--- /dev/null
+From bc5bd37ce48c66e9192ad2e7231e9678880f6f8e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 16 Oct 2013 09:49:02 +0100
+Subject: drm: Pad drm_mode_get_connector to 64-bit boundary
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream.
+
+Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
+the 4 bytes beyond the end of its structure with a 32-bit userspace
+running on a 64-bit kernel. This is due to the padding gcc inserts as
+the drm_mode_get_connector struct includes a u64 and its size is not a
+natural multiple of u64s.
+
+64-bit kernel:
+
+sizeof(drm_mode_get_connector)=80, alignof=8
+sizeof(drm_mode_get_encoder)=20, alignof=4
+sizeof(drm_mode_modeinfo)=68, alignof=4
+
+32-bit userspace:
+
+sizeof(drm_mode_get_connector)=76, alignof=4
+sizeof(drm_mode_get_encoder)=20, alignof=4
+sizeof(drm_mode_modeinfo)=68, alignof=4
+
+Fortuituously we can insert explicit padding to the tail of our
+structures without breaking ABI.
+
+Reported-by: Pavel Roskin <proski@gnu.org>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/drm/drm_mode.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/uapi/drm/drm_mode.h
++++ b/include/uapi/drm/drm_mode.h
+@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
+ __u32 connection;
+ __u32 mm_width, mm_height; /**< HxW in millimeters */
+ __u32 subpixel;
++
++ __u32 pad;
+ };
+
+ #define DRM_MODE_PROP_PENDING (1<<0)
--- /dev/null
+From b062672e305ce071f21eb9e18b102c2a430e0999 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 16 Oct 2013 11:22:44 +0100
+Subject: drm: Prevent overwriting from userspace underallocating core ioctl structs
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream.
+
+Apply the protections from
+
+commit 1b2f1489633888d4a06028315dc19d65768a1c05
+Author: Dave Airlie <airlied@redhat.com>
+Date: Sat Aug 14 20:20:34 2010 +1000
+
+ drm: block userspace under allocating buffer and having drivers overwrite it (v2)
+
+to the core ioctl structs as well, for we found one instance where there
+is a 32-/64-bit size mismatch and were guilty of writing beyond the end
+of the user's buffer.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Dave Airlie <airlied@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_drv.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -406,9 +406,16 @@ long drm_ioctl(struct file *filp,
+ cmd = ioctl->cmd_drv;
+ }
+ else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
++ u32 drv_size;
++
+ ioctl = &drm_ioctls[nr];
+- cmd = ioctl->cmd;
++
++ drv_size = _IOC_SIZE(ioctl->cmd);
+ usize = asize = _IOC_SIZE(cmd);
++ if (drv_size > asize)
++ asize = drv_size;
++
++ cmd = ioctl->cmd;
+ } else
+ goto err_i1;
+
--- /dev/null
+From c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 10 Oct 2013 16:45:27 -0400
+Subject: drm/radeon/atom: workaround vbios bug in transmitter table on rs780
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream.
+
+Some rs780 asics seem to be affected as well.
+
+See:
+http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=60791
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1641,7 +1641,7 @@ radeon_atom_encoder_dpms_dig(struct drm_
+ * does the same thing and more.
+ */
+ if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
+- (rdev->family != CHIP_RS880))
++ (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880))
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+ }
+ if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
--- /dev/null
+From c4249855ac5b2a383704d31e040d3831d6a25c6f Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 9 Oct 2013 01:42:51 -0700
+Subject: drm/vmwgfx: Don't kill clients on VT switch
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit c4249855ac5b2a383704d31e040d3831d6a25c6f upstream.
+
+DRI clients that tried to grab the TTM lock when the master (X server) was
+switched away during a VT switch were sent the SIGTERM signal by the
+kernel. Fix this so that they are only sent that signal when the master has
+exited.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_dev
+ struct vmw_fpriv *vmw_fp;
+
+ vmw_fp = vmw_fpriv(file_priv);
+- ttm_object_file_release(&vmw_fp->tfile);
+- if (vmw_fp->locked_master)
++
++ if (vmw_fp->locked_master) {
++ struct vmw_master *vmaster =
++ vmw_master(vmw_fp->locked_master);
++
++ ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
++ ttm_vt_unlock(&vmaster->lock);
+ drm_master_put(&vmw_fp->locked_master);
++ }
++
++ ttm_object_file_release(&vmw_fp->tfile);
+ kfree(vmw_fp);
+ }
+
+@@ -942,14 +950,13 @@ static void vmw_master_drop(struct drm_d
+
+ vmw_fp->locked_master = drm_master_get(file_priv->master);
+ ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
+- vmw_execbuf_release_pinned_bo(dev_priv);
+-
+ if (unlikely((ret != 0))) {
+ DRM_ERROR("Unable to lock TTM at VT switch.\n");
+ drm_master_put(&vmw_fp->locked_master);
+ }
+
+- ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
++ ttm_lock_set_kill(&vmaster->lock, false, SIGTERM);
++ vmw_execbuf_release_pinned_bo(dev_priv);
+
+ if (!dev_priv->enable_fb) {
+ ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
--- /dev/null
+From 26682480c202e7360cbcdc3bc9e962bf749c6b8d Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 9 Oct 2013 01:42:50 -0700
+Subject: drm/vmwgfx: Don't put resources with invalid id's on lru list
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 26682480c202e7360cbcdc3bc9e962bf749c6b8d upstream.
+
+The evict code may try to swap them out causing a BUG in the destroy
+function.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_r
+ if (new_backup)
+ res->backup_offset = new_backup_offset;
+
+- if (!res->func->may_evict)
++ if (!res->func->may_evict || res->id == -1)
+ return;
+
+ write_lock(&dev_priv->resource_lock);
--- /dev/null
+From 3017f079efd6af199b0852b5c425364513db460e Mon Sep 17 00:00:00 2001
+From: Chen LinX <linx.z.chen@intel.com>
+Date: Wed, 30 Oct 2013 13:56:18 -0700
+Subject: mm/pagewalk.c: fix walk_page_range() access of wrong PTEs
+
+From: Chen LinX <linx.z.chen@intel.com>
+
+commit 3017f079efd6af199b0852b5c425364513db460e upstream.
+
+When walk_page_range walk a memory map's page tables, it'll skip
+VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it
+maybe larger than 'end'. In next loop, 'addr' will be larger than
+'next'. Then in /proc/XXXX/pagemap file reading procedure, the 'addr'
+will growing forever in pagemap_pte_range, pte_to_pagemap_entry will
+access the wrong pte.
+
+ BUG: Bad page map in process procrank pte:8437526f pmd:785de067
+ addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping: (null) index:9108d
+ CPU: 1 PID: 4974 Comm: procrank Tainted: G B W O 3.10.1+ #1
+ Call Trace:
+ dump_stack+0x16/0x18
+ print_bad_pte+0x114/0x1b0
+ vm_normal_page+0x56/0x60
+ pagemap_pte_range+0x17a/0x1d0
+ walk_page_range+0x19e/0x2c0
+ pagemap_read+0x16e/0x200
+ vfs_read+0x84/0x150
+ SyS_read+0x4a/0x80
+ syscall_call+0x7/0xb
+
+Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
+Signed-off-by: Chen LinX <linx.z.chen@intel.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/pagewalk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr,
+ if (err)
+ break;
+ pgd++;
+- } while (addr = next, addr != end);
++ } while (addr = next, addr < end);
+
+ return err;
+ }
--- /dev/null
+From bcb615a81b1765864c71c50afb56631e7a1e5283 Mon Sep 17 00:00:00 2001
+From: Zhang Yanfei <zhangyanfei.yes@gmail.com>
+Date: Mon, 8 Jul 2013 16:00:19 -0700
+Subject: mm/vmalloc.c: fix an overflow bug in alloc_vmap_area()
+
+From: Zhang Yanfei <zhangyanfei.yes@gmail.com>
+
+commit bcb615a81b1765864c71c50afb56631e7a1e5283 upstream.
+
+When searching a vmap area in the vmalloc space, we use (addr + size -
+1) to check if the value is less than addr, which is an overflow. But
+we assign (addr + size) to vmap_area->va_end.
+
+So if we come across the below case:
+
+ (addr + size - 1) : not overflow
+ (addr + size) : overflow
+
+we will assign an overflow value (e.g 0) to vmap_area->va_end, And this
+will trigger BUG in __insert_vmap_area, causing system panic.
+
+So using (addr + size) to check the overflow should be the correct
+behaviour, not (addr + size - 1).
+
+Signed-off-by: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
+Reported-by: Ghennadi Procopciuc <unix140@gmail.com>
+Tested-by: Daniel Baluta <dbaluta@ixiacom.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Anatoly Muliarski <x86ever@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmalloc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -388,12 +388,12 @@ nocache:
+ addr = ALIGN(first->va_end, align);
+ if (addr < vstart)
+ goto nocache;
+- if (addr + size - 1 < addr)
++ if (addr + size < addr)
+ goto overflow;
+
+ } else {
+ addr = ALIGN(vstart, align);
+- if (addr + size - 1 < addr)
++ if (addr + size < addr)
+ goto overflow;
+
+ n = vmap_area_root.rb_node;
+@@ -420,7 +420,7 @@ nocache:
+ if (addr + cached_hole_size < first->va_start)
+ cached_hole_size = first->va_start - addr;
+ addr = ALIGN(first->va_end, align);
+- if (addr + size - 1 < addr)
++ if (addr + size < addr)
+ goto overflow;
+
+ if (list_is_last(&first->list, &vmap_area_list))
--- /dev/null
+From 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@intel.com>
+Date: Mon, 15 Jul 2013 13:23:47 -0700
+Subject: NTB: Add Error Handling in ntb_device_setup
+
+From: Jon Mason <jon.mason@intel.com>
+
+commit 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab upstream.
+
+If an error is encountered in ntb_device_setup, it is possible that the
+spci_cmd isn't populated. Writes to the offset can result in a NULL
+pointer dereference. This issue is easily encountered by running in
+NTB-RP mode, as it currently is not supported and will generate an
+error. To get around this issue, return if an error is encountered
+prior to attempting to write to the spci_cmd offset.
+
+Signed-off-by: Jon Mason <jon.mason@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ntb/ntb_hw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/ntb/ntb_hw.c
++++ b/drivers/ntb/ntb_hw.c
+@@ -644,10 +644,13 @@ static int ntb_device_setup(struct ntb_d
+ rc = -ENODEV;
+ }
+
++ if (rc)
++ return rc;
++
+ /* Enable Bus Master and Memory Space on the secondary side */
+ writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd);
+
+- return rc;
++ return 0;
+ }
+
+ static void ntb_device_free(struct ntb_device *ndev)
--- /dev/null
+From 1517a3f21a1dd321f16bcf44204bddff9d21abd0 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@intel.com>
+Date: Tue, 30 Jul 2013 15:58:49 -0700
+Subject: NTB: Correct debugfs to work with more than 1 NTB Device
+
+From: Jon Mason <jon.mason@intel.com>
+
+commit 1517a3f21a1dd321f16bcf44204bddff9d21abd0 upstream.
+
+Debugfs was setup in NTB to only have a single debugfs directory. This
+resulted in the leaking of debugfs directories and files when multiple
+NTB devices were present, due to each device stomping on the variables
+containing the previous device's values (thus preventing them from being
+freed on cleanup). Correct this by creating a secondary directory of
+the PCI BDF for each device present, and nesting the previously existing
+information in those directories.
+
+Signed-off-by: Jon Mason <jon.mason@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ntb/ntb_hw.c | 27 +++++++++++++++++++++++++++
+ drivers/ntb/ntb_hw.h | 16 ++++++++++++++++
+ drivers/ntb/ntb_transport.c | 17 +++++------------
+ 3 files changed, 48 insertions(+), 12 deletions(-)
+
+--- a/drivers/ntb/ntb_hw.c
++++ b/drivers/ntb/ntb_hw.c
+@@ -78,6 +78,8 @@ enum {
+ BWD_HW,
+ };
+
++static struct dentry *debugfs_dir;
++
+ /* Translate memory window 0,1 to BAR 2,4 */
+ #define MW_TO_BAR(mw) (mw * 2 + 2)
+
+@@ -998,6 +1000,28 @@ static void ntb_free_callbacks(struct nt
+ kfree(ndev->db_cb);
+ }
+
++static void ntb_setup_debugfs(struct ntb_device *ndev)
++{
++ if (!debugfs_initialized())
++ return;
++
++ if (!debugfs_dir)
++ debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
++
++ ndev->debugfs_dir = debugfs_create_dir(pci_name(ndev->pdev),
++ debugfs_dir);
++}
++
++static void ntb_free_debugfs(struct ntb_device *ndev)
++{
++ debugfs_remove_recursive(ndev->debugfs_dir);
++
++ if (debugfs_dir && simple_empty(debugfs_dir)) {
++ debugfs_remove_recursive(debugfs_dir);
++ debugfs_dir = NULL;
++ }
++}
++
+ static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ struct ntb_device *ndev;
+@@ -1010,6 +1034,7 @@ static int ntb_pci_probe(struct pci_dev
+ ndev->pdev = pdev;
+ ndev->link_status = NTB_LINK_DOWN;
+ pci_set_drvdata(pdev, ndev);
++ ntb_setup_debugfs(ndev);
+
+ rc = pci_enable_device(pdev);
+ if (rc)
+@@ -1106,6 +1131,7 @@ err2:
+ err1:
+ pci_disable_device(pdev);
+ err:
++ ntb_free_debugfs(ndev);
+ kfree(ndev);
+
+ dev_err(&pdev->dev, "Error loading %s module\n", KBUILD_MODNAME);
+@@ -1135,6 +1161,7 @@ static void ntb_pci_remove(struct pci_de
+ iounmap(ndev->reg_base);
+ pci_release_selected_regions(pdev, NTB_BAR_MASK);
+ pci_disable_device(pdev);
++ ntb_free_debugfs(ndev);
+ kfree(ndev);
+ }
+
+--- a/drivers/ntb/ntb_hw.h
++++ b/drivers/ntb/ntb_hw.h
+@@ -127,6 +127,8 @@ struct ntb_device {
+ unsigned char link_status;
+ struct delayed_work hb_timer;
+ unsigned long last_ts;
++
++ struct dentry *debugfs_dir;
+ };
+
+ /**
+@@ -155,6 +157,20 @@ static inline struct pci_dev *ntb_query_
+ return ndev->pdev;
+ }
+
++/**
++ * ntb_query_debugfs() - return the debugfs pointer
++ * @ndev: pointer to ntb_device instance
++ *
++ * Given the ntb pointer, return the debugfs directory pointer for the NTB
++ * hardware device
++ *
++ * RETURNS: a pointer to the debugfs directory
++ */
++static inline struct dentry *ntb_query_debugfs(struct ntb_device *ndev)
++{
++ return ndev->debugfs_dir;
++}
++
+ struct ntb_device *ntb_register_transport(struct pci_dev *pdev,
+ void *transport);
+ void ntb_unregister_transport(struct ntb_device *ndev);
+--- a/drivers/ntb/ntb_transport.c
++++ b/drivers/ntb/ntb_transport.c
+@@ -157,7 +157,6 @@ struct ntb_transport {
+ bool transport_link;
+ struct delayed_work link_work;
+ struct work_struct link_cleanup;
+- struct dentry *debugfs_dir;
+ };
+
+ enum {
+@@ -824,12 +823,12 @@ static void ntb_transport_init_queue(str
+ qp->tx_max_frame = min(transport_mtu, tx_size / 2);
+ qp->tx_max_entry = tx_size / qp->tx_max_frame;
+
+- if (nt->debugfs_dir) {
++ if (ntb_query_debugfs(nt->ndev)) {
+ char debugfs_name[4];
+
+ snprintf(debugfs_name, 4, "qp%d", qp_num);
+ qp->debugfs_dir = debugfs_create_dir(debugfs_name,
+- nt->debugfs_dir);
++ ntb_query_debugfs(nt->ndev));
+
+ qp->debugfs_stats = debugfs_create_file("stats", S_IRUSR,
+ qp->debugfs_dir, qp,
+@@ -857,11 +856,6 @@ int ntb_transport_init(struct pci_dev *p
+ if (!nt)
+ return -ENOMEM;
+
+- if (debugfs_initialized())
+- nt->debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+- else
+- nt->debugfs_dir = NULL;
+-
+ nt->ndev = ntb_register_transport(pdev, nt);
+ if (!nt->ndev) {
+ rc = -EIO;
+@@ -907,7 +901,6 @@ err2:
+ err1:
+ ntb_unregister_transport(nt->ndev);
+ err:
+- debugfs_remove_recursive(nt->debugfs_dir);
+ kfree(nt);
+ return rc;
+ }
+@@ -921,16 +914,16 @@ void ntb_transport_free(void *transport)
+ nt->transport_link = NTB_LINK_DOWN;
+
+ /* verify that all the qp's are freed */
+- for (i = 0; i < nt->max_qps; i++)
++ for (i = 0; i < nt->max_qps; i++) {
+ if (!test_bit(i, &nt->qp_bitmap))
+ ntb_transport_free_queue(&nt->qps[i]);
++ debugfs_remove_recursive(nt->qps[i].debugfs_dir);
++ }
+
+ ntb_bus_remove(nt);
+
+ cancel_delayed_work_sync(&nt->link_work);
+
+- debugfs_remove_recursive(nt->debugfs_dir);
+-
+ ntb_unregister_event_callback(nt->ndev);
+
+ pdev = ntb_query_pdev(nt->ndev);
--- /dev/null
+From 87034511519815259e37336f52edf06d114d43b6 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@intel.com>
+Date: Mon, 15 Jul 2013 15:26:14 -0700
+Subject: NTB: Correct Number of Scratch Pad Registers
+
+From: Jon Mason <jon.mason@intel.com>
+
+commit 87034511519815259e37336f52edf06d114d43b6 upstream.
+
+The NTB Xeon hardware has 16 scratch pad registers and 16 back-to-back
+scratch pad registers. Correct the #define to represent this and update
+the variable names to reflect their usage.
+
+Signed-off-by: Jon Mason <jon.mason@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ntb/ntb_hw.c | 2 +-
+ drivers/ntb/ntb_regs.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/ntb/ntb_hw.c
++++ b/drivers/ntb/ntb_hw.c
+@@ -547,7 +547,7 @@ static int ntb_xeon_setup(struct ntb_dev
+ if (ndev->conn_type == NTB_CONN_B2B) {
+ ndev->reg_ofs.sdb = ndev->reg_base + SNB_B2B_DOORBELL_OFFSET;
+ ndev->reg_ofs.spad_write = ndev->reg_base + SNB_B2B_SPAD_OFFSET;
+- ndev->limits.max_spads = SNB_MAX_SPADS;
++ ndev->limits.max_spads = SNB_MAX_B2B_SPADS;
+ } else {
+ ndev->reg_ofs.sdb = ndev->reg_base + SNB_SDOORBELL_OFFSET;
+ ndev->reg_ofs.spad_write = ndev->reg_base + SNB_SPAD_OFFSET;
+--- a/drivers/ntb/ntb_regs.h
++++ b/drivers/ntb/ntb_regs.h
+@@ -53,8 +53,8 @@
+ #define NTB_LINK_WIDTH_MASK 0x03f0
+
+ #define SNB_MSIX_CNT 4
+-#define SNB_MAX_SPADS 16
+-#define SNB_MAX_COMPAT_SPADS 8
++#define SNB_MAX_B2B_SPADS 16
++#define SNB_MAX_COMPAT_SPADS 16
+ /* Reserve the uppermost bit for link interrupt */
+ #define SNB_MAX_DB_BITS 15
+ #define SNB_DB_BITS_PER_VEC 5
--- /dev/null
+From b6750cfe0710a14fd147ba27fddbecae8ba88c77 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@intel.com>
+Date: Fri, 31 May 2013 14:05:53 -0700
+Subject: NTB: Correct USD/DSD Identification
+
+From: Jon Mason <jon.mason@intel.com>
+
+commit b6750cfe0710a14fd147ba27fddbecae8ba88c77 upstream.
+
+Due to ambiguous documentation, the USD/DSD identification is backward
+when compared to the setting in BIOS. Correct the bits to match the
+BIOS setting.
+
+Signed-off-by: Jon Mason <jon.mason@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ntb/ntb_hw.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/ntb/ntb_hw.c
++++ b/drivers/ntb/ntb_hw.c
+@@ -531,9 +531,9 @@ static int ntb_xeon_setup(struct ntb_dev
+ }
+
+ if (val & SNB_PPD_DEV_TYPE)
+- ndev->dev_type = NTB_DEV_DSD;
+- else
+ ndev->dev_type = NTB_DEV_USD;
++ else
++ ndev->dev_type = NTB_DEV_DSD;
+
+ ndev->reg_ofs.pdb = ndev->reg_base + SNB_PDOORBELL_OFFSET;
+ ndev->reg_ofs.pdb_mask = ndev->reg_base + SNB_PDBMSK_OFFSET;
+@@ -647,6 +647,9 @@ static int ntb_device_setup(struct ntb_d
+ if (rc)
+ return rc;
+
++ dev_info(&ndev->pdev->dev, "Device Type = %s\n",
++ ndev->dev_type == NTB_DEV_USD ? "USD/DSP" : "DSD/USP");
++
+ /* Enable Bus Master and Memory Space on the secondary side */
+ writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd);
+
--- /dev/null
+From 05e16745c0c471bba313961b605b6da3b21a853d Mon Sep 17 00:00:00 2001
+From: Gu Zheng <guz.fnst@cn.fujitsu.com>
+Date: Fri, 25 Oct 2013 18:15:06 +0800
+Subject: seq_file: always update file->f_pos in seq_lseek()
+
+From: Gu Zheng <guz.fnst@cn.fujitsu.com>
+
+commit 05e16745c0c471bba313961b605b6da3b21a853d upstream.
+
+This issue was first pointed out by Jiaxing Wang several months ago, but no
+further comments:
+https://lkml.org/lkml/2013/6/29/41
+
+As we know pread() does not change f_pos, so after pread(), file->f_pos
+and m->read_pos become different. And seq_lseek() does not update file->f_pos
+if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to
+m->read_pos), then a subsequent read may read from a wrong position, the
+following program produces the problem:
+
+ char str1[32] = { 0 };
+ char str2[32] = { 0 };
+ int poffset = 10;
+ int count = 20;
+
+ /*open any seq file*/
+ int fd = open("/proc/modules", O_RDONLY);
+
+ pread(fd, str1, count, poffset);
+ printf("pread:%s\n", str1);
+
+ /*seek to where m->read_pos is*/
+ lseek(fd, poffset+count, SEEK_SET);
+
+ /*supposed to read from poffset+count, but this read from position 0*/
+ read(fd, str2, count);
+ printf("read:%s\n", str2);
+
+out put:
+pread:
+ ck_netbios_ns 12665
+read:
+ nf_conntrack_netbios
+
+/proc/modules:
+nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000
+nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000
+
+So we always update file->f_pos to offset in seq_lseek() to fix this issue.
+
+Signed-off-by: Jiaxing Wang <hello.wjx@gmail.com>
+Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Jonghwan Choi <jhbird.choi@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/seq_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff
+ m->read_pos = offset;
+ retval = file->f_pos = offset;
+ }
++ } else {
++ file->f_pos = offset;
+ }
+ }
+ file->f_version = m->version;
mm-numa-sanitize-task_numa_fault-callsites.patch
mm-close-races-between-thp-migration-and-pmd-numa-clearing.patch
mm-account-for-a-thp-numa-hinting-update-as-one-pte-update.patch
+mm-pagewalk.c-fix-walk_page_range-access-of-wrong-ptes.patch
+mm-vmalloc.c-fix-an-overflow-bug-in-alloc_vmap_area.patch
+drm-vmwgfx-don-t-put-resources-with-invalid-id-s-on-lru-list.patch
+drm-vmwgfx-don-t-kill-clients-on-vt-switch.patch
+drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch
+drm-pad-drm_mode_get_connector-to-64-bit-boundary.patch
+drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch
+seq_file-always-update-file-f_pos-in-seq_lseek.patch
+ntb-add-error-handling-in-ntb_device_setup.patch
+ntb-correct-number-of-scratch-pad-registers.patch
+ntb-correct-usd-dsd-identification.patch
+ntb-correct-debugfs-to-work-with-more-than-1-ntb-device.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
