--- /dev/null
+From 0882dae983707455e97479e5e904e37673517ebc Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Wed, 8 Jan 2014 11:12:27 -0200
+Subject: drm/i915: fix DDI PLLs HW state readout code
+
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+
+commit 0882dae983707455e97479e5e904e37673517ebc upstream.
+
+Properly zero the refcounts and crtc->ddi_pll_set so the previous HW
+state doesn't affect the result of reading the current HW state.
+
+This fixes WARNs about WRPLL refcount if we have an HDMI monitor on
+HSW and then suspend/resume.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64379
+Tested-by: Qingshuai Tian <qingshuai.tian@intel.com>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ddi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1193,12 +1193,18 @@ void intel_ddi_setup_hw_pll_state(struct
+ enum pipe pipe;
+ struct intel_crtc *intel_crtc;
+
++ dev_priv->ddi_plls.spll_refcount = 0;
++ dev_priv->ddi_plls.wrpll1_refcount = 0;
++ dev_priv->ddi_plls.wrpll2_refcount = 0;
++
+ for_each_pipe(pipe) {
+ intel_crtc =
+ to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
+
+- if (!intel_crtc->active)
++ if (!intel_crtc->active) {
++ intel_crtc->ddi_pll_sel = PORT_CLK_SEL_NONE;
+ continue;
++ }
+
+ intel_crtc->ddi_pll_sel = intel_ddi_get_crtc_pll(dev_priv,
+ pipe);
--- /dev/null
+From 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 12 Dec 2013 10:13:33 +1100
+Subject: md: fix problem when adding device to read-only array with bitmap.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97 upstream.
+
+If an array is started degraded, and then the missing device
+is found it can be re-added and a minimal bitmap-based recovery
+will bring it fully up-to-date.
+
+If the array is read-only a recovery would not be allowed.
+But also if the array is read-only and the missing device was
+present very recently, then there could be no need for any
+recovery at all, so we simply include the device in the read-only
+array without any recovery.
+
+However... if the missing device was removed a little longer ago
+it could be missing some updates, but if a bitmap is present it will
+be conditionally accepted pending a bitmap-based update. We don't
+currently detect this case properly and will include that old
+device into the read-only array with no recovery even though it really
+needs a recovery.
+
+This patch keeps track of whether a bitmap-based-recovery is really
+needed or not in the new Bitmap_sync rdev flag. If that is set,
+then the device will not be added to a read-only array.
+
+Cc: Andrei Warkentin <andreiw@vmware.com>
+Fixes: d70ed2e4fafdbef0800e73942482bb075c21578b
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 18 +++++++++++++++---
+ drivers/md/md.h | 3 +++
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1118,6 +1118,7 @@ static int super_90_validate(struct mdde
+ rdev->raid_disk = -1;
+ clear_bit(Faulty, &rdev->flags);
+ clear_bit(In_sync, &rdev->flags);
++ clear_bit(Bitmap_sync, &rdev->flags);
+ clear_bit(WriteMostly, &rdev->flags);
+
+ if (mddev->raid_disks == 0) {
+@@ -1196,6 +1197,8 @@ static int super_90_validate(struct mdde
+ */
+ if (ev1 < mddev->bitmap->events_cleared)
+ return 0;
++ if (ev1 < mddev->events)
++ set_bit(Bitmap_sync, &rdev->flags);
+ } else {
+ if (ev1 < mddev->events)
+ /* just a hot-add of a new device, leave raid_disk at -1 */
+@@ -1604,6 +1607,7 @@ static int super_1_validate(struct mddev
+ rdev->raid_disk = -1;
+ clear_bit(Faulty, &rdev->flags);
+ clear_bit(In_sync, &rdev->flags);
++ clear_bit(Bitmap_sync, &rdev->flags);
+ clear_bit(WriteMostly, &rdev->flags);
+
+ if (mddev->raid_disks == 0) {
+@@ -1686,6 +1690,8 @@ static int super_1_validate(struct mddev
+ */
+ if (ev1 < mddev->bitmap->events_cleared)
+ return 0;
++ if (ev1 < mddev->events)
++ set_bit(Bitmap_sync, &rdev->flags);
+ } else {
+ if (ev1 < mddev->events)
+ /* just a hot-add of a new device, leave raid_disk at -1 */
+@@ -2829,6 +2835,7 @@ slot_store(struct md_rdev *rdev, const c
+ else
+ rdev->saved_raid_disk = -1;
+ clear_bit(In_sync, &rdev->flags);
++ clear_bit(Bitmap_sync, &rdev->flags);
+ err = rdev->mddev->pers->
+ hot_add_disk(rdev->mddev, rdev);
+ if (err) {
+@@ -5761,6 +5768,7 @@ static int add_new_disk(struct mddev * m
+ info->raid_disk < mddev->raid_disks) {
+ rdev->raid_disk = info->raid_disk;
+ set_bit(In_sync, &rdev->flags);
++ clear_bit(Bitmap_sync, &rdev->flags);
+ } else
+ rdev->raid_disk = -1;
+ } else
+@@ -7694,7 +7702,8 @@ static int remove_and_add_spares(struct
+ if (test_bit(Faulty, &rdev->flags))
+ continue;
+ if (mddev->ro &&
+- rdev->saved_raid_disk < 0)
++ ! (rdev->saved_raid_disk >= 0 &&
++ !test_bit(Bitmap_sync, &rdev->flags)))
+ continue;
+
+ rdev->recovery_offset = 0;
+@@ -7775,9 +7784,12 @@ void md_check_recovery(struct mddev *mdd
+ * As we only add devices that are already in-sync,
+ * we can activate the spares immediately.
+ */
+- clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+ remove_and_add_spares(mddev, NULL);
+- mddev->pers->spare_active(mddev);
++ /* There is no thread, but we need to call
++ * ->spare_active and clear saved_raid_disk
++ */
++ md_reap_sync_thread(mddev);
++ clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+ goto unlock;
+ }
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -129,6 +129,9 @@ struct md_rdev {
+ enum flag_bits {
+ Faulty, /* device is known to have a fault */
+ In_sync, /* device is in_sync with rest of array */
++ Bitmap_sync, /* ..actually, not quite In_sync. Need a
++ * bitmap-based recovery to get fully in sync
++ */
+ Unmerged, /* device is being added to array and should
+ * be considerred for bvec_merge_fn but not
+ * yet for actual IO
--- /dev/null
+From e8b849158508565e0cd6bc80061124afc5879160 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 6 Jan 2014 10:35:34 +1100
+Subject: md/raid10: fix bug when raid10 recovery fails to recover a block.
+
+From: NeilBrown <neilb@suse.de>
+
+commit e8b849158508565e0cd6bc80061124afc5879160 upstream.
+
+commit e875ecea266a543e643b19e44cf472f1412708f9
+ md/raid10 record bad blocks as needed during recovery.
+
+added code to the "cannot recover this block" path to record a bad
+block rather than fail the whole recovery.
+Unfortunately this new case was placed *after* r10bio was freed rather
+than *before*, yet it still uses r10bio.
+This is will crash with a null dereference.
+
+So move the freeing of r10bio down where it is safe.
+
+Fixes: e875ecea266a543e643b19e44cf472f1412708f9
+Reported-by: Damian Nowak <spam@nowaker.net>
+URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3198,10 +3198,6 @@ static sector_t sync_request(struct mdde
+ if (j == conf->copies) {
+ /* Cannot recover, so abort the recovery or
+ * record a bad block */
+- put_buf(r10_bio);
+- if (rb2)
+- atomic_dec(&rb2->remaining);
+- r10_bio = rb2;
+ if (any_working) {
+ /* problem is that there are bad blocks
+ * on other device(s)
+@@ -3233,6 +3229,10 @@ static sector_t sync_request(struct mdde
+ mirror->recovery_disabled
+ = mddev->recovery_disabled;
+ }
++ put_buf(r10_bio);
++ if (rb2)
++ atomic_dec(&rb2->remaining);
++ r10_bio = rb2;
+ break;
+ }
+ }
--- /dev/null
+From b50c259e25d9260b9108dc0c2964c26e5ecbe1c1 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 14 Jan 2014 10:38:09 +1100
+Subject: md/raid10: fix two bugs in handling of known-bad-blocks.
+
+From: NeilBrown <neilb@suse.de>
+
+commit b50c259e25d9260b9108dc0c2964c26e5ecbe1c1 upstream.
+
+If we discover a bad block when reading we split the request and
+potentially read some of it from a different device.
+
+The code path of this has two bugs in RAID10.
+1/ we get a spin_lock with _irq, but unlock without _irq!!
+2/ The calculation of 'sectors_handled' is wrong, as can be clearly
+ seen by comparison with raid1.c
+
+This leads to at least 2 warnings and a probable crash is a RAID10
+ever had known bad blocks.
+
+Fixes: 856e08e23762dfb92ffc68fd0a8d228f9e152160
+Reported-by: Damian Nowak <spam@nowaker.net>
+URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1321,7 +1321,7 @@ read_again:
+ /* Could not read all from this device, so we will
+ * need another r10_bio.
+ */
+- sectors_handled = (r10_bio->sectors + max_sectors
++ sectors_handled = (r10_bio->sector + max_sectors
+ - bio->bi_sector);
+ r10_bio->sectors = max_sectors;
+ spin_lock_irq(&conf->device_lock);
+@@ -1329,7 +1329,7 @@ read_again:
+ bio->bi_phys_segments = 2;
+ else
+ bio->bi_phys_segments++;
+- spin_unlock(&conf->device_lock);
++ spin_unlock_irq(&conf->device_lock);
+ /* Cannot call generic_make_request directly
+ * as that will be queued in __generic_make_request
+ * and subsequent mempool_alloc might block
--- /dev/null
+From 1cc03eb93245e63b0b7a7832165efdc52e25b4e6 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 6 Jan 2014 13:19:42 +1100
+Subject: md/raid5: Fix possible confusion when multiple write errors occur.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 1cc03eb93245e63b0b7a7832165efdc52e25b4e6 upstream.
+
+commit 5d8c71f9e5fbdd95650be00294d238e27a363b5c
+ md: raid5 crash during degradation
+
+Fixed a crash in an overly simplistic way which could leave
+R5_WriteError or R5_MadeGood set in the stripe cache for devices
+for which it is no longer relevant.
+When those devices are removed and spares added the flags are still
+set and can cause incorrect behaviour.
+
+commit 14a75d3e07c784c004b4b44b34af996b8e4ac453
+ md/raid5: preferentially read from replacement device if possible.
+
+Fixed the same bug if a more effective way, so we can now revert
+the original commit.
+
+Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
+Fixes: 5d8c71f9e5fbdd95650be00294d238e27a363b5c
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid5.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3391,7 +3391,7 @@ static void analyse_stripe(struct stripe
+ */
+ set_bit(R5_Insync, &dev->flags);
+
+- if (rdev && test_bit(R5_WriteError, &dev->flags)) {
++ if (test_bit(R5_WriteError, &dev->flags)) {
+ /* This flag does not apply to '.replacement'
+ * only to .rdev, so make sure to check that*/
+ struct md_rdev *rdev2 = rcu_dereference(
+@@ -3404,7 +3404,7 @@ static void analyse_stripe(struct stripe
+ } else
+ clear_bit(R5_WriteError, &dev->flags);
+ }
+- if (rdev && test_bit(R5_MadeGood, &dev->flags)) {
++ if (test_bit(R5_MadeGood, &dev->flags)) {
+ /* This flag does not apply to '.replacement'
+ * only to .rdev, so make sure to check that*/
+ struct md_rdev *rdev2 = rcu_dereference(
--- /dev/null
+From f92f455f67fef27929e6043499414605b0c94872 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Tue, 21 Jan 2014 15:48:47 -0800
+Subject: mm: Make {,set}page_address() static inline if WANT_PAGE_VIRTUAL
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit f92f455f67fef27929e6043499414605b0c94872 upstream.
+
+{,set}page_address() are macros if WANT_PAGE_VIRTUAL. If
+!WANT_PAGE_VIRTUAL, they're plain C functions.
+
+If someone calls them with a void *, this pointer is auto-converted to
+struct page * if !WANT_PAGE_VIRTUAL, but causes a build failure on
+architectures using WANT_PAGE_VIRTUAL (arc, m68k and sparc64):
+
+ drivers/md/bcache/bset.c: In function `__btree_sort':
+ drivers/md/bcache/bset.c:1190: warning: dereferencing `void *' pointer
+ drivers/md/bcache/bset.c:1190: error: request for member `virtual' in something not a structure or union
+
+Convert them to static inline functions to fix this. There are already
+plenty of users of struct page members inside <linux/mm.h>, so there's
+no reason to keep them as macros.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mm.h | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -766,11 +766,14 @@ static __always_inline void *lowmem_page
+ #endif
+
+ #if defined(WANT_PAGE_VIRTUAL)
+-#define page_address(page) ((page)->virtual)
+-#define set_page_address(page, address) \
+- do { \
+- (page)->virtual = (address); \
+- } while(0)
++static inline void *page_address(const struct page *page)
++{
++ return page->virtual;
++}
++static inline void set_page_address(struct page *page, void *address)
++{
++ page->virtual = address;
++}
+ #define page_address_init() do { } while(0)
+ #endif
+
--- /dev/null
+From 70f2fe3a26248724d8a5019681a869abdaf3e89a Mon Sep 17 00:00:00 2001
+From: Andreas Rohner <andreas.rohner@gmx.net>
+Date: Tue, 14 Jan 2014 17:56:36 -0800
+Subject: nilfs2: fix segctor bug that causes file system corruption
+
+From: Andreas Rohner <andreas.rohner@gmx.net>
+
+commit 70f2fe3a26248724d8a5019681a869abdaf3e89a upstream.
+
+There is a bug in the function nilfs_segctor_collect, which results in
+active data being written to a segment, that is marked as clean. It is
+possible, that this segment is selected for a later segment
+construction, whereby the old data is overwritten.
+
+The problem shows itself with the following kernel log message:
+
+ nilfs_sufile_do_cancel_free: segment 6533 must be clean
+
+Usually a few hours later the file system gets corrupted:
+
+ NILFS: bad btree node (blocknr=8748107): level = 0, flags = 0x0, nchildren = 0
+ NILFS error (device sdc1): nilfs_bmap_last_key: broken bmap (inode number=114660)
+
+The issue can be reproduced with a file system that is nearly full and
+with the cleaner running, while some IO intensive task is running.
+Although it is quite hard to reproduce.
+
+This is what happens:
+
+ 1. The cleaner starts the segment construction
+ 2. nilfs_segctor_collect is called
+ 3. sc_stage is on NILFS_ST_SUFILE and segments are freed
+ 4. sc_stage is on NILFS_ST_DAT current segment is full
+ 5. nilfs_segctor_extend_segments is called, which
+ allocates a new segment
+ 6. The new segment is one of the segments freed in step 3
+ 7. nilfs_sufile_cancel_freev is called and produces an error message
+ 8. Loop around and the collection starts again
+ 9. sc_stage is on NILFS_ST_SUFILE and segments are freed
+ including the newly allocated segment, which will contain active
+ data and can be allocated at a later time
+10. A few hours later another segment construction allocates the
+ segment and causes file system corruption
+
+This can be prevented by simply reordering the statements. If
+nilfs_sufile_cancel_freev is called before nilfs_segctor_extend_segments
+the freed segments are marked as dirty and cannot be allocated any more.
+
+Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
+Reviewed-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/segment.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1440,17 +1440,19 @@ static int nilfs_segctor_collect(struct
+
+ nilfs_clear_logs(&sci->sc_segbufs);
+
+- err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+- if (unlikely(err))
+- return err;
+-
+ if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
+ err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
+ sci->sc_freesegs,
+ sci->sc_nfreesegs,
+ NULL);
+ WARN_ON(err); /* do not happen */
++ sci->sc_stage.flags &= ~NILFS_CF_SUFREED;
+ }
++
++ err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
++ if (unlikely(err))
++ return err;
++
+ nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
+ sci->sc_stage = prev_stage;
+ }
--- /dev/null
+From fe43390702a1b5741fdf217063b05c7612b38303 Mon Sep 17 00:00:00 2001
+From: Jon Medhurst <tixy@linaro.org>
+Date: Tue, 10 Dec 2013 10:18:58 +0000
+Subject: serial: amba-pl011: use port lock to guard control register access
+
+From: Jon Medhurst <tixy@linaro.org>
+
+commit fe43390702a1b5741fdf217063b05c7612b38303 upstream.
+
+When the pl011 is being used for a console, pl011_console_write forces
+the control register (CR) to enable the UART for transmission and then
+restores this to the original value afterwards. It does this while
+holding the port lock.
+
+Unfortunately, when the uart is started or shutdown - say in response to
+userland using the serial device for a terminal - then this updates the
+control register without any locking.
+
+This means we can have
+
+ pl011_console_write Save CR
+ pl011_startup Initialise CR, e.g. enable receive
+ pl011_console_write Restore old CR with receive not enabled
+
+this result is a serial port which doesn't respond to any input.
+
+A similar race in reverse could happen when the device is shutdown.
+
+We can fix these problems by taking the port lock when updating CR.
+
+Signed-off-by: Jon Medhurst <tixy@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/amba-pl011.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1543,6 +1543,8 @@ static int pl011_startup(struct uart_por
+ /*
+ * Provoke TX FIFO interrupt into asserting.
+ */
++ spin_lock_irq(&uap->port.lock);
++
+ cr = UART01x_CR_UARTEN | UART011_CR_TXE | UART011_CR_LBE;
+ writew(cr, uap->port.membase + UART011_CR);
+ writew(0, uap->port.membase + UART011_FBRD);
+@@ -1567,6 +1569,8 @@ static int pl011_startup(struct uart_por
+ cr |= UART01x_CR_UARTEN | UART011_CR_RXE | UART011_CR_TXE;
+ writew(cr, uap->port.membase + UART011_CR);
+
++ spin_unlock_irq(&uap->port.lock);
++
+ /*
+ * initialise the old status of the modem signals
+ */
+@@ -1636,11 +1640,13 @@ static void pl011_shutdown(struct uart_p
+ * it during startup().
+ */
+ uap->autorts = false;
++ spin_lock_irq(&uap->port.lock);
+ cr = readw(uap->port.membase + UART011_CR);
+ uap->old_cr = cr;
+ cr &= UART011_CR_RTS | UART011_CR_DTR;
+ cr |= UART01x_CR_UARTEN | UART011_CR_TXE;
+ writew(cr, uap->port.membase + UART011_CR);
++ spin_unlock_irq(&uap->port.lock);
+
+ /*
+ * disable break condition and fifos
selinux-fix-possible-null-pointer-dereference-in-selinux_inode_permission.patch
ftrace-x86-load-ftrace_ops-in-parameter-not-the-variable-holding-it.patch
thp-fix-copy_page_rep-gpf-by-testing-is_huge_zero_pmd-once-only.patch
+nilfs2-fix-segctor-bug-that-causes-file-system-corruption.patch
+drm-i915-fix-ddi-plls-hw-state-readout-code.patch
+md-fix-problem-when-adding-device-to-read-only-array-with-bitmap.patch
+md-raid10-fix-bug-when-raid10-recovery-fails-to-recover-a-block.patch
+md-raid10-fix-two-bugs-in-handling-of-known-bad-blocks.patch
+md-raid5-fix-possible-confusion-when-multiple-write-errors-occur.patch
+mm-make-set-page_address-static-inline-if-want_page_virtual.patch
+serial-amba-pl011-use-port-lock-to-guard-control-register-access.patch