--- /dev/null
+From ac124504ecf6b20a2457d873d0728a8b991a5b0c Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Wed, 14 Aug 2013 22:36:32 +0100
+Subject: ARM: 7816/1: CONFIG_KUSER_HELPERS: fix help text
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit ac124504ecf6b20a2457d873d0728a8b991a5b0c upstream.
+
+Commit f6f91b0d9fd9 ("ARM: allow kuser helpers to be removed from the
+vector page") introduced some help text for the CONFIG_KUSER_HELPERS
+option which is rather contradictory.
+
+Let's fix that, and improve it a little.
+
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/Kconfig | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -789,15 +789,18 @@ config KUSER_HELPERS
+ the CPU type fitted to the system. This permits binaries to be
+ run on ARMv4 through to ARMv7 without modification.
+
++ See Documentation/arm/kernel_user_helpers.txt for details.
++
+ However, the fixed address nature of these helpers can be used
+ by ROP (return orientated programming) authors when creating
+ exploits.
+
+ If all of the binaries and libraries which run on your platform
+ are built specifically for your platform, and make no use of
+- these helpers, then you can turn this option off. However,
+- when such an binary or library is run, it will receive a SIGILL
+- signal, which will terminate the program.
++ these helpers, then you can turn this option off to hinder
++ such exploits. However, in that case, if a binary or library
++ relying on those helpers is run, it will receive a SIGILL signal,
++ which will terminate the program.
+
+ Say N here only if you are absolutely certain that you do not
+ need these helpers; otherwise, the safe option is to say Y.
--- /dev/null
+From a57603ca2871ee0773b00839c1ea35c4a2d3eeb0 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Fri, 28 Jun 2013 10:39:15 +0200
+Subject: ARM: at91/DT: fix at91sam9n12ek memory node
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit a57603ca2871ee0773b00839c1ea35c4a2d3eeb0 upstream.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9n12ek.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/at91sam9n12ek.dts
++++ b/arch/arm/boot/dts/at91sam9n12ek.dts
+@@ -14,11 +14,11 @@
+ compatible = "atmel,at91sam9n12ek", "atmel,at91sam9n12", "atmel,at91sam9";
+
+ chosen {
+- bootargs = "mem=128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
++ bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
+ };
+
+ memory {
+- reg = <0x20000000 0x10000000>;
++ reg = <0x20000000 0x8000000>;
+ };
+
+ clocks {
--- /dev/null
+From acd36357edc08649e85ff15dc4ed62353c912eff Mon Sep 17 00:00:00 2001
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Fri, 16 Aug 2013 14:43:48 +0530
+Subject: ARM: davinci: nand: specify ecc strength
+
+From: Sekhar Nori <nsekhar@ti.com>
+
+commit acd36357edc08649e85ff15dc4ed62353c912eff upstream.
+
+Starting with kernel v3.5, it is mandatory
+to specify ECC strength when using hardware
+ECC. Without this, kernel panics with a warning
+of the sort:
+
+Driver must set ecc.strength when using hardware ECC
+------------[ cut here ]------------
+kernel BUG at drivers/mtd/nand/nand_base.c:3519!
+
+Fix this by specifying ECC strength for the boards
+which were missing this.
+
+Reported-by: Holger Freyther <holger@freyther.de>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-davinci/board-dm355-leopard.c | 1 +
+ arch/arm/mach-davinci/board-dm644x-evm.c | 1 +
+ arch/arm/mach-davinci/board-dm646x-evm.c | 1 +
+ arch/arm/mach-davinci/board-neuros-osd2.c | 1 +
+ 4 files changed, 4 insertions(+)
+
+--- a/arch/arm/mach-davinci/board-dm355-leopard.c
++++ b/arch/arm/mach-davinci/board-dm355-leopard.c
+@@ -75,6 +75,7 @@ static struct davinci_nand_pdata davinci
+ .parts = davinci_nand_partitions,
+ .nr_parts = ARRAY_SIZE(davinci_nand_partitions),
+ .ecc_mode = NAND_ECC_HW_SYNDROME,
++ .ecc_bits = 4,
+ .bbt_options = NAND_BBT_USE_FLASH,
+ };
+
+--- a/arch/arm/mach-davinci/board-dm644x-evm.c
++++ b/arch/arm/mach-davinci/board-dm644x-evm.c
+@@ -153,6 +153,7 @@ static struct davinci_nand_pdata davinci
+ .parts = davinci_evm_nandflash_partition,
+ .nr_parts = ARRAY_SIZE(davinci_evm_nandflash_partition),
+ .ecc_mode = NAND_ECC_HW,
++ .ecc_bits = 1,
+ .bbt_options = NAND_BBT_USE_FLASH,
+ .timing = &davinci_evm_nandflash_timing,
+ };
+--- a/arch/arm/mach-davinci/board-dm646x-evm.c
++++ b/arch/arm/mach-davinci/board-dm646x-evm.c
+@@ -90,6 +90,7 @@ static struct davinci_nand_pdata davinci
+ .parts = davinci_nand_partitions,
+ .nr_parts = ARRAY_SIZE(davinci_nand_partitions),
+ .ecc_mode = NAND_ECC_HW,
++ .ecc_bits = 1,
+ .options = 0,
+ };
+
+--- a/arch/arm/mach-davinci/board-neuros-osd2.c
++++ b/arch/arm/mach-davinci/board-neuros-osd2.c
+@@ -88,6 +88,7 @@ static struct davinci_nand_pdata davinci
+ .parts = davinci_ntosd2_nandflash_partition,
+ .nr_parts = ARRAY_SIZE(davinci_ntosd2_nandflash_partition),
+ .ecc_mode = NAND_ECC_HW,
++ .ecc_bits = 1,
+ .bbt_options = NAND_BBT_USE_FLASH,
+ };
+
--- /dev/null
+From 868f6fea8fa63f09acbfa93256d0d2abdcabff79 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 20 Aug 2013 11:47:39 +0100
+Subject: arm64: perf: fix array out of bounds access in armpmu_map_hw_event()
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 868f6fea8fa63f09acbfa93256d0d2abdcabff79 upstream.
+
+This is a port of d9f966357b14 ("ARM: 7810/1: perf: Fix array out of
+bounds access in armpmu_map_hw_event()") to arm64, which fixes an oops
+in the arm64 perf backend found as a result of Vince's fuzzing tool.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/perf_event.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (*
+ static int
+ armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
+ {
+- int mapping = (*event_map)[config];
++ int mapping;
++
++ if (config >= PERF_COUNT_HW_MAX)
++ return -EINVAL;
++
++ mapping = (*event_map)[config];
+ return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
+ }
+
--- /dev/null
+From ee7538a008a45050c8f706d38b600f55953169f9 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 20 Aug 2013 11:47:40 +0100
+Subject: arm64: perf: fix event validation for software group leaders
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit ee7538a008a45050c8f706d38b600f55953169f9 upstream.
+
+This is a port of c95eb3184ea1 ("ARM: 7809/1: perf: fix event validation
+for software group leaders") to arm64, which fixes a panic in the arm64
+perf backend found as a result of Vince's fuzzing tool.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/perf_event.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -322,6 +322,9 @@ validate_event(struct pmu_hw_events *hw_
+ struct hw_perf_event fake_event = event->hw;
+ struct pmu *leader_pmu = event->group_leader->pmu;
+
++ if (is_software_event(event))
++ return 1;
++
+ if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
+ return 1;
+
--- /dev/null
+From 93dbc1b3b506e16c1f6d5b5dcfe756a85cb1dc58 Mon Sep 17 00:00:00 2001
+From: Daniel Drake <dsd@laptop.org>
+Date: Thu, 22 Aug 2013 16:35:43 -0700
+Subject: drivers/platform/olpc/olpc-ec.c: initialise earlier
+
+From: Daniel Drake <dsd@laptop.org>
+
+commit 93dbc1b3b506e16c1f6d5b5dcfe756a85cb1dc58 upstream.
+
+Being a low-level component, various drivers (e.g. olpc-battery) assume
+that it is ok to communicate with the OLPC Embedded Controller during
+probe. Therefore the OLPC EC driver must be initialised before other
+drivers try to use it. This was the case until it was recently moved
+out of arch/x86 and restructured around commits ac2504151f5a ("Platform:
+OLPC: turn EC driver into a platform_driver") and 85f90cf6ca56 ("x86:
+OLPC: switch over to using new EC driver on x86").
+
+Use arch_initcall so that olpc-ec is readied earlier, matching the
+previous behaviour.
+
+Fixes a regression introduced in Linux-3.6 where various drivers such as
+olpc-battery and olpc-xo1-sci failed to load due to an inability to
+communicate with the EC. The user-visible effect was a lack of battery
+monitoring, missing ebook/lid switch input devices, etc.
+
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Cc: Andres Salomon <dilinger@queued.net>
+Cc: Paul Fox <pgf@laptop.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/olpc/olpc-ec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/olpc/olpc-ec.c
++++ b/drivers/platform/olpc/olpc-ec.c
+@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(vo
+ return platform_driver_register(&olpc_ec_plat_driver);
+ }
+
+-module_init(olpc_ec_init_module);
++arch_initcall(olpc_ec_init_module);
+
+ MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
+ MODULE_LICENSE("GPL");
--- /dev/null
+From 884020bf3d2a3787a1cc6df902e98e0eec60330b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 6 Aug 2013 19:01:14 +0100
+Subject: drm/i915: Invalidate TLBs for the rings after a reset
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 884020bf3d2a3787a1cc6df902e98e0eec60330b upstream.
+
+After any "soft gfx reset" we must manually invalidate the TLBs
+associated with each ring. Empirically, it seems that a
+suspend/resume or D3-D0 cycle count as a "soft reset". The symptom is
+that the hardware would fail to note the new address for its status
+page, and so it would continue to write the shadow registers and
+breadcrumbs into the old physical address (now used by something
+completely different, scary). Whereas the driver would read the new
+status page and never see any progress, it would appear that the GPU
+hung immediately upon resume.
+
+Based on a patch by naresh kumar kachhi <naresh.kumar.kacchi@intel.com>
+
+Reported-by: Thiago Macieira <thiago@kde.org>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64725
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Tested-by: Thiago Macieira <thiago@kde.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 2 ++
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -617,6 +617,8 @@
+ will not assert AGPBUSY# and will only
+ be delivered when out of C3. */
+ #define INSTPM_FORCE_ORDERING (1<<7) /* GEN6+ */
++#define INSTPM_TLB_INVALIDATE (1<<9)
++#define INSTPM_SYNC_FLUSH (1<<5)
+ #define ACTHD 0x020c8
+ #define FW_BLC 0x020d8
+ #define FW_BLC2 0x020dc
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -907,6 +907,18 @@ void intel_ring_setup_status_page(struct
+
+ I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
+ POSTING_READ(mmio);
++
++ /* Flush the TLB for this page */
++ if (INTEL_INFO(dev)->gen >= 6) {
++ u32 reg = RING_INSTPM(ring->mmio_base);
++ I915_WRITE(reg,
++ _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
++ INSTPM_SYNC_FLUSH));
++ if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
++ 1000))
++ DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
++ ring->name);
++ }
+ }
+
+ static int
--- /dev/null
+From 112a6d0c071808f6d48354fc8834a574e5dcefc0 Mon Sep 17 00:00:00 2001
+From: Christian König <christian.koenig@amd.com>
+Date: Sun, 11 Aug 2013 21:27:56 +0200
+Subject: drm/radeon: fix UVD message buffer validation
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 112a6d0c071808f6d48354fc8834a574e5dcefc0 upstream.
+
+When the message buffer is currently moving block until it is idle again.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_uvd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -359,6 +359,14 @@ static int radeon_uvd_cs_msg(struct rade
+ return -EINVAL;
+ }
+
++ if (bo->tbo.sync_obj) {
++ r = radeon_fence_wait(bo->tbo.sync_obj, false);
++ if (r) {
++ DRM_ERROR("Failed waiting for UVD message (%d)!\n", r);
++ return r;
++ }
++ }
++
+ r = radeon_bo_kmap(bo, &ptr);
+ if (r)
+ return r;
--- /dev/null
+From d43a93c8d9bc4e0dc0293b6458c077c3c797594f Mon Sep 17 00:00:00 2001
+From: Rafał Miłecki <zajec5@gmail.com>
+Date: Thu, 15 Aug 2013 18:55:22 +0200
+Subject: drm/radeon: fix WREG32_OR macro setting bits in a register
+
+From: Rafał Miłecki <zajec5@gmail.com>
+
+commit d43a93c8d9bc4e0dc0293b6458c077c3c797594f upstream.
+
+This bug (introduced in 3.10) in WREG32_OR made
+commit d3418eacad403033e95e49dc14afa37c2112c134
+"drm/radeon/evergreen: setup HDMI before enabling it"
+cause a regression. Sometimes audio over HDMI wasn't working, sometimes
+display was corrupted.
+
+This fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=60687
+https://bugzilla.kernel.org/show_bug.cgi?id=60709
+https://bugs.freedesktop.org/show_bug.cgi?id=67767
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1764,7 +1764,7 @@ void r100_io_wreg(struct radeon_device *
+ WREG32(reg, tmp_); \
+ } while (0)
+ #define WREG32_AND(reg, and) WREG32_P(reg, 0, and)
+-#define WREG32_OR(reg, or) WREG32_P(reg, or, ~or)
++#define WREG32_OR(reg, or) WREG32_P(reg, or, ~(or))
+ #define WREG32_PLL_P(reg, val, mask) \
+ do { \
+ uint32_t tmp_ = RREG32_PLL(reg); \
--- /dev/null
+From 022374c02e357ac82e98dd2689fb2efe05723d69 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 13 Aug 2013 15:57:32 -0400
+Subject: drm/radeon/r7xx: fix copy paste typo in golden register setup
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 022374c02e357ac82e98dd2689fb2efe05723d69 upstream.
+
+Uses the wrong array size for some asics which can lead
+to garbage getting written to registers.
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=60674
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/rv770.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -744,10 +744,10 @@ static void rv770_init_golden_registers(
+ (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
+ radeon_program_register_sequence(rdev,
+ rv730_golden_registers,
+- (const u32)ARRAY_SIZE(rv770_golden_registers));
++ (const u32)ARRAY_SIZE(rv730_golden_registers));
+ radeon_program_register_sequence(rdev,
+ rv730_mgcg_init,
+- (const u32)ARRAY_SIZE(rv770_mgcg_init));
++ (const u32)ARRAY_SIZE(rv730_mgcg_init));
+ break;
+ case CHIP_RV710:
+ radeon_program_register_sequence(rdev,
+@@ -758,18 +758,18 @@ static void rv770_init_golden_registers(
+ (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
+ radeon_program_register_sequence(rdev,
+ rv710_golden_registers,
+- (const u32)ARRAY_SIZE(rv770_golden_registers));
++ (const u32)ARRAY_SIZE(rv710_golden_registers));
+ radeon_program_register_sequence(rdev,
+ rv710_mgcg_init,
+- (const u32)ARRAY_SIZE(rv770_mgcg_init));
++ (const u32)ARRAY_SIZE(rv710_mgcg_init));
+ break;
+ case CHIP_RV740:
+ radeon_program_register_sequence(rdev,
+ rv740_golden_registers,
+- (const u32)ARRAY_SIZE(rv770_golden_registers));
++ (const u32)ARRAY_SIZE(rv740_golden_registers));
+ radeon_program_register_sequence(rdev,
+ rv740_mgcg_init,
+- (const u32)ARRAY_SIZE(rv770_mgcg_init));
++ (const u32)ARRAY_SIZE(rv740_mgcg_init));
+ break;
+ default:
+ break;
--- /dev/null
+From 4bf93b50fd04118ac7f33a3c2b8a0a1f9fa80bc9 Mon Sep 17 00:00:00 2001
+From: Vyacheslav Dubeyko <slava@dubeyko.com>
+Date: Thu, 22 Aug 2013 16:35:45 -0700
+Subject: nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection
+
+From: Vyacheslav Dubeyko <slava@dubeyko.com>
+
+commit 4bf93b50fd04118ac7f33a3c2b8a0a1f9fa80bc9 upstream.
+
+Fix the issue with improper counting number of flying bio requests for
+BIO_EOPNOTSUPP error detection case.
+
+The sb_nbio must be incremented exactly the same number of times as
+complete() function was called (or will be called) because
+nilfs_segbuf_wait() will call wail_for_completion() for the number of
+times set to sb_nbio:
+
+ do {
+ wait_for_completion(&segbuf->sb_bio_event);
+ } while (--segbuf->sb_nbio > 0);
+
+Two functions complete() and wait_for_completion() must be called the
+same number of times for the same sb_bio_event. Otherwise,
+wait_for_completion() will hang or leak.
+
+Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/segbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nilfs2/segbuf.c
++++ b/fs/nilfs2/segbuf.c
+@@ -376,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struc
+ bio->bi_private = segbuf;
+ bio_get(bio);
+ submit_bio(mode, bio);
++ segbuf->sb_nbio++;
+ if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
+ bio_put(bio);
+ err = -EOPNOTSUPP;
+ goto failed;
+ }
+- segbuf->sb_nbio++;
+ bio_put(bio);
+
+ wi->bio = NULL;
--- /dev/null
+From 2df37a19c686c2d7c4e9b4ce1505b5141e3e5552 Mon Sep 17 00:00:00 2001
+From: Vyacheslav Dubeyko <slava@dubeyko.com>
+Date: Thu, 22 Aug 2013 16:35:44 -0700
+Subject: nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error
+
+From: Vyacheslav Dubeyko <slava@dubeyko.com>
+
+commit 2df37a19c686c2d7c4e9b4ce1505b5141e3e5552 upstream.
+
+Remove double call of bio_put() in nilfs_end_bio_write() for the case of
+BIO_EOPNOTSUPP error detection. The issue was found by Dan Carpenter
+and he suggests first version of the fix too.
+
+Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/segbuf.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/nilfs2/segbuf.c
++++ b/fs/nilfs2/segbuf.c
+@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct b
+
+ if (err == -EOPNOTSUPP) {
+ set_bit(BIO_EOPNOTSUPP, &bio->bi_flags);
+- bio_put(bio);
+- /* to be detected by submit_seg_bio() */
++ /* to be detected by nilfs_segbuf_submit_bio() */
+ }
+
+ if (!uptodate)
--- /dev/null
+From 9e40127526e857fa3f29d51e83277204fbdfc6ba Mon Sep 17 00:00:00 2001
+From: Wladislav Wiebe <wladislav.kw@gmail.com>
+Date: Mon, 12 Aug 2013 13:06:53 +0200
+Subject: of: fdt: fix memory initialization for expanded DT
+
+From: Wladislav Wiebe <wladislav.kw@gmail.com>
+
+commit 9e40127526e857fa3f29d51e83277204fbdfc6ba upstream.
+
+Already existing property flags are filled wrong for properties created from
+initial FDT. This could cause problems if this DYNAMIC device-tree functions
+are used later, i.e. properties are attached/detached/replaced. Simply dumping
+flags from the running system show, that some initial static (not allocated via
+kzmalloc()) nodes are marked as dynamic.
+
+I putted some debug extensions to property_proc_show(..) :
+..
++ if (OF_IS_DYNAMIC(pp))
++ pr_err("DEBUG: xxx : OF_IS_DYNAMIC\n");
++ if (OF_IS_DETACHED(pp))
++ pr_err("DEBUG: xxx : OF_IS_DETACHED\n");
+
+when you operate on the nodes (e.g.: ~$ cat /proc/device-tree/*some_node*) you
+will see that those flags are filled wrong, basically in most cases it will dump
+a DYNAMIC or DETACHED status, which is in not true.
+(BTW. this OF_IS_DETACHED is a own define for debug purposes which which just
+make a test_bit(OF_DETACHED, &x->_flags)
+
+If nodes are dynamic kernel is allowed to kfree() them. But it will crash
+attempting to do so on the nodes from FDT -- they are not allocated via
+kzmalloc().
+
+Signed-off-by: Wladislav Wiebe <wladislav.kw@gmail.com>
+Acked-by: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+Signed-off-by: Rob Herring <rob.herring@calxeda.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/fdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -392,6 +392,8 @@ static void __unflatten_device_tree(stru
+ mem = (unsigned long)
+ dt_alloc(size + 4, __alignof__(struct device_node));
+
++ memset((void *)mem, 0, size);
++
+ ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
+
+ pr_debug(" unflattening %lx...\n", mem);
ftrace-check-module-functions-being-traced-on-reload.patch
xen-smp-initialize-ipi-vectors-before-marking-cpu-online.patch
arc-strchr-breakage-in-big-endian-configuration.patch
+zd1201-do-not-use-stack-as-urb-transfer_buffer.patch
+vfs-collect_mounts-should-return-an-err_ptr.patch
+x86-don-t-clear-olpc_ofw_header-when-sentinel-is-detected.patch
+xen-events-initialize-local-per-cpu-mask-for-all-possible-events.patch
+xen-events-mask-events-when-changing-their-vcpu-binding.patch
+arm-davinci-nand-specify-ecc-strength.patch
+arm-at91-dt-fix-at91sam9n12ek-memory-node.patch
+arm64-perf-fix-array-out-of-bounds-access-in-armpmu_map_hw_event.patch
+arm64-perf-fix-event-validation-for-software-group-leaders.patch
+arm-7816-1-config_kuser_helpers-fix-help-text.patch
+staging-comedi-bug-fix-null-pointer-dereference-on-failed-attach.patch
+drm-radeon-r7xx-fix-copy-paste-typo-in-golden-register-setup.patch
+drm-radeon-fix-uvd-message-buffer-validation.patch
+drm-radeon-fix-wreg32_or-macro-setting-bits-in-a-register.patch
+drm-i915-invalidate-tlbs-for-the-rings-after-a-reset.patch
+of-fdt-fix-memory-initialization-for-expanded-dt.patch
+nilfs2-remove-double-bio_put-in-nilfs_end_bio_write-for-bio_eopnotsupp-error.patch
+nilfs2-fix-issue-with-counting-number-of-bio-requests-for-bio_eopnotsupp-error-detection.patch
+drivers-platform-olpc-olpc-ec.c-initialise-earlier.patch
+usb-phy-fix-build-breakage.patch
--- /dev/null
+From 3955dfa8216f712bc204a5ad2f4e51efff252fde Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 23 Aug 2013 12:37:17 +0100
+Subject: staging: comedi: bug-fix NULL pointer dereference on failed attach
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 3955dfa8216f712bc204a5ad2f4e51efff252fde upstream.
+
+Commit dcd7b8bd63cb81c5b973bf86510ca3c80bbbd162 ("staging: comedi: put
+module _after_ detach" by myself) reversed a couple of calls in
+`comedi_device_attach()` when recovering from an error returned by the
+low-level driver's 'attach' handler. Unfortunately, that introduced a
+NULL pointer dereference bug as `dev->driver` is NULL after the call to
+`comedi_device_detach()`. We still have a pointer to the low-level
+comedi driver structure in the `driv` variable, so use that instead.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers.c
++++ b/drivers/staging/comedi/drivers.c
+@@ -464,7 +464,7 @@ int comedi_device_attach(struct comedi_d
+ ret = comedi_device_postconfig(dev);
+ if (ret < 0) {
+ comedi_device_detach(dev);
+- module_put(dev->driver->module);
++ module_put(driv->module);
+ }
+ /* On success, the driver module count has been incremented. */
+ return ret;
--- /dev/null
+From 52d5b9aba1f5790ca3231c262979c2c3e26dd99b Mon Sep 17 00:00:00 2001
+From: Anatolij Gustschin <agust@denx.de>
+Date: Wed, 21 Aug 2013 17:43:31 +0200
+Subject: usb: phy: fix build breakage
+
+From: Anatolij Gustschin <agust@denx.de>
+
+commit 52d5b9aba1f5790ca3231c262979c2c3e26dd99b upstream.
+
+Commit 94ae9843 (usb: phy: rename all phy drivers to phy-$name-usb.c)
+renamed drivers/usb/phy/otg_fsm.h to drivers/usb/phy/phy-fsm-usb.h
+but changed drivers/usb/phy/phy-fsm-usb.c to include not existing
+"phy-otg-fsm.h" instead of new "phy-fsm-usb.h". This breaks building:
+ ...
+ drivers/usb/phy/phy-fsm-usb.c:32:25: fatal error: phy-otg-fsm.h: No such file or directory
+ compilation terminated.
+ make[3]: *** [drivers/usb/phy/phy-fsm-usb.o] Error 1
+
+This commit also missed to modify drivers/usb/phy/phy-fsl-usb.h
+to include new "phy-fsm-usb.h" instead of "otg_fsm.h" resulting
+in another build breakage:
+ ...
+ In file included from drivers/usb/phy/phy-fsl-usb.c:46:0:
+ drivers/usb/phy/phy-fsl-usb.h:18:21: fatal error: otg_fsm.h: No such file or directory
+ compilation terminated.
+ make[3]: *** [drivers/usb/phy/phy-fsl-usb.o] Error 1
+
+Fix both issues.
+
+Signed-off-by: Anatolij Gustschin <agust@denx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/phy/phy-fsl-usb.h | 2 +-
+ drivers/usb/phy/phy-fsm-usb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/phy/phy-fsl-usb.h
++++ b/drivers/usb/phy/phy-fsl-usb.h
+@@ -15,7 +15,7 @@
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+-#include "otg_fsm.h"
++#include "phy-fsm-usb.h"
+ #include <linux/usb/otg.h>
+ #include <linux/ioctl.h>
+
+--- a/drivers/usb/phy/phy-fsm-usb.c
++++ b/drivers/usb/phy/phy-fsm-usb.c
+@@ -29,7 +29,7 @@
+ #include <linux/usb/gadget.h>
+ #include <linux/usb/otg.h>
+
+-#include "phy-otg-fsm.h"
++#include "phy-fsm-usb.h"
+
+ /* Change USB protocol when there is a protocol change */
+ static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
--- /dev/null
+From 52e220d357a38cb29fa2e29f34ed94c1d66357f4 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 14 Aug 2013 12:44:39 +0300
+Subject: VFS: collect_mounts() should return an ERR_PTR
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 52e220d357a38cb29fa2e29f34ed94c1d66357f4 upstream.
+
+This should actually be returning an ERR_PTR on error instead of NULL.
+That was how it was designed and all the callers expect it.
+
+[AV: actually, that's what "VFS: Make clone_mnt()/copy_tree()/collect_mounts()
+return errors" missed - originally collect_mounts() was expected to return
+NULL on failure]
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1429,7 +1429,7 @@ struct vfsmount *collect_mounts(struct p
+ CL_COPY_ALL | CL_PRIVATE);
+ namespace_unlock();
+ if (IS_ERR(tree))
+- return NULL;
++ return ERR_CAST(tree);
+ return &tree->mnt;
+ }
+
--- /dev/null
+From d55e37bb0f51316e552376ddc0a3fff34ca7108b Mon Sep 17 00:00:00 2001
+From: Daniel Drake <dsd@laptop.org>
+Date: Fri, 9 Aug 2013 18:14:20 -0400
+Subject: x86: Don't clear olpc_ofw_header when sentinel is detected
+
+From: Daniel Drake <dsd@laptop.org>
+
+commit d55e37bb0f51316e552376ddc0a3fff34ca7108b upstream.
+
+OpenFirmware wasn't quite following the protocol described in boot.txt
+and the kernel has detected this through use of the sentinel value
+in boot_params. OFW does zero out almost all of the stuff that it should
+do, but not the sentinel.
+
+This causes the kernel to clear olpc_ofw_header, which breaks x86 OLPC
+support.
+
+OpenFirmware has now been fixed. However, it would be nice if we could
+maintain Linux compatibility with old firmware versions. To do that, we just
+have to avoid zeroing out olpc_ofw_header.
+
+OFW does not write to any other parts of the header that are being zapped
+by the sentinel-detection code, and all users of olpc_ofw_header are
+somewhat protected through checking for the OLPC_OFW_SIG magic value
+before using it. So this should not cause any problems for anyone.
+
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Link: http://lkml.kernel.org/r/20130809221420.618E6FAB03@dev.laptop.org
+Acked-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/bootparam_utils.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/bootparam_utils.h
++++ b/arch/x86/include/asm/bootparam_utils.h
+@@ -35,9 +35,9 @@ static void sanitize_boot_params(struct
+ */
+ if (boot_params->sentinel) {
+ /* fields in boot_params are left uninitialized, clear them */
+- memset(&boot_params->olpc_ofw_header, 0,
++ memset(&boot_params->ext_ramdisk_image, 0,
+ (char *)&boot_params->efi_info -
+- (char *)&boot_params->olpc_ofw_header);
++ (char *)&boot_params->ext_ramdisk_image);
+ memset(&boot_params->kbd_status, 0,
+ (char *)&boot_params->hdr -
+ (char *)&boot_params->kbd_status);
--- /dev/null
+From 84ca7a8e45dafb49cd5ca90a343ba033e2885c17 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 15 Aug 2013 13:21:06 +0100
+Subject: xen/events: initialize local per-cpu mask for all possible events
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit 84ca7a8e45dafb49cd5ca90a343ba033e2885c17 upstream.
+
+The sizeof() argument in init_evtchn_cpu_bindings() is incorrect
+resulting in only the first 64 (or 32 in 32-bit guests) ports having
+their bindings being initialized to VCPU 0.
+
+In most cases this does not cause a problem as request_irq() will set
+the irq affinity which will set the correct local per-cpu mask.
+However, if the request_irq() is called on a VCPU other than 0, there
+is a window between the unmasking of the event and the affinity being
+set were an event may be lost because it is not locally unmasked on
+any VCPU. If request_irq() is called on VCPU 0 then local irqs are
+disabled during the window and the race does not occur.
+
+Fix this by initializing all NR_EVENT_CHANNEL bits in the local
+per-cpu masks.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/events.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -346,7 +346,7 @@ static void init_evtchn_cpu_bindings(voi
+
+ for_each_possible_cpu(i)
+ memset(per_cpu(cpu_evtchn_mask, i),
+- (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
++ (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
+ }
+
+ static inline void clear_evtchn(int port)
--- /dev/null
+From 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 15 Aug 2013 13:21:07 +0100
+Subject: xen/events: mask events when changing their VCPU binding
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 upstream.
+
+When a event is being bound to a VCPU there is a window between the
+EVTCHNOP_bind_vpcu call and the adjustment of the local per-cpu masks
+where an event may be lost. The hypervisor upcalls the new VCPU but
+the kernel thinks that event is still bound to the old VCPU and
+ignores it.
+
+There is even a problem when the event is being bound to the same VCPU
+as there is a small window beween the clear_bit() and set_bit() calls
+in bind_evtchn_to_cpu(). When scanning for pending events, the kernel
+may read the bit when it is momentarily clear and ignore the event.
+
+Avoid this by masking the event during the whole bind operation.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/events.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -1492,8 +1492,10 @@ void rebind_evtchn_irq(int evtchn, int i
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ {
++ struct shared_info *s = HYPERVISOR_shared_info;
+ struct evtchn_bind_vcpu bind_vcpu;
+ int evtchn = evtchn_from_irq(irq);
++ int masked;
+
+ if (!VALID_EVTCHN(evtchn))
+ return -1;
+@@ -1510,6 +1512,12 @@ static int rebind_irq_to_cpu(unsigned ir
+ bind_vcpu.vcpu = tcpu;
+
+ /*
++ * Mask the event while changing the VCPU binding to prevent
++ * it being delivered on an unexpected VCPU.
++ */
++ masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask));
++
++ /*
+ * If this fails, it usually just indicates that we're dealing with a
+ * virq or IPI channel, which don't actually need to be rebound. Ignore
+ * it, but don't do the xenlinux-level rebind in that case.
+@@ -1517,6 +1525,9 @@ static int rebind_irq_to_cpu(unsigned ir
+ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
+ bind_evtchn_to_cpu(evtchn, tcpu);
+
++ if (!masked)
++ unmask_evtchn(evtchn);
++
+ return 0;
+ }
+
--- /dev/null
+From 1206ff4ff9d2ef7468a355328bc58ac6ebf5be44 Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+Date: Tue, 6 Aug 2013 14:28:42 +0300
+Subject: zd1201: do not use stack as URB transfer_buffer
+
+From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+
+commit 1206ff4ff9d2ef7468a355328bc58ac6ebf5be44 upstream.
+
+Patch fixes zd1201 not to use stack as URB transfer_buffer. URB buffers need
+to be DMA-able, which stack is not.
+
+Patch is only compile tested.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/zd1201.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/zd1201.c
++++ b/drivers/net/wireless/zd1201.c
+@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_d
+ goto exit;
+
+ err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
+- USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
++ USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
+ if (err < 0)
+ goto exit;
+
++ memcpy(&ret, buf, sizeof(ret));
++
+ if (ret & 0x80) {
+ err = -EIO;
+ goto exit;
projects / thirdparty / kernel / stable-queue.git / commitdiff
