11 files changed, 44 insertions, 25 deletions

diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index 2570fcc7665d..812312542e50 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -440,7 +440,7 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
         unsigned int gtlb_index;
 
         gtlb_index = kvmppc_get_gpr(vcpu, ra);
-        if (gtlb_index > KVM44x_GUEST_TLB_SIZE) {
+        if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
                 printk("%s: index %d\n", __func__, gtlb_index);
                 kvmppc_dump_vcpu(vcpu);
                 return EMULATE_FAIL;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 2ba58206812a..737361fcd503 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2067,7 +2067,7 @@ static int cpuid_interception(struct vcpu_svm *svm)
 static int iret_interception(struct vcpu_svm *svm)
 {
         ++svm->vcpu.stat.nmi_window_exits;
-        svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
         svm->vcpu.arch.hflags |= HF_IRET_MASK;
         return 1;
 }
@@ -2479,7 +2479,7 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 
         svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
         vcpu->arch.hflags |= HF_NMI_MASK;
-        svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
         ++vcpu->stat.nmi_injections;
 }
 
@@ -2539,10 +2539,10 @@ static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
 
         if (masked) {
                 svm->vcpu.arch.hflags |= HF_NMI_MASK;
-                svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
         } else {
                 svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
-                svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
         }
 }
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bc933cfb4e66..2f8db0ec8ae4 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2703,8 +2703,7 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
                 return 0;
 
         return  !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
-                        (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS |
-                                GUEST_INTR_STATE_NMI));
+                        (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_NMI));
 }
 
 static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3c4ca98ad27f..c4f35b545c1d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1712,6 +1712,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
         if (copy_from_user(cpuid_entries, entries,
                            cpuid->nent * sizeof(struct kvm_cpuid_entry)))
                 goto out_free;
+        vcpu_load(vcpu);
         for (i = 0; i < cpuid->nent; i++) {
                 vcpu->arch.cpuid_entries[i].function = cpuid_entries[i].function;
                 vcpu->arch.cpuid_entries[i].eax = cpuid_entries[i].eax;
@@ -1729,6 +1730,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
         r = 0;
         kvm_apic_set_version(vcpu);
         kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
 
 out_free:
         vfree(cpuid_entries);
@@ -1749,9 +1751,11 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
         if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
                            cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
                 goto out;
+        vcpu_load(vcpu);
         vcpu->arch.cpuid_nent = cpuid->nent;
         kvm_apic_set_version(vcpu);
         kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
         return 0;
 
 out:
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 6da962c9b21c..d71f0fc34b46 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1875,6 +1875,7 @@ got_driver:
                  */
                 if (filp->f_op == &hung_up_tty_fops)
                         filp->f_op = &tty_fops;
+                unlock_kernel();
                 goto retry_open;
         }
         unlock_kernel();
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index a3d5728b6449..f2ab025ad97a 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -349,6 +349,9 @@ int wm831x_auxadc_read(struct wm831x *wm831x, enum wm831x_auxadc input)
                 goto disable;
         }
 
+        /* If an interrupt arrived late clean up after it */
+        try_wait_for_completion(&wm831x->auxadc_done);
+
         /* Ignore the result to allow us to soldier on without IRQ hookup */
         wait_for_completion_timeout(&wm831x->auxadc_done, msecs_to_jiffies(5));
 
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index e400a3bed063..b5807484b4c9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -363,6 +363,10 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
         reg |= 1 << channel | WM8350_AUXADC_POLL;
         wm8350_reg_write(wm8350, WM8350_DIGITISER_CONTROL_1, reg);
 
+        /* If a late IRQ left the completion signalled then consume
+         * the completion. */
+        try_wait_for_completion(&wm8350->auxadc_done);
+
         /* We ignore the result of the completion and just check for a
          * conversion result, allowing us to soldier on if the IRQ
          * infrastructure is not set up for the chip. */
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4315b23590bd..eacb588a9345 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -120,7 +120,8 @@
 #define  MX2_UCR3_RXDMUXSEL      (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
 #define  UCR4_INVR       (1<<9)  /* Inverted infrared reception */
 #define  UCR4_ENIRI      (1<<8)  /* Serial infrared interrupt enable */
 #define  UCR4_WKEN       (1<<7)  /* Wake interrupt enable */
@@ -591,6 +592,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
         return 0;
 }
 
+/* half the RX buffer size */
+#define CTSTL 16
+
 static int imx_startup(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
@@ -607,6 +611,10 @@ static int imx_startup(struct uart_port *port)
         if (USE_IRDA(sport))
                 temp |= UCR4_IRSC;
 
+        /* set the trigger level for CTS */
+        temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
+        temp |= CTSTL<<  UCR4_CTSTL_SHF;
+
         writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
 
         if (USE_IRDA(sport)) {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index a176ab4bd65b..02469c31bf0b 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -1467,7 +1467,7 @@ mpc52xx_uart_init(void)
         /*
          * Map the PSC FIFO Controller and init if on MPC512x.
          */
-        if (psc_ops->fifoc_init) {
+        if (psc_ops && psc_ops->fifoc_init) {
                 ret = psc_ops->fifoc_init();
                 if (ret)
                         return ret;
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 03a5eb22da2b..7c79c1d76d0c 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -197,7 +197,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
         union kvm_ioapic_redirect_entry entry;
         int ret = 1;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
                 entry = ioapic->redirtbl[irq];
                 level ^= entry.fields.polarity;
@@ -214,7 +214,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
                 }
                 trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 
         return ret;
 }
@@ -238,9 +238,9 @@ static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int vector,
                  * is dropped it will be put into irr and will be delivered
                  * after ack notifier returns.
                  */
-                mutex_unlock(&ioapic->lock);
+                spin_unlock(&ioapic->lock);
                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
-                mutex_lock(&ioapic->lock);
+                spin_lock(&ioapic->lock);
 
                 if (trigger_mode != IOAPIC_LEVEL_TRIG)
                         continue;
@@ -259,9 +259,9 @@ void kvm_ioapic_update_eoi(struct kvm *kvm, int vector, int trigger_mode)
         smp_rmb();
         if (!test_bit(vector, ioapic->handled_vectors))
                 return;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         __kvm_ioapic_update_eoi(ioapic, vector, trigger_mode);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 }
 
 static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
@@ -287,7 +287,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
         ASSERT(!(addr & 0xf));  /* check alignment */
 
         addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         switch (addr) {
         case IOAPIC_REG_SELECT:
                 result = ioapic->ioregsel;
@@ -301,7 +301,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
                 result = 0;
                 break;
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 
         switch (len) {
         case 8:
@@ -338,7 +338,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
         }
 
         addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         switch (addr) {
         case IOAPIC_REG_SELECT:
                 ioapic->ioregsel = data;
@@ -356,7 +356,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
         default:
                 break;
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
 
@@ -386,7 +386,7 @@ int kvm_ioapic_init(struct kvm *kvm)
         ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
         if (!ioapic)
                 return -ENOMEM;
-        mutex_init(&ioapic->lock);
+        spin_lock_init(&ioapic->lock);
         kvm->arch.vioapic = ioapic;
         kvm_ioapic_reset(ioapic);
         kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
@@ -419,9 +419,9 @@ int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
         if (!ioapic)
                 return -EINVAL;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
 
@@ -431,9 +431,9 @@ int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
         if (!ioapic)
                 return -EINVAL;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
         update_handled_vectors(ioapic);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
diff --git a/virt/kvm/ioapic.h b/virt/kvm/ioapic.h
index 8a751b78a430..0b190c34ccc3 100644
--- a/virt/kvm/ioapic.h
+++ b/virt/kvm/ioapic.h
@@ -45,7 +45,7 @@ struct kvm_ioapic {
         struct kvm_io_device dev;
         struct kvm *kvm;
         void (*ack_notifier)(void *opaque, int irq);
-        struct mutex lock;
+        spinlock_t lock;
         DECLARE_BITMAP(handled_vectors, 256);
 };