--- /dev/null
+From c5f927a6f62196226915f12194c9d0df4e2210d7 Mon Sep 17 00:00:00 2001
+From: Jed Davis <jld@mozilla.com>
+Date: Thu, 20 Jun 2013 10:16:29 +0100
+Subject: ARM: 7765/1: perf: Record the user-mode PC in the call chain.
+
+From: Jed Davis <jld@mozilla.com>
+
+commit c5f927a6f62196226915f12194c9d0df4e2210d7 upstream.
+
+With this change, we no longer lose the innermost entry in the user-mode
+part of the call chain. See also the x86 port, which includes the ip.
+
+It's possible to partially work around this problem by post-processing
+the data to use the PERF_SAMPLE_IP value, but this works only if the CPU
+wasn't in the kernel when the sample was taken.
+
+Signed-off-by: Jed Davis <jld@mozilla.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/perf_event.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -569,6 +569,7 @@ perf_callchain_user(struct perf_callchai
+ return;
+ }
+
++ perf_callchain_store(entry, regs->ARM_pc);
+ tail = (struct frame_tail __user *)regs->ARM_fp - 1;
+
+ while ((entry->nr < PERF_MAX_STACK_DEPTH) &&
--- /dev/null
+From ae120d9edfe96628f03d87634acda0bfa7110632 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+Date: Fri, 21 Jun 2013 12:06:19 +0100
+Subject: ARM: 7767/1: let the ASID allocator handle suspended animation
+
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+
+commit ae120d9edfe96628f03d87634acda0bfa7110632 upstream.
+
+When a CPU is running a process, the ASID for that process is
+held in a per-CPU variable (the "active ASIDs" array). When
+the ASID allocator handles a rollover, it copies the active
+ASIDs into a "reserved ASIDs" array to ensure that a process
+currently running on another CPU will continue to run unaffected.
+The active array is zero-ed to indicate that a rollover occurred.
+
+Because of this mechanism, a reserved ASID is only remembered for
+a single rollover. A subsequent rollover will completely refill
+the reserved ASIDs array.
+
+In a severely oversubscribed environment where a CPU can be
+prevented from running for extended periods of time (think virtual
+machines), the above has a horrible side effect:
+
+[P{a} denotes process P running with ASID a]
+
+ CPU-0 CPU-1
+
+ A{x} [active = <x 0>]
+
+ [suspended] runs B{y} [active = <x y>]
+
+ [rollover:
+ active = <0 0>
+ reserved = <x y>]
+
+ runs B{y} [active = <0 y>
+ reserved = <x y>]
+
+ [rollover:
+ active = <0 0>
+ reserved = <0 y>]
+
+ runs C{x} [active = <0 x>]
+
+ [resumes]
+
+ runs A{x}
+
+At that stage, both A and C have the same ASID, with deadly
+consequences.
+
+The fix is to preserve reserved ASIDs across rollovers if
+the CPU doesn't have an active ASID when the rollover occurs.
+
+Acked-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Catalin Carinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/context.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -128,6 +128,15 @@ static void flush_context(unsigned int c
+ asid = 0;
+ } else {
+ asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
++ /*
++ * If this CPU has already been through a
++ * rollover, but hasn't run another task in
++ * the meantime, we must preserve its reserved
++ * ASID, as this is the only trace we have of
++ * the process it is still running.
++ */
++ if (asid == 0)
++ asid = per_cpu(reserved_asids, i);
+ __set_bit(ASID_TO_IDX(asid), asid_map);
+ }
+ per_cpu(reserved_asids, i) = asid;
--- /dev/null
+From b8e4a4740fa2b17c0a447b3ab783b3dc10702e27 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+Date: Fri, 21 Jun 2013 12:06:55 +0100
+Subject: ARM: 7768/1: prevent risks of out-of-bound access in ASID allocator
+
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+
+commit b8e4a4740fa2b17c0a447b3ab783b3dc10702e27 upstream.
+
+On a CPU that never ran anything, both the active and reserved ASID
+fields are set to zero. In this case the ASID_TO_IDX() macro will
+return -1, which is not a very useful value to index a bitmap.
+
+Instead of trying to offset the ASID so that ASID #1 is actually
+bit 0 in the asid_map bitmap, just always ignore bit 0 and start
+the search from bit 1. This makes the code a bit more readable,
+and without risk of OoB access.
+
+Acked-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/context.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -39,10 +39,7 @@
+ * non 64-bit operations.
+ */
+ #define ASID_FIRST_VERSION (1ULL << ASID_BITS)
+-#define NUM_USER_ASIDS (ASID_FIRST_VERSION - 1)
+-
+-#define ASID_TO_IDX(asid) ((asid & ~ASID_MASK) - 1)
+-#define IDX_TO_ASID(idx) ((idx + 1) & ~ASID_MASK)
++#define NUM_USER_ASIDS ASID_FIRST_VERSION
+
+ static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
+ static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
+@@ -137,7 +134,7 @@ static void flush_context(unsigned int c
+ */
+ if (asid == 0)
+ asid = per_cpu(reserved_asids, i);
+- __set_bit(ASID_TO_IDX(asid), asid_map);
++ __set_bit(asid & ~ASID_MASK, asid_map);
+ }
+ per_cpu(reserved_asids, i) = asid;
+ }
+@@ -176,17 +173,19 @@ static u64 new_context(struct mm_struct
+ /*
+ * Allocate a free ASID. If we can't find one, take a
+ * note of the currently active ASIDs and mark the TLBs
+- * as requiring flushes.
++ * as requiring flushes. We always count from ASID #1,
++ * as we reserve ASID #0 to switch via TTBR0 and indicate
++ * rollover events.
+ */
+- asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++ asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ if (asid == NUM_USER_ASIDS) {
+ generation = atomic64_add_return(ASID_FIRST_VERSION,
+ &asid_generation);
+ flush_context(cpu);
+- asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++ asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ }
+ __set_bit(asid, asid_map);
+- asid = generation | IDX_TO_ASID(asid);
++ asid |= generation;
+ cpumask_clear(mm_cpumask(mm));
+ }
+
--- /dev/null
+From 0d0752bca1f9a91fb646647aa4abbb21156f316c Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+Date: Fri, 21 Jun 2013 12:07:27 +0100
+Subject: ARM: 7769/1: Cortex-A15: fix erratum 798181 implementation
+
+From: Marc Zyngier <Marc.Zyngier@arm.com>
+
+commit 0d0752bca1f9a91fb646647aa4abbb21156f316c upstream.
+
+Looking into the active_asids array is not enough, as we also need
+to look into the reserved_asids array (they both represent processes
+that are currently running).
+
+Also, not holding the ASID allocator lock is racy, as another CPU
+could schedule that process and trigger a rollover, making the erratum
+workaround miss an IPI.
+
+Exposing this outside of context.c is a little ugly on the side, so
+let's define a new entry point that the erratum workaround can call
+to obtain the cpumask.
+
+Acked-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/mmu_context.h | 10 +++++++++-
+ arch/arm/kernel/smp_tlb.c | 18 ++----------------
+ arch/arm/mm/context.c | 29 ++++++++++++++++++++++++++++-
+ 3 files changed, 39 insertions(+), 18 deletions(-)
+
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -27,7 +27,15 @@ void __check_vmalloc_seq(struct mm_struc
+ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
+ #define init_new_context(tsk,mm) ({ atomic64_set(&mm->context.id, 0); 0; })
+
+-DECLARE_PER_CPU(atomic64_t, active_asids);
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++ cpumask_t *mask);
++#else /* !CONFIG_ARM_ERRATA_798181 */
++static inline void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++ cpumask_t *mask)
++{
++}
++#endif /* CONFIG_ARM_ERRATA_798181 */
+
+ #else /* !CONFIG_CPU_HAS_ASID */
+
+--- a/arch/arm/kernel/smp_tlb.c
++++ b/arch/arm/kernel/smp_tlb.c
+@@ -103,7 +103,7 @@ static void broadcast_tlb_a15_erratum(vo
+
+ static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+ {
+- int cpu, this_cpu;
++ int this_cpu;
+ cpumask_t mask = { CPU_BITS_NONE };
+
+ if (!erratum_a15_798181())
+@@ -111,21 +111,7 @@ static void broadcast_tlb_mm_a15_erratum
+
+ dummy_flush_tlb_a15_erratum();
+ this_cpu = get_cpu();
+- for_each_online_cpu(cpu) {
+- if (cpu == this_cpu)
+- continue;
+- /*
+- * We only need to send an IPI if the other CPUs are running
+- * the same ASID as the one being invalidated. There is no
+- * need for locking around the active_asids check since the
+- * switch_mm() function has at least one dmb() (as required by
+- * this workaround) in case a context switch happens on
+- * another CPU after the condition below.
+- */
+- if (atomic64_read(&mm->context.id) ==
+- atomic64_read(&per_cpu(active_asids, cpu)))
+- cpumask_set_cpu(cpu, &mask);
+- }
++ a15_erratum_get_cpumask(this_cpu, mm, &mask);
+ smp_call_function_many(&mask, ipi_flush_tlb_a15_erratum, NULL, 1);
+ put_cpu();
+ }
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -45,10 +45,37 @@ static DEFINE_RAW_SPINLOCK(cpu_asid_lock
+ static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
+ static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
+
+-DEFINE_PER_CPU(atomic64_t, active_asids);
++static DEFINE_PER_CPU(atomic64_t, active_asids);
+ static DEFINE_PER_CPU(u64, reserved_asids);
+ static cpumask_t tlb_flush_pending;
+
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++ cpumask_t *mask)
++{
++ int cpu;
++ unsigned long flags;
++ u64 context_id, asid;
++
++ raw_spin_lock_irqsave(&cpu_asid_lock, flags);
++ context_id = mm->context.id.counter;
++ for_each_online_cpu(cpu) {
++ if (cpu == this_cpu)
++ continue;
++ /*
++ * We only need to send an IPI if the other CPUs are
++ * running the same ASID as the one being invalidated.
++ */
++ asid = per_cpu(active_asids, cpu).counter;
++ if (asid == 0)
++ asid = per_cpu(reserved_asids, cpu);
++ if (context_id == asid)
++ cpumask_set_cpu(cpu, mask);
++ }
++ raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
++}
++#endif
++
+ #ifdef CONFIG_ARM_LPAE
+ static void cpu_set_reserved_ttbr0(void)
+ {
--- /dev/null
+From cbbe6f82b489e7ceba4ad7c833bd3a76cd0084cb Mon Sep 17 00:00:00 2001
+From: Jason Liu <r64343@freescale.com>
+Date: Mon, 1 Jul 2013 09:53:30 +0100
+Subject: ARM: 7778/1: smp_twd: twd_update_frequency need be run on all online CPUs
+
+From: Jason Liu <r64343@freescale.com>
+
+commit cbbe6f82b489e7ceba4ad7c833bd3a76cd0084cb upstream.
+
+When the local timer freq changed, the twd_update_frequency function
+should be run all the CPUs include itself, otherwise, the twd freq will
+not get updated and the local timer will not run correcttly.
+
+smp_call_function will run functions on all other CPUs, but not include
+himself, this is not correct,use on_each_cpu instead to fix this issue.
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Rob Herring <rob.herring@calxeda.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Jason Liu <r64343@freescale.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/smp_twd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/kernel/smp_twd.c
++++ b/arch/arm/kernel/smp_twd.c
+@@ -120,7 +120,7 @@ static int twd_rate_change(struct notifi
+ * changing cpu.
+ */
+ if (flags == POST_RATE_CHANGE)
+- smp_call_function(twd_update_frequency,
++ on_each_cpu(twd_update_frequency,
+ (void *)&cnd->new_rate, 1);
+
+ return NOTIFY_OK;
--- /dev/null
+From 7925e89f54fc49bcd1e73f0a65c4a3eb35b9cfb1 Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Thu, 18 Apr 2013 18:34:06 +0100
+Subject: ARM: dts: imx: cpus/cpu nodes dts updates
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit 7925e89f54fc49bcd1e73f0a65c4a3eb35b9cfb1 upstream.
+
+This patch updates the in-kernel dts files according to the latest cpus
+and cpu bindings updates for ARM.
+
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx23.dtsi | 8 ++++++--
+ arch/arm/boot/dts/imx28.dtsi | 8 ++++++--
+ arch/arm/boot/dts/imx6dl.dtsi | 2 ++
+ arch/arm/boot/dts/imx6q.dtsi | 4 ++++
+ 4 files changed, 18 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -23,8 +23,12 @@
+ };
+
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -32,8 +32,12 @@
+ };
+
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -18,12 +18,14 @@
+
+ cpu@0 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <0>;
+ next-level-cache = <&L2>;
+ };
+
+ cpu@1 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <1>;
+ next-level-cache = <&L2>;
+ };
+--- a/arch/arm/boot/dts/imx6q.dtsi
++++ b/arch/arm/boot/dts/imx6q.dtsi
+@@ -18,6 +18,7 @@
+
+ cpu@0 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <0>;
+ next-level-cache = <&L2>;
+ operating-points = <
+@@ -39,18 +40,21 @@
+
+ cpu@1 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <1>;
+ next-level-cache = <&L2>;
+ };
+
+ cpu@2 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <2>;
+ next-level-cache = <&L2>;
+ };
+
+ cpu@3 {
+ compatible = "arm,cortex-a9";
++ device_type = "cpu";
+ reg = <3>;
+ next-level-cache = <&L2>;
+ };
--- /dev/null
+From 319e0b4f02f73983c03a2ca38595fc6367929edf Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 9 Jul 2013 09:52:55 +0100
+Subject: ARM: mm: fix boot on SA1110 Assabet
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 319e0b4f02f73983c03a2ca38595fc6367929edf upstream.
+
+Commit 83db0384 (mm/ARM: use common help functions to free reserved
+pages) broke booting on the Assabet by trying to convert a PFN to
+a virtual address using the __va() macro. This macro takes the
+physical address, not a PFN. Fix this.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -600,7 +600,7 @@ void __init mem_init(void)
+
+ #ifdef CONFIG_SA1111
+ /* now that our DMA memory is actually so designated, we can free it */
+- free_reserved_area(__va(PHYS_PFN_OFFSET), swapper_pg_dir, 0, NULL);
++ free_reserved_area(__va(PHYS_OFFSET), swapper_pg_dir, 0, NULL);
+ #endif
+
+ free_highpages();
--- /dev/null
+From 1eb14ea1e6bcd11d6d0ba937fc39808bb4d3453e Mon Sep 17 00:00:00 2001
+From: Magnus Damm <damm@opensource.se>
+Date: Mon, 1 Jul 2013 20:48:07 +0900
+Subject: ARM: shmobile: emev2 GIO3 resource fix
+
+From: Magnus Damm <damm@opensource.se>
+
+commit 1eb14ea1e6bcd11d6d0ba937fc39808bb4d3453e upstream.
+
+Fix GIO3 base addresses for EMEV2.
+
+This bug was introduced by 088efd9273b5076a0aead479aa31f1066d182b3e
+("mach-shmobile: Emma Mobile EV2 GPIO support V3") which was included in v3.5.
+
+Signed-off-by: Magnus Damm <damm@opensource.se>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/setup-emev2.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-shmobile/setup-emev2.c
++++ b/arch/arm/mach-shmobile/setup-emev2.c
+@@ -287,14 +287,14 @@ static struct gpio_em_config gio3_config
+ static struct resource gio3_resources[] = {
+ [0] = {
+ .name = "GIO_096",
+- .start = 0xe0050100,
+- .end = 0xe005012b,
++ .start = 0xe0050180,
++ .end = 0xe00501ab,
+ .flags = IORESOURCE_MEM,
+ },
+ [1] = {
+ .name = "GIO_096",
+- .start = 0xe0050140,
+- .end = 0xe005015f,
++ .start = 0xe00501c0,
++ .end = 0xe00501df,
+ .flags = IORESOURCE_MEM,
+ },
+ [2] = {
--- /dev/null
+From f820b60582f75e73e83b8505d7e48fe59770f558 Mon Sep 17 00:00:00 2001
+From: Takanari Hayama <taki@igel.co.jp>
+Date: Mon, 1 Jul 2013 16:38:53 +0900
+Subject: ARM: shmobile: r8a73a4: Fix resources for SCIFB0
+
+From: Takanari Hayama <taki@igel.co.jp>
+
+commit f820b60582f75e73e83b8505d7e48fe59770f558 upstream.
+
+Fix base address and IRQ resources associated with SCIFB0.
+
+This bug was introduced by e481a528901d0cd18b5b5fcbdc55207ea3b6ef68
+("ARM: shmobile: r8a73a4 SCIF support V3") which was included in v3.10.
+
+Signed-off-by: Takanari Hayama <taki@igel.co.jp>
+Acked-by: Magnus Damm <damm@opensource.se>
+[ horms+renesas@verge.net.au: Add information about commit and version
+ this bug was added in ]
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/setup-r8a73a4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-shmobile/setup-r8a73a4.c
++++ b/arch/arm/mach-shmobile/setup-r8a73a4.c
+@@ -62,7 +62,7 @@ enum { SCIFA0, SCIFA1, SCIFB0, SCIFB1, S
+ static const struct plat_sci_port scif[] = {
+ SCIFA_DATA(SCIFA0, 0xe6c40000, gic_spi(144)), /* SCIFA0 */
+ SCIFA_DATA(SCIFA1, 0xe6c50000, gic_spi(145)), /* SCIFA1 */
+- SCIFB_DATA(SCIFB0, 0xe6c50000, gic_spi(145)), /* SCIFB0 */
++ SCIFB_DATA(SCIFB0, 0xe6c20000, gic_spi(148)), /* SCIFB0 */
+ SCIFB_DATA(SCIFB1, 0xe6c30000, gic_spi(149)), /* SCIFB1 */
+ SCIFB_DATA(SCIFB2, 0xe6ce0000, gic_spi(150)), /* SCIFB2 */
+ SCIFB_DATA(SCIFB3, 0xe6cf0000, gic_spi(151)), /* SCIFB3 */
--- /dev/null
+From da331ba8e9c5de72a27e50f71105395bba6eebe0 Mon Sep 17 00:00:00 2001
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Date: Wed, 3 Jul 2013 15:00:43 -0700
+Subject: drivers/dma/pl330.c: fix locking in pl330_free_chan_resources()
+
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+
+commit da331ba8e9c5de72a27e50f71105395bba6eebe0 upstream.
+
+tasklet_kill() may sleep so call it before taking pch->lock.
+
+Fixes following lockup:
+
+ BUG: scheduling while atomic: cat/2383/0x00000002
+ Modules linked in:
+ unwind_backtrace+0x0/0xfc
+ __schedule_bug+0x4c/0x58
+ __schedule+0x690/0x6e0
+ sys_sched_yield+0x70/0x78
+ tasklet_kill+0x34/0x8c
+ pl330_free_chan_resources+0x24/0x88
+ dma_chan_put+0x4c/0x50
+ [...]
+ BUG: spinlock lockup suspected on CPU#0, swapper/0/0
+ lock: 0xe52aa04c, .magic: dead4ead, .owner: cat/2383, .owner_cpu: 1
+ unwind_backtrace+0x0/0xfc
+ do_raw_spin_lock+0x194/0x204
+ _raw_spin_lock_irqsave+0x20/0x28
+ pl330_tasklet+0x2c/0x5a8
+ tasklet_action+0xfc/0x114
+ __do_softirq+0xe4/0x19c
+ irq_exit+0x98/0x9c
+ handle_IPI+0x124/0x16c
+ gic_handle_irq+0x64/0x68
+ __irq_svc+0x40/0x70
+ cpuidle_wrap_enter+0x4c/0xa0
+ cpuidle_enter_state+0x18/0x68
+ cpuidle_idle_call+0xac/0xe0
+ cpu_idle+0xac/0xf0
+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
+Cc: Vinod Koul <vinod.koul@linux.intel.com>
+Cc: Tomasz Figa <t.figa@samsung.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/pl330.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2485,10 +2485,10 @@ static void pl330_free_chan_resources(st
+ struct dma_pl330_chan *pch = to_pchan(chan);
+ unsigned long flags;
+
+- spin_lock_irqsave(&pch->lock, flags);
+-
+ tasklet_kill(&pch->task);
+
++ spin_lock_irqsave(&pch->lock, flags);
++
+ pl330_release_channel(pch->pl330_chid);
+ pch->pl330_chid = NULL;
+
--- /dev/null
+From fdf96a907c1fbb93c633e2b7ede3b8df26d6a4c0 Mon Sep 17 00:00:00 2001
+From: Steve French <smfrench@us.ibm.com>
+Date: Tue, 25 Jun 2013 14:03:16 -0500
+Subject: Handle big endianness in NTLM (ntlmv2) authentication
+
+From: Steve French <smfrench@us.ibm.com>
+
+commit fdf96a907c1fbb93c633e2b7ede3b8df26d6a4c0 upstream.
+
+This is RH bug 970891
+Uppercasing of username during calculation of ntlmv2 hash fails
+because UniStrupr function does not handle big endian wchars.
+
+Also fix a comment in the same code to reflect its correct usage.
+
+[To make it easier for stable (rather than require 2nd patch) fixed
+this patch of Shirish's to remove endian warning generated
+by sparse -- steve f.]
+
+Reported-by: steve <sanpatr1@in.ibm.com>
+Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifs_unicode.h | 8 ++++----
+ fs/cifs/cifsencrypt.c | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/cifs/cifs_unicode.h
++++ b/fs/cifs/cifs_unicode.h
+@@ -327,14 +327,14 @@ UniToupper(register wchar_t uc)
+ /*
+ * UniStrupr: Upper case a unicode string
+ */
+-static inline wchar_t *
+-UniStrupr(register wchar_t *upin)
++static inline __le16 *
++UniStrupr(register __le16 *upin)
+ {
+- register wchar_t *up;
++ register __le16 *up;
+
+ up = upin;
+ while (*up) { /* For all characters */
+- *up = UniToupper(*up);
++ *up = cpu_to_le16(UniToupper(le16_to_cpu(*up)));
+ up++;
+ }
+ return upin; /* Return input pointer */
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -414,7 +414,7 @@ static int calc_ntlmv2_hash(struct cifs_
+ int rc = 0;
+ int len;
+ char nt_hash[CIFS_NTHASH_SIZE];
+- wchar_t *user;
++ __le16 *user;
+ wchar_t *domain;
+ wchar_t *server;
+
+@@ -439,7 +439,7 @@ static int calc_ntlmv2_hash(struct cifs_
+ return rc;
+ }
+
+- /* convert ses->user_name to unicode and uppercase */
++ /* convert ses->user_name to unicode */
+ len = ses->user_name ? strlen(ses->user_name) : 0;
+ user = kmalloc(2 + (len * 2), GFP_KERNEL);
+ if (user == NULL) {
+@@ -448,7 +448,7 @@ static int calc_ntlmv2_hash(struct cifs_
+ }
+
+ if (len) {
+- len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp);
++ len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp);
+ UniStrupr(user);
+ } else {
+ memset(user, '\0', 2);
--- /dev/null
+From f37a96914d1aea10fed8d9af10251f0b9caea31b Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Mon, 8 Jul 2013 16:00:29 -0700
+Subject: memcg, kmem: fix reference count handling on the error path
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit f37a96914d1aea10fed8d9af10251f0b9caea31b upstream.
+
+mem_cgroup_css_online calls mem_cgroup_put if memcg_init_kmem fails.
+This is not correct because only memcg_propagate_kmem takes an
+additional reference while mem_cgroup_sockets_init is allowed to fail as
+well (although no current implementation fails) but it doesn't take any
+reference. This all suggests that it should be memcg_propagate_kmem
+that should clean up after itself so this patch moves mem_cgroup_put
+over there.
+
+Unfortunately this is not that easy (as pointed out by Li Zefan) because
+memcg_kmem_mark_dead marks the group dead (KMEM_ACCOUNTED_DEAD) if it is
+marked active (KMEM_ACCOUNTED_ACTIVE) which is the case even if
+memcg_propagate_kmem fails so the additional reference is dropped in
+that case in kmem_cgroup_destroy which means that the reference would be
+dropped two times.
+
+The easiest way then would be to simply remove mem_cgrroup_put from
+mem_cgroup_css_online and rely on kmem_cgroup_destroy doing the right
+thing.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Glauber Costa <glommer@openvz.org>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6296,14 +6296,6 @@ mem_cgroup_css_online(struct cgroup *con
+
+ error = memcg_init_kmem(memcg, &mem_cgroup_subsys);
+ mutex_unlock(&memcg_create_mutex);
+- if (error) {
+- /*
+- * We call put now because our (and parent's) refcnts
+- * are already in place. mem_cgroup_put() will internally
+- * call __mem_cgroup_free, so return directly
+- */
+- mem_cgroup_put(memcg);
+- }
+ return error;
+ }
+
--- /dev/null
+From cea27eb2a202959783f81254c48c250ddd80e129 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <liwanp@linux.vnet.ibm.com>
+Date: Wed, 3 Jul 2013 15:02:40 -0700
+Subject: mm/memory-hotplug: fix lowmem count overflow when offline pages
+
+From: Wanpeng Li <liwanp@linux.vnet.ibm.com>
+
+commit cea27eb2a202959783f81254c48c250ddd80e129 upstream.
+
+The logic for the memory-remove code fails to correctly account the
+Total High Memory when a memory block which contains High Memory is
+offlined as shown in the example below. The following patch fixes it.
+
+Before logic memory remove:
+
+MemTotal: 7603740 kB
+MemFree: 6329612 kB
+Buffers: 94352 kB
+Cached: 872008 kB
+SwapCached: 0 kB
+Active: 626932 kB
+Inactive: 519216 kB
+Active(anon): 180776 kB
+Inactive(anon): 222944 kB
+Active(file): 446156 kB
+Inactive(file): 296272 kB
+Unevictable: 0 kB
+Mlocked: 0 kB
+HighTotal: 7294672 kB
+HighFree: 5704696 kB
+LowTotal: 309068 kB
+LowFree: 624916 kB
+
+After logic memory remove:
+
+MemTotal: 7079452 kB
+MemFree: 5805976 kB
+Buffers: 94372 kB
+Cached: 872000 kB
+SwapCached: 0 kB
+Active: 626936 kB
+Inactive: 519236 kB
+Active(anon): 180780 kB
+Inactive(anon): 222944 kB
+Active(file): 446156 kB
+Inactive(file): 296292 kB
+Unevictable: 0 kB
+Mlocked: 0 kB
+HighTotal: 7294672 kB
+HighFree: 5181024 kB
+LowTotal: 4294752076 kB
+LowFree: 624952 kB
+
+[mhocko@suse.cz: fix CONFIG_HIGHMEM=n build]
+Signed-off-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
+Reviewed-by: Michal Hocko <mhocko@suse.cz>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6142,6 +6142,10 @@ __offline_isolated_pages(unsigned long s
+ list_del(&page->lru);
+ rmv_page_order(page);
+ zone->free_area[order].nr_free--;
++#ifdef CONFIG_HIGHMEM
++ if (PageHighMem(page))
++ totalhigh_pages -= 1 << order;
++#endif
+ for (i = 0; i < (1 << order); i++)
+ SetPageReserved((page+i));
+ pfn += (1 << order);
ext4-fix-ext4_get_group_number.patch
ext4-don-t-show-usrquota-grpquota-twice-in-proc-mounts.patch
ext4-don-t-allow-ext4_free_blocks-to-fail-due-to-enomem.patch
+arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch
+arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch
+arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch
+arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch
+arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch
+arm-dts-imx-cpus-cpu-nodes-dts-updates.patch
+arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch
+arm-shmobile-emev2-gio3-resource-fix.patch
+arm-mm-fix-boot-on-sa1110-assabet.patch
+drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch
+memcg-kmem-fix-reference-count-handling-on-the-error-path.patch
+mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch
+handle-big-endianness-in-ntlm-ntlmv2-authentication.patch
+ubifs-correct-mount-message.patch
--- /dev/null
+From beadadfa5467e09e36891f39cae1f5d8d3bbf17e Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 2 Apr 2013 12:24:37 +0200
+Subject: UBIFS: correct mount message
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit beadadfa5467e09e36891f39cae1f5d8d3bbf17e upstream.
+
+When mounting an UBIFS R/W volume, we have the message:
+UBIFS: mounted UBI device 0, volume 1, name "rootfs"(null)
+With this patch, we'll have:
+UBIFS: mounted UBI device 0, volume 1, name "rootfs"
+Which is, I think, what was intended.
+
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1412,7 +1412,7 @@ static int mount_ubifs(struct ubifs_info
+
+ ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"%s",
+ c->vi.ubi_num, c->vi.vol_id, c->vi.name,
+- c->ro_mount ? ", R/O mode" : NULL);
++ c->ro_mount ? ", R/O mode" : "");
+ x = (long long)c->main_lebs * c->leb_size;
+ y = (long long)c->log_lebs * c->leb_size + c->max_bud_bytes;
+ ubifs_msg("LEB size: %d bytes (%d KiB), min./max. I/O unit sizes: %d bytes/%d bytes",
projects / thirdparty / kernel / stable-queue.git / commitdiff
