUNT_SHIFT) |
    573 - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
    574 + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
    575 GMBUS_SLAVE_READ | GMBUS_SW_RDY);
    576 while (len) {
    577 int ret;
    578 @@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
    579 }
    580
    581 static int
    582 -gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
    583 +gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg,
    584 + u32 gmbus1_index)
    585 {
    586 - int reg_offset = dev_priv->gpio_mmio_base;
    587 - u16 len = msg->len;
    588 u8 *buf = msg->buf;
    589 + unsigned int rx_size = msg->len;
    590 + unsigned int len;
    591 + int ret;
    592 +
    593 + do {
    594 + len = min(rx_size, GMBUS_BYTE_COUNT_MAX);
    595 +
    596 + ret = gmbus_xfer_read_chunk(dev_priv, msg->addr,
    597 + buf, len, gmbus1_index);
    598 + if (ret)
    599 + return ret;
    600 +
    601 + rx_size -= len;
    602 + buf += len;
    603 + } while (rx_size != 0);
    604 +
    605 + return 0;
    606 +}
    607 +
    608 +static int
    609 +gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv,
    610 + unsigned short addr, u8 *buf, unsigned int len)
    611 +{
    612 + int reg_offset = dev_priv->gpio_mmio_base;
    613 + unsigned int chunk_size = len;
    614 u32 val, loop;
    615
    616 val = loop = 0;
    617 @@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
    618 I915_WRITE(GMBUS3 + reg_offset, val);
    619 I915_WRITE(GMBUS1 + reg_offset,
    620 GMBUS_CYCLE_WAIT |
    621 - (msg->len << GMBUS_BYTE_COUNT_SHIFT) |
    622 - (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) |
    623 + (chunk_size << GMBUS_BYTE_COUNT_SHIFT) |
    624 + (addr << GMBUS_SLAVE_ADDR_SHIFT) |
    625 GMBUS_SLAVE_WRITE | GMBUS_SW_RDY);
    626 while (len) {
    627 int ret;
    628 @@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
    629 if (ret)
    630 return ret;
    631 }
    632 +
    633 + return 0;
    634 +}
    635 +
    636 +static int
    637 +gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)
    638 +{
    639 + u8 *buf = msg->buf;
    640 + unsigned int tx_size = msg->len;
    641 + unsigned int len;
    642 + int ret;
    643 +
    644 + do {
    645 + len = min(tx_size, GMBUS_BYTE_COUNT_MAX);
    646 +
    647 + ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len);
    648 + if (ret)
    649 + return ret;
    650 +
    651 + buf += len;
    652 + tx_size -= len;
    653 + } while (tx_size != 0);
    654 +
    655 return 0;
    656 }
    657
    658 diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
    659 index 971dd8795b68..8ac333094991 100644
    660 --- a/drivers/gpu/drm/radeon/atombios_crtc.c
    661 +++ b/drivers/gpu/drm/radeon/atombios_crtc.c
    662 @@ -312,8 +312,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
    663 misc |= ATOM_COMPOSITESYNC;
    664 if (mode->flags & DRM_MODE_FLAG_INTERLACE)
    665 misc |= ATOM_INTERLACE;
    666 - if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    667 + if (mode->flags & DRM_MODE_FLAG_DBLCLK)
    668 misc |= ATOM_DOUBLE_CLOCK_MODE;
    669 + if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    670 + misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
    671
    672 args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
    673 args.ucCRTC = radeon_crtc->crtc_id;
    674 @@ -356,8 +358,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
    675 misc |= ATOM_COMPOSITESYNC;
    676 if (mode->flags & DRM_MODE_FLAG_INTERLACE)
    677 misc |= ATOM_INTERLACE;
    678 - if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    679 + if (mode->flags & DRM_MODE_FLAG_DBLCLK)
    680 misc |= ATOM_DOUBLE_CLOCK_MODE;
    681 + if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    682 + misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
    683
    684 args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
    685 args.ucCRTC = radeon_crtc->crtc_id;
    686 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
    687 index 92f34de7aee9..05e6a7d13d4e 100644
    688 --- a/drivers/hv/channel.c
    689 +++ b/drivers/hv/channel.c
    690 @@ -169,7 +169,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    691 GFP_KERNEL);
    692 if (!open_info) {
    693 err = -ENOMEM;
    694 - goto error0;
    695 + goto error_gpadl;
    696 }
    697
    698 init_completion(&open_info->waitevent);
    699 @@ -185,7 +185,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    700
    701 if (userdatalen > MAX_USER_DEFINED_BYTES) {
    702 err = -EINVAL;
    703 - goto error0;
    704 + goto error_gpadl;
    705 }
    706
    707 if (userdatalen)
    708 @@ -226,6 +226,9 @@ error1:
    709 list_del(&open_info->msglistentry);
    710 spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
    711
    712 +error_gpadl:
    713 + vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
    714 +
    715 error0:
    716 free_pages((unsigned long)out,
    717 get_order(send_ringbuffer_size + recv_ringbuffer_size));
    718 diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
    719 index 48e31ed69dbf..9d539cbfc833 100644
    720 --- a/drivers/i2c/i2c-core.c
    721 +++ b/drivers/i2c/i2c-core.c
    722 @@ -206,6 +206,7 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
    723 adap->bus_recovery_info->set_scl(adap, 1);
    724 return i2c_generic_recovery(adap);
    725 }
    726 +EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
    727
    728 int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
    729 {
    730 @@ -220,6 +221,7 @@ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)
    731
    732 return ret;
    733 }
    734 +EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery);
    735
    736 int i2c_recover_bus(struct i2c_adapter *adap)
    737 {
    738 @@ -229,6 +231,7 @@ int i2c_recover_bus(struct i2c_adapter *adap)
    739 dev_dbg(&adap->dev, "Trying i2c bus recovery\n");
    740 return adap->bus_recovery_info->recover_bus(adap);
    741 }
    742 +EXPORT_SYMBOL_GPL(i2c_recover_bus);
    743
    744 static int i2c_device_probe(struct device *dev)
    745 {
    746 diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    747 index 055ebebc07dd..c1fef27010d4 100644
    748 --- a/drivers/infiniband/core/umem.c
    749 +++ b/drivers/infiniband/core/umem.c
    750 @@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    751 if (dmasync)
    752 dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
    753
    754 + if (!size)
    755 + return ERR_PTR(-EINVAL);
    756 +
    757 /*
    758 * If the combination of the addr and size requested for this memory
    759 * region causes an integer overflow, return error.
    760 */
    761 - if ((PAGE_ALIGN(addr + size) <= size) ||
    762 - (PAGE_ALIGN(addr + size) <= addr))
    763 + if (((addr + size) < addr) ||
    764 + PAGE_ALIGN(addr + size) < (addr + size))
    765 return ERR_PTR(-EINVAL);
    766
    767 if (!can_do_mlock())
    768 diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
    769 index 4f10af2905b5..262a18437ceb 100644
    770 --- a/drivers/infiniband/hw/mlx4/qp.c
    771 +++ b/drivers/infiniband/hw/mlx4/qp.c
    772 @@ -2174,8 +2174,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
    773
    774 memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
    775
    776 - *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
    777 - wr->wr.ud.hlen);
    778 + *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
    779 *lso_seg_len = halign;
    780 return 0;
    781 }
    782 diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    783 index 85e75239c814..1af7df263368 100644
    784 --- a/drivers/input/mouse/elantech.c
    785 +++ b/drivers/input/mouse/elantech.c
    786 @@ -784,6 +784,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
    787 }
    788
    789 /*
    790 + * This writes the reg_07 value again to the hardware at the end of every
    791 + * set_rate call because the register loses its value. reg_07 allows setting
    792 + * absolute mode on v4 hardware
    793 + */
    794 +static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
    795 + unsigned int rate)
    796 +{
    797 + struct elantech_data *etd = psmouse->private;
    798 +
    799 + etd->original_set_rate(psmouse, rate);
    800 + if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
    801 + psmouse_err(psmouse, "restoring reg_07 failed\n");
    802 +}
    803 +
    804 +/*
    805 * Put the touchpad into absolute mode
    806 */
    807 static int elantech_set_absolute_mode(struct psmouse *psmouse)
    808 @@ -985,6 +1000,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
    809 * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons
    810 * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons
    811 * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons
    812 + * Asus TP500LN 0x381f17 10, 14, 0e clickpad
    813 + * Asus X750JN 0x381f17 10, 14, 0e clickpad
    814 * Asus UX31 0x361f00 20, 15, 0e clickpad
    815 * Asus UX32VD 0x361f02 00, 15, 0e clickpad
    816 * Avatar AVIU-145A2 0x361f00 ? clickpad
    817 @@ -1452,6 +1469,11 @@ int elantech_init(struct psmouse *psmouse)
    818 goto init_fail;
    819 }
    820
    821 + if (etd->fw_version == 0x381f17) {
    822 + etd->original_set_rate = psmouse->set_rate;
    823 + psmouse->set_rate = elantech_set_rate_restore_reg_07;
    824 + }
    825 +
    826 if (elantech_set_input_params(psmouse)) {
    827 psmouse_err(psmouse, "failed to query touchpad range.\n");
    828 goto init_fail;
    829 diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
    830 index c1c15ab6872d..13a12ccbff51 100644
    831 --- a/drivers/input/mouse/elantech.h
    832 +++ b/drivers/input/mouse/elantech.h
    833 @@ -138,6 +138,7 @@ struct elantech_data {
    834 struct finger_pos mt[ETP_MAX_FINGERS];
    835 unsigned char parity[256];
    836 int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param);
    837 + void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
    838 };
    839
    840 #ifdef CONFIG_MOUSE_PS2_ELANTECH
    841 diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c
    842 index a59153d2f8bf..518a5299ff0b 100644
    843 --- a/drivers/media/usb/stk1160/stk1160-v4l.c
    844 +++ b/drivers/media/usb/stk1160/stk1160-v4l.c
    845 @@ -245,6 +245,11 @@ static int stk1160_stop_streaming(struct stk1160 *dev)
    846 if (mutex_lock_interruptible(&dev->v4l_lock))
    847 return -ERESTARTSYS;
    848
    849 + /*
    850 + * Once URBs are cancelled, the URB complete handler
    851 + * won't be running. This is required to safely release the
    852 + * current buffer (dev->isoc_ctl.buf).
    853 + */
    854 stk1160_cancel_isoc(dev);
    855
    856 /*
    857 @@ -665,8 +670,16 @@ void stk1160_clear_queue(struct stk1160 *dev)
    858 stk1160_info("buffer [%p/%d] aborted\n",
    859 buf, buf->vb.v4l2_buf.index);
    860 }
    861 - /* It's important to clear current buffer */
    862 - dev->isoc_ctl.buf = NULL;
    863 +
    864 + /* It's important to release the current buffer */
    865 + if (dev->isoc_ctl.buf) {
    866 + buf = dev->isoc_ctl.buf;
    867 + dev->isoc_ctl.buf = NULL;
    868 +
    869 + vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
    870 + stk1160_info("buffer [%p/%d] aborted\n",
    871 + buf, buf->vb.v4l2_buf.index);
    872 + }
    873 spin_unlock_irqrestore(&dev->buf_lock, flags);
    874 }
    875
    876 diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
    877 index f4176ca3a794..cdd61ab5c2b5 100644
    878 --- a/drivers/memstick/core/mspro_block.c
    879 +++ b/drivers/memstick/core/mspro_block.c
    880 @@ -758,7 +758,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
    881
    882 if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
    883 if (msb->data_dir == READ) {
    884 - for (cnt = 0; cnt < msb->current_seg; cnt++)
    885 + for (cnt = 0; cnt < msb->current_seg; cnt++) {
    886 t_len += msb->req_sg[cnt].length
    887 / msb->page_size;
    888
    889 @@ -766,6 +766,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
    890 t_len += msb->current_page - 1;
    891
    892 t_len *= msb->page_size;
    893 + }
    894 }
    895 } else
    896 t_len = blk_rq_bytes(msb->block_req);
    897 diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c
    898 index c071d410488f..79d69bd26dd2 100644
    899 --- a/drivers/mtd/ubi/attach.c
    900 +++ b/drivers/mtd/ubi/attach.c
    901 @@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb,
    902 second_is_newer = !second_is_newer;
    903 } else {
    904 dbg_bld("PEB %d CRC is OK", pnum);
    905 - bitflips = !!err;
    906 + bitflips |= !!err;
    907 }
    908 mutex_unlock(&ubi->buf_mutex);
    909
    910 diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
    911 index 4f02848bb2bc..fc764e7976bd 100644
    912 --- a/drivers/mtd/ubi/cdev.c
    913 +++ b/drivers/mtd/ubi/cdev.c
    914 @@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
    915 /* Validate the request */
    916 err = -EINVAL;
    917 if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
    918 - req.bytes < 0 || req.lnum >= vol->usable_leb_size)
    919 + req.bytes < 0 || req.bytes > vol->usable_leb_size)
    920 break;
    921
    922 err = get_exclusive(desc);
    923 diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
    924 index 0e11671dadc4..930cf2c77abb 100644
    925 --- a/drivers/mtd/ubi/eba.c
    926 +++ b/drivers/mtd/ubi/eba.c
    927 @@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
    928 * during re-size.
    929 */
    930 ubi_move_aeb_to_list(av, aeb, &ai->erase);
    931 - vol->eba_tbl[aeb->lnum] = aeb->pnum;
    932 + else
    933 + vol->eba_tbl[aeb->lnum] = aeb->pnum;
    934 }
    935 }
    936
    937 diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
    938 index 49e570abe58b..c08254016fe8 100644
    939 --- a/drivers/mtd/ubi/wl.c
    940 +++ b/drivers/mtd/ubi/wl.c
    941 @@ -999,7 +999,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
    942 int cancel)
    943 {
    944 int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
    945 - int vol_id = -1, uninitialized_var(lnum);
    946 + int vol_id = -1, lnum = -1;
    947 #ifdef CONFIG_MTD_UBI_FASTMAP
    948 int anchor = wrk->anchor;
    949 #endif
    950 diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
    951 index 59ad007dd5aa..a978fc82ceb5 100644
    952 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c
    953 +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
    954 @@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
    955 static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
    956 struct e1000_rx_ring *rx_ring,
    957 int *work_done, int work_to_do);
    958 +static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
    959 + struct e1000_rx_ring *rx_ring,
    960 + int cleaned_count)
    961 +{
    962 +}
    963 static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
    964 struct e1000_rx_ring *rx_ring,
    965 int cleaned_count);
    966 @@ -3555,8 +3560,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
    967 msleep(1);
    968 /* e1000_down has a dependency on max_frame_size */
    969 hw->max_frame_size = max_frame;
    970 - if (netif_running(netdev))
    971 + if (netif_running(netdev)) {
    972 + /* prevent buffers from being reallocated */
    973 + adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
    974 e1000_down(adapter);
    975 + }
    976
    977 /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
    978 * means we reserve 2 more, this pushes us to allocate from the next
    979 diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    980 index e7a2af3ad05a..7555095e0b74 100644
    981 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    982 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    983 @@ -313,6 +313,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
    984 {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
    985 {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
    986 {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
    987 + {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
    988 {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
    989 {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
    990 {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
    991 @@ -369,6 +370,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
    992 {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
    993 {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
    994 {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
    995 + {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
    996 {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
    997 {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
    998 {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
    999 diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
    1000 index 7f1669cdea09..779dc2b2ca75 100644
    1001 --- a/drivers/net/wireless/ti/wl18xx/debugfs.c
    1002 +++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
    1003 @@ -136,7 +136,7 @@ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u");
    1004 WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, accum_arp_pend_requests, "%u");
    1005 WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, max_arp_queue_dep, "%u");
    1006
    1007 -WL18XX_DEBUGFS_FWSTATS_FILE(rx_rate, rx_frames_per_rates, "%u");
    1008 +WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(rx_rate, rx_frames_per_rates, 50);
    1009
    1010 WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, tx_agg_vs_rate,
    1011 AGGR_STATS_TX_AGG*AGGR_STATS_TX_RATE);
    1012 diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
    1013 index f7381dd69009..1bce4325e86b 100644
    1014 --- a/drivers/net/wireless/ti/wlcore/debugfs.h
    1015 +++ b/drivers/net/wireless/ti/wlcore/debugfs.h
    1016 @@ -26,8 +26,8 @@
    1017
    1018 #include "wlcore.h"
    1019
    1020 -int wl1271_format_buffer(char __user *userbuf, size_t count,
    1021 - loff_t *ppos, char *fmt, ...);
    1022 +__printf(4, 5) int wl1271_format_buffer(char __user *userbuf, size_t count,
    1023 + loff_t *ppos, char *fmt, ...);
    1024
    1025 int wl1271_debugfs_init(struct wl1271 *wl);
    1026 void wl1271_debugfs_exit(struct wl1271 *wl);
    1027 diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
    1028 index a50576081b34..46d2de24bf3e 100644
    1029 --- a/drivers/parport/Kconfig
    1030 +++ b/drivers/parport/Kconfig
    1031 @@ -36,7 +36,9 @@ if PARPORT
    1032 config PARPORT_PC
    1033 tristate "PC-style hardware"
    1034 depends on (!SPARC64 || PCI) && !SPARC32 && !M32R && !FRV && !S390 && \
    1035 - (!M68K || ISA) && !MN10300 && !AVR32 && !BLACKFIN && !XTENSA
    1036 + (!M68K || ISA) && !MN10300 && !AVR32 && !BLACKFIN && \
    1037 + !XTENSA && !CRIS && !H8300 && !ARM64
    1038 +
    1039 ---help---
    1040 You should say Y here if you have a PC-style parallel port. All
    1041 IBM PC compatible computers and some Alphas have PC-style
    1042 diff --git a/drivers/power/lp8788-charger.c b/drivers/power/lp8788-charger.c
    1043 index ed49b50b220b..72da2a6c22db 100644
    1044 --- a/drivers/power/lp8788-charger.c
    1045 +++ b/drivers/power/lp8788-charger.c
    1046 @@ -417,8 +417,10 @@ static int lp8788_psy_register(struct platform_device *pdev,
    1047 pchg->battery.num_properties = ARRAY_SIZE(lp8788_battery_prop);
    1048 pchg->battery.get_property = lp8788_battery_get_property;
    1049
    1050 - if (power_supply_register(&pdev->dev, &pchg->battery))
    1051 + if (power_supply_register(&pdev->dev, &pchg->battery)) {
    1052 + power_supply_unregister(&pchg->charger);
    1053 return -EPERM;
    1054 + }
    1055
    1056 return 0;
    1057 }
    1058 diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
    1059 index c9e244984e30..fa50c7dc3d3e 100644
    1060 --- a/drivers/scsi/mvsas/mv_sas.c
    1061 +++ b/drivers/scsi/mvsas/mv_sas.c
    1062 @@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag)
    1063 static int mvs_task_prep_ata(struct mvs_info *mvi,
    1064 struct mvs_task_exec_info *tei)
    1065 {
    1066 - struct sas_ha_struct *sha = mvi->sas;
    1067 struct sas_task *task = tei->task;
    1068 struct domain_device *dev = task->dev;
    1069 struct mvs_device *mvi_dev = dev->lldd_dev;
    1070 struct mvs_cmd_hdr *hdr = tei->hdr;
    1071 struct asd_sas_port *sas_port = dev->port;
    1072 - struct sas_phy *sphy = dev->phy;
    1073 - struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];
    1074 struct mvs_slot_info *slot;
    1075 void *buf_prd;
    1076 u32 tag = tei->tag, hdr_tag;
    1077 @@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi,
    1078 slot->tx = mvi->tx_prod;
    1079 del_q = TXQ_MODE_I | tag |
    1080 (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
    1081 - (MVS_PHY_ID << TXQ_PHY_SHIFT) |
    1082 + ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) |
    1083 (mvi_dev->taskfileset << TXQ_SRS_SHIFT);
    1084 mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q);
    1085
    1086 diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
    1087 index a8990783ba66..913b91c78a22 100644
    1088 --- a/drivers/scsi/storvsc_drv.c
    1089 +++ b/drivers/scsi/storvsc_drv.c
    1090 @@ -631,21 +631,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
    1091 if (bounce_sgl[j].length == PAGE_SIZE) {
    1092 /* full..move to next entry */
    1093 sg_kunmap_atomic(bounce_addr);
    1094 + bounce_addr = 0;
    1095 j++;
    1096 + }
    1097
    1098 - /* if we need to use another bounce buffer */
    1099 - if (srclen || i != orig_sgl_count - 1)
    1100 - bounce_addr = sg_kmap_atomic(bounce_sgl,j);
    1101 + /* if we need to use another bounce buffer */
    1102 + if (srclen && bounce_addr == 0)
    1103 + bounce_addr = sg_kmap_atomic(bounce_sgl, j);
    1104
    1105 - } else if (srclen == 0 && i == orig_sgl_count - 1) {
    1106 - /* unmap the last bounce that is < PAGE_SIZE */
    1107 - sg_kunmap_atomic(bounce_addr);
    1108 - }
    1109 }
    1110
    1111 sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
    1112 }
    1113
    1114 + if (bounce_addr)
    1115 + sg_kunmap_atomic(bounce_addr);
    1116 +
    1117 local_irq_restore(flags);
    1118
    1119 return total_copied;
    1120 diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
    1121 index 911e9e0711d2..a08f923b9925 100644
    1122 --- a/drivers/spi/spidev.c
    1123 +++ b/drivers/spi/spidev.c
    1124 @@ -243,7 +243,10 @@ static int spidev_message(struct spidev_data *spidev,
    1125 k_tmp->len = u_tmp->len;
    1126
    1127 total += k_tmp->len;
    1128 - if (total > bufsiz) {
    1129 + /* Check total length of transfers. Also check each
    1130 + * transfer length to avoid arithmetic overflow.
    1131 + */
    1132 + if (total > bufsiz || k_tmp->len > bufsiz) {
    1133 status = -EMSGSIZE;
    1134 goto done;
    1135 }
    1136 diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
    1137 index 6463ca3bcfba..07133d0c971b 100644
    1138 --- a/drivers/usb/class/cdc-wdm.c
    1139 +++ b/drivers/usb/class/cdc-wdm.c
    1140 @@ -244,7 +244,7 @@ static void wdm_int_callback(struct urb *urb)
    1141 case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
    1142 dev_dbg(&desc->intf->dev,
    1143 "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
    1144 - dr->wIndex, dr->wLength);
    1145 + le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
    1146 break;
    1147
    1148 case USB_CDC_NOTIFY_NETWORK_CONNECTION:
    1149 @@ -257,7 +257,9 @@ static void wdm_int_callback(struct urb *urb)
    1150 clear_bit(WDM_POLL_RUNNING, &desc->flags);
    1151 dev_err(&desc->intf->dev,
    1152 "unknown notification %d received: index %d len %d\n",
    1153 - dr->bNotificationType, dr->wIndex, dr->wLength);
    1154 + dr->bNotificationType,
    1155 + le16_to_cpu(dr->wIndex),
    1156 + le16_to_cpu(dr->wLength));
    1157 goto exit;
    1158 }
    1159
    1160 @@ -403,7 +405,7 @@ static ssize_t wdm_write
    1161 USB_RECIP_INTERFACE);
    1162 req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
    1163 req->wValue = 0;
    1164 - req->wIndex = desc->inum;
    1165 + req->wIndex = desc->inum; /* already converted */
    1166 req->wLength = cpu_to_le16(count);
    1167 set_bit(WDM_IN_USE, &desc->flags);
    1168 desc->outbuf = buf;
    1169 @@ -417,7 +419,7 @@ static ssize_t wdm_write
    1170 rv = usb_translate_errors(rv);
    1171 } else {
    1172 dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
    1173 - req->wIndex);
    1174 + le16_to_cpu(req->wIndex));
    1175 }
    1176 out:
    1177 usb_autopm_put_interface(desc->intf);
    1178 @@ -780,7 +782,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
    1179 desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
    1180 desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
    1181 desc->irq->wValue = 0;
    1182 - desc->irq->wIndex = desc->inum;
    1183 + desc->irq->wIndex = desc->inum; /* already converted */
    1184 desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);
    1185
    1186 usb_fill_control_urb(
    1187 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    1188 index c9f56ffdba9a..11a073cda1d6 100644
    1189 --- a/drivers/usb/core/hub.c
    1190 +++ b/drivers/usb/core/hub.c
    1191 @@ -3282,10 +3282,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
    1192 dev_dbg(hub->intfdev, "can't resume port %d, status %d\n",
    1193 port1, status);
    1194 } else {
    1195 - /* drive resume for at least 20 msec */
    1196 + /* drive resume for USB_RESUME_TIMEOUT msec */
    1197 dev_dbg(&udev->dev, "usb %sresume\n",
    1198 (PMSG_IS_AUTO(msg) ? "auto-" : ""));
    1199 - msleep(25);
    1200 + msleep(USB_RESUME_TIMEOUT);
    1201
    1202 /* Virtual root hubs can trigger on GET_PORT_STATUS to
    1203 * stop resume signaling. Then finish the resume
    1204 diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    1205 index 44a292b75012..a660716f9331 100644
    1206 --- a/drivers/usb/gadget/composite.c
    1207 +++ b/drivers/usb/gadget/composite.c
    1208 @@ -528,7 +528,7 @@ static int bos_desc(struct usb_composite_dev *cdev)
    1209 usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
    1210 usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
    1211 usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
    1212 - usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT);
    1213 + usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT | USB_BESL_SUPPORT);
    1214
    1215 /*
    1216 * The Superspeed USB Capability descriptor shall be implemented by all
    1217 diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
    1218 index b64e661618bb..baf2807934c1 100644
    1219 --- a/drivers/usb/host/isp116x-hcd.c
    1220 +++ b/drivers/usb/host/isp116x-hcd.c
    1221 @@ -1488,7 +1488,7 @@ static int isp116x_bus_resume(struct usb_hcd *hcd)
    1222 spin_unlock_irq(&isp116x->lock);
    1223
    1224 hcd->state = HC_STATE_RESUMING;
    1225 - msleep(20);
    1226 + msleep(USB_RESUME_TIMEOUT);
    1227
    1228 /* Go operational */
    1229 spin_lock_irq(&isp116x->lock);
    1230 diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
    1231 index a6fd8f5371df..6656dfda5665 100644
    1232 --- a/drivers/usb/host/r8a66597-hcd.c
    1233 +++ b/drivers/usb/host/r8a66597-hcd.c
    1234 @@ -2301,7 +2301,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd)
    1235 rh->port &= ~USB_PORT_STAT_SUSPEND;
    1236 rh->port |= USB_PORT_STAT_C_SUSPEND << 16;
    1237 r8a66597_mdfy(r8a66597, RESUME, RESUME | UACT, dvstctr_reg);
    1238 - msleep(50);
    1239 + msleep(USB_RESUME_TIMEOUT);
    1240 r8a66597_mdfy(r8a66597, UACT, RESUME | UACT, dvstctr_reg);
    1241 }
    1242
    1243 diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
    1244 index b2ec7fe758dd..b4cad9346035 100644
    1245 --- a/drivers/usb/host/sl811-hcd.c
    1246 +++ b/drivers/usb/host/sl811-hcd.c
    1247 @@ -1251,7 +1251,7 @@ sl811h_hub_control(
    1248 sl811_write(sl811, SL11H_CTLREG1, sl811->ctrl1);
    1249
    1250 mod_timer(&sl811->timer, jiffies
    1251 - + msecs_to_jiffies(20));
    1252 + + msecs_to_jiffies(USB_RESUME_TIMEOUT));
    1253 break;
    1254 case USB_PORT_FEAT_POWER:
    1255 port_power(sl811, 0);
    1256 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1257 index 9948890ef93e..bc7a886e3c36 100644
    1258 --- a/drivers/usb/host/xhci-ring.c
    1259 +++ b/drivers/usb/host/xhci-ring.c
    1260 @@ -1697,7 +1697,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
    1261 } else {
    1262 xhci_dbg(xhci, "resume HS port %d\n", port_id);
    1263 bus_state->resume_done[faked_port_index] = jiffies +
    1264 - msecs_to_jiffies(20);
    1265 + msecs_to_jiffies(USB_RESUME_TIMEOUT);
    1266 set_bit(faked_port_index, &bus_state->resuming_ports);
    1267 mod_timer(&hcd->rh_timer,
    1268 bus_state->resume_done[faked_port_index]);
    1269 diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
    1270 index a9984c700d2c..5f79d8e2caab 100644
    1271 --- a/drivers/usb/phy/phy.c
    1272 +++ b/drivers/usb/phy/phy.c
    1273 @@ -78,7 +78,9 @@ static void devm_usb_phy_release(struct device *dev, void *res)
    1274
    1275 static int devm_usb_phy_match(struct device *dev, void *res, void *match_data)
    1276 {
    1277 - return res == match_data;
    1278 + struct usb_phy **phy = res;
    1279 +
    1280 + return *phy == match_data;
    1281 }
    1282
    1283 /**
    1284 diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
    1285 index bc922c47d046..37e62c7b3273 100644
    1286 --- a/drivers/video/console/Kconfig
    1287 +++ b/drivers/video/console/Kconfig
    1288 @@ -6,7 +6,10 @@ menu "Console display driver support"
    1289
    1290 config VGA_CONSOLE
    1291 bool "VGA text console" if EXPERT || !X86
    1292 - depends on !4xx && !8xx && !SPARC && !M68K && !PARISC && !FRV && !SUPERH && !BLACKFIN && !AVR32 && !MN10300 && (!ARM || ARCH_FOOTBRIDGE || ARCH_INTEGRATOR || ARCH_NETWINDER)
    1293 + depends on !4xx && !8xx && !SPARC && !M68K && !PARISC && !FRV && \
    1294 + !SUPERH && !BLACKFIN && !AVR32 && !MN10300 && !CRIS && \
    1295 + (!ARM || ARCH_FOOTBRIDGE || ARCH_INTEGRATOR || ARCH_NETWINDER) && \
    1296 + !ARM64
    1297 default y
    1298 help
    1299 Saying Y here will allow you to use Linux in text mode through a
    1300 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    1301 index 3c4d8797ea9a..53f620a4350e 100644
    1302 --- a/fs/binfmt_elf.c
    1303 +++ b/fs/binfmt_elf.c
    1304 @@ -756,6 +756,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
    1305 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
    1306 int elf_prot = 0, elf_flags;
    1307 unsigned long k, vaddr;
    1308 + unsigned long total_size = 0;
    1309
    1310 if (elf_ppnt->p_type != PT_LOAD)
    1311 continue;
    1312 @@ -820,10 +821,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
    1313 #else
    1314 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
    1315 #endif
    1316 + total_size = total_mapping_size(elf_phdata,
    1317 + loc->elf_ex.e_phnum);
    1318 + if (!total_size) {
    1319 + error = -EINVAL;
    1320 + goto out_free_dentry;
    1321 + }
    1322 }
    1323
    1324 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
    1325 - elf_prot, elf_flags, 0);
    1326 + elf_prot, elf_flags, total_size);
    1327 if (BAD_ADDR(error)) {
    1328 send_sig(SIGKILL, current, 0);
    1329 retval = IS_ERR((void *)error) ?
    1330 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
    1331 index f99c71e40f8b..07f167a1d271 100644
    1332 --- a/fs/btrfs/extent-tree.c
    1333 +++ b/fs/btrfs/extent-tree.c
    1334 @@ -6363,12 +6363,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
    1335 return -ENOSPC;
    1336 }
    1337
    1338 - if (btrfs_test_opt(root, DISCARD))
    1339 - ret = btrfs_discard_extent(root, start, len, NULL);
    1340 -
    1341 if (pin)
    1342 pin_down_extent(root, cache, start, len, 1);
    1343 else {
    1344 + if (btrfs_test_opt(root, DISCARD))
    1345 + ret = btrfs_discard_extent(root, start, len, NULL);
    1346 btrfs_add_free_space(cache, start, len);
    1347 btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
    1348 }
    1349 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
    1350 index 783906c687b5..dbefa6c609f4 100644
    1351 --- a/fs/btrfs/ioctl.c
    1352 +++ b/fs/btrfs/ioctl.c
    1353 @@ -2572,6 +2572,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
    1354 if (off + len == src->i_size)
    1355 len = ALIGN(src->i_size, bs) - off;
    1356
    1357 + if (len == 0) {
    1358 + ret = 0;
    1359 + goto out_unlock;
    1360 + }
    1361 +
    1362 /* verify the end result is block aligned */
    1363 if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
    1364 !IS_ALIGNED(destoff, bs))
    1365 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    1366 index f1312173fa90..facf8590b714 100644
    1367 --- a/fs/ext4/namei.c
    1368 +++ b/fs/ext4/namei.c
    1369 @@ -1880,7 +1880,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    1370 struct inode *inode)
    1371 {
    1372 struct inode *dir = dentry->d_parent->d_inode;
    1373 - struct buffer_head *bh;
    1374 + struct buffer_head *bh = NULL;
    1375 struct ext4_dir_entry_2 *de;
    1376 struct ext4_dir_entry_tail *t;
    1377 struct super_block *sb;
    1378 @@ -1905,14 +1905,14 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    1379 return retval;
    1380 if (retval == 1) {
    1381 retval = 0;
    1382 - return retval;
    1383 + goto out;
    1384 }
    1385 }
    1386
    1387 if (is_dx(dir)) {
    1388 retval = ext4_dx_add_entry(handle, dentry, inode);
    1389 if (!retval || (retval != ERR_BAD_DX_DIR))
    1390 - return retval;
    1391 + goto out;
    1392 ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
    1393 dx_fallback++;
    1394 ext4_mark_inode_dirty(handle, dir);
    1395 @@ -1924,14 +1924,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    1396 return PTR_ERR(bh);
    1397
    1398 retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
    1399 - if (retval != -ENOSPC) {
    1400 - brelse(bh);
    1401 - return retval;
    1402 - }
    1403 + if (retval != -ENOSPC)
    1404 + goto out;
    1405
    1406 if (blocks == 1 && !dx_fallback &&
    1407 - EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
    1408 - return make_indexed_dir(handle, dentry, inode, bh);
    1409 + EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
    1410 + retval = make_indexed_dir(handle, dentry, inode, bh);
    1411 + bh = NULL; /* make_indexed_dir releases bh */
    1412 + goto out;
    1413 + }
    1414 brelse(bh);
    1415 }
    1416 bh = ext4_append(handle, dir, &block);
    1417 @@ -1947,6 +1948,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    1418 }
    1419
    1420 retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
    1421 +out:
    1422 brelse(bh);
    1423 if (retval == 0)
    1424 ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
    1425 diff --git a/fs/namei.c b/fs/namei.c
    1426 index f7c4393f8535..036c21246d6a 100644
    1427 --- a/fs/namei.c
    1428 +++ b/fs/namei.c
    1429 @@ -1542,7 +1542,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
    1430
    1431 if (should_follow_link(inode, follow)) {
    1432 if (nd->flags & LOOKUP_RCU) {
    1433 - if (unlikely(unlazy_walk(nd, path->dentry))) {
    1434 + if (unlikely(nd->path.mnt != path->mnt ||
    1435 + unlazy_walk(nd, path->dentry))) {
    1436 err = -ECHILD;
    1437 goto out_err;
    1438 }
    1439 @@ -2824,7 +2825,8 @@ finish_lookup:
    1440
    1441 if (should_follow_link(inode, !symlink_ok)) {
    1442 if (nd->flags & LOOKUP_RCU) {
    1443 - if (unlikely(unlazy_walk(nd, path->dentry))) {
    1444 + if (unlikely(nd->path.mnt != path->mnt ||
    1445 + unlazy_walk(nd, path->dentry))) {
    1446 error = -ECHILD;
    1447 goto out;
    1448 }
    1449 diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
    1450 index a64adcc29ae5..f819e813c8ac 100644
    1451 --- a/include/acpi/actypes.h
    1452 +++ b/include/acpi/actypes.h
    1453 @@ -198,9 +198,29 @@ typedef int INT32;
    1454 typedef s32 acpi_native_int;
    1455
    1456 typedef u32 acpi_size;
    1457 +
    1458 +#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
    1459 +
    1460 +/*
    1461 + * OSPMs can define this to shrink the size of the structures for 32-bit
    1462 + * none PAE environment. ASL compiler may always define this to generate
    1463 + * 32-bit OSPM compliant tables.
    1464 + */
    1465 typedef u32 acpi_io_address;
    1466 typedef u32 acpi_physical_address;
    1467
    1468 +#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
    1469 +
    1470 +/*
    1471 + * It is reported that, after some calculations, the physical addresses can
    1472 + * wrap over the 32-bit boundary on 32-bit PAE environment.
    1473 + * https://bugzilla.kernel.org/show_bug.cgi?id=87971
    1474 + */
    1475 +typedef u64 acpi_io_address;
    1476 +typedef u64 acpi_physical_address;
    1477 +
    1478 +#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
    1479 +
    1480 #define ACPI_MAX_PTR ACPI_UINT32_MAX
    1481 #define ACPI_SIZE_MAX ACPI_UINT32_MAX
    1482
    1483 diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
    1484 index ef04b36ca6ed..f7db107abb04 100644
    1485 --- a/include/acpi/platform/acenv.h
    1486 +++ b/include/acpi/platform/acenv.h
    1487 @@ -76,6 +76,7 @@
    1488 #define ACPI_LARGE_NAMESPACE_NODE
    1489 #define ACPI_DATA_TABLE_DISASSEMBLY
    1490 #define ACPI_SINGLE_THREADED
    1491 +#define ACPI_32BIT_PHYSICAL_ADDRESS
    1492 #endif
    1493
    1494 /* acpi_exec configuration. Multithreaded with full AML debugger */
    1495 diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
    1496 index c1a1216e29ce..87b27263f5e2 100644
    1497 --- a/include/asm-generic/sections.h
    1498 +++ b/include/asm-generic/sections.h
    1499 @@ -3,6 +3,8 @@
    1500
    1501 /* References to section boundaries */
    1502
    1503 +#include <linux/compiler.h>
    1504 +
    1505 extern char _text[], _stext[], _etext[];
    1506 extern char _data[], _sdata[], _edata[];
    1507 extern char __bss_start[], __bss_stop[];
    1508 @@ -18,6 +20,8 @@ extern char __start_rodata[], __end_rodata[];
    1509 /* Start and end of .ctors section - used for constructor calls. */
    1510 extern char __ctors_start[], __ctors_end[];
    1511
    1512 +extern __visible const void __nosave_begin, __nosave_end;
    1513 +
    1514 /* function descriptor handling (if any). Override
    1515 * in asm/sections.h */
    1516 #ifndef dereference_function_descriptor
    1517 diff --git a/include/linux/usb.h b/include/linux/usb.h
    1518 index a0bee5a28d1a..28bd3a898cba 100644
    1519 --- a/include/linux/usb.h
    1520 +++ b/include/linux/usb.h
    1521 @@ -206,6 +206,32 @@ void usb_put_intf(struct usb_interface *intf);
    1522 #define USB_MAXINTERFACES 32
    1523 #define USB_MAXIADS (USB_MAXINTERFACES/2)
    1524
    1525 +/*
    1526 + * USB Resume Timer: Every Host controller driver should drive the resume
    1527 + * signalling on the bus for the amount of time defined by this macro.
    1528 + *
    1529 + * That way we will have a 'stable' behavior among all HCDs supported by Linux.
    1530 + *
    1531 + * Note that the USB Specification states we should drive resume for *at least*
    1532 + * 20 ms, but it doesn't give an upper bound. This creates two possible
    1533 + * situations which we want to avoid:
    1534 + *
    1535 + * (a) sometimes an msleep(20) might expire slightly before 20 ms, which causes
    1536 + * us to fail USB Electrical Tests, thus failing Certification
    1537 + *
    1538 + * (b) Some (many) devices actually need more than 20 ms of resume signalling,
    1539 + * and while we can argue that's against the USB Specification, we don't have
    1540 + * control over which devices a certification laboratory will be using for
    1541 + * certification. If CertLab uses a device which was tested against Windows and
    1542 + * that happens to have relaxed resume signalling rules, we might fall into
    1543 + * situations where we fail interoperability and electrical tests.
    1544 + *
    1545 + * In order to avoid both conditions, we're using a 40 ms resume timeout, which
    1546 + * should cope with both LPJ calibration errors and devices not following every
    1547 + * detail of the USB Specification.
    1548 + */
    1549 +#define USB_RESUME_TIMEOUT 40 /* ms */
    1550 +
    1551 /**
    1552 * struct usb_interface_cache - long-term representation of a device interface
    1553 * @num_altsetting: number of altsettings defined.
    1554 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
    1555 index afadcf7b4a22..118323bc8529 100644
    1556 --- a/kernel/ptrace.c
    1557 +++ b/kernel/ptrace.c
    1558 @@ -720,6 +720,8 @@ static int ptrace_peek_siginfo(struct task_struct *child,
    1559 static int ptrace_resume(struct task_struct *child, long request,
    1560 unsigned long data)
    1561 {
    1562 + bool need_siglock;
    1563 +
    1564 if (!valid_signal(data))
    1565 return -EIO;
    1566
    1567 @@ -747,8 +749,26 @@ static int ptrace_resume(struct task_struct *child, long request,
    1568 user_disable_single_step(child);
    1569 }
    1570
    1571 + /*
    1572 + * Change ->exit_code and ->state under siglock to avoid the race
    1573 + * with wait_task_stopped() in between; a non-zero ->exit_code will
    1574 + * wrongly look like another report from tracee.
    1575 + *
    1576 + * Note that we need siglock even if ->exit_code == data and/or this
    1577 + * status was not reported yet, the new status must not be cleared by
    1578 + * wait_task_stopped() after resume.
    1579 + *
    1580 + * If data == 0 we do not care if wait_task_stopped() reports the old
    1581 + * status and clears the code too; this can't race with the tracee, it
    1582 + * takes siglock after resume.
    1583 + */
    1584 + need_siglock = data && !thread_group_empty(current);
    1585 + if (need_siglock)
    1586 + spin_lock_irq(&child->sighand->siglock);
    1587 child->exit_code = data;
    1588 wake_up_state(child, __TASK_TRACED);
    1589 + if (need_siglock)
    1590 + spin_unlock_irq(&child->sighand->siglock);
    1591
    1592 return 0;
    1593 }
    1594 diff --git a/kernel/softirq.c b/kernel/softirq.c
    1595 index 787b3a032429..21956f00cb51 100644
    1596 --- a/kernel/softirq.c
    1597 +++ b/kernel/softirq.c
    1598 @@ -774,9 +774,13 @@ static void run_ksoftirqd(unsigned int cpu)
    1599 local_irq_disable();
    1600 if (local_softirq_pending()) {
    1601 __do_softirq();
    1602 - rcu_note_context_switch(cpu);
    1603 local_irq_enable();
    1604 cond_resched();
    1605 +
    1606 + preempt_disable();
    1607 + rcu_note_context_switch(cpu);
    1608 + preempt_enable();
    1609 +
    1610 return;
    1611 }
    1612 local_irq_enable();
    1613 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
    1614 index 3d9fee3a80b3..ab21b8c66535 100644
    1615 --- a/kernel/trace/ring_buffer.c
    1616 +++ b/kernel/trace/ring_buffer.c
    1617 @@ -2650,7 +2650,7 @@ static DEFINE_PER_CPU(unsigned int, current_context);
    1618
    1619 static __always_inline int trace_recursive_lock(void)
    1620 {
    1621 - unsigned int val = this_cpu_read(current_context);
    1622 + unsigned int val = __this_cpu_read(current_context);
    1623 int bit;
    1624
    1625 if (in_interrupt()) {
    1626 @@ -2667,18 +2667,17 @@ static __always_inline int trace_recursive_lock(void)
    1627 return 1;
    1628
    1629 val |= (1 << bit);
    1630 - this_cpu_write(current_context, val);
    1631 + __this_cpu_write(current_context, val);
    1632
    1633 return 0;
    1634 }
    1635
    1636 static __always_inline void trace_recursive_unlock(void)
    1637 {
    1638 - unsigned int val = this_cpu_read(current_context);
    1639 + unsigned int val = __this_cpu_read(current_context);
    1640
    1641 - val--;
    1642 - val &= this_cpu_read(current_context);
    1643 - this_cpu_write(current_context, val);
    1644 + val &= val & (val - 1);
    1645 + __this_cpu_write(current_context, val);
    1646 }
    1647
    1648 #else
    1649 diff --git a/lib/string.c b/lib/string.c
    1650 index 43d0781daf47..cb9ea2181557 100644
    1651 --- a/lib/string.c
    1652 +++ b/lib/string.c
    1653 @@ -598,7 +598,7 @@ EXPORT_SYMBOL(memset);
    1654 void memzero_explicit(void *s, size_t count)
    1655 {
    1656 memset(s, 0, count);
    1657 - OPTIMIZER_HIDE_VAR(s);
    1658 + barrier();
    1659 }
    1660 EXPORT_SYMBOL(memzero_explicit);
    1661
    1662 diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
    1663 index 31ee5c6033df..479e8a63125a 100644
    1664 --- a/net/ipv4/ip_forward.c
    1665 +++ b/net/ipv4/ip_forward.c
    1666 @@ -126,6 +126,9 @@ int ip_forward(struct sk_buff *skb)
    1667 struct rtable *rt; /* Route we use */
    1668 struct ip_options *opt = &(IPCB(skb)->opt);
    1669
    1670 + if (unlikely(skb->sk))
    1671 + goto drop;
    1672 +
    1673 if (skb_warn_if_lro(skb))
    1674 goto drop;
    1675
    1676 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1677 index 7681a1bbd97f..76c80b59e80f 100644
    1678 --- a/net/ipv4/tcp_output.c
    1679 +++ b/net/ipv4/tcp_output.c
    1680 @@ -2571,39 +2571,65 @@ begin_fwd:
    1681 }
    1682 }
    1683
    1684 -/* Send a fin. The caller locks the socket for us. This cannot be
    1685 - * allowed to fail queueing a FIN frame under any circumstances.
    1686 +/* We allow to exceed memory limits for FIN packets to expedite
    1687 + * connection tear down and (memory) recovery.
    1688 + * Otherwise tcp_send_fin() could be tempted to either delay FIN
    1689 + * or even be forced to close flow without any FIN.
    1690 + */
    1691 +static void sk_forced_wmem_schedule(struct sock *sk, int size)
    1692 +{
    1693 + int amt, status;
    1694 +
    1695 + if (size <= sk->sk_forward_alloc)
    1696 + return;
    1697 + amt = sk_mem_pages(size);
    1698 + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
    1699 + sk_memory_allocated_add(sk, amt, &status);
    1700 +}
    1701 +
    1702 +/* Send a FIN. The caller locks the socket for us.
    1703 + * We should try to send a FIN packet really hard, but eventually give up.
    1704 */
    1705 void tcp_send_fin(struct sock *sk)
    1706 {
    1707 + struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk);
    1708 struct tcp_sock *tp = tcp_sk(sk);
    1709 - struct sk_buff *skb = tcp_write_queue_tail(sk);
    1710 - int mss_now;
    1711
    1712 - /* Optimization, tack on the FIN if we have a queue of
    1713 - * unsent frames. But be careful about outgoing SACKS
    1714 - * and IP options.
    1715 + /* Optimization, tack on the FIN if we have one skb in write queue and
    1716 + * this skb was not yet sent, or we are under memory pressure.
    1717 + * Note: in the latter case, FIN packet will be sent after a timeout,
    1718 + * as TCP stack thinks it has already been transmitted.
    1719 */
    1720 - mss_now = tcp_current_mss(sk);
    1721 -
    1722 - if (tcp_send_head(sk) != NULL) {
    1723 - TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
    1724 - TCP_SKB_CB(skb)->end_seq++;
    1725 + if (tskb && (tcp_send_head(sk) || sk_under_memory_pressure(sk))) {
    1726 +coalesce:
    1727 + TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
    1728 + TCP_SKB_CB(tskb)->end_seq++;
    1729 tp->write_seq++;
    1730 + if (!tcp_send_head(sk)) {
    1731 + /* This means tskb was already sent.
    1732 + * Pretend we included the FIN on previous transmit.
    1733 + * We need to set tp->snd_nxt to the value it would have
    1734 + * if FIN had been sent. This is because retransmit path
    1735 + * does not change tp->snd_nxt.
    1736 + */
    1737 + tp->snd_nxt++;
    1738 + return;
    1739 + }
    1740 } else {
    1741 - /* Socket is locked, keep trying until memory is available. */
    1742 - for (;;) {
    1743 - skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
    1744 - if (skb)
    1745 - break;
    1746 - yield();
    1747 + skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
    1748 + if (unlikely(!skb)) {
    1749 + if (tskb)
    1750 + goto coalesce;
    1751 + return;
    1752 }
    1753 + skb_reserve(skb, MAX_TCP_HEADER);
    1754 + sk_forced_wmem_schedule(sk, skb->truesize);
    1755 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
    1756 tcp_init_nondata_skb(skb, tp->write_seq,
    1757 TCPHDR_ACK | TCPHDR_FIN);
    1758 tcp_queue_skb(sk, skb);
    1759 }
    1760 - __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
    1761 + __tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF);
    1762 }
    1763
    1764 /* We get here when a process closes a file descriptor (either due to
    1765 diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
    1766 index 2ca9f2e93139..53745f4c2bf5 100644
    1767 --- a/sound/pci/emu10k1/emuproc.c
    1768 +++ b/sound/pci/emu10k1/emuproc.c
    1769 @@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
    1770 struct snd_emu10k1 *emu = entry->private_data;
    1771 u32 value;
    1772 u32 value2;
    1773 - unsigned long flags;
    1774 u32 rate;
    1775
    1776 if (emu->card_capabilities->emu_model) {
    1777 - spin_lock_irqsave(&emu->emu_lock, flags);
    1778 snd_emu1010_fpga_read(emu, 0x38, &value);
    1779 - spin_unlock_irqrestore(&emu->emu_lock, flags);
    1780 if ((value & 0x1) == 0) {
    1781 - spin_lock_irqsave(&emu->emu_lock, flags);
    1782 snd_emu1010_fpga_read(emu, 0x2a, &value);
    1783 snd_emu1010_fpga_read(emu, 0x2b, &value2);
    1784 - spin_unlock_irqrestore(&emu->emu_lock, flags);
    1785 rate = 0x1770000 / (((value << 5) | value2)+1);
    1786 snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
    1787 } else {
    1788 snd_iprintf(buffer, "ADAT Unlocked\n");
    1789 }
    1790 - spin_lock_irqsave(&emu->emu_lock, flags);
    1791 snd_emu1010_fpga_read(emu, 0x20, &value);
    1792 - spin_unlock_irqrestore(&emu->emu_lock, flags);
    1793 if ((value & 0x4) == 0) {
    1794 - spin_lock_irqsave(&emu->emu_lock, flags);
    1795 snd_emu1010_fpga_read(emu, 0x28, &value);
    1796 snd_emu1010_fpga_read(emu, 0x29, &value2);
    1797 - spin_unlock_irqrestore(&emu->emu_lock, flags);
    1798 rate = 0x1770000 / (((value << 5) | value2)+1);
    1799 snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
    1800 } else {
    1801 @@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
    1802 {
    1803 struct snd_emu10k1 *emu = entry->private_data;
    1804 u32 value;
    1805 - unsigned long flags;
    1806 int i;
    1807 snd_iprintf(buffer, "EMU1010 Registers:\n\n");
    1808
    1809 for(i = 0; i < 0x40; i+=1) {
    1810 - spin_lock_irqsave(&emu->emu_lock, flags);
    1811 snd_emu1010_fpga_read(emu, i, &value);
    1812 - spin_unlock_irqrestore(&emu->emu_lock, flags);
    1813 snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
    1814 }
    1815 }
    1816 diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile
    1817 index d1b3a361e526..4039854560d0 100644
    1818 --- a/tools/power/x86/turbostat/Makefile
    1819 +++ b/tools/power/x86/turbostat/Makefile
    1820 @@ -1,8 +1,12 @@
    1821 CC = $(CROSS_COMPILE)gcc
    1822 -BUILD_OUTPUT := $(PWD)
    1823 +BUILD_OUTPUT := $(CURDIR)
    1824 PREFIX := /usr
    1825 DESTDIR :=
    1826
    1827 +ifeq ("$(origin O)", "command line")
    1828 + BUILD_OUTPUT := $(O)
    1829 +endif
    1830 +
    1831 turbostat : turbostat.c
    1832 CFLAGS += -Wall
    1833 CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"'
    1834 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    1835 index a17f190be58e..1d4b8bed4e48 100644
    1836 --- a/virt/kvm/kvm_main.c
    1837 +++ b/virt/kvm/kvm_main.c
    1838 @@ -1549,8 +1549,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
    1839 ghc->generation = slots->generation;
    1840 ghc->len = len;
    1841 ghc->memslot = gfn_to_memslot(kvm, start_gfn);
    1842 - ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
    1843 - if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
    1844 + ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
    1845 + if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
    1846 ghc->hva += offset;
    1847 } else {
    1848 /*