--- /dev/null
+From 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Mon, 16 Dec 2013 07:04:59 +0530
+Subject: ath9k: Fix interrupt handling for the AR9002 family
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 upstream.
+
+This patch adds a driver workaround for a HW issue.
+
+A race condition in the HW results in missing interrupts,
+which can be avoided by a read/write with the ISR register.
+All chips in the AR9002 series are affected by this bug - AR9003
+and above do not have this problem.
+
+Cc: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++++++++++++++++++++-----
+ 1 file changed, 43 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath
+ mask2 |= ATH9K_INT_CST;
+ if (isr2 & AR_ISR_S2_TSFOOR)
+ mask2 |= ATH9K_INT_TSFOOR;
++
++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++ REG_WRITE(ah, AR_ISR_S2, isr2);
++ isr &= ~AR_ISR_BCNMISC;
++ }
+ }
+
+- isr = REG_READ(ah, AR_ISR_RAC);
++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
++ isr = REG_READ(ah, AR_ISR_RAC);
++
+ if (isr == 0xffffffff) {
+ *masked = 0;
+ return false;
+@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath
+
+ *masked |= ATH9K_INT_TX;
+
+- s0_s = REG_READ(ah, AR_ISR_S0_S);
++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
++ s0_s = REG_READ(ah, AR_ISR_S0_S);
++ s1_s = REG_READ(ah, AR_ISR_S1_S);
++ } else {
++ s0_s = REG_READ(ah, AR_ISR_S0);
++ REG_WRITE(ah, AR_ISR_S0, s0_s);
++ s1_s = REG_READ(ah, AR_ISR_S1);
++ REG_WRITE(ah, AR_ISR_S1, s1_s);
++
++ isr &= ~(AR_ISR_TXOK |
++ AR_ISR_TXDESC |
++ AR_ISR_TXERR |
++ AR_ISR_TXEOL);
++ }
++
+ ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
+ ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
+-
+- s1_s = REG_READ(ah, AR_ISR_S1_S);
+ ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
+ ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
+ }
+@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath
+ *masked |= mask2;
+ }
+
+- if (AR_SREV_9100(ah))
+- return true;
+-
+- if (isr & AR_ISR_GENTMR) {
++ if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
+ u32 s5_s;
+
+- s5_s = REG_READ(ah, AR_ISR_S5_S);
++ if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
++ s5_s = REG_READ(ah, AR_ISR_S5_S);
++ } else {
++ s5_s = REG_READ(ah, AR_ISR_S5);
++ }
++
+ ah->intr_gen_timer_trigger =
+ MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
+
+@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath
+ if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
+ !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+ *masked |= ATH9K_INT_TIM_TIMER;
++
++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++ REG_WRITE(ah, AR_ISR_S5, s5_s);
++ isr &= ~AR_ISR_GENTMR;
++ }
++ }
++
++ if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
++ REG_WRITE(ah, AR_ISR, isr);
++ REG_READ(ah, AR_ISR);
+ }
+
++ if (AR_SREV_9100(ah))
++ return true;
++
+ if (sync_cause) {
+ ath9k_debug_sync_cause(common, sync_cause);
+ fatal_int =
--- /dev/null
+From 657eb17d87852c42b55c4b06d5425baa08b2ddb3 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <vanhoefm@gmail.com>
+Date: Thu, 28 Nov 2013 12:21:45 +0100
+Subject: ath9k_htc: properly set MAC address and BSSID mask
+
+From: Mathy Vanhoef <vanhoefm@gmail.com>
+
+commit 657eb17d87852c42b55c4b06d5425baa08b2ddb3 upstream.
+
+Pick the MAC address of the first virtual interface as the new hardware MAC
+address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579.
+
+Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 +++++++++++++++++--------
+ drivers/net/wireless/ath/ath9k/main.c | 5 +++--
+ 2 files changed, 20 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -145,21 +145,26 @@ static void ath9k_htc_bssid_iter(void *d
+ struct ath9k_vif_iter_data *iter_data = data;
+ int i;
+
+- for (i = 0; i < ETH_ALEN; i++)
+- iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
++ if (iter_data->hw_macaddr != NULL) {
++ for (i = 0; i < ETH_ALEN; i++)
++ iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
++ } else {
++ iter_data->hw_macaddr = mac;
++ }
+ }
+
+-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
++static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
+ struct ieee80211_vif *vif)
+ {
+ struct ath_common *common = ath9k_hw_common(priv->ah);
+ struct ath9k_vif_iter_data iter_data;
+
+ /*
+- * Use the hardware MAC address as reference, the hardware uses it
+- * together with the BSSID mask when matching addresses.
++ * Pick the MAC address of the first interface as the new hardware
++ * MAC address. The hardware will use it together with the BSSID mask
++ * when matching addresses.
+ */
+- iter_data.hw_macaddr = common->macaddr;
++ iter_data.hw_macaddr = NULL;
+ memset(&iter_data.mask, 0xff, ETH_ALEN);
+
+ if (vif)
+@@ -171,6 +176,10 @@ static void ath9k_htc_set_bssid_mask(str
+ ath9k_htc_bssid_iter, &iter_data);
+
+ memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
++
++ if (iter_data.hw_macaddr)
++ memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
++
+ ath_hw_setbssidmask(common);
+ }
+
+@@ -1076,7 +1085,7 @@ static int ath9k_htc_add_interface(struc
+ goto out;
+ }
+
+- ath9k_htc_set_bssid_mask(priv, vif);
++ ath9k_htc_set_mac_bssid_mask(priv, vif);
+
+ priv->vif_slot |= (1 << avp->index);
+ priv->nvifs++;
+@@ -1139,7 +1148,7 @@ static void ath9k_htc_remove_interface(s
+
+ ath9k_htc_set_opmode(priv);
+
+- ath9k_htc_set_bssid_mask(priv, vif);
++ ath9k_htc_set_mac_bssid_mask(priv, vif);
+
+ /*
+ * Stop ANI only if there are no associated station interfaces.
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -889,8 +889,9 @@ void ath9k_calculate_iter_data(struct ie
+ struct ath_common *common = ath9k_hw_common(ah);
+
+ /*
+- * Use the hardware MAC address as reference, the hardware uses it
+- * together with the BSSID mask when matching addresses.
++ * Pick the MAC address of the first interface as the new hardware
++ * MAC address. The hardware will use it together with the BSSID mask
++ * when matching addresses.
+ */
+ memset(iter_data, 0, sizeof(*iter_data));
+ memset(&iter_data->mask, 0xff, ETH_ALEN);
--- /dev/null
+From f60900f2609e893c7f8d0bccc7ada4947dac4cd5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon, 23 Dec 2013 18:49:30 +0100
+Subject: auxvec.h: account for AT_HWCAP2 in AT_VECTOR_SIZE_BASE
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit f60900f2609e893c7f8d0bccc7ada4947dac4cd5 upstream.
+
+Commit 2171364d1a92 ("powerpc: Add HWCAP2 aux entry") introduced a new
+AT_ auxv entry type AT_HWCAP2 but failed to update AT_VECTOR_SIZE_BASE
+accordingly.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Fixes: 2171364d1a92 (powerpc: Add HWCAP2 aux entry)
+Acked-by: Michael Neuling <michael@neuling.org>
+Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/auxvec.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/auxvec.h
++++ b/include/linux/auxvec.h
+@@ -3,6 +3,6 @@
+
+ #include <uapi/linux/auxvec.h>
+
+-#define AT_VECTOR_SIZE_BASE 19 /* NEW_AUX_ENT entries in auxiliary table */
++#define AT_VECTOR_SIZE_BASE 20 /* NEW_AUX_ENT entries in auxiliary table */
+ /* number of "#define AT_.*" above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} */
+ #endif /* _LINUX_AUXVEC_H */
--- /dev/null
+From 56f91aad69444d650237295f68c195b74d888d95 Mon Sep 17 00:00:00 2001
+From: Li Wang <liwang@ubuntukylin.com>
+Date: Wed, 13 Nov 2013 15:22:14 +0800
+Subject: ceph: Avoid data inconsistency due to d-cache aliasing in readpage()
+
+From: Li Wang <liwang@ubuntukylin.com>
+
+commit 56f91aad69444d650237295f68c195b74d888d95 upstream.
+
+If the length of data to be read in readpage() is exactly
+PAGE_CACHE_SIZE, the original code does not flush d-cache
+for data consistency after finishing reading. This patches fixes
+this.
+
+Signed-off-by: Li Wang <liwang@ubuntukylin.com>
+Signed-off-by: Sage Weil <sage@inktank.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/addr.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -213,9 +213,13 @@ static int readpage_nounlock(struct file
+ if (err < 0) {
+ SetPageError(page);
+ goto out;
+- } else if (err < PAGE_CACHE_SIZE) {
++ } else {
++ if (err < PAGE_CACHE_SIZE) {
+ /* zero fill remainder of page */
+- zero_user_segment(page, err, PAGE_CACHE_SIZE);
++ zero_user_segment(page, err, PAGE_CACHE_SIZE);
++ } else {
++ flush_dcache_page(page);
++ }
+ }
+ SetPageUptodate(page);
+
--- /dev/null
+From f447ef4a56dee4b68a91460bcdfe06b5011085f2 Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Fri, 11 Oct 2013 08:45:51 -0400
+Subject: cpupower: Fix segfault due to incorrect getopt_long arugments
+
+From: Josh Boyer <jwboyer@redhat.com>
+
+commit f447ef4a56dee4b68a91460bcdfe06b5011085f2 upstream.
+
+If a user calls 'cpupower set --perf-bias 15', the process will end with
+a SIGSEGV in libc because cpupower-set passes a NULL optarg to the atoi
+call. This is because the getopt_long structure currently has all of
+the options as having an optional_argument when they really have a
+required argument. We change the structure to use required_argument to
+match the short options and it resolves the issue.
+
+This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1000439
+
+Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Cc: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/power/cpupower/utils/cpupower-set.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/tools/power/cpupower/utils/cpupower-set.c
++++ b/tools/power/cpupower/utils/cpupower-set.c
+@@ -18,9 +18,9 @@
+ #include "helpers/bitmask.h"
+
+ static struct option set_opts[] = {
+- { .name = "perf-bias", .has_arg = optional_argument, .flag = NULL, .val = 'b'},
+- { .name = "sched-mc", .has_arg = optional_argument, .flag = NULL, .val = 'm'},
+- { .name = "sched-smt", .has_arg = optional_argument, .flag = NULL, .val = 's'},
++ { .name = "perf-bias", .has_arg = required_argument, .flag = NULL, .val = 'b'},
++ { .name = "sched-mc", .has_arg = required_argument, .flag = NULL, .val = 'm'},
++ { .name = "sched-smt", .has_arg = required_argument, .flag = NULL, .val = 's'},
+ { },
+ };
+
--- /dev/null
+From 407900cfb54bdb2cfa228010b6697305f66b2948 Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <peter@korsgaard.com>
+Date: Mon, 16 Dec 2013 11:35:33 +0100
+Subject: dm9601: fix reception of full size ethernet frames on dm9620/dm9621a
+
+From: Peter Korsgaard <peter@korsgaard.com>
+
+commit 407900cfb54bdb2cfa228010b6697305f66b2948 upstream.
+
+dm9620/dm9621a require room for 4 byte padding even in dm9601 (3 byte
+header) mode.
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/dm9601.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *de
+ dev->net->ethtool_ops = &dm9601_ethtool_ops;
+ dev->net->hard_header_len += DM_TX_OVERHEAD;
+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+- dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
++
++ /* dm9620/21a require room for 4 byte padding, even in dm9601
++ * mode, so we need +1 to be able to receive full size
++ * ethernet frames.
++ */
++ dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
+
+ dev->mii.dev = dev->net;
+ dev->mii.mdio_read = dm9601_mdio_read;
--- /dev/null
+From 4263c86dca5198da6bd3ad826d0b2304fbe25776 Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <peter@korsgaard.com>
+Date: Mon, 16 Dec 2013 11:35:35 +0100
+Subject: dm9601: work around tx fifo sync issue on dm962x
+
+From: Peter Korsgaard <peter@korsgaard.com>
+
+commit 4263c86dca5198da6bd3ad826d0b2304fbe25776 upstream.
+
+Certain dm962x revisions contain an bug, where if a USB bulk transfer retry
+(E.G. if bulk crc mismatch) happens right after a transfer with odd or
+maxpacket length, the internal tx hardware fifo gets out of sync causing
+the interface to stop working.
+
+Work around it by adding up to 3 bytes of padding to ensure this situation
+cannot trigger.
+
+This workaround also means we never pass multiple-of-maxpacket size skb's
+to usbnet, so the length adjustment to handle usbnet's padding of those can
+be removed.
+
+Reported-by: Joseph Chang <joseph_chang@davicom.com.tw>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/dm9601.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -473,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet
+ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ gfp_t flags)
+ {
+- int len;
++ int len, pad;
+
+ /* format:
+ b1: packet length low
+@@ -481,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(s
+ b3..n: packet data
+ */
+
+- len = skb->len;
++ len = skb->len + DM_TX_OVERHEAD;
+
+- if (skb_headroom(skb) < DM_TX_OVERHEAD) {
++ /* workaround for dm962x errata with tx fifo getting out of
++ * sync if a USB bulk transfer retry happens right after a
++ * packet with odd / maxpacket length by adding up to 3 bytes
++ * padding.
++ */
++ while ((len & 1) || !(len % dev->maxpacket))
++ len++;
++
++ len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
++ pad = len - skb->len;
++
++ if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
+ struct sk_buff *skb2;
+
+- skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
++ skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
+ dev_kfree_skb_any(skb);
+ skb = skb2;
+ if (!skb)
+@@ -495,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(s
+
+ __skb_push(skb, DM_TX_OVERHEAD);
+
+- /* usbnet adds padding if length is a multiple of packet size
+- if so, adjust length value in header */
+- if ((skb->len % dev->maxpacket) == 0)
+- len++;
++ if (pad) {
++ memset(skb->data + skb->len, 0, pad);
++ __skb_put(skb, pad);
++ }
+
+ skb->data[0] = len;
+ skb->data[1] = len >> 8;
--- /dev/null
+From e66d2ae7c67bd9ac982a3d1890564de7f7eabf4b Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Sun, 29 Dec 2013 02:29:30 +0100
+Subject: KVM: x86: Fix APIC map calculation after re-enabling
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+commit e66d2ae7c67bd9ac982a3d1890564de7f7eabf4b upstream.
+
+Update arch.apic_base before triggering recalculate_apic_map. Otherwise
+the recalculation will work against the previous state of the APIC and
+will fail to build the correct map when an APIC is hardware-enabled
+again.
+
+This fixes a regression of 1e08ec4a13.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/lapic.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1364,6 +1364,10 @@ void kvm_lapic_set_base(struct kvm_vcpu
+ return;
+ }
+
++ if (!kvm_vcpu_is_bsp(apic->vcpu))
++ value &= ~MSR_IA32_APICBASE_BSP;
++ vcpu->arch.apic_base = value;
++
+ /* update jump label if enable bit changes */
+ if ((vcpu->arch.apic_base ^ value) & MSR_IA32_APICBASE_ENABLE) {
+ if (value & MSR_IA32_APICBASE_ENABLE)
+@@ -1373,10 +1377,6 @@ void kvm_lapic_set_base(struct kvm_vcpu
+ recalculate_apic_map(vcpu->kvm);
+ }
+
+- if (!kvm_vcpu_is_bsp(apic->vcpu))
+- value &= ~MSR_IA32_APICBASE_BSP;
+-
+- vcpu->arch.apic_base = value;
+ if ((old_value ^ value) & X2APIC_ENABLE) {
+ if (value & X2APIC_ENABLE) {
+ u32 id = kvm_apic_id(apic);
--- /dev/null
+From 286e4f90a72c0b0621dde0294af6ed4b0baddabb Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Mon, 23 Dec 2013 12:19:51 +1100
+Subject: powerpc: Align p_end
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 286e4f90a72c0b0621dde0294af6ed4b0baddabb upstream.
+
+p_end is an 8 byte value embedded in the text section. This means it
+is only 4 byte aligned when it should be 8 byte aligned. Fix this
+by adding an explicit alignment.
+
+This fixes an issue where POWER7 little endian builds with
+CONFIG_RELOCATABLE=y fail to boot.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/head_64.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -467,6 +467,7 @@ _STATIC(__after_prom_start)
+ mtctr r8
+ bctr
+
++.balign 8
+ p_end: .llong _end - _stext
+
+ 4: /* Now copy the rest of the kernel up to _end */
--- /dev/null
+From 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Mon, 16 Dec 2013 15:12:43 +1100
+Subject: powerpc: Fix bad stack check in exception entry
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 upstream.
+
+In EXCEPTION_PROLOG_COMMON() we check to see if the stack pointer (r1)
+is valid when coming from the kernel. If it's not valid, we die but
+with a nice oops message.
+
+Currently we allocate a stack frame (subtract INT_FRAME_SIZE) before we
+check to see if the stack pointer is negative. Unfortunately, this
+won't detect a bad stack where r1 is less than INT_FRAME_SIZE.
+
+This patch fixes the check to compare the modified r1 with
+-INT_FRAME_SIZE. With this, bad kernel stack pointers (including NULL
+pointers) are correctly detected again.
+
+Kudos to Paulus for finding this.
+
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/exception-64s.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -264,7 +264,7 @@ do_kvm_##n: \
+ subi r1,r1,INT_FRAME_SIZE; /* alloc frame on kernel stack */ \
+ beq- 1f; \
+ ld r1,PACAKSAVE(r13); /* kernel stack to use */ \
+-1: cmpdi cr1,r1,0; /* check if r1 is in userspace */ \
++1: cmpdi cr1,r1,-INT_FRAME_SIZE; /* check if r1 is in userspace */ \
+ blt+ cr1,3f; /* abort if it is */ \
+ li r1,(n); /* will be reloaded later */ \
+ sth r1,PACA_TRAP_SAVE(r13); \
drm-i915-use-the-correct-gmch_ctrl-register-for-sandybridge.patch
drm-radeon-fix-uvd-256mb-check.patch
drm-radeon-0x9649-is-sumo2-not-sumo.patch
+ceph-avoid-data-inconsistency-due-to-d-cache-aliasing-in-readpage.patch
+tg3-expand-4g_overflow_test-workaround-to-skb-fragments-of-any-size.patch
+auxvec.h-account-for-at_hwcap2-in-at_vector_size_base.patch
+dm9601-fix-reception-of-full-size-ethernet-frames-on-dm9620-dm9621a.patch
+dm9601-work-around-tx-fifo-sync-issue-on-dm962x.patch
+ath9k-fix-interrupt-handling-for-the-ar9002-family.patch
+ath9k_htc-properly-set-mac-address-and-bssid-mask.patch
+kvm-x86-fix-apic-map-calculation-after-re-enabling.patch
+powerpc-fix-bad-stack-check-in-exception-entry.patch
+powerpc-align-p_end.patch
+cpupower-fix-segfault-due-to-incorrect-getopt_long-arugments.patch
--- /dev/null
+From 375679104ab3ccfd18dcbd7ba503734fb9a2c63a Mon Sep 17 00:00:00 2001
+From: Nithin Sujir <nsujir@broadcom.com>
+Date: Thu, 19 Dec 2013 17:44:11 -0800
+Subject: tg3: Expand 4g_overflow_test workaround to skb fragments of any size.
+
+From: Nithin Sujir <nsujir@broadcom.com>
+
+commit 375679104ab3ccfd18dcbd7ba503734fb9a2c63a upstream.
+
+The current driver assumes that an skb fragment can only be upto jumbo
+size. Presumably this was a fast-path optimization. This assumption is
+no longer true as fragments can be upto 32k.
+
+v2: Remove unnecessary parantheses per Eric Dumazet.
+
+Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
+Signed-off-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/tg3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -7482,7 +7482,7 @@ static inline int tg3_4g_overflow_test(d
+ {
+ u32 base = (u32) mapping & 0xffffffff;
+
+- return (base > 0xffffdcc0) && (base + len + 8 < base);
++ return base + len + 8 < base;
+ }
+
+ /* Test for TSO DMA buffers that cross into regions which are within MSS bytes
projects / thirdparty / kernel / stable-queue.git / commitdiff
