14 files changed, 135 insertions, 54 deletions

diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index f0863bec186f..d72433f2d310 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -120,7 +120,7 @@ static int i8k_smm(struct smm_regs *regs)
         int eax = regs->eax;
 
 #if defined(CONFIG_X86_64)
-        asm("pushq %%rax\n\t"
+        asm volatile("pushq %%rax\n\t"
                 "movl 0(%%rax),%%edx\n\t"
                 "pushq %%rdx\n\t"
                 "movl 4(%%rax),%%ebx\n\t"
@@ -142,11 +142,11 @@ static int i8k_smm(struct smm_regs *regs)
                 "lahf\n\t"
                 "shrl $8,%%eax\n\t"
                 "andl $1,%%eax\n"
-                :"=a"(rc), "+m" (*regs)
+                :"=a"(rc)
                 :    "a"(regs)
                 :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #else
-        asm("pushl %%eax\n\t"
+        asm volatile("pushl %%eax\n\t"
             "movl 0(%%eax),%%edx\n\t"
             "push %%edx\n\t"
             "movl 4(%%eax),%%ebx\n\t"
@@ -168,7 +168,7 @@ static int i8k_smm(struct smm_regs *regs)
             "lahf\n\t"
             "shrl $8,%%eax\n\t"
             "andl $1,%%eax\n"
-            :"=a"(rc), "+m" (*regs)
+            :"=a"(rc)
             :    "a"(regs)
             :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #endif
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 5624db8c9ad0..003170ea2e39 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -64,17 +64,57 @@ void pci_bus_remove_resources(struct pci_bus *bus)
         }
 }
 
+static bool pci_bus_resource_better(struct resource *res1, bool pos1,
+                                    struct resource *res2, bool pos2)
+{
+        /* If exactly one is positive decode, always prefer that one */
+        if (pos1 != pos2)
+                return pos1 ? true : false;
+
+        /* Prefer the one that contains the highest address */
+        if (res1->end != res2->end)
+                return (res1->end > res2->end) ? true : false;
+
+        /* Otherwise, prefer the one with highest "center of gravity" */
+        if (res1->start != res2->start)
+                return (res1->start > res2->start) ? true : false;
+
+        /* Otherwise, choose one arbitrarily (but consistently) */
+        return (res1 > res2) ? true : false;
+}
+
+static bool pci_bus_resource_positive(struct pci_bus *bus, struct resource *res)
+{
+        struct pci_bus_resource *bus_res;
+
+        /*
+         * This relies on the fact that pci_bus.resource[] refers to P2P or
+         * CardBus bridge base/limit registers, which are always positively
+         * decoded.  The pci_bus.resources list contains host bridge or
+         * subtractively decoded resources.
+         */
+        list_for_each_entry(bus_res, &bus->resources, list) {
+                if (bus_res->res == res)
+                        return (bus_res->flags & PCI_SUBTRACTIVE_DECODE) ?
+                                false : true;
+        }
+        return true;
+}
+
 /*
- * Find the highest-address bus resource below the cursor "res".  If the
- * cursor is NULL, return the highest resource.
+ * Find the next-best bus resource after the cursor "res".  If the cursor is
+ * NULL, return the best resource.  "Best" means that we prefer positive
+ * decode regions over subtractive decode, then those at higher addresses.
  */
 static struct resource *pci_bus_find_resource_prev(struct pci_bus *bus,
                                                    unsigned int type,
                                                    struct resource *res)
 {
+        bool res_pos, r_pos, prev_pos = false;
         struct resource *r, *prev = NULL;
         int i;
 
+        res_pos = pci_bus_resource_positive(bus, res);
         pci_bus_for_each_resource(bus, r, i) {
                 if (!r)
                         continue;
@@ -82,26 +122,14 @@ static struct resource *pci_bus_find_resource_prev(struct pci_bus *bus,
                 if ((r->flags & IORESOURCE_TYPE_BITS) != type)
                         continue;
 
-                /* If this resource is at or past the cursor, skip it */
-                if (res) {
-                        if (r == res)
-                                continue;
-                        if (r->end > res->end)
-                                continue;
-                        if (r->end == res->end && r->start > res->start)
-                                continue;
+                r_pos = pci_bus_resource_positive(bus, r);
+                if (!res || pci_bus_resource_better(res, res_pos, r, r_pos)) {
+                        if (!prev || pci_bus_resource_better(r, r_pos,
+                                                             prev, prev_pos)) {
+                                prev = r;
+                                prev_pos = r_pos;
+                        }
                 }
-
-                if (!prev)
-                        prev = r;
-
-                /*
-                 * A small resource is higher than a large one that ends at
-                 * the same address.
-                 */
-                if (r->end > prev->end ||
-                    (r->end == prev->end && r->start > prev->start))
-                        prev = r;
         }
 
         return prev;
diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 5becbdee4027..2850e64dedae 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -276,6 +276,12 @@ int __init ibmphp_access_ebda (void)
 
         for (;;) {
                 offset = next_offset;
+
+                /* Make sure what we read is still in the mapped section */
+                if (WARN(offset > (ebda_sz * 1024 - 4),
+                         "ibmphp_ebda: next read is beyond ebda_sz\n"))
+                        break;
+
                 next_offset = readw (io_mem + offset);  /* offset of next blk */
 
                 offset += 2;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index b5a7d9bfcb24..95712a375cd5 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -705,17 +705,21 @@ void pci_remove_legacy_files(struct pci_bus *b)
 
 #ifdef HAVE_PCI_MMAP
 
-int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
+int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
+                  enum pci_mmap_api mmap_api)
 {
-        unsigned long nr, start, size;
+        unsigned long nr, start, size, pci_start;
 
+        if (pci_resource_len(pdev, resno) == 0)
+                return 0;
         nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
         start = vma->vm_pgoff;
         size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
-        if (start < size && size - start >= nr)
+        pci_start = (mmap_api == PCI_MMAP_SYSFS) ?
+                        pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
+        if (start >= pci_start && start < pci_start + size &&
+                        start + nr <= pci_start + size)
                 return 1;
-        WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
-                current->comm, start, start+nr, pci_name(pdev), resno, size);
         return 0;
 }
 
@@ -745,8 +749,15 @@ pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
         if (i >= PCI_ROM_RESOURCE)
                 return -ENODEV;
 
-        if (!pci_mmap_fits(pdev, i, vma))
+        if (!pci_mmap_fits(pdev, i, vma, PCI_MMAP_SYSFS)) {
+                WARN(1, "process \"%s\" tried to map 0x%08lx bytes "
+                        "at page 0x%08lx on %s BAR %d (start 0x%16Lx, size 0x%16Lx)\n",
+                        current->comm, vma->vm_end-vma->vm_start, vma->vm_pgoff,
+                        pci_name(pdev), i,
+                        (u64)pci_resource_start(pdev, i),
+                        (u64)pci_resource_len(pdev, i));
                 return -EINVAL;
+        }
 
         /* pci_mmap_page_range() expects the same kind of entry as coming
          * from /proc/bus/pci/ which is a "user visible" value. If this is
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e98c8104297b..710c8a29be0d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1007,6 +1007,18 @@ static int __pci_enable_device_flags(struct pci_dev *dev,
         int err;
         int i, bars = 0;
 
+        /*
+         * Power state could be unknown at this point, either due to a fresh
+         * boot or a device removal call.  So get the current power state
+         * so that things like MSI message writing will behave as expected
+         * (e.g. if the device really is in D0 at enable time).
+         */
+        if (dev->pm_cap) {
+                u16 pmcsr;
+                pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+                dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+        }
+
         if (atomic_add_return(1, &dev->enable_cnt) > 1)
                 return 0;               /* already enabled */
 
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index f5c7c382765f..7d33f6673868 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -22,8 +22,13 @@ extern void pci_remove_firmware_label_files(struct pci_dev *pdev);
 #endif
 extern void pci_cleanup_rom(struct pci_dev *dev);
 #ifdef HAVE_PCI_MMAP
+enum pci_mmap_api {
+        PCI_MMAP_SYSFS, /* mmap on /sys/bus/pci/devices/<BDF>/resource<N> */
+        PCI_MMAP_PROCFS /* mmap on /proc/bus/pci/<BDF> */
+};
 extern int pci_mmap_fits(struct pci_dev *pdev, int resno,
-                         struct vm_area_struct *vma);
+                         struct vm_area_struct *vmai,
+                         enum pci_mmap_api mmap_api);
 #endif
 int pci_probe_reset_function(struct pci_dev *dev);
 
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index 297b72c880a1..ea00647f4732 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -257,7 +257,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
 
         /* Make sure the caller is mapping a real resource for this device */
         for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                if (pci_mmap_fits(dev, i, vma))
+                if (pci_mmap_fits(dev, i, vma,  PCI_MMAP_PROCFS))
                         break;
         }
 
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 5efbd5990ff8..06e41ed93230 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -761,7 +761,7 @@ err_unmap:
         clk_put(rtc->clk);
         iounmap(rtc->regbase);
 err_badmap:
-        release_resource(rtc->res);
+        release_mem_region(rtc->res->start, rtc->regsize);
 err_badres:
         kfree(rtc);
 
@@ -786,7 +786,7 @@ static int __exit sh_rtc_remove(struct platform_device *pdev)
         }
 
         iounmap(rtc->regbase);
-        release_resource(rtc->res);
+        release_mem_region(rtc->res->start, rtc->regsize);
 
         clk_disable(rtc->clk);
         clk_put(rtc->clk);
diff --git a/drivers/sh/clk/core.c b/drivers/sh/clk/core.c
index 09615b51d591..cb12a8e1466b 100644
--- a/drivers/sh/clk/core.c
+++ b/drivers/sh/clk/core.c
@@ -571,7 +571,7 @@ long clk_round_parent(struct clk *clk, unsigned long target,
                                         *best_freq = freq_max;
                         }
 
-                        pr_debug("too low freq %lu, error %lu\n", freq->frequency,
+                        pr_debug("too low freq %u, error %lu\n", freq->frequency,
                                  target - freq_max);
 
                         if (!error)
@@ -591,7 +591,7 @@ long clk_round_parent(struct clk *clk, unsigned long target,
                                         *best_freq = freq_min;
                         }
 
-                        pr_debug("too high freq %lu, error %lu\n", freq->frequency,
+                        pr_debug("too high freq %u, error %lu\n", freq->frequency,
                                  freq_min - target);
 
                         if (!error)
diff --git a/drivers/sh/intc/virq.c b/drivers/sh/intc/virq.c
index e5bf5d3c698e..4e0ff7181164 100644
--- a/drivers/sh/intc/virq.c
+++ b/drivers/sh/intc/virq.c
@@ -215,7 +215,7 @@ restart:
                 entry = radix_tree_deref_slot((void **)entries[i]);
                 if (unlikely(!entry))
                         continue;
-                if (unlikely(entry == RADIX_TREE_RETRY))
+                if (radix_tree_deref_retry(entry))
                         goto restart;
 
                 irq = create_irq();
diff --git a/drivers/video/omap2/vram.c b/drivers/video/omap2/vram.c
index fed2a72bc6b6..2fd7e5271be9 100644
--- a/drivers/video/omap2/vram.c
+++ b/drivers/video/omap2/vram.c
@@ -554,9 +554,15 @@ void __init omap_vram_reserve_sdram_memblock(void)
         size = PAGE_ALIGN(size);
 
         if (paddr) {
-                if ((paddr & ~PAGE_MASK) ||
-                    !memblock_is_region_memory(paddr, size)) {
-                        pr_err("Illegal SDRAM region for VRAM\n");
+                if (paddr & ~PAGE_MASK) {
+                        pr_err("VRAM start address 0x%08x not page aligned\n",
+                                        paddr);
+                        return;
+                }
+
+                if (!memblock_is_region_memory(paddr, size)) {
+                        pr_err("Illegal SDRAM region 0x%08x..0x%08x for VRAM\n",
+                                        paddr, paddr + size - 1);
                         return;
                 }
 
@@ -570,9 +576,12 @@ void __init omap_vram_reserve_sdram_memblock(void)
                         return;
                 }
         } else {
-                paddr = memblock_alloc_base(size, PAGE_SIZE, MEMBLOCK_REAL_LIMIT);
+                paddr = memblock_alloc(size, PAGE_SIZE);
         }
 
+        memblock_free(paddr, size);
+        memblock_remove(paddr, size);
+
         omap_vram_add_region(paddr, size);
 
         pr_info("Reserving %u bytes SDRAM for VRAM\n", size);
diff --git a/drivers/video/sh_mobile_hdmi.c b/drivers/video/sh_mobile_hdmi.c
index 55b3077ff6ff..d7df10315d8d 100644
--- a/drivers/video/sh_mobile_hdmi.c
+++ b/drivers/video/sh_mobile_hdmi.c
@@ -1071,6 +1071,10 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                 if (!hdmi->info)
                         goto out;
 
+                hdmi->monspec.modedb_len = 0;
+                fb_destroy_modedb(hdmi->monspec.modedb);
+                hdmi->monspec.modedb = NULL;
+
                 acquire_console_sem();
 
                 /* HDMI disconnect */
@@ -1078,7 +1082,6 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
 
                 release_console_sem();
                 pm_runtime_put(hdmi->dev);
-                fb_destroy_modedb(hdmi->monspec.modedb);
         }
 
 out:
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 50963739a409..9b1364723c65 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -115,15 +115,16 @@ static const struct fb_videomode default_720p = {
         .xres = 1280,
         .yres = 720,
 
-        .left_margin = 200,
-        .right_margin = 88,
-        .hsync_len = 48,
+        .left_margin = 220,
+        .right_margin = 110,
+        .hsync_len = 40,
 
         .upper_margin = 20,
         .lower_margin = 5,
         .vsync_len = 5,
 
         .pixclock = 13468,
+        .refresh = 60,
         .sync = FB_SYNC_VERT_HIGH_ACT | FB_SYNC_HOR_HIGH_ACT,
 };
 
@@ -1197,6 +1198,7 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
                 const struct fb_videomode *mode = cfg->lcd_cfg;
                 unsigned long max_size = 0;
                 int k;
+                int num_cfg;
 
                 ch->info = framebuffer_alloc(0, &pdev->dev);
                 if (!ch->info) {
@@ -1232,8 +1234,14 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
                 info->fix = sh_mobile_lcdc_fix;
                 info->fix.smem_len = max_size * (cfg->bpp / 8) * 2;
 
-                if (!mode)
+                if (!mode) {
                         mode = &default_720p;
+                        num_cfg = 1;
+                } else {
+                        num_cfg = ch->cfg.num_cfg;
+                }
+
+                fb_videomode_to_modelist(mode, num_cfg, &info->modelist);
 
                 fb_videomode_to_var(var, mode);
                 /* Default Y virtual resolution is 2x panel size */
@@ -1281,10 +1289,6 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
 
         for (i = 0; i < j; i++) {
                 struct sh_mobile_lcdc_chan *ch = priv->ch + i;
-                const struct fb_videomode *mode = ch->cfg.lcd_cfg;
-
-                if (!mode)
-                        mode = &default_720p;
 
                 info = ch->info;
 
@@ -1297,7 +1301,6 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
                         }
                 }
 
-                fb_videomode_to_modelist(mode, ch->cfg.num_cfg, &info->modelist);
                 error = register_framebuffer(info);
                 if (error < 0)
                         goto err1;
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index b52f8e4ef1fd..3dde12b0ab06 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -4181,6 +4181,9 @@ static void __devinit
 sisfb_post_map_vram(struct sis_video_info *ivideo, unsigned int *mapsize,
                         unsigned int min)
 {
+        if (*mapsize < (min << 20))
+                return;
+
         ivideo->video_vbase = ioremap(ivideo->video_base, (*mapsize));
 
         if(!ivideo->video_vbase) {
@@ -4514,7 +4517,7 @@ sisfb_post_sis300(struct pci_dev *pdev)
         } else {
 #endif
                 /* Need to map max FB size for finding out about RAM size */
-                mapsize = 64 << 20;
+                mapsize = ivideo->video_size;
                 sisfb_post_map_vram(ivideo, &mapsize, 4);
 
                 if(ivideo->video_vbase) {
@@ -4680,7 +4683,7 @@ sisfb_post_xgi_ramsize(struct sis_video_info *ivideo)
         orSISIDXREG(SISSR, 0x20, (0x80 | 0x04));
 
         /* Need to map max FB size for finding out about RAM size */
-        mapsize = 256 << 20;
+        mapsize = ivideo->video_size;
         sisfb_post_map_vram(ivideo, &mapsize, 32);
 
         if(!ivideo->video_vbase) {
@@ -5936,6 +5939,7 @@ sisfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         ivideo->video_base = pci_resource_start(pdev, 0);
+        ivideo->video_size = pci_resource_len(pdev, 0);
         ivideo->mmio_base  = pci_resource_start(pdev, 1);
         ivideo->mmio_size  = pci_resource_len(pdev, 1);
         ivideo->SiS_Pr.RelIO = pci_resource_start(pdev, 2) + 0x30;