Linux patch 3.10.713.10-79

2 files changed, 1507 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 59f86bb1..16b79b8d 100644
--- a/0000_README
+++ b/0000_README
@@ -322,6 +322,10 @@ Patch:  1069_linux-3.10.70.patch
 From:   http://www.kernel.org
 Desc:   Linux 3.10.70
 
+Patch:  1070_linux-3.10.71.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.71
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1070_linux-3.10.71.patch b/1070_linux-3.10.71.patch
new file mode 100644
index 00000000..3465e29d
--- /dev/null
+++ b/1070_linux-3.10.71.patch
@@ -0,0 +1,1503 @@
+diff --git a/Makefile b/Makefile
+index 402cbb7c27f1..d8b42f71ea5a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 70
++SUBLEVEL = 71
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index 95b1522212a7..ecf23eaa20c1 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -270,7 +270,8 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
+ #define pmd_clear(xp)			do { pmd_val(*(xp)) = 0; } while (0)
+ 
+ #define pte_page(x) (mem_map + \
+-		(unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT)))
++		(unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \
++				PAGE_SHIFT)))
+ 
+ #define mk_pte(page, pgprot)						\
+ ({									\
+diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
+index a5b8fead7d61..9cb7ea776ecd 100644
+--- a/arch/arm/mach-pxa/corgi.c
++++ b/arch/arm/mach-pxa/corgi.c
+@@ -26,6 +26,7 @@
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
+ #include <linux/io.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/corgi_lcd.h>
+@@ -711,6 +712,8 @@ static void __init corgi_init(void)
+ 		sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;
+ 
+ 	platform_add_devices(devices, ARRAY_SIZE(devices));
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init fixup_corgi(struct tag *tags, char **cmdline,
+diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
+index 133109ec7332..a07accfb3aec 100644
+--- a/arch/arm/mach-pxa/hx4700.c
++++ b/arch/arm/mach-pxa/hx4700.c
+@@ -891,6 +891,8 @@ static void __init hx4700_init(void)
+ 	mdelay(10);
+ 	gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1);
+ 	mdelay(10);
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(H4700, "HP iPAQ HX4700")
+diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
+index 50ccd5f1d560..362c05fffc28 100644
+--- a/arch/arm/mach-pxa/poodle.c
++++ b/arch/arm/mach-pxa/poodle.c
+@@ -25,6 +25,7 @@
+ #include <linux/gpio.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/pxa2xx_spi.h>
+@@ -452,6 +453,7 @@ static void __init poodle_init(void)
+ 	pxa_set_i2c_info(NULL);
+ 	i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
+ 	poodle_init_spi();
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init fixup_poodle(struct tag *tags, char **cmdline,
+diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
+index 6645d1e31f14..34853d5dfda2 100644
+--- a/arch/arm/mach-sa1100/pm.c
++++ b/arch/arm/mach-sa1100/pm.c
+@@ -81,6 +81,7 @@ static int sa11x0_pm_enter(suspend_state_t state)
+ 	/*
+ 	 * Ensure not to come back here if it wasn't intended
+ 	 */
++	RCSR = RCSR_SMR;
+ 	PSPR = 0;
+ 
+ 	/*
+diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
+index e393174fe859..3d478102b1c0 100644
+--- a/arch/arm64/kernel/signal32.c
++++ b/arch/arm64/kernel/signal32.c
+@@ -179,8 +179,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
+ 	case __SI_TIMER:
+ 		 err |= __put_user(from->si_tid, &to->si_tid);
+ 		 err |= __put_user(from->si_overrun, &to->si_overrun);
+-		 err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr,
+-				   &to->si_ptr);
++		 err |= __put_user(from->si_int, &to->si_int);
+ 		break;
+ 	case __SI_POLL:
+ 		err |= __put_user(from->si_band, &to->si_band);
+@@ -209,7 +208,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
+ 	case __SI_MESGQ: /* But this is */
+ 		err |= __put_user(from->si_pid, &to->si_pid);
+ 		err |= __put_user(from->si_uid, &to->si_uid);
+-		err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr);
++		err |= __put_user(from->si_int, &to->si_int);
+ 		break;
+ 	default: /* this is just in case for now ... */
+ 		err |= __put_user(from->si_pid, &to->si_pid);
+diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
+index 579e3d93a5ca..b88e9cbdc64b 100644
+--- a/arch/metag/include/asm/processor.h
++++ b/arch/metag/include/asm/processor.h
+@@ -149,8 +149,8 @@ extern void exit_thread(void);
+ 
+ unsigned long get_wchan(struct task_struct *p);
+ 
+-#define	KSTK_EIP(tsk)	((tsk)->thread.kernel_context->CurrPC)
+-#define	KSTK_ESP(tsk)	((tsk)->thread.kernel_context->AX[0].U0)
++#define	KSTK_EIP(tsk)	(task_pt_regs(tsk)->ctx.CurrPC)
++#define	KSTK_ESP(tsk)	(task_pt_regs(tsk)->ctx.AX[0].U0)
+ 
+ #define user_stack_pointer(regs)        ((regs)->ctx.AX[0].U0)
+ 
+diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
+index 6e58e97fcd39..cedeb5686eb5 100644
+--- a/arch/mips/kernel/mips_ksyms.c
++++ b/arch/mips/kernel/mips_ksyms.c
+@@ -14,6 +14,7 @@
+ #include <linux/mm.h>
+ #include <asm/uaccess.h>
+ #include <asm/ftrace.h>
++#include <asm/fpu.h>
+ 
+ extern void *__bzero(void *__s, size_t __count);
+ extern long __strncpy_from_user_nocheck_asm(char *__to,
+@@ -26,6 +27,13 @@ extern long __strnlen_user_nocheck_asm(const char *s);
+ extern long __strnlen_user_asm(const char *s);
+ 
+ /*
++ * Core architecture code
++ */
++#ifdef CONFIG_CPU_R4K_FPU
++EXPORT_SYMBOL_GPL(_save_fp);
++#endif
++
++/*
+  * String functions
+  */
+ EXPORT_SYMBOL(memset);
+diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S
+index dca2aa665993..920b63210806 100644
+--- a/arch/mips/kvm/kvm_locore.S
++++ b/arch/mips/kvm/kvm_locore.S
+@@ -431,7 +431,7 @@ __kvm_mips_return_to_guest:
+     /* Setup status register for running guest in UM */
+     .set at
+     or     v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
+-    and     v1, v1, ~ST0_CU0
++    and     v1, v1, ~(ST0_CU0 | ST0_MX)
+     .set noat
+     mtc0    v1, CP0_STATUS
+     ehb
+diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
+index 2c7b3ade8ec0..843ec38fec7b 100644
+--- a/arch/mips/kvm/kvm_mips.c
++++ b/arch/mips/kvm/kvm_mips.c
+@@ -15,6 +15,7 @@
+ #include <linux/vmalloc.h>
+ #include <linux/fs.h>
+ #include <linux/bootmem.h>
++#include <asm/fpu.h>
+ #include <asm/page.h>
+ #include <asm/cacheflush.h>
+ #include <asm/mmu_context.h>
+@@ -413,11 +414,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ 		vcpu->mmio_needed = 0;
+ 	}
+ 
++	lose_fpu(1);
++
++	local_irq_disable();
+ 	/* Check if we have any exceptions/interrupts pending */
+ 	kvm_mips_deliver_interrupts(vcpu,
+ 				    kvm_read_c0_guest_cause(vcpu->arch.cop0));
+ 
+-	local_irq_disable();
+ 	kvm_guest_enter();
+ 
+ 	r = __kvm_mips_vcpu_run(run, vcpu);
+@@ -1017,9 +1020,6 @@ void kvm_mips_set_c0_status(void)
+ {
+ 	uint32_t status = read_c0_status();
+ 
+-	if (cpu_has_fpu)
+-		status |= (ST0_CU1);
+-
+ 	if (cpu_has_dsp)
+ 		status |= (ST0_MX);
+ 
+diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
+index 1c16141c031c..1fea24944ff4 100644
+--- a/arch/powerpc/sysdev/axonram.c
++++ b/arch/powerpc/sysdev/axonram.c
+@@ -155,7 +155,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector,
+ 	}
+ 
+ 	*kaddr = (void *)(bank->ph_addr + offset);
+-	*pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
++	*pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;
+ 
+ 	return 0;
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index adfc30d9f9f4..41ba726c1ce2 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1182,21 +1182,22 @@ void kvm_track_tsc_matching(struct kvm_vcpu *vcpu)
+ {
+ #ifdef CONFIG_X86_64
+ 	bool vcpus_matched;
+-	bool do_request = false;
+ 	struct kvm_arch *ka = &vcpu->kvm->arch;
+ 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
+ 
+ 	vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 ==
+ 			 atomic_read(&vcpu->kvm->online_vcpus));
+ 
+-	if (vcpus_matched && gtod->clock.vclock_mode == VCLOCK_TSC)
+-		if (!ka->use_master_clock)
+-			do_request = 1;
+-
+-	if (!vcpus_matched && ka->use_master_clock)
+-			do_request = 1;
+-
+-	if (do_request)
++	/*
++	 * Once the masterclock is enabled, always perform request in
++	 * order to update it.
++	 *
++	 * In order to enable masterclock, the host clocksource must be TSC
++	 * and the vcpus need to have matched TSCs.  When that happens,
++	 * perform request to enable masterclock.
++	 */
++	if (ka->use_master_clock ||
++	    (gtod->clock.vclock_mode == VCLOCK_TSC && vcpus_matched))
+ 		kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
+ 
+ 	trace_kvm_track_tsc(vcpu->vcpu_id, ka->nr_vcpus_matched_tsc,
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 5c1ae28825cd..75f9e5d80d02 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -35,12 +35,12 @@ struct __read_mostly va_alignment va_align = {
+ 	.flags = -1,
+ };
+ 
+-static unsigned int stack_maxrandom_size(void)
++static unsigned long stack_maxrandom_size(void)
+ {
+-	unsigned int max = 0;
++	unsigned long max = 0;
+ 	if ((current->flags & PF_RANDOMIZE) &&
+ 		!(current->personality & ADDR_NO_RANDOMIZE)) {
+-		max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
++		max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT;
+ 	}
+ 
+ 	return max;
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 31146225f3d0..7cddfe6baf66 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -942,6 +942,9 @@ static u64 tg_prfill_cpu_rwstat(struct seq_file *sf,
+ 	struct blkg_rwstat rwstat = { }, tmp;
+ 	int i, cpu;
+ 
++	if (tg->stats_cpu == NULL)
++		return 0;
++
+ 	for_each_possible_cpu(cpu) {
+ 		struct tg_stats_cpu *sc = per_cpu_ptr(tg->stats_cpu, cpu);
+ 
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index c981097dd634..69111c5c352c 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3575,6 +3575,11 @@ retry:
+ 
+ 	blkcg = bio_blkcg(bio);
+ 	cfqg = cfq_lookup_create_cfqg(cfqd, blkcg);
++	if (!cfqg) {
++		cfqq = &cfqd->oom_cfqq;
++		goto out;
++	}
++
+ 	cfqq = cic_to_cfqq(cic, is_sync);
+ 
+ 	/*
+@@ -3611,7 +3616,7 @@ retry:
+ 		} else
+ 			cfqq = &cfqd->oom_cfqq;
+ 	}
+-
++out:
+ 	if (new_cfqq)
+ 		kmem_cache_free(cfq_pool, new_cfqq);
+ 
+@@ -3641,12 +3646,17 @@ static struct cfq_queue *
+ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
+ 	      struct bio *bio, gfp_t gfp_mask)
+ {
+-	const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+-	const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
++	int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
++	int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
+ 	struct cfq_queue **async_cfqq = NULL;
+ 	struct cfq_queue *cfqq = NULL;
+ 
+ 	if (!is_sync) {
++		if (!ioprio_valid(cic->ioprio)) {
++			struct task_struct *tsk = current;
++			ioprio = task_nice_ioprio(tsk);
++			ioprio_class = task_nice_ioclass(tsk);
++		}
+ 		async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);
+ 		cfqq = *async_cfqq;
+ 	}
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 2acabdaecec8..dad8891ecbfa 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -151,6 +151,8 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ #define USB_REQ_DFU_DNLOAD	1
+ #define BULK_SIZE		4096
+ #define FW_HDR_SIZE		20
++#define TIMEGAP_USEC_MIN	50
++#define TIMEGAP_USEC_MAX	100
+ 
+ static int ath3k_load_firmware(struct usb_device *udev,
+ 				const struct firmware *firmware)
+@@ -181,6 +183,9 @@ static int ath3k_load_firmware(struct usb_device *udev,
+ 	count -= 20;
+ 
+ 	while (count) {
++		/* workaround the compatibility issue with xHCI controller*/
++		usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ 		size = min_t(uint, count, BULK_SIZE);
+ 		pipe = usb_sndbulkpipe(udev, 0x02);
+ 		memcpy(send_buf, firmware->data + sent, size);
+@@ -277,6 +282,9 @@ static int ath3k_load_fwfile(struct usb_device *udev,
+ 	count -= size;
+ 
+ 	while (count) {
++		/* workaround the compatibility issue with xHCI controller*/
++		usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ 		size = min_t(uint, count, BULK_SIZE);
+ 		pipe = usb_sndbulkpipe(udev, 0x02);
+ 
+diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
+index 156bd3c72770..3925f7b86841 100644
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -488,7 +488,7 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ 		if (burstcnt < 0)
+ 			return burstcnt;
+ 		size = min_t(int, len - i - 1, burstcnt);
+-		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
++		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size);
+ 		if (ret < 0)
+ 			goto out_err;
+ 
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 56b07c35a13e..538856f3e68a 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -148,7 +148,8 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ 	crq.len = (u16)count;
+ 	crq.data = ibmvtpm->rtce_dma_handle;
+ 
+-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]);
++	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
++			      cpu_to_be64(word[1]));
+ 	if (rc != H_SUCCESS) {
+ 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+ 		rc = 0;
+@@ -186,7 +187,8 @@ static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
+ 	crq.valid = (u8)IBMVTPM_VALID_CMD;
+ 	crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
+ 
+-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++			      cpu_to_be64(buf[1]));
+ 	if (rc != H_SUCCESS)
+ 		dev_err(ibmvtpm->dev,
+ 			"ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
+@@ -212,7 +214,8 @@ static int ibmvtpm_crq_get_version(struct ibmvtpm_dev *ibmvtpm)
+ 	crq.valid = (u8)IBMVTPM_VALID_CMD;
+ 	crq.msg = (u8)VTPM_GET_VERSION;
+ 
+-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++			      cpu_to_be64(buf[1]));
+ 	if (rc != H_SUCCESS)
+ 		dev_err(ibmvtpm->dev,
+ 			"ibmvtpm_crq_get_version failed rc=%d\n", rc);
+@@ -307,6 +310,14 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev)
+ static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev)
+ {
+ 	struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev);
++
++	/* ibmvtpm initializes at probe time, so the data we are
++	* asking for may not be set yet. Estimate that 4K required
++	* for TCE-mapped buffer in addition to CRQ.
++	*/
++	if (!ibmvtpm)
++		return CRQ_RES_BUF_SIZE + PAGE_SIZE;
++
+ 	return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
+ }
+ 
+@@ -327,7 +338,8 @@ static int tpm_ibmvtpm_suspend(struct device *dev)
+ 	crq.valid = (u8)IBMVTPM_VALID_CMD;
+ 	crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
+ 
+-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++			      cpu_to_be64(buf[1]));
+ 	if (rc != H_SUCCESS)
+ 		dev_err(ibmvtpm->dev,
+ 			"tpm_ibmvtpm_suspend failed rc=%d\n", rc);
+@@ -511,11 +523,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
+ 	case IBMVTPM_VALID_CMD:
+ 		switch (crq->msg) {
+ 		case VTPM_GET_RTCE_BUFFER_SIZE_RES:
+-			if (crq->len <= 0) {
++			if (be16_to_cpu(crq->len) <= 0) {
+ 				dev_err(ibmvtpm->dev, "Invalid rtce size\n");
+ 				return;
+ 			}
+-			ibmvtpm->rtce_size = crq->len;
++			ibmvtpm->rtce_size = be16_to_cpu(crq->len);
+ 			ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
+ 						    GFP_KERNEL);
+ 			if (!ibmvtpm->rtce_buf) {
+@@ -536,11 +548,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
+ 
+ 			return;
+ 		case VTPM_GET_VERSION_RES:
+-			ibmvtpm->vtpm_version = crq->data;
++			ibmvtpm->vtpm_version = be32_to_cpu(crq->data);
+ 			return;
+ 		case VTPM_TPM_COMMAND_RES:
+ 			/* len of the data in rtce buffer */
+-			ibmvtpm->res_len = crq->len;
++			ibmvtpm->res_len = be16_to_cpu(crq->len);
+ 			wake_up_interruptible(&ibmvtpm->wq);
+ 			return;
+ 		default:
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 72f21377fa02..323d02d33c70 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -75,6 +75,10 @@ enum tis_defaults {
+ #define	TPM_DID_VID(l)			(0x0F00 | ((l) << 12))
+ #define	TPM_RID(l)			(0x0F04 | ((l) << 12))
+ 
++struct priv_data {
++	bool irq_tested;
++};
++
+ static LIST_HEAD(tis_chips);
+ static DEFINE_MUTEX(tis_lock);
+ 
+@@ -338,12 +342,27 @@ out_err:
+ 	return rc;
+ }
+ 
++static void disable_interrupts(struct tpm_chip *chip)
++{
++	u32 intmask;
++
++	intmask =
++	    ioread32(chip->vendor.iobase +
++		     TPM_INT_ENABLE(chip->vendor.locality));
++	intmask &= ~TPM_GLOBAL_INT_ENABLE;
++	iowrite32(intmask,
++		  chip->vendor.iobase +
++		  TPM_INT_ENABLE(chip->vendor.locality));
++	free_irq(chip->vendor.irq, chip);
++	chip->vendor.irq = 0;
++}
++
+ /*
+  * If interrupts are used (signaled by an irq set in the vendor structure)
+  * tpm.c can skip polling for the data to be available as the interrupt is
+  * waited for here
+  */
+-static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len)
+ {
+ 	int rc;
+ 	u32 ordinal;
+@@ -373,6 +392,30 @@ out_err:
+ 	return rc;
+ }
+ 
++static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++{
++	int rc, irq;
++	struct priv_data *priv = chip->vendor.priv;
++
++	if (!chip->vendor.irq || priv->irq_tested)
++		return tpm_tis_send_main(chip, buf, len);
++
++	/* Verify receipt of the expected IRQ */
++	irq = chip->vendor.irq;
++	chip->vendor.irq = 0;
++	rc = tpm_tis_send_main(chip, buf, len);
++	chip->vendor.irq = irq;
++	if (!priv->irq_tested)
++		msleep(1);
++	if (!priv->irq_tested) {
++		disable_interrupts(chip);
++		dev_err(chip->dev,
++			FW_BUG "TPM interrupt not working, polling instead\n");
++	}
++	priv->irq_tested = true;
++	return rc;
++}
++
+ struct tis_vendor_timeout_override {
+ 	u32 did_vid;
+ 	unsigned long timeout_us[4];
+@@ -546,6 +589,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id)
+ 	if (interrupt == 0)
+ 		return IRQ_NONE;
+ 
++	((struct priv_data *)chip->vendor.priv)->irq_tested = true;
+ 	if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+ 		wake_up_interruptible(&chip->vendor.read_queue);
+ 	if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+@@ -575,9 +619,14 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ 	u32 vendor, intfcaps, intmask;
+ 	int rc, i, irq_s, irq_e, probe;
+ 	struct tpm_chip *chip;
++	struct priv_data *priv;
+ 
++	priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL);
++	if (priv == NULL)
++		return -ENOMEM;
+ 	if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
+ 		return -ENODEV;
++	chip->vendor.priv = priv;
+ 
+ 	chip->vendor.iobase = ioremap(start, len);
+ 	if (!chip->vendor.iobase) {
+@@ -646,19 +695,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ 	if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+ 		dev_dbg(dev, "\tData Avail Int Support\n");
+ 
+-	/* get the timeouts before testing for irqs */
+-	if (tpm_get_timeouts(chip)) {
+-		dev_err(dev, "Could not get TPM timeouts and durations\n");
+-		rc = -ENODEV;
+-		goto out_err;
+-	}
+-
+-	if (tpm_do_selftest(chip)) {
+-		dev_err(dev, "TPM self test failed\n");
+-		rc = -ENODEV;
+-		goto out_err;
+-	}
+-
+ 	/* INTERRUPT Setup */
+ 	init_waitqueue_head(&chip->vendor.read_queue);
+ 	init_waitqueue_head(&chip->vendor.int_queue);
+@@ -760,6 +796,18 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ 		}
+ 	}
+ 
++	if (tpm_get_timeouts(chip)) {
++		dev_err(dev, "Could not get TPM timeouts and durations\n");
++		rc = -ENODEV;
++		goto out_err;
++	}
++
++	if (tpm_do_selftest(chip)) {
++		dev_err(dev, "TPM self test failed\n");
++		rc = -ENODEV;
++		goto out_err;
++	}
++
+ 	INIT_LIST_HEAD(&chip->vendor.list);
+ 	mutex_lock(&tis_lock);
+ 	list_add(&chip->vendor.list, &tis_chips);
+diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
+index 7047821a7f8a..4ab7a2156672 100644
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+ 
+ 	pr_debug("previous speed is %u\n", prev_speed);
+ 
++	preempt_disable();
+ 	local_irq_save(flags);
+ 
+ 	/* switch to low state */
+@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+ 
+ out:
+ 	local_irq_restore(flags);
++	preempt_enable();
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(speedstep_get_freqs);
+diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
+index f5a6b70ee6c0..2844009135f8 100644
+--- a/drivers/cpufreq/speedstep-smi.c
++++ b/drivers/cpufreq/speedstep-smi.c
+@@ -188,6 +188,7 @@ static void speedstep_set_state(unsigned int state)
+ 		return;
+ 
+ 	/* Disable IRQs */
++	preempt_disable();
+ 	local_irq_save(flags);
+ 
+ 	command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
+@@ -198,9 +199,19 @@ static void speedstep_set_state(unsigned int state)
+ 
+ 	do {
+ 		if (retry) {
++			/*
++			 * We need to enable interrupts, otherwise the blockage
++			 * won't resolve.
++			 *
++			 * We disable preemption so that other processes don't
++			 * run. If other processes were running, they could
++			 * submit more DMA requests, making the blockage worse.
++			 */
+ 			pr_debug("retry %u, previous result %u, waiting...\n",
+ 					retry, result);
++			local_irq_enable();
+ 			mdelay(retry * 50);
++			local_irq_disable();
+ 		}
+ 		retry++;
+ 		__asm__ __volatile__(
+@@ -217,6 +228,7 @@ static void speedstep_set_state(unsigned int state)
+ 
+ 	/* enable IRQs */
+ 	local_irq_restore(flags);
++	preempt_enable();
+ 
+ 	if (new_state == state)
+ 		pr_debug("change to %u MHz succeeded after %u tries "
+diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
+index 30a5844a7dca..845730469945 100644
+--- a/drivers/gpio/gpio-tps65912.c
++++ b/drivers/gpio/gpio-tps65912.c
+@@ -26,9 +26,12 @@ struct tps65912_gpio_data {
+ 	struct gpio_chip gpio_chip;
+ };
+ 
++#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
++
+ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ {
+-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ 	int val;
+ 
+ 	val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
+@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ 			      int value)
+ {
+-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ 
+ 	if (value)
+ 		tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
+@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+ 				int value)
+ {
+-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ 
+ 	/* Set the initial value */
+ 	tps65912_gpio_set(gc, offset, value);
+@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+ 
+ static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
+ {
+-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ 
+ 	return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
+ 								GPIO_CFG_MASK);
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 469daa04dadb..ccc2f36bb334 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -341,7 +341,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
+ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ {
+ 	int ret, ret_size;
+-	int size = ihid->bufsize;
++	int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
++
++	if (size > ihid->bufsize)
++		size = ihid->bufsize;
+ 
+ 	ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ 	if (ret != size) {
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index e885dbf08c40..86ac4a4ccc01 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -557,7 +557,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 		if (test_bit(WriteMostly, &rdev->flags)) {
+ 			/* Don't balance among write-mostly, just
+ 			 * use the first as a last resort */
+-			if (best_disk < 0) {
++			if (best_dist_disk < 0) {
+ 				if (is_badblock(rdev, this_sector, sectors,
+ 						&first_bad, &bad_sectors)) {
+ 					if (first_bad < this_sector)
+@@ -566,7 +566,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 					best_good_sectors = first_bad - this_sector;
+ 				} else
+ 					best_good_sectors = sectors;
+-				best_disk = disk;
++				best_dist_disk = disk;
++				best_pending_disk = disk;
+ 			}
+ 			continue;
+ 		}
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 4daf5c03b33b..1b6986ce5da9 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2853,7 +2853,8 @@ static void handle_stripe_dirtying(struct r5conf *conf,
+ 	 * generate correct data from the parity.
+ 	 */
+ 	if (conf->max_degraded == 2 ||
+-	    (recovery_cp < MaxSector && sh->sector >= recovery_cp)) {
++	    (recovery_cp < MaxSector && sh->sector >= recovery_cp &&
++	     s->failed == 0)) {
+ 		/* Calculate the real rcw later - for now make it
+ 		 * look like rcw is cheaper
+ 		 */
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index b3fd0ffa3c3f..fc28d514bff0 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -350,6 +350,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ {
+ 	struct dvb_usb_device *d = adap_to_d(adap);
+ 	struct lme2510_state *lme_int = adap_to_priv(adap);
++	struct usb_host_endpoint *ep;
+ 
+ 	lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
+ 
+@@ -371,6 +372,12 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ 				adap,
+ 				8);
+ 
++	/* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
++	ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++
++	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
++		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++
+ 	lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ 
+ 	usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 1ae358e0662d..4edb24bf56f8 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -201,8 +201,8 @@ static struct sdhci_pxa_platdata *pxav3_get_mmc_pdata(struct device *dev)
+ 	if (!pdata)
+ 		return NULL;
+ 
+-	of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles);
+-	if (clk_delay_cycles > 0)
++	if (!of_property_read_u32(np, "mrvl,clk-delay-cycles",
++				  &clk_delay_cycles))
+ 		pdata->clk_delay_cycles = clk_delay_cycles;
+ 
+ 	return pdata;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index 88b9c0964696..e6660d692008 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -360,9 +360,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
+ 	mvmvif->uploaded = false;
+ 	mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
+ 
+-	/* does this make sense at all? */
+-	mvmvif->color++;
+-
+ 	spin_lock_bh(&mvm->time_event_lock);
+ 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
+ 	spin_unlock_bh(&mvm->time_event_lock);
+@@ -544,7 +541,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
+ 
+ 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
+ 	if (ret)
+-		goto out_release;
++		goto out_remove_mac;
+ 
+ 	/*
+ 	 * Update power state on the new interface. Admittedly, based on
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index 4ec8385e4307..3dd0e5bfa0fc 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -832,6 +832,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+ 	sta_id = ba_notif->sta_id;
+ 	tid = ba_notif->tid;
+ 
++	if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
++		      tid >= IWL_MAX_TID_COUNT,
++		      "sta_id %d tid %d", sta_id, tid))
++		return 0;
++
+ 	rcu_read_lock();
+ 
+ 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index 48acfc620191..f05962c32497 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -720,7 +720,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_trans *trans)
+ 	iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
+ 			   trans_pcie->kw.dma >> 4);
+ 
+-	iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
++	/*
++	 * Send 0 as the scd_base_addr since the device may have be reset
++	 * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
++	 * contain garbage.
++	 */
++	iwl_pcie_tx_start(trans, 0);
+ }
+ 
+ /*
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 66aabde82727..5548a13617ab 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1267,7 +1267,7 @@ static int pci_uevent(struct device *dev, struct kobj_uevent_env *env)
+ 	if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
+ 		return -ENOMEM;
+ 
+-	if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
++	if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
+ 			   pdev->vendor, pdev->device,
+ 			   pdev->subsystem_vendor, pdev->subsystem_device,
+ 			   (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
+diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
+index c5d0a08a8747..d6d499782fb4 100644
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ {
+ 	void __iomem *image;
+ 	int last_image;
++	unsigned length;
+ 
+ 	image = rom;
+ 	do {
+@@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ 		if (readb(pds + 3) != 'R')
+ 			break;
+ 		last_image = readb(pds + 21) & 0x80;
+-		/* this length is reliable */
+-		image += readw(pds + 16) * 512;
+-	} while (!last_image);
++		length = readw(pds + 16);
++		image += length * 512;
++	} while (length && !last_image);
+ 
+ 	/* never return a size larger than the PCI resource window */
+ 	/* there are known ROMs that get the size wrong */
+diff --git a/drivers/power/88pm860x_charger.c b/drivers/power/88pm860x_charger.c
+index 36fb4b5a4b0d..1ef35ab79d0f 100644
+--- a/drivers/power/88pm860x_charger.c
++++ b/drivers/power/88pm860x_charger.c
+@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ out_irq:
++	power_supply_unregister(&info->usb);
+ 	while (--i >= 0)
+ 		free_irq(info->irq[i], info);
+ out:
+diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c
+index 81289520f96b..bd53364b75e8 100644
+--- a/drivers/target/iscsi/iscsi_target_tq.c
++++ b/drivers/target/iscsi/iscsi_target_tq.c
+@@ -26,36 +26,22 @@
+ #include "iscsi_target_tq.h"
+ #include "iscsi_target.h"
+ 
+-static LIST_HEAD(active_ts_list);
+ static LIST_HEAD(inactive_ts_list);
+-static DEFINE_SPINLOCK(active_ts_lock);
+ static DEFINE_SPINLOCK(inactive_ts_lock);
+ static DEFINE_SPINLOCK(ts_bitmap_lock);
+ 
+-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
+-{
+-	spin_lock(&active_ts_lock);
+-	list_add_tail(&ts->ts_list, &active_ts_list);
+-	iscsit_global->active_ts++;
+-	spin_unlock(&active_ts_lock);
+-}
+-
+ static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
+ {
++	if (!list_empty(&ts->ts_list)) {
++		WARN_ON(1);
++		return;
++	}
+ 	spin_lock(&inactive_ts_lock);
+ 	list_add_tail(&ts->ts_list, &inactive_ts_list);
+ 	iscsit_global->inactive_ts++;
+ 	spin_unlock(&inactive_ts_lock);
+ }
+ 
+-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
+-{
+-	spin_lock(&active_ts_lock);
+-	list_del(&ts->ts_list);
+-	iscsit_global->active_ts--;
+-	spin_unlock(&active_ts_lock);
+-}
+-
+ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ {
+ 	struct iscsi_thread_set *ts;
+@@ -68,7 +54,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ 
+ 	ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list);
+ 
+-	list_del(&ts->ts_list);
++	list_del_init(&ts->ts_list);
+ 	iscsit_global->inactive_ts--;
+ 	spin_unlock(&inactive_ts_lock);
+ 
+@@ -219,8 +205,6 @@ static void iscsi_deallocate_extra_thread_sets(void)
+ 
+ void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
+ {
+-	iscsi_add_ts_to_active_list(ts);
+-
+ 	spin_lock_bh(&ts->ts_state_lock);
+ 	conn->thread_set = ts;
+ 	ts->conn = conn;
+@@ -423,7 +407,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts)
+ 
+ 	if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ 		spin_unlock_bh(&ts->ts_state_lock);
+-		iscsi_del_ts_from_active_list(ts);
+ 
+ 		if (!iscsit_global->in_shutdown)
+ 			iscsi_deallocate_extra_thread_sets();
+@@ -476,7 +459,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts)
+ 
+ 	if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ 		spin_unlock_bh(&ts->ts_state_lock);
+-		iscsi_del_ts_from_active_list(ts);
+ 
+ 		if (!iscsit_global->in_shutdown)
+ 			iscsi_deallocate_extra_thread_sets();
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index abfd99089781..7cb36813aac2 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -215,6 +215,9 @@ static int pty_signal(struct tty_struct *tty, int sig)
+ 	unsigned long flags;
+ 	struct pid *pgrp;
+ 
++	if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
++		return -EINVAL;
++
+ 	if (tty->link) {
+ 		spin_lock_irqsave(&tty->link->ctrl_lock, flags);
+ 		pgrp = get_pid(tty->link->pgrp);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 0d1b3757cfb6..db9d69fa1085 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed)
+ #endif
+ 	if (DO_UPDATE(vc))
+ 		do_update_region(vc, (unsigned long) p, count);
++	notify_update(vc);
+ }
+ 
+ /* used by selection: complement pointer position */
+@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset)
+ 		scr_writew(old, screenpos(vc, old_offset, 1));
+ 		if (DO_UPDATE(vc))
+ 			vc->vc_sw->con_putc(vc, old, oldy, oldx);
++		notify_update(vc);
+ 	}
+ 
+ 	old_offset = offset;
+@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset)
+ 			oldy = (offset >> 1) / vc->vc_cols;
+ 			vc->vc_sw->con_putc(vc, new, oldy, oldx);
+ 		}
++		notify_update(vc);
+ 	}
+-
+ }
+ 
+ static void insert_char(struct vc_data *vc, unsigned int nr)
+diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
+index b0585e623ba9..19fa68a732f3 100644
+--- a/drivers/usb/core/buffer.c
++++ b/drivers/usb/core/buffer.c
+@@ -22,17 +22,25 @@
+  */
+ 
+ /* FIXME tune these based on pool statistics ... */
+-static const size_t	pool_max[HCD_BUFFER_POOLS] = {
+-	/* platforms without dma-friendly caches might need to
+-	 * prevent cacheline sharing...
+-	 */
+-	32,
+-	128,
+-	512,
+-	PAGE_SIZE / 2
+-	/* bigger --> allocate pages */
++static size_t pool_max[HCD_BUFFER_POOLS] = {
++	32, 128, 512, 2048,
+ };
+ 
++void __init usb_init_pool_max(void)
++{
++	/*
++	 * The pool_max values must never be smaller than
++	 * ARCH_KMALLOC_MINALIGN.
++	 */
++	if (ARCH_KMALLOC_MINALIGN <= 32)
++		;			/* Original value is okay */
++	else if (ARCH_KMALLOC_MINALIGN <= 64)
++		pool_max[0] = 64;
++	else if (ARCH_KMALLOC_MINALIGN <= 128)
++		pool_max[0] = 0;	/* Don't use this pool */
++	else
++		BUILD_BUG();		/* We don't allow this */
++}
+ 
+ /* SETUP primitives */
+ 
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index f6e5ceb03afb..cbfd3d14fa5a 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1593,6 +1593,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
+ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ {
+ 	struct usb_hcd		*hcd;
++	struct usb_device	*udev = urb->dev;
+ 	int			retval = -EIDRM;
+ 	unsigned long		flags;
+ 
+@@ -1604,20 +1605,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ 	spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
+ 	if (atomic_read(&urb->use_count) > 0) {
+ 		retval = 0;
+-		usb_get_dev(urb->dev);
++		usb_get_dev(udev);
+ 	}
+ 	spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
+ 	if (retval == 0) {
+ 		hcd = bus_to_hcd(urb->dev->bus);
+ 		retval = unlink1(hcd, urb, status);
+-		usb_put_dev(urb->dev);
++		if (retval == 0)
++			retval = -EINPROGRESS;
++		else if (retval != -EIDRM && retval != -EBUSY)
++			dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
++					urb, retval);
++		usb_put_dev(udev);
+ 	}
+-
+-	if (retval == 0)
+-		retval = -EINPROGRESS;
+-	else if (retval != -EIDRM && retval != -EBUSY)
+-		dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
+-				urb, retval);
+ 	return retval;
+ }
+ 
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index b10da720f2b4..e54b1bdcd66e 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -1003,6 +1003,7 @@ static int __init usb_init(void)
+ 		pr_info("%s: USB support disabled\n", usbcore_name);
+ 		return 0;
+ 	}
++	usb_init_pool_max();
+ 
+ 	retval = usb_debugfs_init();
+ 	if (retval)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 8e15acd204ef..f48f5dfab245 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -56,6 +56,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++	{ USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ 	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ 	{ USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ 	{ USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 3aac8e9edac3..3c4d8797ea9a 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -552,11 +552,12 @@ out:
+ 
+ static unsigned long randomize_stack_top(unsigned long stack_top)
+ {
+-	unsigned int random_variable = 0;
++	unsigned long random_variable = 0;
+ 
+ 	if ((current->flags & PF_RANDOMIZE) &&
+ 		!(current->personality & ADDR_NO_RANDOMIZE)) {
+-		random_variable = get_random_int() & STACK_RND_MASK;
++		random_variable = (unsigned long) get_random_int();
++		random_variable &= STACK_RND_MASK;
+ 		random_variable <<= PAGE_SHIFT;
+ 	}
+ #ifdef CONFIG_STACK_GROWSUP
+diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
+index 7654e87b0428..9ad5ba4b299b 100644
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ 				sumlen = c->sector_size - je32_to_cpu(sm->offset);
+ 				sumptr = buf + buf_size - sumlen;
+ 
++				/* sm->offset maybe wrong but MAGIC maybe right */
++				if (sumlen > c->sector_size)
++					goto full_scan;
++
+ 				/* Now, make sure the summary itself is available */
+ 				if (sumlen > buf_size) {
+ 					/* Need to kmalloc for this. */
+@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ 		}
+ 	}
+ 
++full_scan:
+ 	buf_ofs = jeb->offset;
+ 
+ 	if (!buf_size) {
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index cff089a412c7..e05c96ebb27d 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -128,22 +128,24 @@ nfs41_callback_svc(void *vrqstp)
+ 		if (try_to_freeze())
+ 			continue;
+ 
+-		prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
++		prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE);
+ 		spin_lock_bh(&serv->sv_cb_lock);
+ 		if (!list_empty(&serv->sv_cb_list)) {
+ 			req = list_first_entry(&serv->sv_cb_list,
+ 					struct rpc_rqst, rq_bc_list);
+ 			list_del(&req->rq_bc_list);
+ 			spin_unlock_bh(&serv->sv_cb_lock);
++			finish_wait(&serv->sv_cb_waitq, &wq);
+ 			dprintk("Invoking bc_svc_process()\n");
+ 			error = bc_svc_process(serv, req, rqstp);
+ 			dprintk("bc_svc_process() returned w/ error code= %d\n",
+ 				error);
+ 		} else {
+ 			spin_unlock_bh(&serv->sv_cb_lock);
+-			schedule();
++			/* schedule_timeout to game the hung task watchdog */
++			schedule_timeout(60 * HZ);
++			finish_wait(&serv->sv_cb_waitq, &wq);
+ 		}
+-		finish_wait(&serv->sv_cb_waitq, &wq);
+ 	}
+ 	return 0;
+ }
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index a35582c9d444..e98ecf8d2588 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
+ 
+ 		for (i = 0; i < args->csa_nrclists; i++) {
+ 			status = decode_rc_list(xdr, &args->csa_rclists[i]);
+-			if (status)
++			if (status) {
++				args->csa_nrclists = i;
+ 				goto out_free;
++			}
+ 		}
+ 	}
+ 	status = 0;
+diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
+index 4ec431777048..e0451f4201cf 100644
+--- a/fs/xfs/xfs_buf_item.c
++++ b/fs/xfs/xfs_buf_item.c
+@@ -296,6 +296,10 @@ xfs_buf_item_format(
+ 	ASSERT(atomic_read(&bip->bli_refcount) > 0);
+ 	ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
+ 	       (bip->bli_flags & XFS_BLI_STALE));
++	ASSERT((bip->bli_flags & XFS_BLI_STALE) ||
++	       (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF
++	        && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF));
++
+ 
+ 	/*
+ 	 * If it is an inode buffer, transfer the in-memory state to the
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 7f7be5f98f52..f010ab4594f1 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -1655,6 +1655,7 @@ xfs_iunlink(
+ 	agi->agi_unlinked[bucket_index] = cpu_to_be32(agino);
+ 	offset = offsetof(xfs_agi_t, agi_unlinked) +
+ 		(sizeof(xfs_agino_t) * bucket_index);
++	xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ 	xfs_trans_log_buf(tp, agibp, offset,
+ 			  (offset + sizeof(xfs_agino_t) - 1));
+ 	return 0;
+@@ -1746,6 +1747,7 @@ xfs_iunlink_remove(
+ 		agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino);
+ 		offset = offsetof(xfs_agi_t, agi_unlinked) +
+ 			(sizeof(xfs_agino_t) * bucket_index);
++		xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ 		xfs_trans_log_buf(tp, agibp, offset,
+ 				  (offset + sizeof(xfs_agino_t) - 1));
+ 	} else {
+diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
+index 2fd7c1ff1d21..b5d5beb7df3a 100644
+--- a/fs/xfs/xfs_trans.c
++++ b/fs/xfs/xfs_trans.c
+@@ -1100,6 +1100,7 @@ xfs_trans_apply_sb_deltas(
+ 		whole = 1;
+ 	}
+ 
++	xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF);
+ 	if (whole)
+ 		/*
+ 		 * Log the whole thing, the fields are noncontiguous.
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index a78680a92dba..661c0aeef1c4 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
+ 		new_dir_mask |= FS_ISDIR;
+ 	}
+ 
+-	fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
+-	fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
++	fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
++		 fs_cookie);
++	fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
++		 fs_cookie);
+ 
+ 	if (target)
+ 		fsnotify_link_count(target);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 0fdff28d5015..287b906f5d59 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -416,6 +416,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif /* CONFIG_PCI */
+ 
+ /* pci-ish (pdev null is ok) buffer alloc/mapping support */
++void usb_init_pool_max(void);
+ int hcd_buffer_create(struct usb_hcd *hcd);
+ void hcd_buffer_destroy(struct usb_hcd *hcd);
+ 
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 00eb8f7fbf41..545241de23bf 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2532,7 +2532,7 @@ static int kdb_summary(int argc, const char **argv)
+ #define K(x) ((x) << (PAGE_SHIFT - 10))
+ 	kdb_printf("\nMemTotal:       %8lu kB\nMemFree:        %8lu kB\n"
+ 		   "Buffers:        %8lu kB\n",
+-		   val.totalram, val.freeram, val.bufferram);
++		   K(val.totalram), K(val.freeram), K(val.bufferram));
+ 	return 0;
+ }
+ 
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 28db9bedc857..6211d5d6d465 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -631,10 +631,14 @@ int ntp_validate_timex(struct timex *txc)
+ 	if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ 		return -EPERM;
+ 
+-	if (txc->modes & ADJ_FREQUENCY) {
+-		if (LONG_MIN / PPM_SCALE > txc->freq)
++	/*
++	 * Check for potential multiplication overflows that can
++	 * only happen on 64-bit systems:
++	 */
++	if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
++		if (LLONG_MIN / PPM_SCALE > txc->freq)
+ 			return -EINVAL;
+-		if (LONG_MAX / PPM_SCALE < txc->freq)
++		if (LLONG_MAX / PPM_SCALE < txc->freq)
+ 			return -EINVAL;
+ 	}
+ 
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 18cdf91b2f85..8d7e8098e768 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4588,7 +4588,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
+ 	*fpos += written;
+ 
+  out_unlock:
+-	for (i = 0; i < nr_pages; i++){
++	for (i = nr_pages - 1; i >= 0; i--) {
+ 		kunmap_atomic(map_page[i]);
+ 		put_page(pages[i]);
+ 	}
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 3663a305daf7..1b51d9216e7e 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -967,12 +967,24 @@ static void put_osd(struct ceph_osd *osd)
+  */
+ static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+ {
+-	dout("__remove_osd %p\n", osd);
+-	BUG_ON(!list_empty(&osd->o_requests));
+-	rb_erase(&osd->o_node, &osdc->osds);
++	dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
++	WARN_ON(!list_empty(&osd->o_requests));
++	WARN_ON(!list_empty(&osd->o_linger_requests));
++
+ 	list_del_init(&osd->o_osd_lru);
+-	ceph_con_close(&osd->o_con);
+-	put_osd(osd);
++	rb_erase(&osd->o_node, &osdc->osds);
++	RB_CLEAR_NODE(&osd->o_node);
++}
++
++static void remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
++{
++	dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
++
++	if (!RB_EMPTY_NODE(&osd->o_node)) {
++		ceph_con_close(&osd->o_con);
++		__remove_osd(osdc, osd);
++		put_osd(osd);
++	}
+ }
+ 
+ static void remove_all_osds(struct ceph_osd_client *osdc)
+@@ -982,7 +994,7 @@ static void remove_all_osds(struct ceph_osd_client *osdc)
+ 	while (!RB_EMPTY_ROOT(&osdc->osds)) {
+ 		struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds),
+ 						struct ceph_osd, o_node);
+-		__remove_osd(osdc, osd);
++		remove_osd(osdc, osd);
+ 	}
+ 	mutex_unlock(&osdc->request_mutex);
+ }
+@@ -1012,7 +1024,7 @@ static void remove_old_osds(struct ceph_osd_client *osdc)
+ 	list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
+ 		if (time_before(jiffies, osd->lru_ttl))
+ 			break;
+-		__remove_osd(osdc, osd);
++		remove_osd(osdc, osd);
+ 	}
+ 	mutex_unlock(&osdc->request_mutex);
+ }
+@@ -1027,8 +1039,7 @@ static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+ 	dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
+ 	if (list_empty(&osd->o_requests) &&
+ 	    list_empty(&osd->o_linger_requests)) {
+-		__remove_osd(osdc, osd);
+-
++		remove_osd(osdc, osd);
+ 		return -ENODEV;
+ 	}
+ 
+@@ -1610,6 +1621,7 @@ static void reset_changed_osds(struct ceph_osd_client *osdc)
+ {
+ 	struct rb_node *p, *n;
+ 
++	dout("%s %p\n", __func__, osdc);
+ 	for (p = rb_first(&osdc->osds); p; p = n) {
+ 		struct ceph_osd *osd = rb_entry(p, struct ceph_osd, o_node);
+ 
+diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
+index 63c1c8041554..fa66ba30470e 100644
+--- a/sound/pci/riptide/riptide.c
++++ b/sound/pci/riptide/riptide.c
+@@ -2032,32 +2032,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ {
+ 	static int dev;
+ 	struct gameport *gameport;
++	int ret;
+ 
+ 	if (dev >= SNDRV_CARDS)
+ 		return -ENODEV;
++
+ 	if (!enable[dev]) {
+-		dev++;
+-		return -ENOENT;
++		ret = -ENOENT;
++		goto inc_dev;
+ 	}
+ 
+-	if (!joystick_port[dev++])
+-		return 0;
++	if (!joystick_port[dev]) {
++		ret = 0;
++		goto inc_dev;
++	}
+ 
+ 	gameport = gameport_allocate_port();
+-	if (!gameport)
+-		return -ENOMEM;
++	if (!gameport) {
++		ret = -ENOMEM;
++		goto inc_dev;
++	}
+ 	if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+ 		snd_printk(KERN_WARNING
+ 			   "Riptide: cannot grab gameport 0x%x\n",
+ 			   joystick_port[dev]);
+ 		gameport_free_port(gameport);
+-		return -EBUSY;
++		ret = -EBUSY;
++		goto inc_dev;
+ 	}
+ 
+ 	gameport->io = joystick_port[dev];
+ 	gameport_register_port(gameport);
+ 	pci_set_drvdata(pci, gameport);
+-	return 0;
++
++	ret = 0;
++inc_dev:
++	dev++;
++	return ret;
+ }
+ 
+ static void snd_riptide_joystick_remove(struct pci_dev *pci)
+diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
+index 9ea05e956474..dd910d249987 100644
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -5789,6 +5789,9 @@ static int snd_hdspm_playback_open(struct snd_pcm_substream *substream)
+ 		snd_pcm_hw_constraint_minmax(runtime,
+ 					     SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 					     64, 8192);
++		snd_pcm_hw_constraint_minmax(runtime,
++					     SNDRV_PCM_HW_PARAM_PERIODS,
++					     2, 2);
+ 		break;
+ 	}
+ 
+@@ -5863,6 +5866,9 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream)
+ 		snd_pcm_hw_constraint_minmax(runtime,
+ 					     SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 					     64, 8192);
++		snd_pcm_hw_constraint_minmax(runtime,
++					     SNDRV_PCM_HW_PARAM_PERIODS,
++					     2, 2);
+ 		break;
+ 	}
+