--- /dev/null
+From eb3c227289840eed95ddfb0516046f08d8993940 Mon Sep 17 00:00:00 2001
+From: Linus Pizunski <linus@narrativeteam.com>
+Date: Thu, 12 Dec 2013 17:12:23 -0800
+Subject: drivers/rtc/rtc-at91rm9200.c: correct alarm over day/month wrap
+
+From: Linus Pizunski <linus@narrativeteam.com>
+
+commit eb3c227289840eed95ddfb0516046f08d8993940 upstream.
+
+Update month and day of month to the alarm month/day instead of current
+day/month when setting the RTC alarm mask.
+
+Signed-off-by: Linus Pizunski <linus@narrativeteam.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-at91rm9200.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/rtc/rtc-at91rm9200.c
++++ b/drivers/rtc/rtc-at91rm9200.c
+@@ -221,6 +221,8 @@ static int at91_rtc_setalarm(struct devi
+
+ at91_alarm_year = tm.tm_year;
+
++ tm.tm_mon = alrm->time.tm_mon;
++ tm.tm_mday = alrm->time.tm_mday;
+ tm.tm_hour = alrm->time.tm_hour;
+ tm.tm_min = alrm->time.tm_min;
+ tm.tm_sec = alrm->time.tm_sec;
--- /dev/null
+From 32cf0cb0294814cb1ee5d8727e9aac0e9aa80d2e Mon Sep 17 00:00:00 2001
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Date: Thu, 28 Nov 2013 22:10:38 +0200
+Subject: drm/i915: Fix pipe CSC post offset calculation
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 32cf0cb0294814cb1ee5d8727e9aac0e9aa80d2e upstream.
+
+We were miscalculating the pipe CSC post offset for the full->limited
+range conversion. The resulting post offset was double what it was
+supposed to be, which caused blacks to come out grey when using
+limited range output on HSW+.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71769
+Tested-by: Lauri Mylläri <lauri.myllari@gmail.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -5225,7 +5225,7 @@ static void intel_set_pipe_csc(struct dr
+ uint16_t postoff = 0;
+
+ if (intel_crtc->config.limited_color_range)
+- postoff = (16 * (1 << 13) / 255) & 0x1fff;
++ postoff = (16 * (1 << 12) / 255) & 0x1fff;
+
+ I915_WRITE(PIPE_CSC_POSTOFF_HI(pipe), postoff);
+ I915_WRITE(PIPE_CSC_POSTOFF_ME(pipe), postoff);
--- /dev/null
+From cf77ee54362a245f9a01f240adce03a06c05eb68 Mon Sep 17 00:00:00 2001
+From: "Hong H. Pham" <hong.pham@windriver.com>
+Date: Sat, 7 Dec 2013 09:06:33 -0500
+Subject: powerpc: Fix PTE page address mismatch in pgtable ctor/dtor
+
+From: "Hong H. Pham" <hong.pham@windriver.com>
+
+commit cf77ee54362a245f9a01f240adce03a06c05eb68 upstream.
+
+In pte_alloc_one(), pgtable_page_ctor() is passed an address that has
+not been converted by page_address() to the newly allocated PTE page.
+
+When the PTE is freed, __pte_free_tlb() calls pgtable_page_dtor()
+with an address to the PTE page that has been converted by page_address().
+The mismatch in the PTE's page address causes pgtable_page_dtor() to access
+invalid memory, so resources for that PTE (such as the page lock) is not
+properly cleaned up.
+
+On PPC32, only SMP kernels are affected.
+
+On PPC64, only SMP kernels with 4K page size are affected.
+
+This bug was introduced by commit d614bb041209fd7cb5e4b35e11a7b2f6ee8f62b8
+"powerpc: Move the pte free routines from common header".
+
+On a preempt-rt kernel, a spinlock is dynamically allocated for each
+PTE in pgtable_page_ctor(). When the PTE is freed, calling
+pgtable_page_dtor() with a mismatched page address causes a memory leak,
+as the pointer to the PTE's spinlock is bogus.
+
+On mainline, there isn't any immediately obvious symptoms, but the
+problem still exists here.
+
+Fixes: d614bb041209fd7c "powerpc: Move the pte free routes from common header"
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Hong H. Pham <hong.pham@windriver.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/pgalloc-32.h | 6 ++----
+ arch/powerpc/include/asm/pgalloc-64.h | 6 ++----
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+--- a/arch/powerpc/include/asm/pgalloc-32.h
++++ b/arch/powerpc/include/asm/pgalloc-32.h
+@@ -84,10 +84,8 @@ static inline void pgtable_free_tlb(stru
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
+ unsigned long address)
+ {
+- struct page *page = page_address(table);
+-
+ tlb_flush_pgtable(tlb, address);
+- pgtable_page_dtor(page);
+- pgtable_free_tlb(tlb, page, 0);
++ pgtable_page_dtor(table);
++ pgtable_free_tlb(tlb, page_address(table), 0);
+ }
+ #endif /* _ASM_POWERPC_PGALLOC_32_H */
+--- a/arch/powerpc/include/asm/pgalloc-64.h
++++ b/arch/powerpc/include/asm/pgalloc-64.h
+@@ -144,11 +144,9 @@ static inline void pgtable_free_tlb(stru
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
+ unsigned long address)
+ {
+- struct page *page = page_address(table);
+-
+ tlb_flush_pgtable(tlb, address);
+- pgtable_page_dtor(page);
+- pgtable_free_tlb(tlb, page, 0);
++ pgtable_page_dtor(table);
++ pgtable_free_tlb(tlb, page_address(table), 0);
+ }
+
+ #else /* if CONFIG_PPC_64K_PAGES */
projects / thirdparty / kernel / stable-queue.git / commitdiff
