--- /dev/null
+From 29d654067a98c1cb8874c774e5fd799a038af8a6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 31 May 2012 18:53:36 -0400
+Subject: drm/radeon: fix bank information in tiling config
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 29d654067a98c1cb8874c774e5fd799a038af8a6 upstream.
+
+While there are cards with more than 8 mem banks, the max
+number of banks from a tiling perspective is 8, so cap
+the tiling config at 8 banks.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=43448
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 9 ++++++---
+ drivers/gpu/drm/radeon/ni.c | 9 ++++++---
+ drivers/gpu/drm/radeon/rv770.c | 8 ++++++--
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2136,9 +2136,12 @@ static void evergreen_gpu_init(struct ra
+ /* num banks is 8 on all fusion asics. 0 = 4, 1 = 8, 2 = 16 */
+ if (rdev->flags & RADEON_IS_IGP)
+ rdev->config.evergreen.tile_config |= 1 << 4;
+- else
+- rdev->config.evergreen.tile_config |=
+- ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
++ else {
++ if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
++ rdev->config.evergreen.tile_config |= 1 << 4;
++ else
++ rdev->config.evergreen.tile_config |= 0 << 4;
++ }
+ rdev->config.evergreen.tile_config |=
+ ((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT) << 8;
+ rdev->config.evergreen.tile_config |=
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -866,9 +866,12 @@ static void cayman_gpu_init(struct radeo
+ /* num banks is 8 on all fusion asics. 0 = 4, 1 = 8, 2 = 16 */
+ if (rdev->flags & RADEON_IS_IGP)
+ rdev->config.cayman.tile_config |= 1 << 4;
+- else
+- rdev->config.cayman.tile_config |=
+- ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
++ else {
++ if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
++ rdev->config.cayman.tile_config |= 1 << 4;
++ else
++ rdev->config.cayman.tile_config |= 0 << 4;
++ }
+ rdev->config.cayman.tile_config |=
+ ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
+ rdev->config.cayman.tile_config |=
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -689,8 +689,12 @@ static void rv770_gpu_init(struct radeon
+
+ if (rdev->family == CHIP_RV770)
+ gb_tiling_config |= BANK_TILING(1);
+- else
+- gb_tiling_config |= BANK_TILING((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT);
++ else {
++ if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
++ gb_tiling_config |= BANK_TILING(1);
++ else
++ gb_tiling_config |= BANK_TILING(0);
++ }
+ rdev->config.rv770.tiling_nbanks = 4 << ((gb_tiling_config >> 4) & 0x3);
+ gb_tiling_config |= GROUP_SIZE((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT);
+ if ((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT)
--- /dev/null
+From 95c4b23ec4e2fa5604df229ddf134e31d7b3b378 Mon Sep 17 00:00:00 2001
+From: Jerome Glisse <jglisse@redhat.com>
+Date: Thu, 31 May 2012 19:00:24 -0400
+Subject: drm/radeon: fix HD6790, HD6570 backend programming
+
+From: Jerome Glisse <jglisse@redhat.com>
+
+commit 95c4b23ec4e2fa5604df229ddf134e31d7b3b378 upstream.
+
+Without this bit sets we get broken rendering and
+lockups.
+
+fglrx sets this bit.
+
+Bugs that should be fixed by this patch :
+https://bugs.freedesktop.org/show_bug.cgi?id=49792
+https://bugzilla.kernel.org/show_bug.cgi?id=43207
+https://bugs.freedesktop.org/show_bug.cgi?id=39282
+
+Signed-off-by: Jerome Glisse <jglisse@redhat.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2178,9 +2178,9 @@ static void evergreen_gpu_init(struct ra
+ WREG32(CC_SYS_RB_BACKEND_DISABLE, rb);
+ WREG32(GC_USER_RB_BACKEND_DISABLE, rb);
+ WREG32(CC_GC_SHADER_PIPE_CONFIG, sp);
+- }
++ }
+
+- grbm_gfx_index |= SE_BROADCAST_WRITES;
++ grbm_gfx_index = INSTANCE_BROADCAST_WRITES | SE_BROADCAST_WRITES;
+ WREG32(GRBM_GFX_INDEX, grbm_gfx_index);
+ WREG32(RLC_GFX_INDEX, grbm_gfx_index);
+
--- /dev/null
+From 9b00147d9f2ba137ce74b66b768a8312be0b6781 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 30 May 2012 10:09:30 -0400
+Subject: drm/radeon: fix regression in UMS CS ioctl
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9b00147d9f2ba137ce74b66b768a8312be0b6781 upstream.
+
+radeon_cs_parser_init is called by both the legacy UMS
+CS ioctl and the KMS CS ioctl. Protect KMS specific
+pieces of the code by checking that rdev is not NULL.
+
+Reported-by: Michael Burian <michael.burian@sbg.at>
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_cs.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -158,6 +158,7 @@ static int radeon_cs_sync_rings(struct r
+ return 0;
+ }
+
++/* XXX: note that this is called from the legacy UMS CS ioctl as well */
+ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
+ {
+ struct drm_radeon_cs *cs = data;
+@@ -252,23 +253,25 @@ int radeon_cs_parser_init(struct radeon_
+ }
+ }
+
+- if ((p->cs_flags & RADEON_CS_USE_VM) &&
+- !p->rdev->vm_manager.enabled) {
+- DRM_ERROR("VM not active on asic!\n");
+- return -EINVAL;
+- }
++ /* these are KMS only */
++ if (p->rdev) {
++ if ((p->cs_flags & RADEON_CS_USE_VM) &&
++ !p->rdev->vm_manager.enabled) {
++ DRM_ERROR("VM not active on asic!\n");
++ return -EINVAL;
++ }
++
++ /* we only support VM on SI+ */
++ if ((p->rdev->family >= CHIP_TAHITI) &&
++ ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
++ DRM_ERROR("VM required on SI+!\n");
++ return -EINVAL;
++ }
+
+- /* we only support VM on SI+ */
+- if ((p->rdev->family >= CHIP_TAHITI) &&
+- ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
+- DRM_ERROR("VM required on SI+!\n");
+- return -EINVAL;
++ if (radeon_cs_get_ring(p, ring, priority))
++ return -EINVAL;
+ }
+
+- if (radeon_cs_get_ring(p, ring, priority))
+- return -EINVAL;
+-
+-
+ /* deal with non-vm */
+ if ((p->chunk_ib_idx != -1) &&
+ ((p->cs_flags & RADEON_CS_USE_VM) == 0) &&
--- /dev/null
+From 0b8c30bc4943137a4a36b9cb059b1cc684f5d702 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 31 May 2012 18:54:43 -0400
+Subject: drm/radeon: properly program gart on rv740, juniper, cypress, barts, hemlock
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0b8c30bc4943137a4a36b9cb059b1cc684f5d702 upstream.
+
+Need to program an additional VM register. This doesn't not currently
+cause any problems, but allows us to program the proper backend
+map in a subsequent patch which should improve performance on these
+asics.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 5 +++++
+ drivers/gpu/drm/radeon/evergreend.h | 1 +
+ drivers/gpu/drm/radeon/rv770.c | 2 ++
+ drivers/gpu/drm/radeon/rv770d.h | 1 +
+ 4 files changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1029,6 +1029,11 @@ int evergreen_pcie_gart_enable(struct ra
+ WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+ WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+ WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
++ if ((rdev->family == CHIP_JUNIPER) ||
++ (rdev->family == CHIP_CYPRESS) ||
++ (rdev->family == CHIP_HEMLOCK) ||
++ (rdev->family == CHIP_BARTS))
++ WREG32(MC_VM_MD_L1_TLB3_CNTL, tmp);
+ }
+ WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -232,6 +232,7 @@
+ #define MC_VM_MD_L1_TLB0_CNTL 0x2654
+ #define MC_VM_MD_L1_TLB1_CNTL 0x2658
+ #define MC_VM_MD_L1_TLB2_CNTL 0x265C
++#define MC_VM_MD_L1_TLB3_CNTL 0x2698
+
+ #define FUS_MC_VM_MD_L1_TLB0_CNTL 0x265C
+ #define FUS_MC_VM_MD_L1_TLB1_CNTL 0x2660
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -151,6 +151,8 @@ int rv770_pcie_gart_enable(struct radeon
+ WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+ WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+ WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
++ if (rdev->family == CHIP_RV740)
++ WREG32(MC_VM_MD_L1_TLB3_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+--- a/drivers/gpu/drm/radeon/rv770d.h
++++ b/drivers/gpu/drm/radeon/rv770d.h
+@@ -174,6 +174,7 @@
+ #define MC_VM_MD_L1_TLB0_CNTL 0x2654
+ #define MC_VM_MD_L1_TLB1_CNTL 0x2658
+ #define MC_VM_MD_L1_TLB2_CNTL 0x265C
++#define MC_VM_MD_L1_TLB3_CNTL 0x2698
+ #define MC_VM_SYSTEM_APERTURE_DEFAULT_ADDR 0x203C
+ #define MC_VM_SYSTEM_APERTURE_HIGH_ADDR 0x2038
+ #define MC_VM_SYSTEM_APERTURE_LOW_ADDR 0x2034
--- /dev/null
+From a8ff3ee211fccf708e1911bbc096625453ebf759 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Fri, 1 Jun 2012 15:39:11 +0200
+Subject: drm/ttm: Fix spinlock imbalance
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit a8ff3ee211fccf708e1911bbc096625453ebf759 upstream.
+
+This imbalance may cause hangs when TTM is trying to swap out a buffer
+that is already on the delayed delete list.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1821,6 +1821,7 @@ static int ttm_bo_swapout(struct ttm_mem
+ spin_unlock(&glob->lru_lock);
+ (void) ttm_bo_cleanup_refs(bo, false, false, false);
+ kref_put(&bo->list_kref, ttm_bo_release_list);
++ spin_lock(&glob->lru_lock);
+ continue;
+ }
+
--- /dev/null
+From 0824db38e515644f8d1bfd64adbd7cb2c6ea7c62 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Fri, 1 Jun 2012 15:48:04 +0200
+Subject: drm/vmwgfx: Fix nasty write past alloced memory area
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 0824db38e515644f8d1bfd64adbd7cb2c6ea7c62 upstream.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+@@ -66,7 +66,7 @@ static int vmw_gmr2_bind(struct vmw_priv
+ cmd += sizeof(remap_cmd) / sizeof(uint32);
+
+ for (i = 0; i < num_pages; ++i) {
+- if (VMW_PPN_SIZE > 4)
++ if (VMW_PPN_SIZE <= 4)
+ *cmd = page_to_pfn(*pages++);
+ else
+ *((uint64_t *)cmd) = page_to_pfn(*pages++);
--- /dev/null
+From 9ca3cc6f3026946ba655e863ca2096339e667639 Mon Sep 17 00:00:00 2001
+From: Stephan Gatzka <stephan@gatzka.org>
+Date: Sat, 2 Jun 2012 03:04:06 +0000
+Subject: fec_mpc52xx: fix timestamp filtering
+
+From: Stephan Gatzka <stephan@gatzka.org>
+
+commit 9ca3cc6f3026946ba655e863ca2096339e667639 upstream.
+
+skb_defer_rx_timestamp was called with a freshly allocated skb but must
+be called with rskb instead.
+
+Signed-off-by: Stephan Gatzka <stephan@gatzka.org>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/freescale/fec_mpc52xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+@@ -437,7 +437,7 @@ static irqreturn_t mpc52xx_fec_rx_interr
+ length = status & BCOM_FEC_RX_BD_LEN_MASK;
+ skb_put(rskb, length - 4); /* length without CRC32 */
+ rskb->protocol = eth_type_trans(rskb, dev);
+- if (!skb_defer_rx_timestamp(skb))
++ if (!skb_defer_rx_timestamp(rskb))
+ netif_rx(rskb);
+
+ spin_lock(&priv->lock);
--- /dev/null
+From 2e24e32e2759348c9290404abad4f729f791bfad Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Thu, 24 May 2012 00:17:23 +0200
+Subject: mtd: block2mtd: fix recursive call of mtd_writev
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+commit 2e24e32e2759348c9290404abad4f729f791bfad upstream.
+
+The 'mtd_writev' interface calls the function assigned
+to the '_write' field of a given mtd device if that is
+not NULL. The block2mtd driver sets the '_writev' field
+to the 'mtd_writev' function itself and thus causes a
+endless loop.
+
+This is caused by 1dbebd32562b3c2caeca35960e5cb00bfcc12900
+(mtd: harmonize mtd_writev usage).
+
+Remove the assignment from the block2mtd driver to fix the
+issue.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/devices/block2mtd.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -271,7 +271,6 @@ static struct block2mtd_dev *add_device(
+ dev->mtd.flags = MTD_CAP_RAM;
+ dev->mtd._erase = block2mtd_erase;
+ dev->mtd._write = block2mtd_write;
+- dev->mtd._writev = mtd_writev;
+ dev->mtd._sync = block2mtd_sync;
+ dev->mtd._read = block2mtd_read;
+ dev->mtd.priv = dev;
--- /dev/null
+From 4a43faf54e9173b6acce37cf7f053fc9515a2cdf Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Fri, 25 May 2012 16:22:42 +0200
+Subject: mtd: mxc_nand: move ecc strengh setup before nand_scan_tail
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 4a43faf54e9173b6acce37cf7f053fc9515a2cdf upstream.
+
+Since commit 6a918bade9dab40aaef80559bd1169c69e8d69cb, the mxc_nand driver
+fails with:
+
+Driver must set ecc.strength when using hardware ECC
+
+This is because nand_scan_tail checks for correct ecc strength
+settings, so we must set them up before nand_scan_tail.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/mxc_nand.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -1219,12 +1219,6 @@ static int __init mxcnd_probe(struct pla
+ if (nfc_is_v21() && mtd->writesize == 4096)
+ this->ecc.layout = &nandv2_hw_eccoob_4k;
+
+- /* second phase scan */
+- if (nand_scan_tail(mtd)) {
+- err = -ENXIO;
+- goto escan;
+- }
+-
+ if (this->ecc.mode == NAND_ECC_HW) {
+ if (nfc_is_v1())
+ this->ecc.strength = 1;
+@@ -1232,6 +1226,12 @@ static int __init mxcnd_probe(struct pla
+ this->ecc.strength = (host->eccsize == 4) ? 4 : 8;
+ }
+
++ /* second phase scan */
++ if (nand_scan_tail(mtd)) {
++ err = -ENXIO;
++ goto escan;
++ }
++
+ /* Register the partitions */
+ mtd_device_parse_register(mtd, part_probes, NULL, pdata->parts,
+ pdata->nr_parts);
--- /dev/null
+From 34a5704d91d6f8376a4c0a0143a1dd3eb3ccb37e Mon Sep 17 00:00:00 2001
+From: Dmitry Maluka <D.Maluka@adbglobal.com>
+Date: Fri, 11 May 2012 20:51:51 +0300
+Subject: mtd: nand: fix scan_read_raw_oob
+
+From: Dmitry Maluka <D.Maluka@adbglobal.com>
+
+commit 34a5704d91d6f8376a4c0a0143a1dd3eb3ccb37e upstream.
+
+It seems there is a bug in scan_read_raw_oob() in nand_bbt.c which
+should cause wrong functioning of NAND_BBT_SCANALLPAGES option.
+
+Artem: the patch did not apply and I had to amend it a bit.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_bbt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/nand/nand_bbt.c
++++ b/drivers/mtd/nand/nand_bbt.c
+@@ -324,6 +324,7 @@ static int scan_read_raw_oob(struct mtd_
+
+ buf += mtd->oobsize + mtd->writesize;
+ len -= mtd->writesize;
++ offs += mtd->writesize;
+ }
+ return 0;
+ }
--- /dev/null
+From 2e929d001e85126d9267de373d4b76014789661d Mon Sep 17 00:00:00 2001
+From: Frank Svendsboe <frank.svendsboe@gmail.com>
+Date: Thu, 17 May 2012 22:43:09 +0200
+Subject: mtd: of_parts: fix breakage in Kconfig
+
+From: Frank Svendsboe <frank.svendsboe@gmail.com>
+
+commit 2e929d001e85126d9267de373d4b76014789661d upstream.
+
+MTD_OF_PARTS and the default setting is not working due to using 'Y'
+instead of 'y', introduced in commit
+d6137badeff1ef64b4e0092ec249ebdeaeb3ff37. This made our board, and
+possibly other boards using DTS defined partitions and not having
+CONFIG_MTD_OF_PARTS=y defined in the defconfig, fail to mount root.
+
+Signed-off-by: Frank Svendsboe <frank.svendsboe@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -128,7 +128,7 @@ config MTD_AFS_PARTS
+
+ config MTD_OF_PARTS
+ tristate "OpenFirmware partitioning information support"
+- default Y
++ default y
+ depends on OF
+ help
+ This provides a partition parsing function which derives
slub-fix-a-memory-leak-in-get_partial_node.patch
vfs-umount_tree-might-be-called-on-subtree-that-had-never-made-it.patch
vfs-increment-iversion-when-a-file-is-truncated.patch
+fec_mpc52xx-fix-timestamp-filtering.patch
+x86-x32-ptrace-remove-ptrace_arch_prctl-for-x32.patch
+x86-reset-the-debug_stack-update-counter.patch
+mtd-nand-fix-scan_read_raw_oob.patch
+mtd-of_parts-fix-breakage-in-kconfig.patch
+mtd-block2mtd-fix-recursive-call-of-mtd_writev.patch
+mtd-mxc_nand-move-ecc-strengh-setup-before-nand_scan_tail.patch
+drm-radeon-fix-regression-in-ums-cs-ioctl.patch
+drm-radeon-fix-bank-information-in-tiling-config.patch
+drm-radeon-properly-program-gart-on-rv740-juniper-cypress-barts-hemlock.patch
+drm-radeon-fix-hd6790-hd6570-backend-programming.patch
+drm-ttm-fix-spinlock-imbalance.patch
+drm-vmwgfx-fix-nasty-write-past-alloced-memory-area.patch
--- /dev/null
+From c0525a6972d3f1fb83058ef503e183475d6e4e26 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Wed, 30 May 2012 11:43:19 -0400
+Subject: x86: Reset the debug_stack update counter
+
+From: Steven Rostedt <srostedt@redhat.com>
+
+commit c0525a6972d3f1fb83058ef503e183475d6e4e26 upstream.
+
+When an NMI goes off and it sees that it preempted the debug stack,
+to keep the debug stack safe, it changes the IDT to point to one that
+does not modify the stack on breakpoint (to allow breakpoints in NMIs).
+
+But the variable that gets set to know to undo it on exit never gets
+cleared on exit. Thus every NMI will reset it on exit the first time
+it is done even if it does not need to be reset.
+
+[ Added H. Peter Anvin's suggestion to use this_cpu_read/write ]
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/nmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -491,14 +491,16 @@ static inline void nmi_nesting_preproces
+ */
+ if (unlikely(is_debug_stack(regs->sp))) {
+ debug_stack_set_zero();
+- __get_cpu_var(update_debug_stack) = 1;
++ this_cpu_write(update_debug_stack, 1);
+ }
+ }
+
+ static inline void nmi_nesting_postprocess(void)
+ {
+- if (unlikely(__get_cpu_var(update_debug_stack)))
++ if (unlikely(this_cpu_read(update_debug_stack))) {
+ debug_stack_reset();
++ this_cpu_write(update_debug_stack, 0);
++ }
+ }
+ #endif
+
--- /dev/null
+From bad1a753d4d4deb09d4bc0bac1dd4fc3298502e9 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Mon, 21 May 2012 20:29:45 -0700
+Subject: x86, x32, ptrace: Remove PTRACE_ARCH_PRCTL for x32
+
+From: "H.J. Lu" <hjl.tools@gmail.com>
+
+commit bad1a753d4d4deb09d4bc0bac1dd4fc3298502e9 upstream.
+
+When I added x32 ptrace to 3.4 kernel, I also include PTRACE_ARCH_PRCTL
+support for x32 GDB For ARCH_GET_FS/GS, it takes a pointer to int64. But
+at user level, ARCH_GET_FS/GS takes a pointer to int32. So I have to add
+x32 ptrace to glibc to handle it with a temporary int64 passed to kernel and
+copy it back to GDB as int32. Roland suggested that PTRACE_ARCH_PRCTL
+is obsolete and x32 GDB should use fs_base and gs_base fields of
+user_regs_struct instead.
+
+Accordingly, remove PTRACE_ARCH_PRCTL completely from the x32 code to
+avoid possible memory overrun when pointer to int32 is passed to
+kernel.
+
+Link: http://lkml.kernel.org/r/CAMe9rOpDzHfS7NH7m1vmD9QRw8SSj4Sc%2BaNOgcWm_WJME2eRsQ@mail.gmail.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/ptrace.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -1211,12 +1211,6 @@ static long x32_arch_ptrace(struct task_
+ 0, sizeof(struct user_i387_struct),
+ datap);
+
+- /* normal 64bit interface to access TLS data.
+- Works just like arch_prctl, except that the arguments
+- are reversed. */
+- case PTRACE_ARCH_PRCTL:
+- return do_arch_prctl(child, data, addr);
+-
+ default:
+ return compat_ptrace_request(child, request, addr, data);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
