--- /dev/null
+From a90b40385735af0d3031f98e97b439e8944a31b3 Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Mon, 6 Jan 2014 22:50:37 +0800
+Subject: ACPI / Battery: Add a _BIX quirk for NEC LZ750/LS
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit a90b40385735af0d3031f98e97b439e8944a31b3 upstream.
+
+The AML method _BIX of NEC LZ750/LS returns a broken package which
+skips the first member "Revision" (ACPI 5.0, Table 10-234).
+
+Add a quirk for this machine to skip member "Revision" during parsing
+the package returned by _BIX.
+
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=67351
+Reported-and-tested-by: Francisco Castro <fcr@adinet.com.uy>
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/battery.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -68,6 +68,7 @@ MODULE_AUTHOR("Alexey Starikovskiy <asta
+ MODULE_DESCRIPTION("ACPI Battery Driver");
+ MODULE_LICENSE("GPL");
+
++static int battery_bix_broken_package;
+ static unsigned int cache_time = 1000;
+ module_param(cache_time, uint, 0644);
+ MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+@@ -443,7 +444,12 @@ static int acpi_battery_get_info(struct
+ ACPI_EXCEPTION((AE_INFO, status, "Evaluating %s", name));
+ return -ENODEV;
+ }
+- if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
++
++ if (battery_bix_broken_package)
++ result = extract_package(battery, buffer.pointer,
++ extended_info_offsets + 1,
++ ARRAY_SIZE(extended_info_offsets) - 1);
++ else if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
+ result = extract_package(battery, buffer.pointer,
+ extended_info_offsets,
+ ARRAY_SIZE(extended_info_offsets));
+@@ -1064,6 +1070,17 @@ static int battery_notify(struct notifie
+ return 0;
+ }
+
++static struct dmi_system_id bat_dmi_table[] = {
++ {
++ .ident = "NEC LZ750/LS",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"),
++ },
++ },
++ {},
++};
++
+ static int acpi_battery_add(struct acpi_device *device)
+ {
+ int result = 0;
+@@ -1174,6 +1191,8 @@ static void __init acpi_battery_init_asy
+ if (!acpi_battery_dir)
+ return;
+ #endif
++ if (dmi_check_system(bat_dmi_table))
++ battery_bix_broken_package = 1;
+ if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ acpi_unlock_battery_dir(acpi_battery_dir);
--- /dev/null
+From df45c712d1f4ef37714245fb75de726f4ca2bf8d Mon Sep 17 00:00:00 2001
+From: Jiang Liu <jiang.liu@linux.intel.com>
+Date: Thu, 19 Dec 2013 20:38:15 +0800
+Subject: ACPI / TPM: fix memory leak when walking ACPI namespace
+
+From: Jiang Liu <jiang.liu@linux.intel.com>
+
+commit df45c712d1f4ef37714245fb75de726f4ca2bf8d upstream.
+
+In function ppi_callback(), memory allocated by acpi_get_name() will get
+leaked when current device isn't the desired TPM device, so fix the
+memory leak.
+
+Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_ppi.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/tpm/tpm_ppi.c
++++ b/drivers/char/tpm/tpm_ppi.c
+@@ -27,15 +27,18 @@ static char *tpm_device_name = "TPM";
+ static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context,
+ void **return_value)
+ {
+- acpi_status status;
++ acpi_status status = AE_OK;
+ struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+- status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
+- if (strstr(buffer.pointer, context) != NULL) {
+- *return_value = handle;
++
++ if (ACPI_SUCCESS(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer))) {
++ if (strstr(buffer.pointer, context) != NULL) {
++ *return_value = handle;
++ status = AE_CTRL_TERMINATE;
++ }
+ kfree(buffer.pointer);
+- return AE_CTRL_TERMINATE;
+ }
+- return AE_OK;
++
++ return status;
+ }
+
+ static inline void ppi_assign_params(union acpi_object params[4],
--- /dev/null
+From e098f5cbe9d410e7878b50f524dce36cc83ec40e Mon Sep 17 00:00:00 2001
+From: Simon Guinot <sguinot@lacie.com>
+Date: Mon, 23 Dec 2013 13:24:35 +0100
+Subject: ahci: add PCI ID for Marvell 88SE9170 SATA controller
+
+From: Simon Guinot <sguinot@lacie.com>
+
+commit e098f5cbe9d410e7878b50f524dce36cc83ec40e upstream.
+
+This patch adds support for the PCI ID provided by the Marvell 88SE9170
+SATA controller.
+
+Signed-off-by: Simon Guinot <sguinot@lacie.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ahci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -427,6 +427,9 @@ static const struct pci_device_id ahci_p
+ .driver_data = board_ahci_yes_fbs }, /* 88se9128 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9125 */
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178,
++ PCI_VENDOR_ID_MARVELL_EXT, 0x9170),
++ .driver_data = board_ahci_yes_fbs }, /* 88se9170 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
--- /dev/null
+From 8777539479abd7b3efeb691685415dc2b057d0e0 Mon Sep 17 00:00:00 2001
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+Date: Thu, 12 Dec 2013 08:32:02 +0530
+Subject: ARM: dts: exynos5250: Fix MDMA0 clock number
+
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+
+commit 8777539479abd7b3efeb691685415dc2b057d0e0 upstream.
+
+Due to incorrect clock specified in MDMA0 node, using MDMA0 controller
+could cause system failures, due to wrong clock being controlled. This
+patch fixes this by specifying correct clock.
+
+Signed-off-by: Abhilash Kesavan <a.kesavan@samsung.com>
+Acked-by: Mike Turquette <mturquette@linaro.org>
+[t.figa: Corrected commit message and description.]
+Signed-off-by: Tomasz Figa <t.figa@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -545,7 +545,7 @@
+ compatible = "arm,pl330", "arm,primecell";
+ reg = <0x10800000 0x1000>;
+ interrupts = <0 33 0>;
+- clocks = <&clock 271>;
++ clocks = <&clock 346>;
+ clock-names = "apb_pclk";
+ #dma-cells = <1>;
+ #dma-channels = <8>;
--- /dev/null
+From dcd740b645003b866d7eb30d13d34d0729cce9db Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Mon, 16 Dec 2013 19:16:07 +0100
+Subject: ARM: shmobile: armadillo: Fix coherent DMA mask
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit dcd740b645003b866d7eb30d13d34d0729cce9db upstream.
+
+Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better
+handing of DMA masks for coherent allocations") added an additional
+check to the coherent DMA mask that results in an error when the mask is
+larger than what dma_addr_t can address.
+
+Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix
+the problem.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/board-armadillo800eva.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
++++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
+@@ -437,7 +437,7 @@ static struct platform_device lcdc0_devi
+ .id = 0,
+ .dev = {
+ .platform_data = &lcdc0_info,
+- .coherent_dma_mask = ~0,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -534,7 +534,7 @@ static struct platform_device hdmi_lcdc_
+ .id = 1,
+ .dev = {
+ .platform_data = &hdmi_lcdc_info,
+- .coherent_dma_mask = ~0,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
--- /dev/null
+From 4f387323853c495ac589210832fad4503f75a0e7 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Mon, 16 Dec 2013 19:16:08 +0100
+Subject: ARM: shmobile: kzm9g: Fix coherent DMA mask
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit 4f387323853c495ac589210832fad4503f75a0e7 upstream.
+
+Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better
+handing of DMA masks for coherent allocations") added an additional
+check to the coherent DMA mask that results in an error when the mask is
+larger than what dma_addr_t can address.
+
+Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix
+the problem.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/board-kzm9g.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-shmobile/board-kzm9g.c
++++ b/arch/arm/mach-shmobile/board-kzm9g.c
+@@ -332,7 +332,7 @@ static struct platform_device lcdc_devic
+ .resource = lcdc_resources,
+ .dev = {
+ .platform_data = &lcdc_info,
+- .coherent_dma_mask = ~0,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
--- /dev/null
+From b6328a6b7ba57fc84c38248f6f0e387e1170f1a8 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Mon, 16 Dec 2013 19:16:09 +0100
+Subject: ARM: shmobile: mackerel: Fix coherent DMA mask
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit b6328a6b7ba57fc84c38248f6f0e387e1170f1a8 upstream.
+
+Commit 4dcfa60071b3d23f0181f27d8519f12e37cefbb9 ("ARM: DMA-API: better
+handing of DMA masks for coherent allocations") added an additional
+check to the coherent DMA mask that results in an error when the mask is
+larger than what dma_addr_t can address.
+
+Set the LCDC coherent DMA mask to DMA_BIT_MASK(32) instead of ~0 to fix
+the problem.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/board-mackerel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-shmobile/board-mackerel.c
++++ b/arch/arm/mach-shmobile/board-mackerel.c
+@@ -421,7 +421,7 @@ static struct platform_device lcdc_devic
+ .resource = lcdc_resources,
+ .dev = {
+ .platform_data = &lcdc_info,
+- .coherent_dma_mask = ~0,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -497,7 +497,7 @@ static struct platform_device hdmi_lcdc_
+ .id = 1,
+ .dev = {
+ .platform_data = &hdmi_lcdc_info,
+- .coherent_dma_mask = ~0,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
--- /dev/null
+From 778037e1ccb75609846deca9e419449c1dc137fa Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 16 Dec 2013 10:41:38 +0000
+Subject: clk: clk-divider: fix divisor > 255 bug
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 778037e1ccb75609846deca9e419449c1dc137fa upstream.
+
+Commit 6d9252bd9a4bb (clk: Add support for power of two type dividers)
+merged in v3.6 added the _get_val function to convert a divisor value to
+a register field value depending on the flags. However it used the type
+u8 for the div field, causing divisors larger than 255 to be masked
+and the resultant clock rate to be too high.
+
+E.g. in my case an 11bit divider was supposed to divide 24.576 MHz down
+to 32.768KHz. The divisor was correctly calculated as 750 (0x2ee). This
+was masked to 238 (0xee) resulting in a frequency of 103.26KHz.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Rajendra Nayak <rnayak@ti.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Mike Turquette <mturquette@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-divider.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -87,7 +87,7 @@ static unsigned int _get_table_val(const
+ return 0;
+ }
+
+-static unsigned int _get_val(struct clk_divider *divider, u8 div)
++static unsigned int _get_val(struct clk_divider *divider, unsigned int div)
+ {
+ if (divider->flags & CLK_DIVIDER_ONE_BASED)
+ return div;
--- /dev/null
+From 97c3557c3e0413efb1f021f582d1459760e22727 Mon Sep 17 00:00:00 2001
+From: Andrew Bresticker <abrestic@chromium.org>
+Date: Fri, 8 Nov 2013 15:44:07 +0530
+Subject: clk: exynos5250: fix sysmmu_mfc{l,r} gate clocks
+
+From: Andrew Bresticker <abrestic@chromium.org>
+
+commit 97c3557c3e0413efb1f021f582d1459760e22727 upstream.
+
+The gate clocks for the MFC sysmmus appear to be flipped, i.e.
+GATE_IP_MFC[2] gates sysmmu_mfcl and GATE_IP_MFC[1] gates sysmmu_mfcr.
+Fix this so that the MFC will start up.
+
+Signed-off-by: Andrew Bresticker <abrestic@chromium.org>
+Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
+Acked-by: Mike Turquette <mturquette@linaro.org>
+Signed-off-by: Tomasz Figa <t.figa@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/samsung/clk-exynos5250.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/samsung/clk-exynos5250.c
++++ b/drivers/clk/samsung/clk-exynos5250.c
+@@ -325,8 +325,8 @@ struct samsung_gate_clock exynos5250_gat
+ GATE(smmu_gscl2, "smmu_gscl2", "aclk266", GATE_IP_GSCL, 9, 0, 0),
+ GATE(smmu_gscl3, "smmu_gscl3", "aclk266", GATE_IP_GSCL, 10, 0, 0),
+ GATE(mfc, "mfc", "aclk333", GATE_IP_MFC, 0, 0, 0),
+- GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 1, 0, 0),
+- GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 2, 0, 0),
++ GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 2, 0, 0),
++ GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 1, 0, 0),
+ GATE(rotator, "rotator", "aclk266", GATE_IP_GEN, 1, 0, 0),
+ GATE(jpeg, "jpeg", "aclk166", GATE_IP_GEN, 2, 0, 0),
+ GATE(mdma1, "mdma1", "aclk266", GATE_IP_GEN, 4, 0, 0),
--- /dev/null
+From 5fdd1b56be51b1ec4dbde5b213d649ac717442da Mon Sep 17 00:00:00 2001
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+Date: Fri, 22 Nov 2013 14:21:08 +0900
+Subject: clk: samsung: exynos4: Correct SRC_MFC register
+
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+
+commit 5fdd1b56be51b1ec4dbde5b213d649ac717442da upstream.
+
+The SRC_MFC register offset was incorrect, which could cause have caused
+wrong calculation of rate of sclk_mfc clock, that could in turn lead to
+incorrect operation of MFC. This patch corrects it.
+
+Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
+Acked-by: Mike Turquette <mturquette@linaro.org>
+[t.figa: Updated patch description]
+Signed-off-by: Tomasz Figa <t.figa@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/samsung/clk-exynos4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -40,7 +40,7 @@
+ #define SRC_TOP1 0xc214
+ #define SRC_CAM 0xc220
+ #define SRC_TV 0xc224
+-#define SRC_MFC 0xcc28
++#define SRC_MFC 0xc228
+ #define SRC_G3D 0xc22c
+ #define E4210_SRC_IMAGE 0xc230
+ #define SRC_LCD0 0xc234
--- /dev/null
+From 2feed5aecf5f367b92bd6b6e92afe9e3de466907 Mon Sep 17 00:00:00 2001
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+Date: Wed, 11 Dec 2013 17:27:05 +0530
+Subject: clk: samsung: exynos5250: Add CLK_IGNORE_UNUSED flag for the sysreg clock
+
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+
+commit 2feed5aecf5f367b92bd6b6e92afe9e3de466907 upstream.
+
+The sysreg (system register) generates control signals for various blocks
+like disp1blk, i2c, mipi, usb etc. However, it gets disabled as an unused
+clock at boot-up. This can lead to failures in operation of above blocks,
+because they can not be configured properly if this clock is disabled.
+
+Signed-off-by: Abhilash Kesavan <a.kesavan@samsung.com>
+Acked-by: Mike Turquette <mturquette@linaro.org>
+[t.figa: Updated patch description.]
+Signed-off-by: Tomasz Figa <t.figa@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/samsung/clk-exynos5250.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/samsung/clk-exynos5250.c
++++ b/drivers/clk/samsung/clk-exynos5250.c
+@@ -377,7 +377,8 @@ struct samsung_gate_clock exynos5250_gat
+ GATE(hsi2c2, "hsi2c2", "aclk66", GATE_IP_PERIC, 30, 0, 0),
+ GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
+ GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
+- GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
++ GATE(sysreg, "sysreg", "aclk66",
++ GATE_IP_PERIS, 1, CLK_IGNORE_UNUSED, 0),
+ GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
+ GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
+ GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
--- /dev/null
+From 6d60792ec059d9f2139828f9f017679abb81aa73 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sun, 5 Jan 2014 20:07:02 -0500
+Subject: drm/nouveau/bios: make jump conditional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 6d60792ec059d9f2139828f9f017679abb81aa73 upstream.
+
+This fixes a hang in VBIOS scripts of the form "condition; jump".
+The jump used to always be executed, while now it will only be
+executed if the condition is true.
+
+See https://bugs.freedesktop.org/show_bug.cgi?id=72943
+
+Reported-by: Darcy Brás da Silva <dardevelin@cidadecool.com>
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/core/subdev/bios/init.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+@@ -1295,7 +1295,11 @@ init_jump(struct nvbios_init *init)
+ u16 offset = nv_ro16(bios, init->offset + 1);
+
+ trace("JUMP\t0x%04x\n", offset);
+- init->offset = offset;
++
++ if (init_exec(init))
++ init->offset = offset;
++ else
++ init->offset += 3;
+ }
+
+ /**
--- /dev/null
+From 6cbd7ee10e2842a3d1f9b60abede1c8f3d1f1130 Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Mon, 6 Jan 2014 10:59:16 -0800
+Subject: intel_pstate: Add X86_FEATURE_APERFMPERF to cpu match parameters.
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit 6cbd7ee10e2842a3d1f9b60abede1c8f3d1f1130 upstream.
+
+KVM environments do not support APERF/MPERF MSRs. intel_pstate cannot
+operate without these registers.
+
+The previous validity checks in intel_pstate_msrs_not_valid() are
+insufficent in nested KVMs.
+
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1046317
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -516,7 +516,8 @@ static void intel_pstate_timer_func(unsi
+ }
+
+ #define ICPU(model, policy) \
+- { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy }
++ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\
++ (unsigned long)&policy }
+
+ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
+ ICPU(0x2a, default_policy),
--- /dev/null
+From 277d916fc2e959c3f106904116bb4f7b1148d47a Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 16 Dec 2013 21:39:50 +0100
+Subject: mac80211: move "bufferable MMPDU" check to fix AP mode scan
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 277d916fc2e959c3f106904116bb4f7b1148d47a upstream.
+
+The check needs to apply to both multicast and unicast packets,
+otherwise probe requests on AP mode scans are sent through the multicast
+buffer queue, which adds long delays (often longer than the scanning
+interval).
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/tx.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -447,7 +447,6 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ {
+ struct sta_info *sta = tx->sta;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+ struct ieee80211_local *local = tx->local;
+
+ if (unlikely(!sta))
+@@ -458,15 +457,6 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
+ int ac = skb_get_queue_mapping(tx->skb);
+
+- /* only deauth, disassoc and action are bufferable MMPDUs */
+- if (ieee80211_is_mgmt(hdr->frame_control) &&
+- !ieee80211_is_deauth(hdr->frame_control) &&
+- !ieee80211_is_disassoc(hdr->frame_control) &&
+- !ieee80211_is_action(hdr->frame_control)) {
+- info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+- return TX_CONTINUE;
+- }
+-
+ ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
+ sta->sta.addr, sta->sta.aid, ac);
+ if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+@@ -509,9 +499,22 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ static ieee80211_tx_result debug_noinline
+ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
+ {
++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
++
+ if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
+ return TX_CONTINUE;
+
++ /* only deauth, disassoc and action are bufferable MMPDUs */
++ if (ieee80211_is_mgmt(hdr->frame_control) &&
++ !ieee80211_is_deauth(hdr->frame_control) &&
++ !ieee80211_is_disassoc(hdr->frame_control) &&
++ !ieee80211_is_action(hdr->frame_control)) {
++ if (tx->flags & IEEE80211_TX_UNICAST)
++ info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
++ return TX_CONTINUE;
++ }
++
+ if (tx->flags & IEEE80211_TX_UNICAST)
+ return ieee80211_tx_h_unicast_ps_buf(tx);
+ else
--- /dev/null
+From 73beb63d290f961c299526852884846b0d868840 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 2 Dec 2013 12:20:36 +0100
+Subject: mfd: rtsx_pcr: Disable interrupts before cancelling delayed works
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 73beb63d290f961c299526852884846b0d868840 upstream.
+
+This fixes a kernel panic when resuming from suspend to RAM.
+Without this fix an interrupt hits after the delayed work is canceled
+and thus requeues it. So we end up freeing an armed timer.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/rtsx_pcr.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/mfd/rtsx_pcr.c
++++ b/drivers/mfd/rtsx_pcr.c
+@@ -1195,8 +1195,14 @@ static void rtsx_pci_remove(struct pci_d
+
+ pcr->remove_pci = true;
+
+- cancel_delayed_work(&pcr->carddet_work);
+- cancel_delayed_work(&pcr->idle_work);
++ /* Disable interrupts at the pcr level */
++ spin_lock_irq(&pcr->lock);
++ rtsx_pci_writel(pcr, RTSX_BIER, 0);
++ pcr->bier = 0;
++ spin_unlock_irq(&pcr->lock);
++
++ cancel_delayed_work_sync(&pcr->carddet_work);
++ cancel_delayed_work_sync(&pcr->idle_work);
+
+ mfd_remove_devices(&pcidev->dev);
+
--- /dev/null
+From 2690d97ade05c5325cbf7c72b94b90d265659886 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <dborkman@redhat.com>
+Date: Tue, 31 Dec 2013 16:28:39 +0100
+Subject: netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper
+
+From: Daniel Borkmann <dborkman@redhat.com>
+
+commit 2690d97ade05c5325cbf7c72b94b90d265659886 upstream.
+
+Commit 5901b6be885e attempted to introduce IPv6 support into
+IRC NAT helper. By doing so, the following code seemed to be removed
+by accident:
+
+ ip = ntohl(exp->master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip);
+ sprintf(buffer, "%u %u", ip, port);
+ pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n", buffer, &ip, port);
+
+This leads to the fact that buffer[] was left uninitialized and
+contained some stack value. When we call nf_nat_mangle_tcp_packet(),
+we call strlen(buffer) on excatly this uninitialized buffer. If we
+are unlucky and the skb has enough tailroom, we overwrite resp. leak
+contents with values that sit on our stack into the packet and send
+that out to the receiver.
+
+Since the rather informal DCC spec [1] does not seem to specify
+IPv6 support right now, we log such occurences so that admins can
+act accordingly, and drop the packet. I've looked into XChat source,
+and IPv6 is not supported there: addresses are in u32 and print
+via %u format string.
+
+Therefore, restore old behaviour as in IPv4, use snprintf(). The
+IRC helper does not support IPv6 by now. By this, we can safely use
+strlen(buffer) in nf_nat_mangle_tcp_packet() and prevent a buffer
+overflow. Also simplify some code as we now have ct variable anyway.
+
+ [1] http://www.irchelp.org/irchelp/rfc/ctcpspec.html
+
+Fixes: 5901b6be885e ("netfilter: nf_nat: support IPv6 in IRC NAT helper")
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Cc: Harald Welte <laforge@gnumonks.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nf_nat_irc.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+--- a/net/netfilter/nf_nat_irc.c
++++ b/net/netfilter/nf_nat_irc.c
+@@ -34,10 +34,14 @@ static unsigned int help(struct sk_buff
+ struct nf_conntrack_expect *exp)
+ {
+ char buffer[sizeof("4294967296 65635")];
++ struct nf_conn *ct = exp->master;
++ union nf_inet_addr newaddr;
+ u_int16_t port;
+ unsigned int ret;
+
+ /* Reply comes from server. */
++ newaddr = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3;
++
+ exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
+ exp->dir = IP_CT_DIR_REPLY;
+ exp->expectfn = nf_nat_follow_master;
+@@ -57,17 +61,35 @@ static unsigned int help(struct sk_buff
+ }
+
+ if (port == 0) {
+- nf_ct_helper_log(skb, exp->master, "all ports in use");
++ nf_ct_helper_log(skb, ct, "all ports in use");
+ return NF_DROP;
+ }
+
+- ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo,
+- protoff, matchoff, matchlen, buffer,
+- strlen(buffer));
++ /* strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
++ * strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
++ * strlen("\1DCC SEND F AAAAAAAA P S\1\n")=26
++ * strlen("\1DCC MOVE F AAAAAAAA P S\1\n")=26
++ * strlen("\1DCC TSEND F AAAAAAAA P S\1\n")=27
++ *
++ * AAAAAAAAA: bound addr (1.0.0.0==16777216, min 8 digits,
++ * 255.255.255.255==4294967296, 10 digits)
++ * P: bound port (min 1 d, max 5d (65635))
++ * F: filename (min 1 d )
++ * S: size (min 1 d )
++ * 0x01, \n: terminators
++ */
++ /* AAA = "us", ie. where server normally talks to. */
++ snprintf(buffer, sizeof(buffer), "%u %u", ntohl(newaddr.ip), port);
++ pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n",
++ buffer, &newaddr.ip, port);
++
++ ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, matchoff,
++ matchlen, buffer, strlen(buffer));
+ if (ret != NF_ACCEPT) {
+- nf_ct_helper_log(skb, exp->master, "cannot mangle packet");
++ nf_ct_helper_log(skb, ct, "cannot mangle packet");
+ nf_ct_unexpect_related(exp);
+ }
++
+ return ret;
+ }
+
--- /dev/null
+From f8dae00684d678afa13041ef170cecfd1297ed40 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sun, 5 Jan 2014 21:25:00 -0500
+Subject: parisc: Ensure full cache coherency for kmap/kunmap
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit f8dae00684d678afa13041ef170cecfd1297ed40 upstream.
+
+Helge Deller noted a few weeks ago problems with the AIO support on
+parisc. This change is the result of numerous iterations on how best to
+deal with this problem.
+
+The solution adopted here is to provide full cache coherency in a
+uniform manner on all parisc systems. This involves calling
+flush_dcache_page() on kmap operations and flush_kernel_dcache_page() on
+kunmap operations. As a result, the copy_user_page() and
+clear_user_page() functions can be removed and the overall code is
+simpler.
+
+The change ensures that both userspace and kernel aliases to a mapped
+page are invalidated and flushed. This is necessary for the correct
+operation of PA8800 and PA8900 based systems which do not support
+inequivalent aliases.
+
+With this change, I have observed no cache related issues on c8000 and
+rp3440. It is now possible for example to do kernel builds with "-j64"
+on four way systems.
+
+On systems using XFS file systems, the patch recently posted by Mikulas
+Patocka to "fix crash using XFS on loopback" is needed to avoid a hang
+caused by an uninitialized lock passed to flush_dcache_page() in the
+page struct.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/cacheflush.h | 12 ++++--------
+ arch/parisc/include/asm/page.h | 5 ++---
+ arch/parisc/kernel/cache.c | 35 -----------------------------------
+ 3 files changed, 6 insertions(+), 46 deletions(-)
+
+--- a/arch/parisc/include/asm/cacheflush.h
++++ b/arch/parisc/include/asm/cacheflush.h
+@@ -125,42 +125,38 @@ flush_anon_page(struct vm_area_struct *v
+ void mark_rodata_ro(void);
+ #endif
+
+-#ifdef CONFIG_PA8X00
+-/* Only pa8800, pa8900 needs this */
+-
+ #include <asm/kmap_types.h>
+
+ #define ARCH_HAS_KMAP
+
+-void kunmap_parisc(void *addr);
+-
+ static inline void *kmap(struct page *page)
+ {
+ might_sleep();
++ flush_dcache_page(page);
+ return page_address(page);
+ }
+
+ static inline void kunmap(struct page *page)
+ {
+- kunmap_parisc(page_address(page));
++ flush_kernel_dcache_page_addr(page_address(page));
+ }
+
+ static inline void *kmap_atomic(struct page *page)
+ {
+ pagefault_disable();
++ flush_dcache_page(page);
+ return page_address(page);
+ }
+
+ static inline void __kunmap_atomic(void *addr)
+ {
+- kunmap_parisc(addr);
++ flush_kernel_dcache_page_addr(addr);
+ pagefault_enable();
+ }
+
+ #define kmap_atomic_prot(page, prot) kmap_atomic(page)
+ #define kmap_atomic_pfn(pfn) kmap_atomic(pfn_to_page(pfn))
+ #define kmap_atomic_to_page(ptr) virt_to_page(ptr)
+-#endif
+
+ #endif /* _PARISC_CACHEFLUSH_H */
+
+--- a/arch/parisc/include/asm/page.h
++++ b/arch/parisc/include/asm/page.h
+@@ -28,9 +28,8 @@ struct page;
+
+ void clear_page_asm(void *page);
+ void copy_page_asm(void *to, void *from);
+-void clear_user_page(void *vto, unsigned long vaddr, struct page *pg);
+-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+- struct page *pg);
++#define clear_user_page(vto, vaddr, page) clear_page_asm(vto)
++#define copy_user_page(vto, vfrom, vaddr, page) copy_page_asm(vto, vfrom)
+
+ /* #define CONFIG_PARISC_TMPALIAS */
+
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -388,41 +388,6 @@ void flush_kernel_dcache_page_addr(void
+ }
+ EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
+
+-void clear_user_page(void *vto, unsigned long vaddr, struct page *page)
+-{
+- clear_page_asm(vto);
+- if (!parisc_requires_coherency())
+- flush_kernel_dcache_page_asm(vto);
+-}
+-EXPORT_SYMBOL(clear_user_page);
+-
+-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+- struct page *pg)
+-{
+- /* Copy using kernel mapping. No coherency is needed
+- (all in kmap/kunmap) on machines that don't support
+- non-equivalent aliasing. However, the `from' page
+- needs to be flushed before it can be accessed through
+- the kernel mapping. */
+- preempt_disable();
+- flush_dcache_page_asm(__pa(vfrom), vaddr);
+- preempt_enable();
+- copy_page_asm(vto, vfrom);
+- if (!parisc_requires_coherency())
+- flush_kernel_dcache_page_asm(vto);
+-}
+-EXPORT_SYMBOL(copy_user_page);
+-
+-#ifdef CONFIG_PA8X00
+-
+-void kunmap_parisc(void *addr)
+-{
+- if (parisc_requires_coherency())
+- flush_kernel_dcache_page_addr(addr);
+-}
+-EXPORT_SYMBOL(kunmap_parisc);
+-#endif
+-
+ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ {
+ unsigned long flags;
--- /dev/null
+From af73623f5f10eb3832c87a169b28f7df040a875b Mon Sep 17 00:00:00 2001
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Date: Mon, 23 Sep 2013 14:47:32 +0200
+Subject: SCSI: sd: Reduce buffer size for vpd request
+
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+
+commit af73623f5f10eb3832c87a169b28f7df040a875b upstream.
+
+Somehow older areca firmware versions have issues with
+scsi_get_vpd_page() and a large buffer, the firmware
+seems to crash and the scsi error-handler will start endless
+recovery retries.
+Limiting the buf-size to 64-bytes fixes this issue with older
+firmware versions (<1.49 for my controller).
+
+Fixes a regression with areca controllers and older firmware versions
+introduced by commit: 66c28f97120e8a621afd5aa7a31c4b85c547d33d
+
+Reported-by: Nix <nix@esperi.org.uk>
+Tested-by: Nix <nix@esperi.org.uk>
+Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2634,13 +2634,16 @@ static void sd_read_write_same(struct sc
+ }
+
+ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
++ /* too large values might cause issues with arcmsr */
++ int vpd_buf_len = 64;
++
+ sdev->no_report_opcodes = 1;
+
+ /* Disable WRITE SAME if REPORT SUPPORTED OPERATION
+ * CODES is unsupported and the device has an ATA
+ * Information VPD page (SAT).
+ */
+- if (!scsi_get_vpd_page(sdev, 0x89, buffer, SD_BUF_SIZE))
++ if (!scsi_get_vpd_page(sdev, 0x89, buffer, vpd_buf_len))
+ sdev->no_write_same = 1;
+ }
+
net-loosen-constraints-for-recalculating-checksum-in-skb_segment.patch
arm-fix-footbridge-clockevent-device.patch
arm-fix-bad-mode-in-...-handler-message-for-undefined-instructions.patch
+arm-dts-exynos5250-fix-mdma0-clock-number.patch
+arm-shmobile-kzm9g-fix-coherent-dma-mask.patch
+arm-shmobile-armadillo-fix-coherent-dma-mask.patch
+arm-shmobile-mackerel-fix-coherent-dma-mask.patch
+drm-nouveau-bios-make-jump-conditional.patch
+parisc-ensure-full-cache-coherency-for-kmap-kunmap.patch
+ahci-add-pci-id-for-marvell-88se9170-sata-controller.patch
+clk-clk-divider-fix-divisor-255-bug.patch
+clk-samsung-exynos4-correct-src_mfc-register.patch
+clk-samsung-exynos5250-add-clk_ignore_unused-flag-for-the-sysreg-clock.patch
+clk-exynos5250-fix-sysmmu_mfc-l-r-gate-clocks.patch
+mfd-rtsx_pcr-disable-interrupts-before-cancelling-delayed-works.patch
+acpi-tpm-fix-memory-leak-when-walking-acpi-namespace.patch
+acpi-battery-add-a-_bix-quirk-for-nec-lz750-ls.patch
+mac80211-move-bufferable-mmpdu-check-to-fix-ap-mode-scan.patch
+intel_pstate-add-x86_feature_aperfmperf-to-cpu-match-parameters.patch
+scsi-sd-reduce-buffer-size-for-vpd-request.patch
+netfilter-nf_nat-fix-access-to-uninitialized-buffer-in-irc-nat-helper.patch
+x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch
--- /dev/null
+From 26bef1318adc1b3a530ecc807ef99346db2aa8b0 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 11 Jan 2014 19:15:52 -0800
+Subject: x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 26bef1318adc1b3a530ecc807ef99346db2aa8b0 upstream.
+
+Before we do an EMMS in the AMD FXSAVE information leak workaround we
+need to clear any pending exceptions, otherwise we trap with a
+floating-point exception inside this code.
+
+Reported-by: halfdog <me@halfdog.net>
+Tested-by: Borislav Petkov <bp@suse.de>
+Link: http://lkml.kernel.org/r/CA%2B55aFxQnY_PCG_n4=0w-VG=YLXL-yr7oMxyy0WU2gCBAf3ydg@mail.gmail.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/fpu-internal.h | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/include/asm/fpu-internal.h
++++ b/arch/x86/include/asm/fpu-internal.h
+@@ -295,12 +295,13 @@ static inline int restore_fpu_checking(s
+ /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+ is pending. Clear the x87 state here by setting it to fixed
+ values. "m" is a random variable that should be in L1 */
+- alternative_input(
+- ASM_NOP8 ASM_NOP2,
+- "emms\n\t" /* clear stack tags */
+- "fildl %P[addr]", /* set F?P to defined value */
+- X86_FEATURE_FXSAVE_LEAK,
+- [addr] "m" (tsk->thread.fpu.has_fpu));
++ if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) {
++ asm volatile(
++ "fnclex\n\t"
++ "emms\n\t"
++ "fildl %P[addr]" /* set F?P to defined value */
++ : : [addr] "m" (tsk->thread.fpu.has_fpu));
++ }
+
+ return fpu_restore_checking(&tsk->thread.fpu);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
