--- /dev/null
+From e55355453600a33bb5ca4f71f2d7214875f3b061 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Thu, 13 Nov 2014 10:38:57 +0100
+Subject: ARM: mvebu: disable I/O coherency on non-SMP situations on Armada 370/375/38x/XP
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit e55355453600a33bb5ca4f71f2d7214875f3b061 upstream.
+
+Enabling the hardware I/O coherency on Armada 370, Armada 375, Armada
+38x and Armada XP requires a certain number of conditions:
+
+ - On Armada 370, the cache policy must be set to write-allocate.
+
+ - On Armada 375, 38x and XP, the cache policy must be set to
+ write-allocate, the pages must be mapped with the shareable
+ attribute, and the SMP bit must be set
+
+Currently, on Armada XP, when CONFIG_SMP is enabled, those conditions
+are met. However, when Armada XP is used in a !CONFIG_SMP kernel, none
+of these conditions are met. With Armada 370, the situation is worse:
+since the processor is single core, regardless of whether CONFIG_SMP
+or !CONFIG_SMP is used, the cache policy will be set to write-back by
+the kernel and not write-allocate.
+
+Since solving this problem turns out to be quite complicated, and we
+don't want to let users with a mainline kernel known to have
+infrequent but existing data corruptions, this commit proposes to
+simply disable hardware I/O coherency in situations where it is known
+not to work.
+
+And basically, the is_smp() function of the kernel tells us whether it
+is OK to enable hardware I/O coherency or not, so this commit slightly
+refactors the coherency_type() function to return
+COHERENCY_FABRIC_TYPE_NONE when is_smp() is false, or the appropriate
+type of the coherency fabric in the other case.
+
+Thanks to this, the I/O coherency fabric will no longer be used at all
+in !CONFIG_SMP configurations. It will continue to be used in
+CONFIG_SMP configurations on Armada XP, Armada 375 and Armada 38x
+(which are multiple cores processors), but will no longer be used on
+Armada 370 (which is a single core processor).
+
+In the process, it simplifies the implementation of the
+coherency_type() function, and adds a missing call to of_node_put().
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Fixes: e60304f8cb7bb545e79fe62d9b9762460c254ec2 ("arm: mvebu: Add hardware I/O Coherency support")
+Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Link: https://lkml.kernel.org/r/1415871540-20302-3-git-send-email-thomas.petazzoni@free-electrons.com
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/coherency.c | 46 ++++++++++++++++++++++++++--------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -361,25 +361,41 @@ static int coherency_type(void)
+ {
+ struct device_node *np;
+ const struct of_device_id *match;
++ int type;
++
++ /*
++ * The coherency fabric is needed:
++ * - For coherency between processors on Armada XP, so only
++ * when SMP is enabled.
++ * - For coherency between the processor and I/O devices, but
++ * this coherency requires many pre-requisites (write
++ * allocate cache policy, shareable pages, SMP bit set) that
++ * are only meant in SMP situations.
++ *
++ * Note that this means that on Armada 370, there is currently
++ * no way to use hardware I/O coherency, because even when
++ * CONFIG_SMP is enabled, is_smp() returns false due to the
++ * Armada 370 being a single-core processor. To lift this
++ * limitation, we would have to find a way to make the cache
++ * policy set to write-allocate (on all Armada SoCs), and to
++ * set the shareable attribute in page tables (on all Armada
++ * SoCs except the Armada 370). Unfortunately, such decisions
++ * are taken very early in the kernel boot process, at a point
++ * where we don't know yet on which SoC we are running.
++
++ */
++ if (!is_smp())
++ return COHERENCY_FABRIC_TYPE_NONE;
+
+ np = of_find_matching_node_and_match(NULL, of_coherency_table, &match);
+- if (np) {
+- int type = (int) match->data;
++ if (!np)
++ return COHERENCY_FABRIC_TYPE_NONE;
++
++ type = (int) match->data;
+
+- /* Armada 370/XP coherency works in both UP and SMP */
+- if (type == COHERENCY_FABRIC_TYPE_ARMADA_370_XP)
+- return type;
+-
+- /* Armada 375 coherency works only on SMP */
+- else if (type == COHERENCY_FABRIC_TYPE_ARMADA_375 && is_smp())
+- return type;
+-
+- /* Armada 380 coherency works only on SMP */
+- else if (type == COHERENCY_FABRIC_TYPE_ARMADA_380 && is_smp())
+- return type;
+- }
++ of_node_put(np);
+
+- return COHERENCY_FABRIC_TYPE_NONE;
++ return type;
+ }
+
+ int coherency_available(void)
--- /dev/null
+From ab1e85372168892387dd1ac171158fc8c3119be4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Fri, 14 Nov 2014 21:43:33 +0100
+Subject: ARM: mvebu: fix ordering in Armada 370 .dtsi
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+
+commit ab1e85372168892387dd1ac171158fc8c3119be4 upstream.
+
+Commit a095b1c78a35 ("ARM: mvebu: sort DT nodes by address")
+missed placing the system-controller in the correct order.
+
+Fixes: a095b1c78a35 ("ARM: mvebu: sort DT nodes by address")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lkml.kernel.org/r/20141114204333.GS27002@pengutronix.de
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/armada-370.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/armada-370.dtsi
++++ b/arch/arm/boot/dts/armada-370.dtsi
+@@ -106,11 +106,6 @@
+ reg = <0x11100 0x20>;
+ };
+
+- system-controller@18200 {
+- compatible = "marvell,armada-370-xp-system-controller";
+- reg = <0x18200 0x100>;
+- };
+-
+ pinctrl {
+ compatible = "marvell,mv88f6710-pinctrl";
+ reg = <0x18000 0x38>;
+@@ -205,6 +200,11 @@
+ interrupts = <91>;
+ };
+
++ system-controller@18200 {
++ compatible = "marvell,armada-370-xp-system-controller";
++ reg = <0x18200 0x100>;
++ };
++
+ gateclk: clock-gating-control@18220 {
+ compatible = "marvell,armada-370-gating-clock";
+ reg = <0x18220 0x4>;
--- /dev/null
+From 30cdef97107370a7f63ab5d80fd2de30540750c8 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Thu, 13 Nov 2014 10:38:56 +0100
+Subject: ARM: mvebu: make the coherency_ll.S functions work with no coherency fabric
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 30cdef97107370a7f63ab5d80fd2de30540750c8 upstream.
+
+The ll_add_cpu_to_smp_group(), ll_enable_coherency() and
+ll_disable_coherency() are used on Armada XP to control the coherency
+fabric. However, they make the assumption that the coherency fabric is
+always available, which is currently a correct assumption but will no
+longer be true with a followup commit that disables the usage of the
+coherency fabric when the conditions are not met to use it.
+
+Therefore, this commit modifies those functions so that they check the
+return value of ll_get_coherency_base(), and if the return value is 0,
+they simply return without configuring anything in the coherency
+fabric.
+
+The ll_get_coherency_base() function is also modified to properly
+return 0 when the function is called with the MMU disabled. In this
+case, it normally returns the physical address of the coherency
+fabric, but we now check if the virtual address is 0, and if that's
+case, return a physical address of 0 to indicate that the coherency
+fabric is not enabled.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Link: https://lkml.kernel.org/r/1415871540-20302-2-git-send-email-thomas.petazzoni@free-electrons.com
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/coherency_ll.S | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-mvebu/coherency_ll.S
++++ b/arch/arm/mach-mvebu/coherency_ll.S
+@@ -24,7 +24,10 @@
+ #include <asm/cp15.h>
+
+ .text
+-/* Returns the coherency base address in r1 (r0 is untouched) */
++/*
++ * Returns the coherency base address in r1 (r0 is untouched), or 0 if
++ * the coherency fabric is not enabled.
++ */
+ ENTRY(ll_get_coherency_base)
+ mrc p15, 0, r1, c1, c0, 0
+ tst r1, #CR_M @ Check MMU bit enabled
+@@ -32,8 +35,13 @@ ENTRY(ll_get_coherency_base)
+
+ /*
+ * MMU is disabled, use the physical address of the coherency
+- * base address.
++ * base address. However, if the coherency fabric isn't mapped
++ * (i.e its virtual address is zero), it means coherency is
++ * not enabled, so we return 0.
+ */
++ ldr r1, =coherency_base
++ cmp r1, #0
++ beq 2f
+ adr r1, 3f
+ ldr r3, [r1]
+ ldr r1, [r1, r3]
+@@ -85,6 +93,9 @@ ENTRY(ll_add_cpu_to_smp_group)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CFG_REG_OFFSET
+@@ -107,6 +118,9 @@ ENTRY(ll_enable_coherency)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
+@@ -131,6 +145,9 @@ ENTRY(ll_disable_coherency)
+ */
+ mov r0, lr
+ bl ll_get_coherency_base
++ /* Bail out if the coherency is not enabled */
++ cmp r1, #0
++ reteq r0
+ bl ll_get_coherency_cpumask
+ mov lr, r0
+ add r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
--- /dev/null
+From b4607572ef86b288a856b9df410ea593c5371dec Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 28 Oct 2014 17:08:42 +0100
+Subject: ARM: mvebu: remove conflicting muxing on Armada 370 DB
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit b4607572ef86b288a856b9df410ea593c5371dec upstream.
+
+Back when audio was enabled, the muxing of some MPP pins was causing
+problems. However, since commit fea038ed55ae ("ARM: mvebu: Add proper
+pin muxing on the Armada 370 DB board"), those problematic MPP pins
+have been assigned a proper muxing for the Ethernet interfaces. This
+proper muxing is now conflicting with the hog pins muxing that had
+been added as part of 249f3822509b ("ARM: mvebu: add audio support to
+Armada 370 DB").
+
+Therefore, this commit simply removes the hog pins muxing, which
+solves a warning a boot time due to the conflicting muxing
+requirements.
+
+Fixes: fea038ed55ae ("ARM: mvebu: Add proper pin muxing on the Armada 370 DB board")
+Cc: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lkml.kernel.org/r/1414512524-24466-5-git-send-email-thomas.petazzoni@free-electrons.com
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/armada-370-db.dts | 24 ------------------------
+ 1 file changed, 24 deletions(-)
+
+--- a/arch/arm/boot/dts/armada-370-db.dts
++++ b/arch/arm/boot/dts/armada-370-db.dts
+@@ -102,30 +102,6 @@
+ broken-cd;
+ };
+
+- pinctrl {
+- /*
+- * These pins might be muxed as I2S by
+- * the bootloader, but it conflicts
+- * with the real I2S pins that are
+- * muxed using i2s_pins. We must mux
+- * those pins to a function other than
+- * I2S.
+- */
+- pinctrl-0 = <&hog_pins1 &hog_pins2>;
+- pinctrl-names = "default";
+-
+- hog_pins1: hog-pins1 {
+- marvell,pins = "mpp6", "mpp8", "mpp10",
+- "mpp12", "mpp13";
+- marvell,function = "gpio";
+- };
+-
+- hog_pins2: hog-pins2 {
+- marvell,pins = "mpp5", "mpp7", "mpp9";
+- marvell,function = "gpo";
+- };
+- };
+-
+ usb@50000 {
+ status = "okay";
+ };
--- /dev/null
+From e4a680099a6e97ecdbb81081cff9e4a489a4dc44 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 10 Oct 2014 17:24:47 +0400
+Subject: ARM: tegra: Re-add removed SoC id macro to tegra_resume()
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit e4a680099a6e97ecdbb81081cff9e4a489a4dc44 upstream.
+
+Commit d127e9c ("ARM: tegra: make tegra_resume can work with current and later
+chips") removed tegra_get_soc_id macro leaving used cpu register corrupted after
+branching to v7_invalidate_l1() and as result causing execution of unintended
+code on tegra20. Possibly it was expected that r6 would be SoC id func argument
+since common cpu reset handler is setting r6 before branching to tegra_resume(),
+but neither tegra20_lp1_reset() nor tegra30_lp1_reset() aren't setting r6
+register before jumping to resume function. Fix it by re-adding macro.
+
+Fixes: d127e9c (ARM: tegra: make tegra_resume can work with current and later chips)
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-tegra/reset-handler.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-tegra/reset-handler.S
++++ b/arch/arm/mach-tegra/reset-handler.S
+@@ -51,6 +51,7 @@ ENTRY(tegra_resume)
+ THUMB( it ne )
+ bne cpu_resume @ no
+
++ tegra_get_soc_id TEGRA_APB_MISC_BASE, r6
+ /* Are we on Tegra20? */
+ cmp r6, #TEGRA20
+ beq 1f @ Yes
--- /dev/null
+From 7d57511d2dba03a8046c8b428dd9192a4bfc1e73 Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Mon, 17 Nov 2014 10:37:40 +0000
+Subject: arm64: Add COMPAT_HWCAP_LPAE
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 7d57511d2dba03a8046c8b428dd9192a4bfc1e73 upstream.
+
+Commit a469abd0f868 (ARM: elf: add new hwcap for identifying atomic
+ldrd/strd instructions) introduces HWCAP_ELF for 32-bit ARM
+applications. As LPAE is always present on arm64, report the
+corresponding compat HWCAP to user space.
+
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/hwcap.h | 1 +
+ arch/arm64/kernel/setup.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/hwcap.h
++++ b/arch/arm64/include/asm/hwcap.h
+@@ -30,6 +30,7 @@
+ #define COMPAT_HWCAP_IDIVA (1 << 17)
+ #define COMPAT_HWCAP_IDIVT (1 << 18)
+ #define COMPAT_HWCAP_IDIV (COMPAT_HWCAP_IDIVA|COMPAT_HWCAP_IDIVT)
++#define COMPAT_HWCAP_LPAE (1 << 20)
+ #define COMPAT_HWCAP_EVTSTRM (1 << 21)
+
+ #define COMPAT_HWCAP2_AES (1 << 0)
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -72,7 +72,8 @@ EXPORT_SYMBOL_GPL(elf_hwcap);
+ COMPAT_HWCAP_FAST_MULT|COMPAT_HWCAP_EDSP|\
+ COMPAT_HWCAP_TLS|COMPAT_HWCAP_VFP|\
+ COMPAT_HWCAP_VFPv3|COMPAT_HWCAP_VFPv4|\
+- COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV)
++ COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV|\
++ COMPAT_HWCAP_LPAE)
+ unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT;
+ unsigned int compat_elf_hwcap2 __read_mostly;
+ #endif
--- /dev/null
+From 51c9fbb1b146f3336a93d398c439b6fbfe5ab489 Mon Sep 17 00:00:00 2001
+From: Zi Shen Lim <zlim.lnx@gmail.com>
+Date: Wed, 3 Dec 2014 08:38:01 +0000
+Subject: arm64: bpf: lift restriction on last instruction
+
+From: Zi Shen Lim <zlim.lnx@gmail.com>
+
+commit 51c9fbb1b146f3336a93d398c439b6fbfe5ab489 upstream.
+
+Earlier implementation assumed last instruction is BPF_EXIT.
+Since this is no longer a restriction in eBPF, we remove this
+limitation.
+
+Per Alexei Starovoitov [1]:
+> classic BPF has a restriction that last insn is always BPF_RET.
+> eBPF doesn't have BPF_RET instruction and this restriction.
+> It has BPF_EXIT insn which can appear anywhere in the program
+> one or more times and it doesn't have to be last insn.
+
+[1] https://lkml.org/lkml/2014/11/27/2
+
+Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
+Acked-by: Alexei Starovoitov <ast@plumgrid.com>
+Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/net/bpf_jit_comp.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -60,7 +60,7 @@ struct jit_ctx {
+ const struct bpf_prog *prog;
+ int idx;
+ int tmp_used;
+- int body_offset;
++ int epilogue_offset;
+ int *offset;
+ u32 *image;
+ };
+@@ -130,8 +130,8 @@ static void jit_fill_hole(void *area, un
+
+ static inline int epilogue_offset(const struct jit_ctx *ctx)
+ {
+- int to = ctx->offset[ctx->prog->len - 1];
+- int from = ctx->idx - ctx->body_offset;
++ int to = ctx->epilogue_offset;
++ int from = ctx->idx;
+
+ return to - from;
+ }
+@@ -463,6 +463,8 @@ emit_cond_jmp:
+ }
+ /* function return */
+ case BPF_JMP | BPF_EXIT:
++ /* Optimization: when last instruction is EXIT,
++ simply fallthrough to epilogue. */
+ if (i == ctx->prog->len - 1)
+ break;
+ jmp_offset = epilogue_offset(ctx);
+@@ -685,11 +687,13 @@ void bpf_int_jit_compile(struct bpf_prog
+
+ /* 1. Initial fake pass to compute ctx->idx. */
+
+- /* Fake pass to fill in ctx->offset. */
++ /* Fake pass to fill in ctx->offset and ctx->tmp_used. */
+ if (build_body(&ctx))
+ goto out;
+
+ build_prologue(&ctx);
++
++ ctx.epilogue_offset = ctx.idx;
+ build_epilogue(&ctx);
+
+ /* Now we know the actual image size. */
+@@ -706,7 +710,6 @@ void bpf_int_jit_compile(struct bpf_prog
+
+ build_prologue(&ctx);
+
+- ctx.body_offset = ctx.idx;
+ if (build_body(&ctx)) {
+ bpf_jit_binary_free(header);
+ goto out;
--- /dev/null
+From dc6057ecb39edb34b0461ca55382094410bd257a Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Thu, 30 Oct 2014 15:32:56 +0100
+Subject: drm/tegra: gem: dumb: pitch and size are outputs
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit dc6057ecb39edb34b0461ca55382094410bd257a upstream.
+
+When creating a dumb buffer object using the DRM_IOCTL_MODE_CREATE_DUMB
+IOCTL, only the width, height, bpp and flags parameters are inputs. The
+caller is not guaranteed to zero out or set handle, pitch and size, so
+the driver must not treat these values as possible inputs.
+
+Fixes a bug where running the Weston compositor on Tegra DRM would cause
+an attempt to allocate a 3 GiB framebuffer to be allocated.
+
+Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tegra/gem.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/tegra/gem.c
++++ b/drivers/gpu/drm/tegra/gem.c
+@@ -259,16 +259,12 @@ void tegra_bo_free_object(struct drm_gem
+ int tegra_bo_dumb_create(struct drm_file *file, struct drm_device *drm,
+ struct drm_mode_create_dumb *args)
+ {
+- int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
++ unsigned int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
+ struct tegra_drm *tegra = drm->dev_private;
+ struct tegra_bo *bo;
+
+- min_pitch = round_up(min_pitch, tegra->pitch_align);
+- if (args->pitch < min_pitch)
+- args->pitch = min_pitch;
+-
+- if (args->size < args->pitch * args->height)
+- args->size = args->pitch * args->height;
++ args->pitch = round_up(min_pitch, tegra->pitch_align);
++ args->size = args->pitch * args->height;
+
+ bo = tegra_bo_create_with_handle(file, drm, args->size, 0,
+ &args->handle);
dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch
dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch
dm-thin-fix-a-race-in-thin_dtr.patch
+arm64-add-compat_hwcap_lpae.patch
+arm64-bpf-lift-restriction-on-last-instruction.patch
+drm-tegra-gem-dumb-pitch-and-size-are-outputs.patch
+arm-tegra-re-add-removed-soc-id-macro-to-tegra_resume.patch
+arm-mvebu-make-the-coherency_ll.s-functions-work-with-no-coherency-fabric.patch
+arm-mvebu-disable-i-o-coherency-on-non-smp-situations-on-armada-370-375-38x-xp.patch
+arm-mvebu-remove-conflicting-muxing-on-armada-370-db.patch
+arm-mvebu-fix-ordering-in-armada-370-.dtsi.patch
+x86-asm-traps-disable-tracing-and-kprobes-in-fixup_bad_iret-and-sync_regs.patch
--- /dev/null
+From 7ddc6a2199f1da405a2fb68c40db8899b1a8cd87 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@amacapital.net>
+Date: Mon, 24 Nov 2014 17:39:06 -0800
+Subject: x86/asm/traps: Disable tracing and kprobes in fixup_bad_iret and sync_regs
+
+From: Andy Lutomirski <luto@amacapital.net>
+
+commit 7ddc6a2199f1da405a2fb68c40db8899b1a8cd87 upstream.
+
+These functions can be executed on the int3 stack, so kprobes
+are dangerous. Tracing is probably a bad idea, too.
+
+Fixes: b645af2d5905 ("x86_64, traps: Rework bad_iret")
+Signed-off-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Link: http://lkml.kernel.org/r/50e33d26adca60816f3ba968875801652507d0c4.1416870125.git.luto@amacapital.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/traps.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -387,7 +387,7 @@ NOKPROBE_SYMBOL(do_int3);
+ * for scheduling or signal handling. The actual stack switch is done in
+ * entry.S
+ */
+-asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs)
++asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
+ {
+ struct pt_regs *regs = eregs;
+ /* Did already sync */
+@@ -413,7 +413,7 @@ struct bad_iret_stack {
+ struct pt_regs regs;
+ };
+
+-asmlinkage __visible
++asmlinkage __visible notrace
+ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
+ {
+ /*
+@@ -436,6 +436,7 @@ struct bad_iret_stack *fixup_bad_iret(st
+ BUG_ON(!user_mode_vm(&new_stack->regs));
+ return new_stack;
+ }
++NOKPROBE_SYMBOL(fixup_bad_iret);
+ #endif
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
