--- /dev/null
+From 0bf6368ee8f25826d0645c0f7a4f17c8845356a4 Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Sat, 15 Mar 2014 13:37:13 -0400
+Subject: ACPI / button: Add ACPI Button event via netlink routine
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 0bf6368ee8f25826d0645c0f7a4f17c8845356a4 upstream.
+
+Commit 1696d9d (ACPI: Remove the old /proc/acpi/event interface)
+removed ACPI Button event which originally was sent to userspace via
+/proc/acpi/event. This caused ACPI shutdown regression on gentoo
+in VirtualBox. Now ACPI events are sent to userspace via netlink,
+so add ACPI Button event back via netlink routine.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=71721
+Reported-and-tested-by: Richard Musil <richard.musil@gmail.com>
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/button.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -302,6 +302,10 @@ static void acpi_button_notify(struct ac
+ input_sync(input);
+
+ pm_wakeup_event(&device->dev, 0);
++ acpi_bus_generate_netlink_event(
++ device->pnp.device_class,
++ dev_name(&device->dev),
++ event, ++button->pushed);
+ }
+ break;
+ default:
--- /dev/null
+From 6ca738d60c563d5c6cf6253ee4b8e76fa77b2b9e Mon Sep 17 00:00:00 2001
+From: Derek Basehore <dbasehore@chromium.org>
+Date: Thu, 3 Apr 2014 14:46:22 -0700
+Subject: backing_dev: fix hung task on sync
+
+From: Derek Basehore <dbasehore@chromium.org>
+
+commit 6ca738d60c563d5c6cf6253ee4b8e76fa77b2b9e upstream.
+
+bdi_wakeup_thread_delayed() used the mod_delayed_work() function to
+schedule work to writeback dirty inodes. The problem with this is that
+it can delay work that is scheduled for immediate execution, such as the
+work from sync_inodes_sb(). This can happen since mod_delayed_work()
+can now steal work from a work_queue. This fixes the problem by using
+queue_delayed_work() instead. This is a regression caused by commit
+839a8e8660b6 ("writeback: replace custom worker pool implementation with
+unbound workqueue").
+
+The reason that this causes a problem is that laptop-mode will change
+the delay, dirty_writeback_centisecs, to 60000 (10 minutes) by default.
+In the case that bdi_wakeup_thread_delayed() races with
+sync_inodes_sb(), sync will be stopped for 10 minutes and trigger a hung
+task. Even if dirty_writeback_centisecs is not long enough to cause a
+hung task, we still don't want to delay sync for that long.
+
+We fix the problem by using queue_delayed_work() when we want to
+schedule writeback sometime in future. This function doesn't change the
+timer if it is already armed.
+
+For the same reason, we also change bdi_writeback_workfn() to
+immediately queue the work again in the case that the work_list is not
+empty. The same problem can happen if the sync work is run on the
+rescue worker.
+
+[jack@suse.cz: update changelog, add comment, use bdi_wakeup_thread_delayed()]
+Signed-off-by: Derek Basehore <dbasehore@chromium.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: Alexander Viro <viro@zento.linux.org.uk>
+Reviewed-by: Tejun Heo <tj@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Darrick J. Wong" <darrick.wong@oracle.com>
+Cc: Derek Basehore <dbasehore@chromium.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Benson Leung <bleung@chromium.org>
+Cc: Sonny Rao <sonnyrao@chromium.org>
+Cc: Luigi Semenzato <semenzato@chromium.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fs-writeback.c | 8 ++++----
+ mm/backing-dev.c | 5 ++++-
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -1039,10 +1039,10 @@ void bdi_writeback_workfn(struct work_st
+ trace_writeback_pages_written(pages_written);
+ }
+
+- if (!list_empty(&bdi->work_list) ||
+- (wb_has_dirty_io(wb) && dirty_writeback_interval))
+- queue_delayed_work(bdi_wq, &wb->dwork,
+- msecs_to_jiffies(dirty_writeback_interval * 10));
++ if (!list_empty(&bdi->work_list))
++ mod_delayed_work(bdi_wq, &wb->dwork, 0);
++ else if (wb_has_dirty_io(wb) && dirty_writeback_interval)
++ bdi_wakeup_thread_delayed(bdi);
+
+ current->flags &= ~PF_SWAPWRITE;
+ }
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -288,13 +288,16 @@ int bdi_has_dirty_io(struct backing_dev_
+ * Note, we wouldn't bother setting up the timer, but this function is on the
+ * fast-path (used by '__mark_inode_dirty()'), so we save few context switches
+ * by delaying the wake-up.
++ *
++ * We have to be careful not to postpone flush work if it is scheduled for
++ * earlier. Thus we use queue_delayed_work().
+ */
+ void bdi_wakeup_thread_delayed(struct backing_dev_info *bdi)
+ {
+ unsigned long timeout;
+
+ timeout = msecs_to_jiffies(dirty_writeback_interval * 10);
+- mod_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
++ queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
+ }
+
+ /*
--- /dev/null
+From 5acda9d12dcf1ad0d9a5a2a7c646de3472fa7555 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 3 Apr 2014 14:46:23 -0700
+Subject: bdi: avoid oops on device removal
+
+From: Jan Kara <jack@suse.cz>
+
+commit 5acda9d12dcf1ad0d9a5a2a7c646de3472fa7555 upstream.
+
+After commit 839a8e8660b6 ("writeback: replace custom worker pool
+implementation with unbound workqueue") when device is removed while we
+are writing to it we crash in bdi_writeback_workfn() ->
+set_worker_desc() because bdi->dev is NULL.
+
+This can happen because even though bdi_unregister() cancels all pending
+flushing work, nothing really prevents new ones from being queued from
+balance_dirty_pages() or other places.
+
+Fix the problem by clearing BDI_registered bit in bdi_unregister() and
+checking it before scheduling of any flushing work.
+
+Fixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977
+
+Reviewed-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Derek Basehore <dbasehore@chromium.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fs-writeback.c | 23 ++++++++++++++++++-----
+ include/linux/backing-dev.h | 2 +-
+ mm/backing-dev.c | 13 +++++++++----
+ 3 files changed, 28 insertions(+), 10 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -89,16 +89,29 @@ static inline struct inode *wb_inode(str
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/writeback.h>
+
++static void bdi_wakeup_thread(struct backing_dev_info *bdi)
++{
++ spin_lock_bh(&bdi->wb_lock);
++ if (test_bit(BDI_registered, &bdi->state))
++ mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
++ spin_unlock_bh(&bdi->wb_lock);
++}
++
+ static void bdi_queue_work(struct backing_dev_info *bdi,
+ struct wb_writeback_work *work)
+ {
+ trace_writeback_queue(bdi, work);
+
+ spin_lock_bh(&bdi->wb_lock);
++ if (!test_bit(BDI_registered, &bdi->state)) {
++ if (work->done)
++ complete(work->done);
++ goto out_unlock;
++ }
+ list_add_tail(&work->list, &bdi->work_list);
+- spin_unlock_bh(&bdi->wb_lock);
+-
+ mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
++out_unlock:
++ spin_unlock_bh(&bdi->wb_lock);
+ }
+
+ static void
+@@ -114,7 +127,7 @@ __bdi_start_writeback(struct backing_dev
+ work = kzalloc(sizeof(*work), GFP_ATOMIC);
+ if (!work) {
+ trace_writeback_nowork(bdi);
+- mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
++ bdi_wakeup_thread(bdi);
+ return;
+ }
+
+@@ -161,7 +174,7 @@ void bdi_start_background_writeback(stru
+ * writeback as soon as there is no other work to do.
+ */
+ trace_writeback_wake_background(bdi);
+- mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
++ bdi_wakeup_thread(bdi);
+ }
+
+ /*
+@@ -1017,7 +1030,7 @@ void bdi_writeback_workfn(struct work_st
+ current->flags |= PF_SWAPWRITE;
+
+ if (likely(!current_is_workqueue_rescuer() ||
+- list_empty(&bdi->bdi_list))) {
++ !test_bit(BDI_registered, &bdi->state))) {
+ /*
+ * The normal path. Keep writing back @bdi until its
+ * work_list is empty. Note that this path is also taken
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -95,7 +95,7 @@ struct backing_dev_info {
+ unsigned int max_ratio, max_prop_frac;
+
+ struct bdi_writeback wb; /* default writeback info for this bdi */
+- spinlock_t wb_lock; /* protects work_list */
++ spinlock_t wb_lock; /* protects work_list & wb.dwork scheduling */
+
+ struct list_head work_list;
+
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -297,7 +297,10 @@ void bdi_wakeup_thread_delayed(struct ba
+ unsigned long timeout;
+
+ timeout = msecs_to_jiffies(dirty_writeback_interval * 10);
+- queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
++ spin_lock_bh(&bdi->wb_lock);
++ if (test_bit(BDI_registered, &bdi->state))
++ queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
++ spin_unlock_bh(&bdi->wb_lock);
+ }
+
+ /*
+@@ -310,9 +313,6 @@ static void bdi_remove_from_list(struct
+ spin_unlock_bh(&bdi_lock);
+
+ synchronize_rcu_expedited();
+-
+- /* bdi_list is now unused, clear it to mark @bdi dying */
+- INIT_LIST_HEAD(&bdi->bdi_list);
+ }
+
+ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
+@@ -363,6 +363,11 @@ static void bdi_wb_shutdown(struct backi
+ */
+ bdi_remove_from_list(bdi);
+
++ /* Make sure nobody queues further work */
++ spin_lock_bh(&bdi->wb_lock);
++ clear_bit(BDI_registered, &bdi->state);
++ spin_unlock_bh(&bdi->wb_lock);
++
+ /*
+ * Drain work list and shutdown the delayed_work. At this point,
+ * @bdi->bdi_list is empty telling bdi_Writeback_workfn() that @bdi
--- /dev/null
+From 5981a8821b774ada0be512fd9bad7c241e17657e Mon Sep 17 00:00:00 2001
+From: Claudio Takahasi <claudio.takahasi@openbossa.org>
+Date: Thu, 25 Jul 2013 16:34:24 -0300
+Subject: Bluetooth: Fix removing Long Term Key
+
+From: Claudio Takahasi <claudio.takahasi@openbossa.org>
+
+commit 5981a8821b774ada0be512fd9bad7c241e17657e upstream.
+
+This patch fixes authentication failure on LE link re-connection when
+BlueZ acts as slave (peripheral). LTK is removed from the internal list
+after its first use causing PIN or Key missing reply when re-connecting
+the link. The LE Long Term Key Request event indicates that the master
+is attempting to encrypt or re-encrypt the link.
+
+Pre-condition: BlueZ host paired and running as slave.
+How to reproduce(master):
+
+ 1) Establish an ACL LE encrypted link
+ 2) Disconnect the link
+ 3) Try to re-establish the ACL LE encrypted link (fails)
+
+> HCI Event: LE Meta Event (0x3e) plen 19
+ LE Connection Complete (0x01)
+ Status: Success (0x00)
+ Handle: 64
+ Role: Slave (0x01)
+...
+@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
+> HCI Event: LE Meta Event (0x3e) plen 13
+ LE Long Term Key Request (0x05)
+ Handle: 64
+ Random number: 875be18439d9aa37
+ Encryption diversifier: 0x76ed
+< HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18
+ Handle: 64
+ Long term key: 2aa531db2fce9f00a0569c7d23d17409
+> HCI Event: Command Complete (0x0e) plen 6
+ LE Long Term Key Request Reply (0x08|0x001a) ncmd 1
+ Status: Success (0x00)
+ Handle: 64
+> HCI Event: Encryption Change (0x08) plen 4
+ Status: Success (0x00)
+ Handle: 64
+ Encryption: Enabled with AES-CCM (0x01)
+...
+@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3
+< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1
+ Advertising: Enabled (0x01)
+> HCI Event: Command Complete (0x0e) plen 4
+ LE Set Advertise Enable (0x08|0x000a) ncmd 1
+ Status: Success (0x00)
+> HCI Event: LE Meta Event (0x3e) plen 19
+ LE Connection Complete (0x01)
+ Status: Success (0x00)
+ Handle: 64
+ Role: Slave (0x01)
+...
+@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
+> HCI Event: LE Meta Event (0x3e) plen 13
+ LE Long Term Key Request (0x05)
+ Handle: 64
+ Random number: 875be18439d9aa37
+ Encryption diversifier: 0x76ed
+< HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2
+ Handle: 64
+> HCI Event: Command Complete (0x0e) plen 6
+ LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1
+ Status: Success (0x00)
+ Handle: 64
+> HCI Event: Disconnect Complete (0x05) plen 4
+ Status: Success (0x00)
+ Handle: 64
+ Reason: Authentication Failure (0x05)
+@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0
+
+Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3593,7 +3593,13 @@ static void hci_le_ltk_request_evt(struc
+
+ hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+
+- if (ltk->type & HCI_SMP_STK) {
++ /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
++ * temporary key used to encrypt a connection following
++ * pairing. It is used during the Encrypted Session Setup to
++ * distribute the keys. Later, security can be re-established
++ * using a distributed LTK.
++ */
++ if (ltk->type == HCI_SMP_STK_SLAVE) {
+ list_del(<k->list);
+ kfree(ltk);
+ }
--- /dev/null
+From f88ba6a2a44ee98e8d59654463dc157bb6d13c43 Mon Sep 17 00:00:00 2001
+From: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Date: Wed, 5 Feb 2014 16:34:38 +0900
+Subject: Btrfs: skip submitting barrier for missing device
+
+From: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+
+commit f88ba6a2a44ee98e8d59654463dc157bb6d13c43 upstream.
+
+I got an error on v3.13:
+ BTRFS error (device sdf1) in write_all_supers:3378: errno=-5 IO failure (errors while submitting device barriers.)
+
+how to reproduce:
+ > mkfs.btrfs -f -d raid1 /dev/sdf1 /dev/sdf2
+ > wipefs -a /dev/sdf2
+ > mount -o degraded /dev/sdf1 /mnt
+ > btrfs balance start -f -sconvert=single -mconvert=single -dconvert=single /mnt
+
+The reason of the error is that barrier_all_devices() failed to submit
+barrier to the missing device. However it is clear that we cannot do
+anything on missing device, and also it is not necessary to care chunks
+on the missing device.
+
+This patch stops sending/waiting barrier if device is missing.
+
+Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/disk-io.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3244,6 +3244,8 @@ static int barrier_all_devices(struct bt
+ /* send down all the barriers */
+ head = &info->fs_devices->devices;
+ list_for_each_entry_rcu(dev, head, dev_list) {
++ if (dev->missing)
++ continue;
+ if (!dev->bdev) {
+ errors_send++;
+ continue;
+@@ -3258,6 +3260,8 @@ static int barrier_all_devices(struct bt
+
+ /* wait for all the barriers */
+ list_for_each_entry_rcu(dev, head, dev_list) {
++ if (dev->missing)
++ continue;
+ if (!dev->bdev) {
+ errors_wait++;
+ continue;
--- /dev/null
+From a94cdd1f4d30f12904ab528152731fb13a812a16 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Mon, 14 Apr 2014 09:46:50 -0500
+Subject: Char: ipmi_bt_sm, fix infinite loop
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.
+
+In read_all_bytes, we do
+
+ unsigned char i;
+ ...
+ bt->read_data[0] = BMC2HOST;
+ bt->read_count = bt->read_data[0];
+ ...
+ for (i = 1; i <= bt->read_count; i++)
+ bt->read_data[i] = BMC2HOST;
+
+If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the
+'for' loop. Make 'i' an 'int' instead of 'char' to get rid of the
+overflow and finish the loop after 255 iterations every time.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Reported-and-debugged-by: Rui Hui Dian <rhdian@novell.com>
+Cc: Tomas Cech <tcech@suse.cz>
+Cc: Corey Minyard <minyard@acm.org>
+Cc: <openipmi-developer@lists.sourceforge.net>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ipmi/ipmi_bt_sm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/ipmi/ipmi_bt_sm.c
++++ b/drivers/char/ipmi/ipmi_bt_sm.c
+@@ -352,7 +352,7 @@ static inline void write_all_bytes(struc
+
+ static inline int read_all_bytes(struct si_sm_data *bt)
+ {
+- unsigned char i;
++ unsigned int i;
+
+ /*
+ * length is "framing info", minimum = 4: NetFn, Seq, Cmd, cCode.
--- /dev/null
+From c019e307ad82a8ee652b8ccbacf69ae94263b07b Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@polito.it>
+Date: Mon, 3 Feb 2014 13:56:04 +0100
+Subject: ima: restore the original behavior for sending data with ima template
+
+From: Roberto Sassu <roberto.sassu@polito.it>
+
+commit c019e307ad82a8ee652b8ccbacf69ae94263b07b upstream.
+
+With the new template mechanism introduced in IMA since kernel 3.13,
+the format of data sent through the binary_runtime_measurements interface
+is slightly changed. Now, for a generic measurement, the format of
+template data (after the template name) is:
+
+template_len | field1_len | field1 | ... | fieldN_len | fieldN
+
+In addition, fields containing a string now include the '\0' termination
+character.
+
+Instead, the format for the 'ima' template should be:
+
+SHA1 digest | event name length | event name
+
+It must be noted that while in the IMA 3.13 code 'event name length' is
+'IMA_EVENT_NAME_LEN_MAX + 1' (256 bytes), so that the template digest
+is calculated correctly, and 'event name' contains '\0', in the pre 3.13
+code 'event name length' is exactly the string length and 'event name'
+does not contain the termination character.
+
+The patch restores the behavior of the IMA code pre 3.13 for the 'ima'
+template so that legacy userspace tools obtain a consistent behavior
+when receiving data from the binary_runtime_measurements interface
+regardless of which kernel version is used.
+
+Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/integrity/ima/ima.h | 2 +-
+ security/integrity/ima/ima_fs.c | 2 ++
+ security/integrity/ima/ima_template_lib.c | 10 +++++++---
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -27,7 +27,7 @@
+ #include "../integrity.h"
+
+ enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
+- IMA_SHOW_ASCII };
++ IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
+ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
+
+ /* digest size for IMA, fits SHA1 or MD5 */
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -160,6 +160,8 @@ static int ima_measurements_show(struct
+
+ if (is_ima_template && strcmp(field->field_id, "d") == 0)
+ show = IMA_SHOW_BINARY_NO_FIELD_LEN;
++ if (is_ima_template && strcmp(field->field_id, "n") == 0)
++ show = IMA_SHOW_BINARY_OLD_STRING_FMT;
+ field->field_show(m, show, &e->template_data[i]);
+ }
+ return 0;
+--- a/security/integrity/ima/ima_template_lib.c
++++ b/security/integrity/ima/ima_template_lib.c
+@@ -109,13 +109,16 @@ static void ima_show_template_data_binar
+ enum data_formats datafmt,
+ struct ima_field_data *field_data)
+ {
++ u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ?
++ strlen(field_data->data) : field_data->len;
++
+ if (show != IMA_SHOW_BINARY_NO_FIELD_LEN)
+- ima_putc(m, &field_data->len, sizeof(u32));
++ ima_putc(m, &len, sizeof(len));
+
+- if (!field_data->len)
++ if (!len)
+ return;
+
+- ima_putc(m, field_data->data, field_data->len);
++ ima_putc(m, field_data->data, len);
+ }
+
+ static void ima_show_template_field_data(struct seq_file *m,
+@@ -129,6 +132,7 @@ static void ima_show_template_field_data
+ break;
+ case IMA_SHOW_BINARY:
+ case IMA_SHOW_BINARY_NO_FIELD_LEN:
++ case IMA_SHOW_BINARY_OLD_STRING_FMT:
+ ima_show_template_data_binary(m, show, datafmt, field_data);
+ break;
+ default:
--- /dev/null
+From 88391d49abb7d8dee91d405f96bd9e003cb6798d Mon Sep 17 00:00:00 2001
+From: Richard Cochran <richardcochran@gmail.com>
+Date: Wed, 5 Mar 2014 17:10:52 +0100
+Subject: kernfs: fix off by one error.
+
+From: Richard Cochran <richardcochran@gmail.com>
+
+commit 88391d49abb7d8dee91d405f96bd9e003cb6798d upstream.
+
+The hash values 0 and 1 are reserved for magic directory entries, but
+the code only prevents names hashing to 0. This patch fixes the test
+to also prevent hash value 1.
+
+Signed-off-by: Richard Cochran <richardcochran@gmail.com>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/kernfs/dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -37,7 +37,7 @@ static unsigned int kernfs_name_hash(con
+ hash = (end_name_hash(hash) ^ hash_ptr((void *)ns, 31));
+ hash &= 0x7fffffffU;
+ /* Reserve hash numbers 0, 1 and INT_MAX for magic directory entries */
+- if (hash < 1)
++ if (hash < 2)
+ hash += 2;
+ if (hash >= INT_MAX)
+ hash = INT_MAX - 1;
--- /dev/null
+From 4afddd60a770560d370d6f85c5aef57c16bf7502 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 2 Apr 2014 16:40:52 -0400
+Subject: kernfs: protect lazy kernfs_iattrs allocation with mutex
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 4afddd60a770560d370d6f85c5aef57c16bf7502 upstream.
+
+kernfs_iattrs is allocated lazily when operations which require it
+take place; unfortunately, the lazy allocation and returning weren't
+properly synchronized and when there are multiple concurrent
+operations, it might end up returning kernfs_iattrs which hasn't
+finished initialization yet or different copies to different callers.
+
+Fix it by synchronizing with a mutex. This can be smarter with memory
+barriers but let's go there if it actually turns out to be necessary.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Link: http://lkml.kernel.org/g/533ABA32.9080602@oracle.com
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/kernfs/inode.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/fs/kernfs/inode.c
++++ b/fs/kernfs/inode.c
+@@ -48,14 +48,18 @@ void __init kernfs_inode_init(void)
+
+ static struct kernfs_iattrs *kernfs_iattrs(struct kernfs_node *kn)
+ {
++ static DEFINE_MUTEX(iattr_mutex);
++ struct kernfs_iattrs *ret;
+ struct iattr *iattrs;
+
++ mutex_lock(&iattr_mutex);
++
+ if (kn->iattr)
+- return kn->iattr;
++ goto out_unlock;
+
+ kn->iattr = kzalloc(sizeof(struct kernfs_iattrs), GFP_KERNEL);
+ if (!kn->iattr)
+- return NULL;
++ goto out_unlock;
+ iattrs = &kn->iattr->ia_iattr;
+
+ /* assign default attributes */
+@@ -65,8 +69,10 @@ static struct kernfs_iattrs *kernfs_iatt
+ iattrs->ia_atime = iattrs->ia_mtime = iattrs->ia_ctime = CURRENT_TIME;
+
+ simple_xattrs_init(&kn->iattr->xattrs);
+-
+- return kn->iattr;
++out_unlock:
++ ret = kn->iattr;
++ mutex_unlock(&iattr_mutex);
++ return ret;
+ }
+
+ static int __kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr)
--- /dev/null
+From 017fcdc30cdae18c0946eef1ece1f14b4c7897ba Mon Sep 17 00:00:00 2001
+From: Mohit Kumar <mohit.kumar@st.com>
+Date: Wed, 16 Apr 2014 10:23:34 -0600
+Subject: PCI: designware: Fix iATU programming for cfg1, io and mem viewport
+
+From: Mohit Kumar <mohit.kumar@st.com>
+
+commit 017fcdc30cdae18c0946eef1ece1f14b4c7897ba upstream.
+
+This patch corrects iATU programming for cfg1, io and mem viewport. Enable
+ATU only after configuring it.
+
+Signed-off-by: Mohit Kumar <mohit.kumar@st.com>
+Signed-off-by: Ajay Khandelwal <ajay.khandelwal@st.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Jingoo Han <jg1.han@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-designware.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -522,13 +522,13 @@ static void dw_pcie_prog_viewport_cfg1(s
+ dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1,
+ PCIE_ATU_VIEWPORT);
+ dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_CFG1, PCIE_ATU_CR1);
+- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ dw_pcie_writel_rc(pp, pp->cfg1_base, PCIE_ATU_LOWER_BASE);
+ dw_pcie_writel_rc(pp, (pp->cfg1_base >> 32), PCIE_ATU_UPPER_BASE);
+ dw_pcie_writel_rc(pp, pp->cfg1_base + pp->config.cfg1_size - 1,
+ PCIE_ATU_LIMIT);
+ dw_pcie_writel_rc(pp, busdev, PCIE_ATU_LOWER_TARGET);
+ dw_pcie_writel_rc(pp, 0, PCIE_ATU_UPPER_TARGET);
++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ }
+
+ static void dw_pcie_prog_viewport_mem_outbound(struct pcie_port *pp)
+@@ -537,7 +537,6 @@ static void dw_pcie_prog_viewport_mem_ou
+ dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX0,
+ PCIE_ATU_VIEWPORT);
+ dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_MEM, PCIE_ATU_CR1);
+- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ dw_pcie_writel_rc(pp, pp->mem_base, PCIE_ATU_LOWER_BASE);
+ dw_pcie_writel_rc(pp, (pp->mem_base >> 32), PCIE_ATU_UPPER_BASE);
+ dw_pcie_writel_rc(pp, pp->mem_base + pp->config.mem_size - 1,
+@@ -545,6 +544,7 @@ static void dw_pcie_prog_viewport_mem_ou
+ dw_pcie_writel_rc(pp, pp->config.mem_bus_addr, PCIE_ATU_LOWER_TARGET);
+ dw_pcie_writel_rc(pp, upper_32_bits(pp->config.mem_bus_addr),
+ PCIE_ATU_UPPER_TARGET);
++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ }
+
+ static void dw_pcie_prog_viewport_io_outbound(struct pcie_port *pp)
+@@ -553,7 +553,6 @@ static void dw_pcie_prog_viewport_io_out
+ dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1,
+ PCIE_ATU_VIEWPORT);
+ dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_IO, PCIE_ATU_CR1);
+- dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ dw_pcie_writel_rc(pp, pp->io_base, PCIE_ATU_LOWER_BASE);
+ dw_pcie_writel_rc(pp, (pp->io_base >> 32), PCIE_ATU_UPPER_BASE);
+ dw_pcie_writel_rc(pp, pp->io_base + pp->config.io_size - 1,
+@@ -561,6 +560,7 @@ static void dw_pcie_prog_viewport_io_out
+ dw_pcie_writel_rc(pp, pp->config.io_bus_addr, PCIE_ATU_LOWER_TARGET);
+ dw_pcie_writel_rc(pp, upper_32_bits(pp->config.io_bus_addr),
+ PCIE_ATU_UPPER_TARGET);
++ dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
+ }
+
+ static int dw_pcie_rd_other_conf(struct pcie_port *pp, struct pci_bus *bus,
--- /dev/null
+From dbffdd6862e67d60703f2df66c558bf448f81d6e Mon Sep 17 00:00:00 2001
+From: Mohit Kumar <mohit.kumar@st.com>
+Date: Wed, 19 Feb 2014 17:34:35 +0530
+Subject: PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR
+
+From: Mohit Kumar <mohit.kumar@st.com>
+
+commit dbffdd6862e67d60703f2df66c558bf448f81d6e upstream.
+
+The Synopsys PCIe core provides one pair of 32-bit BARs (BAR 0 and BAR 1).
+The BARs can be configured as follows:
+
+ - One 64-bit BAR: BARs 0 and 1 are combined to form a single 64-bit BAR
+ - Two 32-bit BARs: BARs 0 and 1 are two independent 32-bit BARs
+
+This patch corrects 64-bit, non-prefetchable memory BAR configuration
+implemented in dw driver.
+
+Signed-off-by: Mohit Kumar <mohit.kumar@st.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Pratyush Anand <pratyush.anand@st.com>
+Cc: Jingoo Han <jg1.han@samsung.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-designware.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -800,7 +800,7 @@ void dw_pcie_setup_rc(struct pcie_port *
+
+ /* setup RC BARs */
+ dw_pcie_writel_rc(pp, 0x00000004, PCI_BASE_ADDRESS_0);
+- dw_pcie_writel_rc(pp, 0x00000004, PCI_BASE_ADDRESS_1);
++ dw_pcie_writel_rc(pp, 0x00000000, PCI_BASE_ADDRESS_1);
+
+ /* setup interrupt pins */
+ dw_pcie_readl_rc(pp, PCI_INTERRUPT_LINE, &val);
--- /dev/null
+From 866d54177b4e671cd52bed1fb487d140d7b691f5 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 7 Mar 2014 16:06:05 -0700
+Subject: PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not enabled
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 866d54177b4e671cd52bed1fb487d140d7b691f5 upstream.
+
+Andreas reported that after 1f42db786b14 ("PCI: Enable INTx if BIOS left
+them disabled"), pciehp surprise removal stopped working.
+
+This happens because pci_reenable_device() on the hotplug bridge (used in
+the pciehp_configure_device() path) clears the Interrupt Disable bit, which
+apparently breaks the bridge's MSI hotplug event reporting.
+
+Previously we cleared the Interrupt Disable bit in do_pci_enable_device(),
+which is used by both pci_enable_device() and pci_reenable_device(). But
+we use pci_reenable_device() after the driver may have enabled MSI or
+MSI-X, and we *set* Interrupt Disable as part of enabling MSI/MSI-X.
+
+This patch clears Interrupt Disable only when MSI/MSI-X has not been
+enabled.
+
+Fixes: 1f42db786b14 PCI: Enable INTx if BIOS left them disabled
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=71691
+Reported-and-tested-by: Andreas Noever <andreas.noever@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1195,6 +1195,9 @@ static int do_pci_enable_device(struct p
+ if (dev->msi_enabled || dev->msix_enabled)
+ return 0;
+
++ if (dev->msi_enabled || dev->msix_enabled)
++ return 0;
++
+ pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+ if (pin) {
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
--- /dev/null
+From d23082257d83e4bc89727d5aedee197e907999d2 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Wed, 2 Apr 2014 17:45:05 +0200
+Subject: pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit d23082257d83e4bc89727d5aedee197e907999d2 upstream.
+
+pidns_get()->get_pid_ns() can hit ns == NULL. This task_struct can't
+go away, but task_active_pid_ns(task) is NULL if release_task(task)
+was already called. Alternatively we could change get_pid_ns(ns) to
+check ns != NULL, but it seems that other callers are fine.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Eric W. Biederman ebiederm@xmission.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/pid_namespace.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/pid_namespace.c
++++ b/kernel/pid_namespace.c
+@@ -318,7 +318,9 @@ static void *pidns_get(struct task_struc
+ struct pid_namespace *ns;
+
+ rcu_read_lock();
+- ns = get_pid_ns(task_active_pid_ns(task));
++ ns = task_active_pid_ns(task);
++ if (ns)
++ get_pid_ns(ns);
+ rcu_read_unlock();
+
+ return ns;
--- /dev/null
+From 7aae51347b21eb738dc1981df1365b57a6c5ee4e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jan 2014 15:37:04 -0500
+Subject: SCSI: sd: don't fail if the device doesn't recognize SYNCHRONIZE CACHE
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 7aae51347b21eb738dc1981df1365b57a6c5ee4e upstream.
+
+Evidently some wacky USB-ATA bridges don't recognize the SYNCHRONIZE
+CACHE command, as shown in this email thread:
+
+ http://marc.info/?t=138978356200002&r=1&w=2
+
+The fact that we can't tell them to drain their caches shouldn't
+prevent the system from going into suspend. Therefore sd_sync_cache()
+shouldn't return an error if the device replies with an Invalid
+Command ASC.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Sven Neumann <s.neumann@raumfeld.com>
+Tested-by: Daniel Mack <zonque@gmail.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1463,8 +1463,8 @@ static int sd_sync_cache(struct scsi_dis
+ sd_print_sense_hdr(sdkp, &sshdr);
+ /* we need to evaluate the error return */
+ if (scsi_sense_valid(&sshdr) &&
+- /* 0x3a is medium not present */
+- sshdr.asc == 0x3a)
++ (sshdr.asc == 0x3a || /* medium not present */
++ sshdr.asc == 0x20)) /* invalid command */
+ /* this is no error here */
+ return 0;
+
user-namespace-fix-incorrect-memory-barriers.patch
+char-ipmi_bt_sm-fix-infinite-loop.patch
+x86-hyperv-bypass-the-timer_irq_works-check.patch
+x86-adjust-irq-remapping-quirk-for-older-revisions-of-5500-5520-chipsets.patch
+pci-designware-fix-rc-bar-to-be-single-64-bit-non-prefetchable-memory-bar.patch
+pci-designware-fix-iatu-programming-for-cfg1-io-and-mem-viewport.patch
+acpi-button-add-acpi-button-event-via-netlink-routine.patch
+pci-enable-intx-in-pci_reenable_device-only-when-msi-msi-x-not-enabled.patch
+staging-comedi-8255_pci-initialize-mite-data-window.patch
+staging-comedi-fix-circular-locking-dependency-in-comedi_mmap.patch
+kernfs-fix-off-by-one-error.patch
+kernfs-protect-lazy-kernfs_iattrs-allocation-with-mutex.patch
+tty-set-correct-tty-name-in-active-sysfs-attribute.patch
+tty-fix-low_latency-bug.patch
+scsi-sd-don-t-fail-if-the-device-doesn-t-recognize-synchronize-cache.patch
+pid_namespace-pidns_get-should-check-task_active_pid_ns-null.patch
+bluetooth-fix-removing-long-term-key.patch
+ima-restore-the-original-behavior-for-sending-data-with-ima-template.patch
+backing_dev-fix-hung-task-on-sync.patch
+bdi-avoid-oops-on-device-removal.patch
+xfs-fix-directory-hash-ordering-bug.patch
+btrfs-skip-submitting-barrier-for-missing-device.patch
--- /dev/null
+From 268d1e799663b795cba15c64f5d29407786a9dd4 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 13 Mar 2014 15:30:39 +0000
+Subject: staging: comedi: 8255_pci: initialize MITE data window
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 268d1e799663b795cba15c64f5d29407786a9dd4 upstream.
+
+According to National Instruments' PCI-DIO-96/PXI-6508/PCI-6503 User
+Manual, the physical address in PCI BAR1 needs to be OR'ed with 0x80 and
+written to register offset 0xC0 in the "MITE" registers (BAR0). Do so
+during initialization of the National Instruments boards handled by the
+"8255_pci" driver. The boards were previously handled by the
+"ni_pcidio" driver, where the initialization was done by `mite_setup()`
+in the "mite" module. The "mite" module comes with too much extra
+baggage for the "8255_pci" driver to deal with so use a local, simpler
+initialization function.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/8255_pci.c | 34 ++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+--- a/drivers/staging/comedi/drivers/8255_pci.c
++++ b/drivers/staging/comedi/drivers/8255_pci.c
+@@ -56,6 +56,7 @@ Configuration Options: not applicable, u
+ #include "../comedidev.h"
+
+ #include "8255.h"
++#include "mite.h"
+
+ enum pci_8255_boardid {
+ BOARD_ADLINK_PCI7224,
+@@ -79,6 +80,7 @@ struct pci_8255_boardinfo {
+ const char *name;
+ int dio_badr;
+ int n_8255;
++ unsigned int has_mite:1;
+ };
+
+ static const struct pci_8255_boardinfo pci_8255_boards[] = {
+@@ -126,36 +128,43 @@ static const struct pci_8255_boardinfo p
+ .name = "ni_pci-dio-96",
+ .dio_badr = 1,
+ .n_8255 = 4,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PCIDIO96B] = {
+ .name = "ni_pci-dio-96b",
+ .dio_badr = 1,
+ .n_8255 = 4,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PXI6508] = {
+ .name = "ni_pxi-6508",
+ .dio_badr = 1,
+ .n_8255 = 4,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PCI6503] = {
+ .name = "ni_pci-6503",
+ .dio_badr = 1,
+ .n_8255 = 1,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PCI6503B] = {
+ .name = "ni_pci-6503b",
+ .dio_badr = 1,
+ .n_8255 = 1,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PCI6503X] = {
+ .name = "ni_pci-6503x",
+ .dio_badr = 1,
+ .n_8255 = 1,
++ .has_mite = 1,
+ },
+ [BOARD_NI_PXI_6503] = {
+ .name = "ni_pxi-6503",
+ .dio_badr = 1,
+ .n_8255 = 1,
++ .has_mite = 1,
+ },
+ };
+
+@@ -163,6 +172,25 @@ struct pci_8255_private {
+ void __iomem *mmio_base;
+ };
+
++static int pci_8255_mite_init(struct pci_dev *pcidev)
++{
++ void __iomem *mite_base;
++ u32 main_phys_addr;
++
++ /* ioremap the MITE registers (BAR 0) temporarily */
++ mite_base = pci_ioremap_bar(pcidev, 0);
++ if (!mite_base)
++ return -ENOMEM;
++
++ /* set data window to main registers (BAR 1) */
++ main_phys_addr = pci_resource_start(pcidev, 1);
++ writel(main_phys_addr | WENAB, mite_base + MITE_IODWBSR);
++
++ /* finished with MITE registers */
++ iounmap(mite_base);
++ return 0;
++}
++
+ static int pci_8255_mmio(int dir, int port, int data, unsigned long iobase)
+ {
+ void __iomem *mmio_base = (void __iomem *)iobase;
+@@ -201,6 +229,12 @@ static int pci_8255_auto_attach(struct c
+ if (ret)
+ return ret;
+
++ if (board->has_mite) {
++ ret = pci_8255_mite_init(pcidev);
++ if (ret)
++ return ret;
++ }
++
+ is_mmio = (pci_resource_flags(pcidev, board->dio_badr) &
+ IORESOURCE_MEM) != 0;
+ if (is_mmio) {
--- /dev/null
+From b34aa86f12e8848ba453215602c8c50fa63c4cb3 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 10 Apr 2014 19:41:57 +0100
+Subject: staging: comedi: fix circular locking dependency in comedi_mmap()
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit b34aa86f12e8848ba453215602c8c50fa63c4cb3 upstream.
+
+Mmapping a comedi data buffer with lockdep checking enabled produced the
+following kernel debug messages:
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.5.0-rc3-ija1+ #9 Tainted: G C
+-------------------------------------------------------
+comedi_test/4160 is trying to acquire lock:
+ (&dev->mutex#2){+.+.+.}, at: [<ffffffffa00313f4>] comedi_mmap+0x57/0x1d9 [comedi]
+
+but task is already holding lock:
+ (&mm->mmap_sem){++++++}, at: [<ffffffff810c96fe>] vm_mmap_pgoff+0x41/0x76
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (&mm->mmap_sem){++++++}:
+ [<ffffffff8106d0e8>] lock_acquire+0x97/0x105
+ [<ffffffff810ce3bc>] might_fault+0x6d/0x90
+ [<ffffffffa0031ffb>] do_devinfo_ioctl.isra.7+0x11e/0x14c [comedi]
+ [<ffffffffa003227f>] comedi_unlocked_ioctl+0x256/0xe48 [comedi]
+ [<ffffffff810f7fcd>] vfs_ioctl+0x18/0x34
+ [<ffffffff810f87fd>] do_vfs_ioctl+0x382/0x43c
+ [<ffffffff810f88f9>] sys_ioctl+0x42/0x65
+ [<ffffffff81415c62>] system_call_fastpath+0x16/0x1b
+
+-> #0 (&dev->mutex#2){+.+.+.}:
+ [<ffffffff8106c528>] __lock_acquire+0x101d/0x1591
+ [<ffffffff8106d0e8>] lock_acquire+0x97/0x105
+ [<ffffffff8140c894>] mutex_lock_nested+0x46/0x2a4
+ [<ffffffffa00313f4>] comedi_mmap+0x57/0x1d9 [comedi]
+ [<ffffffff810d5816>] mmap_region+0x281/0x492
+ [<ffffffff810d5c92>] do_mmap_pgoff+0x26b/0x2a7
+ [<ffffffff810c971a>] vm_mmap_pgoff+0x5d/0x76
+ [<ffffffff810d493f>] sys_mmap_pgoff+0xc7/0x10d
+ [<ffffffff81004d36>] sys_mmap+0x16/0x20
+ [<ffffffff81415c62>] system_call_fastpath+0x16/0x1b
+
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&mm->mmap_sem);
+ lock(&dev->mutex#2);
+ lock(&mm->mmap_sem);
+ lock(&dev->mutex#2);
+
+ *** DEADLOCK ***
+
+To avoid the circular dependency, just try to get the lock in
+`comedi_mmap()` instead of blocking. Since the comedi device's main mutex
+is heavily used, do a down-read of its `attach_lock` rwsemaphore
+instead. Trying to down-read `attach_lock` should only fail if
+some task has down-write locked it, and that is only done while the
+comedi device is being attached to or detached from a low-level hardware
+device.
+
+Unfortunately, acquiring the `attach_lock` doesn't prevent another
+task replacing the comedi data buffer we are trying to mmap. The
+details of the buffer are held in a `struct comedi_buf_map` and pointed
+to by `s->async->buf_map` where `s` is the comedi subdevice whose buffer
+we are trying to map. The `struct comedi_buf_map` is already reference
+counted with a `struct kref`, so we can stop it being freed prematurely.
+
+Modify `comedi_mmap()` to call new function
+`comedi_buf_map_from_subdev_get()` to read the subdevice's current
+buffer map pointer and increment its reference instead of accessing
+`async->buf_map` directly. Call `comedi_buf_map_put()` to decrement the
+reference once the buffer map structure has been dealt with. (Note that
+`comedi_buf_map_put()` does nothing if passed a NULL pointer.)
+
+`comedi_buf_map_from_subdev_get()` checks the subdevice's buffer map
+pointer has been set and the buffer map has been initialized enough for
+`comedi_mmap()` to deal with it (specifically, check the `n_pages`
+member has been set to a non-zero value). If all is well, the buffer
+map's reference is incremented and a pointer to it is returned. The
+comedi subdevice's spin-lock is used to protect the checks. Also use
+the spin-lock in `__comedi_buf_alloc()` and `__comedi_buf_free()` to
+protect changes to the subdevice's buffer map structure pointer and the
+buffer map structure's `n_pages` member. (This checking of `n_pages` is
+a bit clunky and I [Ian Abbott] plan to deal with it in the future.)
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_buf.c | 37 +++++++++++++++++++++++++++++--
+ drivers/staging/comedi/comedi_fops.c | 18 +++++++++++----
+ drivers/staging/comedi/comedi_internal.h | 2 +
+ 3 files changed, 51 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/comedi/comedi_buf.c
++++ b/drivers/staging/comedi/comedi_buf.c
+@@ -61,6 +61,8 @@ static void __comedi_buf_free(struct com
+ struct comedi_subdevice *s)
+ {
+ struct comedi_async *async = s->async;
++ struct comedi_buf_map *bm;
++ unsigned long flags;
+
+ if (async->prealloc_buf) {
+ vunmap(async->prealloc_buf);
+@@ -68,8 +70,11 @@ static void __comedi_buf_free(struct com
+ async->prealloc_bufsz = 0;
+ }
+
+- comedi_buf_map_put(async->buf_map);
++ spin_lock_irqsave(&s->spin_lock, flags);
++ bm = async->buf_map;
+ async->buf_map = NULL;
++ spin_unlock_irqrestore(&s->spin_lock, flags);
++ comedi_buf_map_put(bm);
+ }
+
+ static void __comedi_buf_alloc(struct comedi_device *dev,
+@@ -80,6 +85,7 @@ static void __comedi_buf_alloc(struct co
+ struct page **pages = NULL;
+ struct comedi_buf_map *bm;
+ struct comedi_buf_page *buf;
++ unsigned long flags;
+ unsigned i;
+
+ if (!IS_ENABLED(CONFIG_HAS_DMA) && s->async_dma_dir != DMA_NONE) {
+@@ -92,8 +98,10 @@ static void __comedi_buf_alloc(struct co
+ if (!bm)
+ return;
+
+- async->buf_map = bm;
+ kref_init(&bm->refcount);
++ spin_lock_irqsave(&s->spin_lock, flags);
++ async->buf_map = bm;
++ spin_unlock_irqrestore(&s->spin_lock, flags);
+ bm->dma_dir = s->async_dma_dir;
+ if (bm->dma_dir != DMA_NONE)
+ /* Need ref to hardware device to free buffer later. */
+@@ -127,7 +135,9 @@ static void __comedi_buf_alloc(struct co
+
+ pages[i] = virt_to_page(buf->virt_addr);
+ }
++ spin_lock_irqsave(&s->spin_lock, flags);
+ bm->n_pages = i;
++ spin_unlock_irqrestore(&s->spin_lock, flags);
+
+ /* vmap the prealloc_buf if all the pages were allocated */
+ if (i == n_pages)
+@@ -150,6 +160,29 @@ int comedi_buf_map_put(struct comedi_buf
+ return 1;
+ }
+
++/* returns s->async->buf_map and increments its kref refcount */
++struct comedi_buf_map *
++comedi_buf_map_from_subdev_get(struct comedi_subdevice *s)
++{
++ struct comedi_async *async = s->async;
++ struct comedi_buf_map *bm = NULL;
++ unsigned long flags;
++
++ if (!async)
++ return NULL;
++
++ spin_lock_irqsave(&s->spin_lock, flags);
++ bm = async->buf_map;
++ /* only want it if buffer pages allocated */
++ if (bm && bm->n_pages)
++ comedi_buf_map_get(bm);
++ else
++ bm = NULL;
++ spin_unlock_irqrestore(&s->spin_lock, flags);
++
++ return bm;
++}
++
+ bool comedi_buf_is_mmapped(struct comedi_async *async)
+ {
+ struct comedi_buf_map *bm = async->buf_map;
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1923,14 +1923,21 @@ static int comedi_mmap(struct file *file
+ struct comedi_device *dev = file->private_data;
+ struct comedi_subdevice *s;
+ struct comedi_async *async;
+- struct comedi_buf_map *bm;
++ struct comedi_buf_map *bm = NULL;
+ unsigned long start = vma->vm_start;
+ unsigned long size;
+ int n_pages;
+ int i;
+ int retval;
+
+- mutex_lock(&dev->mutex);
++ /*
++ * 'trylock' avoids circular dependency with current->mm->mmap_sem
++ * and down-reading &dev->attach_lock should normally succeed without
++ * contention unless the device is in the process of being attached
++ * or detached.
++ */
++ if (!down_read_trylock(&dev->attach_lock))
++ return -EAGAIN;
+
+ if (!dev->attached) {
+ dev_dbg(dev->class_dev, "no driver attached\n");
+@@ -1970,7 +1977,9 @@ static int comedi_mmap(struct file *file
+ }
+
+ n_pages = size >> PAGE_SHIFT;
+- bm = async->buf_map;
++
++ /* get reference to current buf map (if any) */
++ bm = comedi_buf_map_from_subdev_get(s);
+ if (!bm || n_pages > bm->n_pages) {
+ retval = -EINVAL;
+ goto done;
+@@ -1994,7 +2003,8 @@ static int comedi_mmap(struct file *file
+
+ retval = 0;
+ done:
+- mutex_unlock(&dev->mutex);
++ up_read(&dev->attach_lock);
++ comedi_buf_map_put(bm); /* put reference to buf map - okay if NULL */
+ return retval;
+ }
+
+--- a/drivers/staging/comedi/comedi_internal.h
++++ b/drivers/staging/comedi/comedi_internal.h
+@@ -19,6 +19,8 @@ void comedi_buf_reset(struct comedi_asyn
+ bool comedi_buf_is_mmapped(struct comedi_async *async);
+ void comedi_buf_map_get(struct comedi_buf_map *bm);
+ int comedi_buf_map_put(struct comedi_buf_map *bm);
++struct comedi_buf_map *comedi_buf_map_from_subdev_get(
++ struct comedi_subdevice *s);
+ unsigned int comedi_buf_write_n_allocated(struct comedi_async *async);
+ void comedi_device_cancel_all(struct comedi_device *dev);
+
--- /dev/null
+From a9c3f68f3cd8d55f809fbdb0c138ed061ea1bd25 Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sat, 22 Feb 2014 07:31:21 -0500
+Subject: tty: Fix low_latency BUG
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit a9c3f68f3cd8d55f809fbdb0c138ed061ea1bd25 upstream.
+
+The user-settable knob, low_latency, has been the source of
+several BUG reports which stem from flush_to_ldisc() running
+in interrupt context. Since 3.12, which added several sleeping
+locks (termios_rwsem and buf->lock) to the input processing path,
+the frequency of these BUG reports has increased.
+
+Note that changes in 3.12 did not introduce this regression;
+sleeping locks were first added to the input processing path
+with the removal of the BKL from N_TTY in commit
+a88a69c91256418c5907c2f1f8a0ec0a36f9e6cc,
+'n_tty: Fix loss of echoed characters and remove bkl from n_tty'
+and later in commit 38db89799bdf11625a831c5af33938dcb11908b6,
+'tty: throttling race fix'. Since those changes, executing
+flush_to_ldisc() in interrupt_context (ie, low_latency set), is unsafe.
+
+However, since most devices do not validate if the low_latency
+setting is appropriate for the context (process or interrupt) in
+which they receive data, some reports are due to misconfiguration.
+Further, serial dma devices for which dma fails, resort to
+interrupt receiving as a backup without resetting low_latency.
+
+Historically, low_latency was used to force wake-up the reading
+process rather than wait for the next scheduler tick. The
+effect was to trim multiple milliseconds of latency from
+when the process would receive new data.
+
+Recent tests [1] have shown that the reading process now receives
+data with only 10's of microseconds latency without low_latency set.
+
+Remove the low_latency rx steering from tty_flip_buffer_push();
+however, leave the knob as an optional hint to drivers that can
+tune their rx fifos and such like. Cleanup stale code comments
+regarding low_latency.
+
+[1] https://lkml.org/lkml/2014/2/20/434
+
+"Yay.. thats an annoying historical pain in the butt gone."
+ -- Alan Cox
+
+Reported-by: Beat Bolli <bbolli@ewanet.ch>
+Reported-by: Pavel Roskin <proski@gnu.org>
+Acked-by: David Sterba <dsterba@suse.cz>
+Cc: Grant Edwards <grant.b.edwards@gmail.com>
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>
+Cc: Hal Murray <murray+fedora@ip-64-139-1-69.sjc.megapath.net>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/ipwireless/tty.c | 3 ---
+ drivers/tty/tty_buffer.c | 20 ++++----------------
+ drivers/usb/gadget/u_serial.c | 4 ++--
+ include/linux/tty.h | 2 +-
+ 4 files changed, 7 insertions(+), 22 deletions(-)
+
+--- a/drivers/tty/ipwireless/tty.c
++++ b/drivers/tty/ipwireless/tty.c
+@@ -176,9 +176,6 @@ void ipwireless_tty_received(struct ipw_
+ ": %d chars not inserted to flip buffer!\n",
+ length - work);
+
+- /*
+- * This may sleep if ->low_latency is set
+- */
+ if (work)
+ tty_flip_buffer_push(&tty->port);
+ }
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -351,14 +351,11 @@ EXPORT_SYMBOL(tty_insert_flip_string_fla
+ * Takes any pending buffers and transfers their ownership to the
+ * ldisc side of the queue. It then schedules those characters for
+ * processing by the line discipline.
+- * Note that this function can only be used when the low_latency flag
+- * is unset. Otherwise the workqueue won't be flushed.
+ */
+
+ void tty_schedule_flip(struct tty_port *port)
+ {
+ struct tty_bufhead *buf = &port->buf;
+- WARN_ON(port->low_latency);
+
+ buf->tail->commit = buf->tail->used;
+ schedule_work(&buf->work);
+@@ -482,17 +479,15 @@ static void flush_to_ldisc(struct work_s
+ */
+ void tty_flush_to_ldisc(struct tty_struct *tty)
+ {
+- if (!tty->port->low_latency)
+- flush_work(&tty->port->buf.work);
++ flush_work(&tty->port->buf.work);
+ }
+
+ /**
+ * tty_flip_buffer_push - terminal
+ * @port: tty port to push
+ *
+- * Queue a push of the terminal flip buffers to the line discipline. This
+- * function must not be called from IRQ context if port->low_latency is
+- * set.
++ * Queue a push of the terminal flip buffers to the line discipline.
++ * Can be called from IRQ/atomic context.
+ *
+ * In the event of the queue being busy for flipping the work will be
+ * held off and retried later.
+@@ -500,14 +495,7 @@ void tty_flush_to_ldisc(struct tty_struc
+
+ void tty_flip_buffer_push(struct tty_port *port)
+ {
+- struct tty_bufhead *buf = &port->buf;
+-
+- buf->tail->commit = buf->tail->used;
+-
+- if (port->low_latency)
+- flush_to_ldisc(&buf->work);
+- else
+- schedule_work(&buf->work);
++ tty_schedule_flip(port);
+ }
+ EXPORT_SYMBOL(tty_flip_buffer_push);
+
+--- a/drivers/usb/gadget/u_serial.c
++++ b/drivers/usb/gadget/u_serial.c
+@@ -549,8 +549,8 @@ static void gs_rx_push(unsigned long _po
+ port->read_started--;
+ }
+
+- /* Push from tty to ldisc; without low_latency set this is handled by
+- * a workqueue, so we won't get callbacks and can hold port_lock
++ /* Push from tty to ldisc; this is handled by a workqueue,
++ * so we won't get callbacks and can hold port_lock
+ */
+ if (do_push)
+ tty_flip_buffer_push(&port->port);
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -208,7 +208,7 @@ struct tty_port {
+ wait_queue_head_t delta_msr_wait; /* Modem status change */
+ unsigned long flags; /* TTY flags ASY_*/
+ unsigned char console:1, /* port is a console */
+- low_latency:1; /* direct buffer flush */
++ low_latency:1; /* optional: tune for latency */
+ struct mutex mutex; /* Locking */
+ struct mutex buf_mutex; /* Buffer alloc lock */
+ unsigned char *xmit_buf; /* Optional buffer */
--- /dev/null
+From 723abd87f6e536f1353c8f64f621520bc29523a3 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Thu, 27 Feb 2014 12:30:51 +0100
+Subject: tty: Set correct tty name in 'active' sysfs attribute
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 723abd87f6e536f1353c8f64f621520bc29523a3 upstream.
+
+The 'active' sysfs attribute should refer to the currently active tty
+devices the console is running on, not the currently active console. The
+console structure doesn't refer to any device in sysfs, only the tty the
+console is running on has. So we need to print out the tty names in
+'active', not the console names.
+
+There is one special-case, which is tty0. If the console is directed to
+it, we want 'tty0' to show up in the file, so user-space knows that the
+messages get forwarded to the active VT. The ->device() callback would
+resolve tty0, though. Hence, treat it special and don't call into the VT
+layer to resolve it (plymouth is known to depend on it).
+
+Cc: Lennart Poettering <lennart@poettering.net>
+Cc: Kay Sievers <kay@vrfy.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Werner Fink <werner@suse.de>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_io.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1271,12 +1271,13 @@ static void pty_line_name(struct tty_dri
+ *
+ * Locking: None
+ */
+-static void tty_line_name(struct tty_driver *driver, int index, char *p)
++static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
+ {
+ if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
+- strcpy(p, driver->name);
++ return sprintf(p, "%s", driver->name);
+ else
+- sprintf(p, "%s%d", driver->name, index + driver->name_base);
++ return sprintf(p, "%s%d", driver->name,
++ index + driver->name_base);
+ }
+
+ /**
+@@ -3545,9 +3546,19 @@ static ssize_t show_cons_active(struct d
+ if (i >= ARRAY_SIZE(cs))
+ break;
+ }
+- while (i--)
+- count += sprintf(buf + count, "%s%d%c",
+- cs[i]->name, cs[i]->index, i ? ' ':'\n');
++ while (i--) {
++ int index = cs[i]->index;
++ struct tty_driver *drv = cs[i]->device(cs[i], &index);
++
++ /* don't resolve tty0 as some programs depend on it */
++ if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
++ count += tty_line_name(drv, index, buf + count);
++ else
++ count += sprintf(buf + count, "%s%d",
++ cs[i]->name, cs[i]->index);
++
++ count += sprintf(buf + count, "%c", i ? ' ':'\n');
++ }
+ console_unlock();
+
+ return count;
--- /dev/null
+From 6f8a1b335fde143b7407036e2368d3cd6eb55674 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Wed, 12 Mar 2014 14:44:33 -0400
+Subject: x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit 6f8a1b335fde143b7407036e2368d3cd6eb55674 upstream.
+
+Commit 03bbcb2e7e2 (iommu/vt-d: add quirk for broken interrupt
+remapping on 55XX chipsets) properly disables irq remapping on the
+5500/5520 chipsets that don't correctly perform that feature.
+
+However, when I wrote it, I followed the errata sheet linked in that
+commit too closely, and explicitly tied the activation of the quirk to
+revision 0x13 of the chip, under the assumption that earlier revisions
+were not in the field. Recently a system was reported to be suffering
+from this remap bug and the quirk hadn't triggered, because the
+revision id register read at a lower value that 0x13, so the quirk
+test failed improperly. Given this, it seems only prudent to adjust
+this quirk so that any revision less than 0x13 has the quirk asserted.
+
+[ tglx: Removed the 0x12 comparison of pci id 3405 as this is covered
+ by the <= 0x13 check already ]
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: x86@kernel.org
+Link: http://lkml.kernel.org/r/1394649873-14913-1-git-send-email-nhorman@tuxdriver.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/early-quirks.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -203,18 +203,15 @@ static void __init intel_remapping_check
+ revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
+
+ /*
+- * Revision 13 of all triggering devices id in this quirk have
+- * a problem draining interrupts when irq remapping is enabled,
+- * and should be flagged as broken. Additionally revisions 0x12
+- * and 0x22 of device id 0x3405 has this problem.
++ * Revision <= 13 of all triggering devices id in this quirk
++ * have a problem draining interrupts when irq remapping is
++ * enabled, and should be flagged as broken. Additionally
++ * revision 0x22 of device id 0x3405 has this problem.
+ */
+- if (revision == 0x13)
++ if (revision <= 0x13)
+ set_irq_remapping_broken();
+- else if ((device == 0x3405) &&
+- ((revision == 0x12) ||
+- (revision == 0x22)))
++ else if (device == 0x3405 && revision == 0x22)
+ set_irq_remapping_broken();
+-
+ }
+
+ /*
--- /dev/null
+From ca3ba2a2f4a49a308e7d78c784d51b2332064f15 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 28 Feb 2014 11:30:29 +0800
+Subject: x86, hyperv: Bypass the timer_irq_works() check
+
+From: Jason Wang <jasowang@redhat.com>
+
+commit ca3ba2a2f4a49a308e7d78c784d51b2332064f15 upstream.
+
+This patch bypass the timer_irq_works() check for hyperv guest since:
+
+- It was guaranteed to work.
+- timer_irq_works() may fail sometime due to the lpj calibration were inaccurate
+ in a hyperv guest or a buggy host.
+
+In the future, we should get the tsc frequency from hypervisor and use preset
+lpj instead.
+
+[ hpa: I would prefer to not defer things to "the future" in the future... ]
+
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Acked-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Link: http://lkml.kernel.org/r/1393558229-14755-1-git-send-email-jasowang@redhat.com
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/mshyperv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -26,6 +26,7 @@
+ #include <asm/irq_regs.h>
+ #include <asm/i8259.h>
+ #include <asm/apic.h>
++#include <asm/timer.h>
+
+ struct ms_hyperv_info ms_hyperv;
+ EXPORT_SYMBOL_GPL(ms_hyperv);
+@@ -105,6 +106,11 @@ static void __init ms_hyperv_init_platfo
+
+ if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
+ clocksource_register_hz(&hyperv_cs, NSEC_PER_SEC/100);
++
++#ifdef CONFIG_X86_IO_APIC
++ no_timer_check = 1;
++#endif
++
+ }
+
+ const __refconst struct hypervisor_x86 x86_hyper_ms_hyperv = {
--- /dev/null
+From c88547a8119e3b581318ab65e9b72f27f23e641d Mon Sep 17 00:00:00 2001
+From: Mark Tinguely <tinguely@sgi.com>
+Date: Fri, 4 Apr 2014 07:10:49 +1100
+Subject: xfs: fix directory hash ordering bug
+
+From: Mark Tinguely <tinguely@sgi.com>
+
+commit c88547a8119e3b581318ab65e9b72f27f23e641d upstream.
+
+Commit f5ea1100 ("xfs: add CRCs to dir2/da node blocks") introduced
+in 3.10 incorrectly converted the btree hash index array pointer in
+xfs_da3_fixhashpath(). It resulted in the the current hash always
+being compared against the first entry in the btree rather than the
+current block index into the btree block's hash entry array. As a
+result, it was comparing the wrong hashes, and so could misorder the
+entries in the btree.
+
+For most cases, this doesn't cause any problems as it requires hash
+collisions to expose the ordering problem. However, when there are
+hash collisions within a directory there is a very good probability
+that the entries will be ordered incorrectly and that actually
+matters when duplicate hashes are placed into or removed from the
+btree block hash entry array.
+
+This bug results in an on-disk directory corruption and that results
+in directory verifier functions throwing corruption warnings into
+the logs. While no data or directory entries are lost, access to
+them may be compromised, and attempts to remove entries from a
+directory that has suffered from this corruption may result in a
+filesystem shutdown. xfs_repair will fix the directory hash
+ordering without data loss occuring.
+
+[dchinner: wrote useful a commit message]
+
+Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: Mark Tinguely <tinguely@sgi.com>
+Reviewed-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_da_btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_da_btree.c
++++ b/fs/xfs/xfs_da_btree.c
+@@ -1295,7 +1295,7 @@ xfs_da3_fixhashpath(
+ node = blk->bp->b_addr;
+ dp->d_ops->node_hdr_from_disk(&nodehdr, node);
+ btree = dp->d_ops->node_tree_p(node);
+- if (be32_to_cpu(btree->hashval) == lasthash)
++ if (be32_to_cpu(btree[blk->index].hashval) == lasthash)
+ break;
+ blk->hashval = lasthash;
+ btree[blk->index].hashval = cpu_to_be32(lasthash);
projects / thirdparty / kernel / stable-queue.git / commitdiff
