20 files changed, 103 insertions, 37 deletions

diff --git a/arch/i386/boot/memory.c b/arch/i386/boot/memory.c
index bccaa1cf6645..378353956b5d 100644
--- a/arch/i386/boot/memory.c
+++ b/arch/i386/boot/memory.c
@@ -28,11 +28,14 @@ static int detect_memory_e820(void)
 
         do {
                 size = sizeof(struct e820entry);
-                id = SMAP;
+
+                /* Important: %edx is clobbered by some BIOSes,
+                   so it must be either used for the error output
+                   or explicitly marked clobbered. */
                 asm("int $0x15; setc %0"
-                    : "=am" (err), "+b" (next), "+d" (id), "+c" (size),
+                    : "=d" (err), "+b" (next), "=a" (id), "+c" (size),
                       "=m" (*desc)
-                    : "D" (desc), "a" (0xe820));
+                    : "D" (desc), "d" (SMAP), "a" (0xe820));
 
                 /* Some BIOSes stop returning SMAP in the middle of
                    the search loop.  We don't know exactly how the BIOS
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index b3ed731a24c6..dd68afce7da5 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -525,5 +525,5 @@ sys_call_table:
         PTR     compat_sys_signalfd
         PTR     compat_sys_timerfd
         PTR     sys_eventfd
-        PTR     sys_fallocate                   /* 4320 */
+        PTR     sys32_fallocate                 /* 4320 */
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/sgi-ip32/ip32-platform.c b/arch/mips/sgi-ip32/ip32-platform.c
index ba3697ee7ff6..7309e48d163d 100644
--- a/arch/mips/sgi-ip32/ip32-platform.c
+++ b/arch/mips/sgi-ip32/ip32-platform.c
@@ -41,8 +41,8 @@ static struct platform_device uart8250_device = {
 
 static int __init uart8250_init(void)
 {
-        uart8250_data[0].iobase = (unsigned long) &mace->isa.serial1;
-        uart8250_data[1].iobase = (unsigned long) &mace->isa.serial1;
+        uart8250_data[0].membase = (void __iomem *) &mace->isa.serial1;
+        uart8250_data[1].membase = (void __iomem *) &mace->isa.serial1;
 
         return platform_device_register(&uart8250_device);
 }
diff --git a/arch/powerpc/boot/dts/mpc8349emitx.dts b/arch/powerpc/boot/dts/mpc8349emitx.dts
index 502f47c01797..44c065a6b5e7 100644
--- a/arch/powerpc/boot/dts/mpc8349emitx.dts
+++ b/arch/powerpc/boot/dts/mpc8349emitx.dts
@@ -99,6 +99,7 @@
                         #size-cells = <0>;
                         interrupt-parent = < &ipic >;
                         interrupts = <26 8>;
+                        dr_mode = "peripheral";
                         phy_type = "ulpi";
                 };
 
diff --git a/arch/powerpc/platforms/83xx/usb.c b/arch/powerpc/platforms/83xx/usb.c
index e7fdf013cd39..eafe7605cdac 100644
--- a/arch/powerpc/platforms/83xx/usb.c
+++ b/arch/powerpc/platforms/83xx/usb.c
@@ -76,14 +76,14 @@ int mpc834x_usb_cfg(void)
                         if (port0_is_dr)
                                 printk(KERN_WARNING
                                         "834x USB port0 can't be used by both DR and MPH!\n");
-                        sicrl |= MPC834X_SICRL_USB0;
+                        sicrl &= ~MPC834X_SICRL_USB0;
                 }
                 prop = of_get_property(np, "port1", NULL);
                 if (prop) {
                         if (port1_is_dr)
                                 printk(KERN_WARNING
                                         "834x USB port1 can't be used by both DR and MPH!\n");
-                        sicrl |= MPC834X_SICRL_USB1;
+                        sicrl &= ~MPC834X_SICRL_USB1;
                 }
                 of_node_put(np);
         }
diff --git a/arch/powerpc/sysdev/commproc.c b/arch/powerpc/sysdev/commproc.c
index 4f67b89ba1d0..dd5417aec1b4 100644
--- a/arch/powerpc/sysdev/commproc.c
+++ b/arch/powerpc/sysdev/commproc.c
@@ -395,4 +395,4 @@ uint cpm_dpram_phys(u8* addr)
 {
         return (dpram_pbase + (uint)(addr - dpram_vbase));
 }
-EXPORT_SYMBOL(cpm_dpram_addr);
+EXPORT_SYMBOL(cpm_dpram_phys);
diff --git a/arch/ppc/8xx_io/commproc.c b/arch/ppc/8xx_io/commproc.c
index 7088428e1fe2..9da880be4dc0 100644
--- a/arch/ppc/8xx_io/commproc.c
+++ b/arch/ppc/8xx_io/commproc.c
@@ -459,7 +459,7 @@ EXPORT_SYMBOL(cpm_dpdump);
 
 void *cpm_dpram_addr(unsigned long offset)
 {
-        return ((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem + offset;
+        return (void *)(dpram_vbase + offset);
 }
 EXPORT_SYMBOL(cpm_dpram_addr);
 
diff --git a/drivers/char/drm/i915_drv.h b/drivers/char/drm/i915_drv.h
index 737088bd0780..28b98733beb8 100644
--- a/drivers/char/drm/i915_drv.h
+++ b/drivers/char/drm/i915_drv.h
@@ -210,6 +210,12 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define I915REG_INT_MASK_R      0x020a8
 #define I915REG_INT_ENABLE_R    0x020a0
 
+#define I915REG_PIPEASTAT       0x70024
+#define I915REG_PIPEBSTAT       0x71024
+
+#define I915_VBLANK_INTERRUPT_ENABLE    (1UL<<17)
+#define I915_VBLANK_CLEAR               (1UL<<1)
+
 #define SRX_INDEX               0x3c4
 #define SRX_DATA                0x3c5
 #define SR01                    1
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index 4b4b2ce89863..bb8e9e9c8201 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -214,6 +214,10 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
         struct drm_device *dev = (struct drm_device *) arg;
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         u16 temp;
+        u32 pipea_stats, pipeb_stats;
+
+        pipea_stats = I915_READ(I915REG_PIPEASTAT);
+        pipeb_stats = I915_READ(I915REG_PIPEBSTAT);
 
         temp = I915_READ16(I915REG_INT_IDENTITY_R);
 
@@ -225,6 +229,8 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                 return IRQ_NONE;
 
         I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
+        (void) I915_READ16(I915REG_INT_IDENTITY_R);
+        DRM_READMEMORYBARRIER();
 
         dev_priv->sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
 
@@ -252,6 +258,12 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 
                 if (dev_priv->swaps_pending > 0)
                         drm_locked_tasklet(dev, i915_vblank_tasklet);
+                I915_WRITE(I915REG_PIPEASTAT,
+                        pipea_stats|I915_VBLANK_INTERRUPT_ENABLE|
+                        I915_VBLANK_CLEAR);
+                I915_WRITE(I915REG_PIPEBSTAT,
+                        pipeb_stats|I915_VBLANK_INTERRUPT_ENABLE|
+                        I915_VBLANK_CLEAR);
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
index e2abe18e575d..7c662ee594a3 100644
--- a/drivers/input/joystick/Kconfig
+++ b/drivers/input/joystick/Kconfig
@@ -277,7 +277,7 @@ config JOYSTICK_XPAD_FF
 
 config JOYSTICK_XPAD_LEDS
         bool "LED Support for Xbox360 controller 'BigX' LED"
-        depends on LEDS_CLASS && JOYSTICK_XPAD
+        depends on JOYSTICK_XPAD && (LEDS_CLASS=y || LEDS_CLASS=JOYSTICK_XPAD)
         ---help---
           This option enables support for the LED which surrounds the Big X on
           XBox 360 controller.
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 4c3785c9d4b8..9ecc3adcf6c1 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1726,6 +1726,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
         case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
+        case E1000_DEV_ID_82571PT_QUAD_COPPER:
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                 /* quad port adapters only support WoL on port A */
                 if (!adapter->quad_port_a) {
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index ba120f7fb0be..8604adbe351c 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -387,6 +387,7 @@ e1000_set_mac_type(struct e1000_hw *hw)
         case E1000_DEV_ID_82571EB_SERDES_DUAL:
         case E1000_DEV_ID_82571EB_SERDES_QUAD:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571PT_QUAD_COPPER:
         case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 hw->mac_type = e1000_82571;
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index fe8714655c90..07f0ea73676e 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -475,6 +475,7 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82571EB_QUAD_COPPER 0x10A4
+#define E1000_DEV_ID_82571PT_QUAD_COPPER 0x10D5
 #define E1000_DEV_ID_82571EB_QUAD_FIBER  0x10A5
 #define E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE  0x10BC
 #define E1000_DEV_ID_82571EB_SERDES_DUAL 0x10D9
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4a225950fb43..e7c8951f47fa 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -108,6 +108,7 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x10BC),
         INTEL_E1000_ETHERNET_DEVICE(0x10C4),
         INTEL_E1000_ETHERNET_DEVICE(0x10C5),
+        INTEL_E1000_ETHERNET_DEVICE(0x10D5),
         INTEL_E1000_ETHERNET_DEVICE(0x10D9),
         INTEL_E1000_ETHERNET_DEVICE(0x10DA),
         /* required last entry */
@@ -1101,6 +1102,7 @@ e1000_probe(struct pci_dev *pdev,
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
         case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
+        case E1000_DEV_ID_82571PT_QUAD_COPPER:
                 /* if quad port adapter, disable WoL on all but port A */
                 if (global_quad_port_a != 0)
                         adapter->eeprom_wol = 0;
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 0792031a5cf9..162489b9f599 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -910,6 +910,20 @@ static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2)
         return le;
 }
 
+static void tx_init(struct sky2_port *sky2)
+{
+        struct sky2_tx_le *le;
+
+        sky2->tx_prod = sky2->tx_cons = 0;
+        sky2->tx_tcpsum = 0;
+        sky2->tx_last_mss = 0;
+
+        le = get_tx_le(sky2);
+        le->addr = 0;
+        le->opcode = OP_ADDR64 | HW_OWNER;
+        sky2->tx_addr64 = 0;
+}
+
 static inline struct tx_ring_info *tx_le_re(struct sky2_port *sky2,
                                             struct sky2_tx_le *le)
 {
@@ -1320,7 +1334,8 @@ static int sky2_up(struct net_device *dev)
                                 GFP_KERNEL);
         if (!sky2->tx_ring)
                 goto err_out;
-        sky2->tx_prod = sky2->tx_cons = 0;
+
+        tx_init(sky2);
 
         sky2->rx_le = pci_alloc_consistent(hw->pdev, RX_LE_BYTES,
                                            &sky2->rx_le_map);
@@ -2148,6 +2163,18 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
         sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
         prefetch(sky2->rx_ring + sky2->rx_next);
 
+        if (length < ETH_ZLEN || length > sky2->rx_data_size)
+                goto len_error;
+
+        /* This chip has hardware problems that generates bogus status.
+         * So do only marginal checking and expect higher level protocols
+         * to handle crap frames.
+         */
+        if (sky2->hw->chip_id == CHIP_ID_YUKON_FE_P &&
+            sky2->hw->chip_rev == CHIP_REV_YU_FE2_A0 &&
+            length != count)
+                goto okay;
+
         if (status & GMR_FS_ANY_ERR)
                 goto error;
 
@@ -2156,8 +2183,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
 
         /* if length reported by DMA does not match PHY, packet was truncated */
         if (length != count)
-                goto len_mismatch;
+                goto len_error;
 
+okay:
         if (length < copybreak)
                 skb = receive_copy(sky2, re, length);
         else
@@ -2167,13 +2195,13 @@ resubmit:
 
         return skb;
 
-len_mismatch:
+len_error:
         /* Truncation of overlength packets
            causes PHY length to not match MAC length */
         ++sky2->net_stats.rx_length_errors;
         if (netif_msg_rx_err(sky2) && net_ratelimit())
-                pr_info(PFX "%s: rx length mismatch: length %d status %#x\n",
-                        dev->name, length, status);
+                pr_info(PFX "%s: rx length error: status %#x length %d\n",
+                        dev->name, status, length);
         goto resubmit;
 
 error:
@@ -3934,13 +3962,6 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
         sky2->hw = hw;
         sky2->msg_enable = netif_msg_init(debug, default_msg);
 
-        /* This chip has hardware problems that generates
-         * bogus PHY receive status so by default shut up the message.
-         */
-        if (hw->chip_id == CHIP_ID_YUKON_FE_P &&
-            hw->chip_rev == CHIP_REV_YU_FE2_A0)
-                sky2->msg_enable &= ~NETIF_MSG_RX_ERR;
-
         /* Auto speed and flow control */
         sky2->autoneg = AUTONEG_ENABLE;
         sky2->flow_mode = FC_BOTH;
@@ -3964,8 +3985,12 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
                 dev->features |= NETIF_F_HIGHDMA;
 
 #ifdef SKY2_VLAN_TAG_USED
-        dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-        dev->vlan_rx_register = sky2_vlan_rx_register;
+        /* The workaround for FE+ status conflicts with VLAN tag detection. */
+        if (!(sky2->hw->chip_id == CHIP_ID_YUKON_FE_P &&
+              sky2->hw->chip_rev == CHIP_REV_YU_FE2_A0)) {
+                dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+                dev->vlan_rx_register = sky2_vlan_rx_register;
+        }
 #endif
 
         /* read the mac address */
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.h b/drivers/serial/cpm_uart/cpm_uart_cpm1.h
index a99e45e2b6d8..2a6477834c3e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.h
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.h
@@ -37,6 +37,6 @@ static inline void cpm_set_smc_fcr(volatile smc_uart_t * up)
         up->smc_tfcr = SMC_EB;
 }
 
-#define DPRAM_BASE      ((unsigned char *)&cpmp->cp_dpmem[0])
+#define DPRAM_BASE      ((unsigned char *)cpm_dpram_addr(0))
 
 #endif
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index a49f9feff776..a204484072f3 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -588,16 +588,6 @@ static int nfs_init_server(struct nfs_server *server, const struct nfs_mount_dat
         server->namelen  = data->namlen;
         /* Create a client RPC handle for the NFSv3 ACL management interface */
         nfs_init_server_aclclient(server);
-        if (clp->cl_nfsversion == 3) {
-                if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
-                        server->namelen = NFS3_MAXNAMLEN;
-                if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
-                        server->caps |= NFS_CAP_READDIRPLUS;
-        } else {
-                if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
-                        server->namelen = NFS2_MAXNAMLEN;
-        }
-
         dprintk("<-- nfs_init_server() = 0 [new %p]\n", clp);
         return 0;
 
@@ -794,6 +784,16 @@ struct nfs_server *nfs_create_server(const struct nfs_mount_data *data,
         error = nfs_probe_fsinfo(server, mntfh, &fattr);
         if (error < 0)
                 goto error;
+        if (server->nfs_client->rpc_ops->version == 3) {
+                if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
+                        server->namelen = NFS3_MAXNAMLEN;
+                if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
+                        server->caps |= NFS_CAP_READDIRPLUS;
+        } else {
+                if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
+                        server->namelen = NFS2_MAXNAMLEN;
+        }
+
         if (!(fattr.valid & NFS_ATTR_FATTR)) {
                 error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr);
                 if (error < 0) {
@@ -984,6 +984,9 @@ struct nfs_server *nfs4_create_server(const struct nfs4_mount_data *data,
         if (error < 0)
                 goto error;
 
+        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+                server->namelen = NFS4_MAXNAMLEN;
+
         BUG_ON(!server->nfs_client);
         BUG_ON(!server->nfs_client->rpc_ops);
         BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
@@ -1056,6 +1059,9 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
         if (error < 0)
                 goto error;
 
+        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+                server->namelen = NFS4_MAXNAMLEN;
+
         dprintk("Referral FSID: %llx:%llx\n",
                 (unsigned long long) server->fsid.major,
                 (unsigned long long) server->fsid.minor);
@@ -1115,6 +1121,9 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
         if (error < 0)
                 goto out_free_server;
 
+        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+                server->namelen = NFS4_MAXNAMLEN;
+
         dprintk("Cloned FSID: %llx:%llx\n",
                 (unsigned long long) server->fsid.major,
                 (unsigned long long) server->fsid.minor);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index ea97408e423e..e4a04d16b8b0 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1162,6 +1162,8 @@ static struct dentry *nfs_readdir_lookup(nfs_readdir_descriptor_t *desc)
         }
         if (!desc->plus || !(entry->fattr->valid & NFS_ATTR_FATTR))
                 return NULL;
+        if (name.len > NFS_SERVER(dir)->namelen)
+                return NULL;
         /* Note: caller is already holding the dir->i_mutex! */
         dentry = d_alloc(parent, &name);
         if (dentry == NULL)
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index d1cbf0a0fbb2..522e5ad4d8ad 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -175,6 +175,9 @@ next_component:
                 path++;
         name.len = path - (const char *) name.name;
 
+        if (name.len > NFS4_MAXNAMLEN)
+                return -ENAMETOOLONG;
+
 eat_dot_dir:
         while (*path == '/')
                 path++;
diff --git a/include/asm-mips/page.h b/include/asm-mips/page.h
index b92dd8c760da..e3301e54d559 100644
--- a/include/asm-mips/page.h
+++ b/include/asm-mips/page.h
@@ -142,7 +142,7 @@ typedef struct { unsigned long pgprot; } pgprot_t;
 /*
  * __pa()/__va() should be used only during mem init.
  */
-#if defined(CONFIG_64BIT) && !defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
 #define __pa(x)                                                         \
 ({                                                                      \
     unsigned long __x = (unsigned long)(x);                             \