origin

GIT afcf0a2d9289bbe50aab362e6fb2798038815973

commit 8058bd0faad860e75547cc5cb5d4ade016247a79
Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date:   Thu May 8 07:47:49 2014 -0400

    tracepoint: Fix use of tracepoint funcs after rcu free
    
    Commit de7b2973903c "tracepoint: Use struct pointer instead of name hash
    for reg/unreg tracepoints" introduces a use after free by calling
    release_probes on the old struct tracepoint array before the newly
    allocated array is published with rcu_assign_pointer. There is a race
    window where tracepoints (RCU readers) can perform a
    "use-after-grace-period-after-free", which shows up as a GPF in
    stress-tests.
    
    Link: http://lkml.kernel.org/r/53698021.5020108@oracle.com
    Link: http://lkml.kernel.org/p/1399549669-25465-1-git-send-email-mathieu.desnoyers@efficios.com
    
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    CC: Oleg Nesterov <oleg@redhat.com>
    CC: Dave Jones <davej@redhat.com>
    Fixes: de7b2973903c "tracepoint: Use struct pointer instead of name hash for reg/unreg tracepoints"
    Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

commit 098507ae3ec2331476fb52e85d4040c1cc6d0ef4
Author: Romain Izard <romain.izard.pro@gmail.com>
Date:   Tue Mar 4 10:09:39 2014 +0100

    trace: module: Maintain a valid user count
    
    The replacement of the 'count' variable by two variables 'incs' and
    'decs' to resolve some race conditions during module unloading was done
    in parallel with some cleanup in the trace subsystem, and was integrated
    as a merge.
    
    Unfortunately, the formula for this replacement was wrong in the tracing
    code, and the refcount in the traces was not usable as a result.
    
    Use 'count = incs - decs' to compute the user count.
    
    Link: http://lkml.kernel.org/p/1393924179-9147-1-git-send-email-romain.izard.pro@gmail.com
    
    Acked-by: Ingo Molnar <mingo@kernel.org>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: stable@vger.kernel.org # 2.6.35
    Fixes: c1ab9cab7509 "merge conflict resolution"
    Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

commit 98fcc5762dcecbb264fa4af5a9ae51136858e299
Author: Micky Ching <micky_ching@realsil.com.cn>
Date:   Tue Apr 29 09:54:54 2014 +0800

    mmc: rtsx: Revert "mmc: rtsx: add support for pre_req and post_req"
    
    This reverts commit c42deffd5b53c9e583d83c7964854ede2f12410d.
    
    commit <mmc: rtsx: add support for pre_req and post_req> did use
    mutex_unlock() in tasklet, but mutex_unlock() can't be used in
    tasklet(atomic context). The driver needs to use mutex to avoid
    concurrency, so we can't use tasklet here, the patch need to be
    removed.
    
    The spinlock host->lock and pcr->lock may deadlock, one way to solve
    the deadlock is remove host->lock in sd_isr_done_transfer(), but if
    using workqueue the we can avoid using the spinlock and also avoid
    the problem.
    
    Signed-off-by: Micky Ching <micky_ching@realsil.com.cn>
    Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>

commit 3ca9e5d36afb5c0a6ee6ceee69e507370beb59c6
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue May 6 12:50:12 2014 -0700

    agp: info leak in agpioc_info_wrap()
    
    On 64 bit systems the agp_info struct has a 4 byte hole between
    ->agp_mode and ->aper_base.  We need to clear it to avoid disclosing
    stack information to userspace.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: David Airlie <airlied@linux.ie>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d353efd02357a74753cd45f367a2d3d357fd6904
Author: Fabian Frederick <fabf@skynet.be>
Date:   Tue May 6 12:50:11 2014 -0700

    fs/affs/super.c: bugfix / double free
    
    Commit 842a859db26b ("affs: use ->kill_sb() to simplify ->put_super()
    and failure exits of ->mount()") adds .kill_sb which frees sbi but
    doesn't remove sbi free in case of parse_options error causing double
    free+random crash.
    
    Signed-off-by: Fabian Frederick <fabf@skynet.be>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: <stable@vger.kernel.org>	[3.14.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1e2ee49f7f1b79f0b14884fe6a602f0411b39552
Author: Will Woods <wwoods@redhat.com>
Date:   Tue May 6 12:50:10 2014 -0700

    fanotify: fix -EOVERFLOW with large files on 64-bit
    
    On 64-bit systems, O_LARGEFILE is automatically added to flags inside
    the open() syscall (also openat(), blkdev_open(), etc).  Userspace
    therefore defines O_LARGEFILE to be 0 - you can use it, but it's a
    no-op.  Everything should be O_LARGEFILE by default.
    
    But: when fanotify does create_fd() it uses dentry_open(), which skips
    all that.  And userspace can't set O_LARGEFILE in fanotify_init()
    because it's defined to 0.  So if fanotify gets an event regarding a
    large file, the read() will just fail with -EOVERFLOW.
    
    This patch adds O_LARGEFILE to fanotify_init()'s event_f_flags on 64-bit
    systems, using the same test as open()/openat()/etc.
    
    Addresses https://bugzilla.redhat.com/show_bug.cgi?id=696821
    
    Signed-off-by: Will Woods <wwoods@redhat.com>
    Acked-by: Eric Paris <eparis@redhat.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 41a212859a4dd583d3aa032cdd3efa564c4f189f
Author: Christoph Lameter <cl@linux.com>
Date:   Tue May 6 12:50:08 2014 -0700

    slub: use sysfs'es release mechanism for kmem_cache
    
    debugobjects warning during netfilter exit:
    
        ------------[ cut here ]------------
        WARNING: CPU: 6 PID: 4178 at lib/debugobjects.c:260 debug_print_object+0x8d/0xb0()
        ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x20
        Modules linked in:
        CPU: 6 PID: 4178 Comm: kworker/u16:2 Tainted: G        W 3.11.0-next-20130906-sasha #3984
        Workqueue: netns cleanup_net
        Call Trace:
          dump_stack+0x52/0x87
          warn_slowpath_common+0x8c/0xc0
          warn_slowpath_fmt+0x46/0x50
          debug_print_object+0x8d/0xb0
          __debug_check_no_obj_freed+0xa5/0x220
          debug_check_no_obj_freed+0x15/0x20
          kmem_cache_free+0x197/0x340
          kmem_cache_destroy+0x86/0xe0
          nf_conntrack_cleanup_net_list+0x131/0x170
          nf_conntrack_pernet_exit+0x5d/0x70
          ops_exit_list+0x5e/0x70
          cleanup_net+0xfb/0x1c0
          process_one_work+0x338/0x550
          worker_thread+0x215/0x350
          kthread+0xe7/0xf0
          ret_from_fork+0x7c/0xb0
    
    Also during dcookie cleanup:
    
        WARNING: CPU: 12 PID: 9725 at lib/debugobjects.c:260 debug_print_object+0x8c/0xb0()
        ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x20
        Modules linked in:
        CPU: 12 PID: 9725 Comm: trinity-c141 Not tainted 3.15.0-rc2-next-20140423-sasha-00018-gc4ff6c4 #408
        Call Trace:
          dump_stack (lib/dump_stack.c:52)
          warn_slowpath_common (kernel/panic.c:430)
          warn_slowpath_fmt (kernel/panic.c:445)
          debug_print_object (lib/debugobjects.c:262)
          __debug_check_no_obj_freed (lib/debugobjects.c:697)
          debug_check_no_obj_freed (lib/debugobjects.c:726)
          kmem_cache_free (mm/slub.c:2689 mm/slub.c:2717)
          kmem_cache_destroy (mm/slab_common.c:363)
          dcookie_unregister (fs/dcookies.c:302 fs/dcookies.c:343)
          event_buffer_release (arch/x86/oprofile/../../../drivers/oprofile/event_buffer.c:153)
          __fput (fs/file_table.c:217)
          ____fput (fs/file_table.c:253)
          task_work_run (kernel/task_work.c:125 (discriminator 1))
          do_notify_resume (include/linux/tracehook.h:196 arch/x86/kernel/signal.c:751)
          int_signal (arch/x86/kernel/entry_64.S:807)
    
    Sysfs has a release mechanism.  Use that to release the kmem_cache
    structure if CONFIG_SYSFS is enabled.
    
    Only slub is changed - slab currently only supports /proc/slabinfo and
    not /sys/kernel/slab/*.  We talked about adding that and someone was
    working on it.
    
    [akpm@linux-foundation.org: fix CONFIG_SYSFS=n build]
    [akpm@linux-foundation.org: fix CONFIG_SYSFS=n build even more]
    Signed-off-by: Christoph Lameter <cl@linux.com>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Tested-by: Sasha Levin <sasha.levin@oracle.com>
    Acked-by: Greg KH <greg@kroah.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: Russell King <rmk@arm.linux.org.uk>
    Cc: Bart Van Assche <bvanassche@acm.org>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 623762517e2370be3b3f95f4fe08d6c063a49b06
Author: Johannes Weiner <hannes@cmpxchg.org>
Date:   Tue May 6 12:50:07 2014 -0700

    revert "mm: vmscan: do not swap anon pages just because free+file is low"
    
    This reverts commit 0bf1457f0cfc ("mm: vmscan: do not swap anon pages
    just because free+file is low") because it introduced a regression in
    mostly-anonymous workloads, where reclaim would become ineffective and
    trap every allocating task in direct reclaim.
    
    The problem is that there is a runaway feedback loop in the scan balance
    between file and anon, where the balance tips heavily towards a tiny
    thrashing file LRU and anonymous pages are no longer being looked at.
    The commit in question removed the safe guard that would detect such
    situations and respond with forced anonymous reclaim.
    
    This commit was part of a series to fix premature swapping in loads with
    relatively little cache, and while it made a small difference, the cure
    is obviously worse than the disease.  Revert it.
    
    Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
    Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Acked-by: Rafael Aquini <aquini@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: <stable@kernel.org>		[3.12+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 6b6751f7feba68d8f5c72b72cc69a1c5a625529c
Author: Ian Kent <raven@themaw.net>
Date:   Tue May 6 12:50:06 2014 -0700

    autofs: fix lockref lookup
    
    autofs needs to be able to see private data dentry flags for its dentrys
    that are being created but not yet hashed and for its dentrys that have
    been rmdir()ed but not yet freed.  It needs to do this so it can block
    processes in these states until a status has been returned to indicate
    the given operation is complete.
    
    It does this by keeping two lists, active and expring, of dentrys in
    this state and uses ->d_release() to keep them stable while it checks
    the reference count to determine if they should be used.
    
    But with the recent lockref changes dentrys being freed sometimes don't
    transition to a reference count of 0 before being freed so autofs can
    occassionally use a dentry that is invalid which can lead to a panic.
    
    Signed-off-by: Ian Kent <raven@themaw.net>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 139b6a6fb1539e04b01663d61baff3088c63dbb5
Author: Johannes Weiner <hannes@cmpxchg.org>
Date:   Tue May 6 12:50:05 2014 -0700

    mm: filemap: update find_get_pages_tag() to deal with shadow entries
    
    Dave Jones reports the following crash when find_get_pages_tag() runs
    into an exceptional entry:
    
      kernel BUG at mm/filemap.c:1347!
      RIP: find_get_pages_tag+0x1cb/0x220
      Call Trace:
        find_get_pages_tag+0x36/0x220
        pagevec_lookup_tag+0x21/0x30
        filemap_fdatawait_range+0xbe/0x1e0
        filemap_fdatawait+0x27/0x30
        sync_inodes_sb+0x204/0x2a0
        sync_inodes_one_sb+0x19/0x20
        iterate_supers+0xb2/0x110
        sys_sync+0x44/0xb0
        ia32_do_call+0x13/0x13
    
      1343                         /*
      1344                          * This function is never used on a shmem/tmpfs
      1345                          * mapping, so a swap entry won't be found here.
      1346                          */
      1347                         BUG();
    
    After commit 0cd6144aadd2 ("mm + fs: prepare for non-page entries in
    page cache radix trees") this comment and BUG() are out of date because
    exceptional entries can now appear in all mappings - as shadows of
    recently evicted pages.
    
    However, as Hugh Dickins notes,
    
      "it is truly surprising for a PAGECACHE_TAG_WRITEBACK (and probably
       any other PAGECACHE_TAG_*) to appear on an exceptional entry.
    
       I expect it comes down to an occasional race in RCU lookup of the
       radix_tree: lacking absolute synchronization, we might sometimes
       catch an exceptional entry, with the tag which really belongs with
       the unexceptional entry which was there an instant before."
    
    And indeed, not only is the tree walk lockless, the tags are also read
    in chunks, one radix tree node at a time.  There is plenty of time for
    page reclaim to swoop in and replace a page that was already looked up
    as tagged with a shadow entry.
    
    Remove the BUG() and update the comment.  While reviewing all other
    lookup sites for whether they properly deal with shadow entries of
    evicted pages, update all the comments and fix memcg file charge moving
    to not miss shmem/tmpfs swapcache pages.
    
    Fixes: 0cd6144aadd2 ("mm + fs: prepare for non-page entries in page cache radix trees")
    Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
    Reported-by: Dave Jones <davej@redhat.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 49e068f0b73dd042c186ffa9b420a9943e90389a
Author: Vlastimil Babka <vbabka@suse.cz>
Date:   Tue May 6 12:50:03 2014 -0700

    mm/compaction: make isolate_freepages start at pageblock boundary
    
    The compaction freepage scanner implementation in isolate_freepages()
    starts by taking the current cc->free_pfn value as the first pfn.  In a
    for loop, it scans from this first pfn to the end of the pageblock, and
    then subtracts pageblock_nr_pages from the first pfn to obtain the first
    pfn for the next for loop iteration.
    
    This means that when cc->free_pfn starts at offset X rather than being
    aligned on pageblock boundary, the scanner will start at offset X in all
    scanned pageblock, ignoring potentially many free pages.  Currently this
    can happen when
    
     a) zone's end pfn is not pageblock aligned, or
    
     b) through zone->compact_cached_free_pfn with CONFIG_HOLES_IN_ZONE
        enabled and a hole spanning the beginning of a pageblock
    
    This patch fixes the problem by aligning the initial pfn in
    isolate_freepages() to pageblock boundary.  This also permits replacing
    the end-of-pageblock alignment within the for loop with a simple
    pageblock_nr_pages increment.
    
    Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
    Reported-by: Heesub Shin <heesub.shin@samsung.com>
    Acked-by: Minchan Kim <minchan@kernel.org>
    Cc: Mel Gorman <mgorman@suse.de>
    Acked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Cc: Michal Nazarewicz <mina86@mina86.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Christoph Lameter <cl@linux.com>
    Acked-by: Rik van Riel <riel@redhat.com>
    Cc: Dongjun Shin <d.j.shin@samsung.com>
    Cc: Sunghwan Yun <sunghwan.yun@samsung.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0e3b7e5402cbec4cee58895a00945356ee26a720
Author: Seth Jennings <sjennings@variantweb.net>
Date:   Tue May 6 12:50:02 2014 -0700

    MAINTAINERS: zswap/zbud: change maintainer email address
    
    sjenning@linux.vnet.ibm.com is no longer a viable entity.
    
    Signed-off-by: Seth Jennings <sjennings@variantweb.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d5c9fde3dae750889168807038243ff36431d276
Author: Rik van Riel <riel@redhat.com>
Date:   Tue May 6 12:50:01 2014 -0700

    mm/page-writeback.c: fix divide by zero in pos_ratio_polynom
    
    It is possible for "limit - setpoint + 1" to equal zero, after getting
    truncated to a 32 bit variable, and resulting in a divide by zero error.
    
    Using the fully 64 bit divide functions avoids this problem.  It also
    will cause pos_ratio_polynom() to return the correct value when
    (setpoint - limit) exceeds 2^32.
    
    Also uninline pos_ratio_polynom, at Andrew's request.
    
    Signed-off-by: Rik van Riel <riel@redhat.com>
    Reviewed-by: Michal Hocko <mhocko@suse.cz>
    Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
    Cc: Luiz Capitulino <lcapitulino@redhat.com>
    Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 457c1b27ed56ec472d202731b12417bff023594a
Author: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Date:   Tue May 6 12:50:00 2014 -0700

    hugetlb: ensure hugepage access is denied if hugepages are not supported
    
    Currently, I am seeing the following when I `mount -t hugetlbfs /none
    /dev/hugetlbfs`, and then simply do a `ls /dev/hugetlbfs`.  I think it's
    related to the fact that hugetlbfs is properly not correctly setting
    itself up in this state?:
    
      Unable to handle kernel paging request for data at address 0x00000031
      Faulting instruction address: 0xc000000000245710
      Oops: Kernel access of bad area, sig: 11 [#1]
      SMP NR_CPUS=2048 NUMA pSeries
      ....
    
    In KVM guests on Power, in a guest not backed by hugepages, we see the
    following:
    
      AnonHugePages:         0 kB
      HugePages_Total:       0
      HugePages_Free:        0
      HugePages_Rsvd:        0
      HugePages_Surp:        0
      Hugepagesize:         64 kB
    
    HPAGE_SHIFT == 0 in this configuration, which indicates that hugepages
    are not supported at boot-time, but this is only checked in
    hugetlb_init().  Extract the check to a helper function, and use it in a
    few relevant places.
    
    This does make hugetlbfs not supported (not registered at all) in this
    environment.  I believe this is fine, as there are no valid hugepages
    and that won't change at runtime.
    
    [akpm@linux-foundation.org: use pr_info(), per Mel]
    [akpm@linux-foundation.org: fix build when HPAGE_SHIFT is undefined]
    Signed-off-by: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
    Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Acked-by: Mel Gorman <mgorman@suse.de>
    Cc: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 93030d83b9e1079836d82b46ab3ec671b1fdb623
Author: Vladimir Davydov <vdavydov@parallels.com>
Date:   Tue May 6 12:49:59 2014 -0700

    slub: fix memcg_propagate_slab_attrs
    
    After creating a cache for a memcg we should initialize its sysfs attrs
    with the values from its parent.  That's what memcg_propagate_slab_attrs
    is for.  Currently it's broken - we clearly muddled root-vs-memcg caches
    there.  Let's fix it up.
    
    Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: Michal Hocko <mhocko@suse.cz>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 35738392b6c050625e41cc6b941f9828794149b3
Author: Chris Cui <chris.wei.cui@gmail.com>
Date:   Tue May 6 12:49:58 2014 -0700

    drivers/rtc/rtc-pcf8523.c: fix month definition
    
    PCF8523 uses 1-12 to represent month according to datasheet.
    link: www.nxp.com/documents/data_sheet/PCF8523.pdf.
    
    Signed-off-by: Chris Cui <chris.wei.cui@gmail.com>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 39f1f78d53b9bcbca91967380c5f0f2305a5c55f
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue May 6 14:02:53 2014 -0400

    nick kvfree() from apparmor
    
    too many places open-code it
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 50c6e282bdf5e8dabf8d7cf7b162545a55645fd9
Author: Christoph Hellwig <hch@lst.de>
Date:   Sun May 4 13:03:32 2014 +0200

    posix_acl: handle NULL ACL in posix_acl_equiv_mode
    
    Various filesystems don't bother checking for a NULL ACL in
    posix_acl_equiv_mode, and thus can dereference a NULL pointer when it
    gets passed one. This usually happens from the NFS server, as the ACL tools
    never pass a NULL ACL, but instead of one representing the mode bits.
    
    Instead of adding boilerplat to all filesystems put this check into one place,
    which will allow us to remove the check from other filesystems as well later
    on.
    
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Reported-by: Ben Greear <greearb@candelatech.com>
    Reported-by: Marco Munderloh <munderl@tnt.uni-hannover.de>,
    Cc: Chuck Lever <chuck.lever@oracle.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 573471c1374e6a54a78efc1d1c047733981c99e2
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:55 2014 -0400

    drm/radeon: add pci ids for Mullins
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 428beddd0236842c6e8f4aabe9597763c2ae9a3b
Author: Leo Liu <leo.liu@amd.com>
Date:   Wed Apr 30 18:40:54 2014 -0400

    drm/radeon: add Mullins VCE support
    
    VCE 2.0 just like the other CIK parts.
    
    Signed-off-by: Leo Liu <leo.liu@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit b214f2a4ba415dcad40fcc7c195d0a402f8211de
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:53 2014 -0400

    drm/radeon: modesetting updates for Mullins.
    
    Uses the same code as Kabini.
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 47f5c7461660b6b550018b83b5b98e330b2d0f7e
Author: Alex Deucher <alexdeucher@gmail.com>
Date:   Wed Apr 30 18:40:52 2014 -0400

    drm/radeon: dpm updates for KV/KB
    
    - Use vddc/sclk dep table for voltage if available
    - Fix UVD DPM setup
    - Patch voltage tables properly for non-UVD blocks
    - Fix DPM + UVD/VCE on Mullins
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 7d032a4b8d460397b6e4a3f343a59fdd1bd5a487
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:51 2014 -0400

    drm/radeon: add Mullins dpm support.
    
    Generic dpm support similar to Kabini. Mullins specific features
    will be worked on later.
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 3f6f0737ba8e9a1bbd47b8cd221386c39c76cd6a
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:50 2014 -0400

    drm/radeon: add Mullins UVD support.
    
    Has same version of UVD as other CIK parts.
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit f73a9e837286bb67c54701441cb51c54aa4abd6a
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:49 2014 -0400

    drm/radeon: update cik init for Mullins.
    
    Also add golden registers, update firmware loading functions.
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit b0a9f22a182487996e530b38e07f02d8ea0bc3cc
Author: Samuel Li <samuel.li@amd.com>
Date:   Wed Apr 30 18:40:48 2014 -0400

    drm/radeon: add Mullins chip family
    
    Mullins is a new CI-based APU.
    
    Signed-off-by: Samuel Li <samuel.li@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit cbe655137aa8f644f4985021a1e1e65df1d28fa8
Author: Christian König <christian.koenig@amd.com>
Date:   Thu May 1 19:00:41 2014 +0200

    drm/radeon: lower the ref * post PLL maximum
    
    Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=75241
    
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit cde10122dc126a223e783f0b40bdb08cc332ab17
Author: Christian König <christian.koenig@amd.com>
Date:   Fri May 2 14:27:42 2014 +0200

    drm/radeon: check that we have a clock before PLL setup
    
    Partially fixes: https://bugzilla.kernel.org/show_bug.cgi?id=75211
    
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit aa4c8b36e5fcf70ba5ec7d175da19dac4a33c51a
Author: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Date:   Thu Apr 24 13:29:14 2014 +0200

    drm/radeon: drm/radeon: add missing radeon_semaphore_free to error path
    
    It would appear this bug has been copy/pasted many times without being noticed.
    
    Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>

commit e9d14aeb3005fc09a937ca419c08b3c612a76a90
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Tue Apr 22 16:53:52 2014 +0900

    drm/radeon: Fix num_banks calculation for SI
    
    The way the tile mode array index was calculated only makes sense for
    the CIK specific macrotile mode array. For SI, we need to use one of the
    tile mode array indices reserved for displayable surfaces.
    
    This happened to result in correct display most if not all of the time
    because most of the SI tiling modes use the same number of banks.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by:  Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 30321c7b658a5661eea715b33e82a5fd3e33e180
Author: David Miller <davem@davemloft.net>
Date:   Mon May 5 16:20:04 2014 -0400

    slab: Fix off by one in object max number tests.
    
    If freelist_idx_t is a byte, SLAB_OBJ_MAX_NUM should be 255 not 256, and
    likewise if freelist_idx_t is a short, then it should be 65535 not
    65536.
    
    This was leading to all kinds of random crashes on sparc64 where
    PAGE_SIZE is 8192.  One problem shown was that if spinlock debugging was
    enabled, we'd get deadlocks in copy_pte_range() or do_wp_page() with the
    same cpu already holding a lock it shouldn't hold, or the lock belonging
    to a completely unrelated process.
    
    Fixes: a41adfaa23df ("slab: introduce byte sized index for the freelist of a slab")
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 7cc68973c36d92c493fc07ff38df6347f85a532e
Author: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Date:   Fri Apr 18 16:24:09 2014 +0900

    slab: fix the type of the index on freelist index accessor
    
    Commit a41adfaa23df ("slab: introduce byte sized index for the freelist
    of a slab") changes the size of freelist index and also changes
    prototype of accessor function to freelist index.  And there was a
    mistake.
    
    The mistake is that although it changes the size of freelist index
    correctly, it changes the size of the index of freelist index
    incorrectly.  With patch, freelist index can be 1 byte or 2 bytes, that
    means that num of object on on a slab can be more than 255.  So we need
    more than 1 byte for the index to find the index of free object on
    freelist.  But, above patch makes this index type 1 byte, so slab which
    have more than 255 objects cannot work properly and in consequence of
    it, the system cannot boot.
    
    This issue was reported by Steven King on m68knommu which would use
    2 bytes freelist index:
    
      https://lkml.org/lkml/2014/4/16/433
    
    To fix is easy.  To change the type of the index of freelist index on
    accessor functions is enough to fix this bug.  Although 2 bytes is
    enough, I use 4 bytes since it have no bad effect and make things more
    easier.  This fix was suggested and tested by Steven in his original
    report.
    
    Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Reported-and-acked-by: Steven King <sfking@fdwdc.com>
    Acked-by: Christoph Lameter <cl@linux.com>
    Tested-by: James Hogan <james.hogan@imgtec.com>
    Tested-by: David Miller <davem@davemloft.net>
    Cc: Pekka Enberg <penberg@kernel.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 825747bb85634a2a7b7dce4e373831e211ab1644
Author: Peter F. Patel-Schneider <pfpschneider@gmail.com>
Date:   Mon May 5 15:55:32 2014 -0700

    HID: sensor-hub: Add in quirk for sensor hub in Lenovo Ideapad Yogas
    
    The sensor hub in Lenovo Yogas needs the enumeration quirk.  I've been running
    the patch for over a month with no problems, whereas the unpatched drivers
    reliably mis-initialized the sensors.
    
    Signed-off-by: Peter F. Patel-Schneider <pfpschneider@gmail.com>
    Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>

commit 8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59
Author: Dave Chinner <dchinner@redhat.com>
Date:   Tue May 6 07:37:31 2014 +1000

    xfs: remote attribute overwrite causes transaction overrun
    
    Commit e461fcb ("xfs: remote attribute lookups require the value
    length") passes the remote attribute length in the xfs_da_args
    structure on lookup so that CRC calculations and validity checking
    can be performed correctly by related code. This, unfortunately has
    the side effect of changing the args->valuelen parameter in cases
    where it shouldn't.
    
    That is, when we replace a remote attribute, the incoming
    replacement stores the value and length in args->value and
    args->valuelen, but then the lookup which finds the existing remote
    attribute overwrites args->valuelen with the length of the remote
    attribute being replaced. Hence when we go to create the new
    attribute, we create it of the size of the existing remote
    attribute, not the size it is supposed to be. When the new attribute
    is much smaller than the old attribute, this results in a
    transaction overrun and an ASSERT() failure on a debug kernel:
    
    XFS: Assertion failed: tp->t_blk_res_used <= tp->t_blk_res, file: fs/xfs/xfs_trans.c, line: 331
    
    Fix this by keeping the remote attribute value length separate to
    the attribute value length in the xfs_da_args structure. The enables
    us to pass the length of the remote attribute to be removed without
    overwriting the new attribute's length.
    
    Also, ensure that when we save remote block contexts for a later
    rename we zero the original state variables so that we don't confuse
    the state of the attribute to be removes with the state of the new
    attribute that we just added. [Spotted by Brain Foster.]
    
    Signed-off-by: Dave Chinner <dchinner@redhat.com>
    Reviewed-by: Brian Foster <bfoster@redhat.com>
    Signed-off-by: Dave Chinner <david@fromorbit.com>

commit d540e43b0ab134b22f015f725ce6e070d12b0244
Author: Brian Foster <bfoster@redhat.com>
Date:   Tue May 6 07:34:28 2014 +1000

    xfs: initialize default acls for ->tmpfile()
    
    The current tmpfile handler does not initialize default ACLs. Doing so
    within xfs_vn_tmpfile() makes it roughly equivalent to xfs_vn_mknod(),
    which is already used as a common create handler.
    
    xfs_vn_mknod() does not currently have a mechanism to determine whether
    to link the file into the namespace. Therefore, further abstract
    xfs_vn_mknod() into a new xfs_generic_create() handler with a tmpfile
    parameter. This new handler calls xfs_create_tmpfile() and d_tmpfile()
    on the dentry when called via ->tmpfile().
    
    Signed-off-by: Brian Foster <bfoster@redhat.com>
    Reviewed-by: Dave Chinner <dchinner@redhat.com>
    Signed-off-by: Dave Chinner <david@fromorbit.com>

commit c8ea5a22bd3b27d68ec2f95483ce8bfe7f114933
Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
Date:   Sun May 4 15:43:02 2014 -0700

    net: macb: Fix race between HW and driver
    
    Under "heavy" RX load, the driver cannot handle the descriptors fast
    enough. In detail, when a descriptor is consumed, its used flag is
    cleared and once the RX budget is consumed all descriptors with a
    cleared used flag are prepared to receive more data. Under load though,
    the HW may constantly receive more data and use those descriptors with a
    cleared used flag before they are actually prepared for next usage.
    
    The head and tail pointers into the RX-ring should always be valid and
    we can omit clearing and checking of the used flag.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 504ad98df3a6b027ce997ca8f620e949cafb151f
Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
Date:   Sun May 4 15:43:01 2014 -0700

    net: macb: Remove 'unlikely' optimization
    
    Coverage data suggests that the unlikely case of receiving data while
    the receive handler is running may not be that unlikely.
    Coverage data after running iperf for a while:
        91320:  891:	work_done = bp->macbgem_ops.mog_rx(bp, budget);
        91320:  892:	if (work_done < budget) {
         2362:  893:		napi_complete(napi);
            -:  894:
            -:  895:		/* Packets received while interrupts were disabled */
         4724:  896:		status = macb_readl(bp, RSR);
         2362:  897:		if (unlikely(status)) {
          762:  898:			if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
          762:  899:				macb_writel(bp, ISR, MACB_BIT(RCOMP));
            -:  900:			napi_reschedule(napi);
            -:  901:		} else {
         1600:  902:			macb_writel(bp, IER, MACB_RX_INT_FLAGS);
            -:  903:		}
            -:  904:	}
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 02f7a34f34e30ee6fd02e01201ae130003e516ab
Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
Date:   Sun May 4 15:43:00 2014 -0700

    net: macb: Re-enable RX interrupt only when RX is done
    
    When data is received during the driver processing received data the
    NAPI is re-scheduled. In that case the RX interrupt should not be
    re-enabled.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6a027b705fb6d2214647a638b44ea91ee6ce7e4c
Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
Date:   Sun May 4 15:42:59 2014 -0700

    net: macb: Clear interrupt flags
    
    A few interrupt flags were not cleared in the ISR, resulting in a sytem
    trapped in the ISR in cases one of those interrupts occurred. Clear all
    flags to avoid such situations.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ccd6d0a9104e9075e57fa539ed6bb622b15284d9
Author: Soren Brinkmann <soren.brinkmann@xilinx.com>
Date:   Sun May 4 15:42:58 2014 -0700

    net: macb: Pass same size to DMA_UNMAP as used for DMA_MAP
    
    Just as commit "net: macb: DMA-unmap full rx-buffer"
    (48330e08fa168395b9fd9f369f06cca1df204361), pass the size that
    was used for mapping the memory also to the unmap routine to
    avoid warnings from the DMA_API.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e96f2e7c430014eff52c93cabef1ad4f42ed0db1
Author: Ying Cai <ycai@google.com>
Date:   Sun May 4 15:20:04 2014 -0700

    ip_tunnel: Set network header properly for IP_ECN_decapsulate()
    
    In ip_tunnel_rcv(), set skb->network_header to inner IP header
    before IP_ECN_decapsulate().
    
    Without the fix, IP_ECN_decapsulate() takes outer IP header as
    inner IP header, possibly causing error messages or packet drops.
    
    Note that this skb_reset_network_header() call was in this spot when
    the original feature for checking consistency of ECN bits through
    tunnels was added in eccc1bb8d4b4 ("tunnel: drop packet if ECN present
    with not-ECT"). It was only removed from this spot in 3d7b46cd20e3
    ("ip_tunnel: push generic protocol handling to ip_tunnel module.").
    
    Fixes: 3d7b46cd20e3 ("ip_tunnel: push generic protocol handling to ip_tunnel module.")
    Reported-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: Ying Cai <ycai@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2c9826243bebeb90a57a7946d4144a2a9a43dc39
Author: David Ertman <davidx.m.ertman@intel.com>
Date:   Thu May 1 02:19:03 2014 +0000

    e1000e: Restrict MDIO Slow Mode workaround to relevant parts
    
    It has been determined that the workaround of putting the PHY into MDIO
    slow mode to access the PHY id is not necessary with Lynx Point and newer
    parts.  The issue that necessitated the workaround has been fixed on the
    newer hardware.
    
    We will maintains, as a last ditch attempt, the conversion to MDIO Slow
    Mode in the failure branch when attempting to access the PHY id so as to
    cover all contingencies.
    
    Signed-off-by: Dave Ertman <davidx.m.ertman@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit 7142a55c3c1fee89a60aa7b402c834b6b8afcb0a
Author: David Ertman <davidx.m.ertman@intel.com>
Date:   Thu May 1 01:22:26 2014 +0000

    e1000e: Fix issue with link flap on 82579
    
    Several customers have reported a link flap issue on 82579. The symptoms
    are random and intermittent link losses when 82579 is connected to specific
    link partners. Issue has been root caused as interoperability problem
    between 82579 and at least some Broadcom PHYs in the Energy Efficient
    Ethernet wake mechanism.
    
    To fix the issue, we are disabling the Phase Locked Loop shutdown in 100M
    Low Power Idle.  This solution will cause an increase of power in 100M EEE
    link. It will cost additional 28mW in this specific mode.
    
    Cc: Lukasz Adamczuk <lukasz.adamczuk@intel.com>
    Signed-off-by: Dave Ertman <davidx.m.ertman@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit fbb9ab10a289ff28b70f53af302d119401960a39
Author: David Ertman <davidx.m.ertman@intel.com>
Date:   Tue Apr 22 05:48:54 2014 +0000

    e1000e: Expand workaround for 10Mb HD throughput bug
    
    In commit 772d05c51c4f4896c120ad418b1e91144a2ac813 "e1000e: slow performance
    between two 82579 connected via 10Mbit hub", a workaround was put into place
    to address the overaggressive transmit behavior of 82579 parts when connecting
    at 10Mbs half-duplex.
    
    This same behavior is seen on i217 and i218 parts as well.  This patch expands
    the original workaround to encompass these parts.
    
    Signed-off-by: Dave Ertman <davidx.m.ertman@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit 77e61146c67765deae45faa7db088c64a9fbca00
Author: David Ertman <davidx.m.ertman@intel.com>
Date:   Tue Apr 22 05:25:53 2014 +0000

    e1000e: Workaround for dropped packets in Gig/100 speeds on 82579
    
    This is a workaround for a HW erratum on 82579 devices.
    Erratum is #23 in Intel 6 Series Chipset and Intel C200 Series Chipset
    specification Update June 2013.
    
    Problem: 82579 parts experience packet loss in Gig and 100 speeds
    when interconnect between PHY and MAC is exiting K1 power saving state.
    This was previously believed to only affect 1Gig speed, but has been observed
    at 100Mbs also.
    
    Workaround: Disable K1 for 82579 devices at Gig and 100 speeds.
    
    Signed-off-by: Dave Ertman <davidx.m.ertman@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit 83d3459a5928f18c9344683e31bc2a7c3c25562a
Author: Eyal Perry <eyalpe@mellanox.com>
Date:   Sun May 4 17:07:25 2014 +0300

    net/mlx4_core: Don't issue PCIe speed/width checks for VFs
    
    Carrying out PCI speed/width checks through pcie_get_minimum_link()
    on VFs yield wrong results, so remove them.
    
    Fixes: b912b2f ('net/mlx4_core: Warn if device doesn't have enough PCI bandwidth')
    Signed-off-by: Eyal Perry <eyalpe@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit f24f790f8eb8bca00c66781b21de2a9ff7cd1c00
Author: Or Gerlitz <ogerlitz@mellanox.com>
Date:   Sun May 4 17:07:24 2014 +0300

    net/mlx4_core: Load the Eth driver first
    
    When running in SRIOV mode, VM that is assigned with a non-provisioned
    Ethernet VFs get themselves a random mac when the Eth driver starts. In
    this case, if the IB driver startup code that deals with RoCE runs first,
    it will use a zero mac as the source mac for the Para-Virtual CM MADs
    which is buggy. To handle that, we change the order of loading.
    
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0254bc8205195c96b47abe33c67f8ccd2f2dad69
Author: Matan Barak <matanb@mellanox.com>
Date:   Sun May 4 17:07:23 2014 +0300

    net/mlx4_core: Fix slave id computation for single port VF
    
    The code that deals with computing the slave id based on a given GID
    gave wrong results when the number of single port VFs wasn't the
    same for port 1 vs. port 2 and the relevant VF is single ported on
    port 2. As a result, incoming CM MADs were dispatched to the wrong VF.
    Fixed that and added documentation to clarify the computation steps.
    
    Fixes: 449fc48 ('net/mlx4: Adapt code for N-Port VF')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 531d9014d5c870fdf493e626c4b4e448273cb616
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Sun May 4 17:07:22 2014 +0300

    net/mlx4_core: Adjust port number in qp_attach wrapper when detaching
    
    When using single ported VFs and the VF is using port 2, we need
    to adjust the port accordingly (change it from 1 to 2).
    
    Fixes: 449fc48 ('net/mlx4: Adapt code for N-Port VF')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 36189cc3cd57ab0f1cd75241f93fe01de928ac06
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon May 5 09:36:43 2014 -0700

    Input: elantech - fix touchpad initialization on Gigabyte U2442
    
    The hw_version 3 Elantech touchpad on the Gigabyte U2442 does not accept
    0x0b as initialization value for r10, this stand-alone version of the
    driver: http://planet76.com/drivers/elantech/psmouse-elantech-v6.tar.bz2
    
    Uses 0x03 which does work, so this means not setting bit 3 of r10 which
    sets: "Enable Real H/W Resolution In Absolute mode"
    
    Which will result in half the x and y resolution we get with that bit set,
    so simply not setting it everywhere is not a solution. We've been unable to
    find a way to identify touchpads where setting the bit will fail, so this
    patch uses a dmi based blacklist for this.
    
    https://bugzilla.kernel.org/show_bug.cgi?id=61151
    
    Cc: stable@vger.kernel.org
    Reported-by: Philipp Wolfer <ph.wolfer@gmail.com>
    Tested-by: Philipp Wolfer <ph.wolfer@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 9becd707841207652449a8dfd90fe9c476d88546
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri May 2 23:27:00 2014 +0200

    net: cdc_ncm: fix buffer overflow
    
    Commit 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs
    if we send ZLPs") changed the padding logic for devices with the ZLP
    flag set.  This meant that frames of any size will be sent without
    additional padding, except for the single byte added if the size is
    a multiple of the USB packet size. But if the unpadded size is
    identical to the maximum frame size, and the maximum size is a
    multiplum of the USB packet size, then this one-byte padding will
    overflow the buffer.
    
    Prevent padding if already at maximum frame size, letting usbnet
    transmit a ZLP instead in this case.
    
    Fixes: 4d619f625a60 ("net: cdc_ncm: no point in filling up the NTBs if we send ZLPs")
    Reported by: Yu-an Shih <yshih@nvidia.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9d4619c492c84e4c1e6d7127f1cbf55da04599d0
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Fri May 2 06:29:21 2014 +0200

    Altera TSE: ALTERA_TSE should depend on HAS_DMA
    
    If NO_DMA=y:
    
    drivers/built-in.o: In function `altera_tse_probe':
    altera_tse_main.c:(.text+0x25ec2e): undefined reference to `dma_set_mask'
    altera_tse_main.c:(.text+0x25ec78): undefined reference to `dma_supported'
    altera_tse_main.c:(.text+0x25ecb6): undefined reference to `dma_supported'
    drivers/built-in.o: In function `sgdma_async_read':
    altera_sgdma.c:(.text+0x25f620): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `sgdma_uninitialize':
    (.text+0x25f678): undefined reference to `dma_unmap_single'
    drivers/built-in.o: In function `sgdma_uninitialize':
    (.text+0x25f696): undefined reference to `dma_unmap_single'
    drivers/built-in.o: In function `sgdma_initialize':
    (.text+0x25f6f0): undefined reference to `dma_map_single'
    drivers/built-in.o: In function `sgdma_initialize':
    (.text+0x25f702): undefined reference to `dma_mapping_error'
    drivers/built-in.o: In function `sgdma_tx_buffer':
    (.text+0x25f92a): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `sgdma_rx_status':
    (.text+0x25fa24): undefined reference to `dma_sync_single_for_cpu'
    make[3]: *** [vmlinux] Error 1
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Acked-by: Vince Bridgers <vbridgers2013@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2c4a336e0a3e203fab6aa8d8f7bb70a0ad968a6b
Author: Andy King <acking@vmware.com>
Date:   Thu May 1 15:20:43 2014 -0700

    vsock: Make transport the proto owner
    
    Right now the core vsock module is the owner of the proto family. This
    means there's nothing preventing the transport module from unloading if
    there are open sockets, which results in a panic. Fix that by allowing
    the transport to be the owner, which will refcount it properly.
    
    Includes version bump to 1.0.1.0-k
    
    Passes checkpatch this time, I swear...
    
    Acked-by: Dmitry Torokhov <dtor@vmware.com>
    Signed-off-by: Andy King <acking@vmware.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 55b441be5cd600bf645a01b14900880a09941d4c
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Thu May 1 04:46:36 2014 +0400

    xtensa: ISS: don't depend on CONFIG_TTY
    
    Build console support only when CONFIG_TTY is selected.
    This restores ISS as the default platform for allnoconfig builds.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
    Signed-off-by: Chris Zankel <chris@zankel.net>

commit 0624bcaaf06c1fe5aca4e72287a3f13026764d36
Author: Christoph Hellwig <hch@infradead.org>
Date:   Fri Apr 25 01:12:01 2014 -0700

    fix quoting of Ted's name in MAINTAINERS
    
    Unpaired quotes really confuse mutt when copy & pasting it into the To:
    form.
    
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    [ I'm going to remove all silly quotes entirely one day, but that day is
      not today.  So I'll just apply this  - Linus ]
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 2145e15e0557a01b9195d1c7199a1b92cb9be81f
Author: Matthew Daley <mattd@bugfuzz.com>
Date:   Mon Apr 28 19:05:21 2014 +1200

    floppy: don't write kernel-only members to FDRAWCMD ioctl output
    
    Do not leak kernel-only floppy_raw_cmd structure members to userspace.
    This includes the linked-list pointer and the pointer to the allocated
    DMA space.
    
    Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c
Author: Matthew Daley <mattd@bugfuzz.com>
Date:   Mon Apr 28 19:05:20 2014 +1200

    floppy: ignore kernel-only members in FDRAWCMD ioctl input
    
    Always clear out these floppy_raw_cmd struct members after copying the
    entire structure from userspace so that the in-kernel version is always
    valid and never left in an interdeterminate state.
    
    Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f06ab794af7055d0949b09885f79f8b493deec64
Author: Anssi Hannula <anssi.hannula@iki.fi>
Date:   Mon May 5 02:38:43 2014 +0300

    ALSA: hda - hdmi: Set converter channel count even without sink
    
    Since commit 1df5a06a ("ALSA: hda - hdmi: Fix programmed active channel
    count") channel count is no longer being set if monitor_present is 0.
    This is because setting the count was moved after the CA value is
    determined, which is only after the monitor_present check in
    hdmi_setup_audio_infoframe().
    
    Unfortunately, in some cases, such as with a non-spec-compliant codec or
    with a problematic video driver, monitor_present is always 0. As a
    specific example, this seems to happen with gen1 ATV (SiI1390 codec),
    causing left-channel-only stereo playback (multi-channel playback has
    apparently never worked with this codec despite it reporting 8 channels,
    reason unknown).
    
    Simply setting converter channel count without setting the pin infoframe
    and channel mapping as well does not theoretically make much sense as
    this will just mean they are out-of-sync and multichannel playback will
    have a wrong channel mapping.
    
    However, adding back just setting the converter channel count even in
    no-monitor case is the safest change which at least fixes the stereo
    playback regression on SiI1390 codec. Do that.
    
    Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
    Reported-by: Stephan Raue <stephan@openelec.tv>
    Tested-by: Stephan Raue <stephan@openelec.tv>
    Cc: <stable@vger.kernel.org> # 3.12+
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 2f433083e854ec72c19dc9b0e1cebcc8e230fd75
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Fri May 2 19:48:13 2014 +0200

    HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S
    
    This touchpad seriously dislikes init reports, not only timeing out, but
    also refusing to work after this.
    
    Cc: stable@vger.kernel.org
    Reported-and-tested-by: Vincent Fortier <th0ma7@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>

commit 19e4ec525b37cdecbdb4f86edaae7f56a67339ee
Author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date:   Wed Apr 30 17:48:40 2014 -0400

    HID: core: fix computation of the report size
    
    The extra seven bits are only required when allocating the report buffer.
    We can not use those extra bytes for the length of the report in the
    generic implementation of .request because the device might (will) refuse
    the set_report command.
    This has been verified on the Atmel touchpad found on the Samsung Ativ 9
    plus, which uses hid-multitouch and HID over I2C. Without this fix, the
    device refuses to switch to the multitouch mode, and it becomes unresponsive
    from the user point of view.
    
    Actually, this has been discussed during the initial submission of the
    commit 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, see
    https://patchwork.kernel.org/patch/3621751/
    
    Unfortunately, I completely forgot about it later.
    
    Reported-by: Matthias Bayer <thematthiasbayer@gmail.com>
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>

commit bebfef150e0b8fa68704cddacf05b8c26462d565
Author: Kees Cook <keescook@chromium.org>
Date:   Mon Apr 7 21:44:07 2014 -0700

    UBI: avoid workqueue format string leak
    
    When building the name for the workqueue thread, make sure a format
    string cannot leak in from the disk name.
    
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

commit 3d21bb7667c4b57a15077d60d23385d9a1c01d08
Author: Tanya Brokhman <tlinder@codeaurora.org>
Date:   Tue Apr 1 11:02:07 2014 +0300

    UBI: fix ubi free PEBs count calculation
    
    The ubi->free_count should be updated with every insert/remove to/from
    the ubi->free list.
    
    Signed-off-by: Tanya Brokhman <tlinder@codeaurora.org>
    Reviewed-by: Dolev Raviv <draviv@codeaurora.org>
    Acked-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

commit 87ed89d21ede38f86be9419ca7c6dd4761764bbb
Author: Tanya Brokhman <tlinder@codeaurora.org>
Date:   Tue Apr 1 11:01:12 2014 +0300

    UBI: fix error path in __wl_get_peb
    
    In case of an error (if there are not free PEB's for example),
    __wl_get_peb will return a negative value. In order to prevent access
    violation we need to test the returned value prior to using it later on.
    
    Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
    Reviewed-by: Dolev Raviv <draviv@codeaurora.org>
    Acked-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

commit fcdd57c8902a936a616df2066d873b38ef3ed364
Author: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Date:   Mon Apr 7 13:39:06 2014 +0300

    UBIFS: fix remount error path
    
    Dan's "smatch" checker found out that there was a bug in the error path of the
    'ubifs_remount_rw()' function. Instead of jumping to the "out" label which
    cleans-things up, we just returned.
    
    This patch fixes the problem.
    
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

commit c99d609a16506602a7398eea7d12b13513f3d889
Author: Dave Chinner <dchinner@redhat.com>
Date:   Mon May 5 16:18:37 2014 +1000

    xfs: fully support v5 format filesystems
    
    We have had this code in the kernel for over a year now and have
    shaken all the known issues out of the code over the past few
    releases. It's now time to remove the experimental warnings during
    mount and fully support the new filesystem format in production
    systems.
    
    Remove the experimental warning, and add a version number to the
    initial "mounting filesystem" message to tell use what type of
    filesystem is being mounted. Also, remove the temporary inode
    cluster size output at mount time now we know that this code works
    fine.
    
    Signed-off-by: Dave Chinner <dchinner@redhat.com>
    Reviewed-by: Brian Foster <bfoster@redhat.com>
    Signed-off-by: Dave Chinner <david@fromorbit.com>

commit 3cf0b0311e746a26dcc7c0b5ba0756f61d636a33
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat May 3 23:27:00 2014 +0300

    agp: info leak in agpioc_info_wrap()
    
    On 64 bit systems the agp_info struct has a 4 byte hole between
    ->agp_mode and ->aper_base.  We need to clear it to avoid disclosing
    stack information to userspace.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>

commit f6a082fed1e6407c2f4437d0d963b1bcbe5f9f58
Author: John Fastabend <john.fastabend@gmail.com>
Date:   Thu May 1 09:23:06 2014 -0700

    net: sched: lock imbalance in hhf qdisc
    
    hhf_change() takes the sch_tree_lock and releases it but misses the
    error cases. Fix the missed case here.
    
    To reproduce try a command like this,
    
    # tc qdisc change dev p3p2 root hhf quantum 40960 non_hh_weight 300000
    
    Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit fe866433f843b080246ce729b5e6b27b5f5d9a58
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Apr 29 13:28:23 2014 -0700

    sparc64: Give more detailed information in {pgd,pmd}_ERROR() and kill pte_ERROR().
    
    pte_ERROR() is not used anywhere, delete it.
    
    For pgd_ERROR() and pmd_ERROR(), output something similar to x86, giving the address
    of the pgd/pmd as well as it's value.
    
    Also provide the caller, since these macros are invoked from pgd_clear_bad() and
    pmd_clear_bad() which provides little context as to what high level operation was
    occuring when the BAD state was detected.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 26cf432551d749e7d581db33529507a711c6eaab
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Apr 29 13:03:27 2014 -0700

    sparc64: Add basic validations to {pud,pmd}_bad().
    
    Instead of returning false we should at least check the most basic
    things, otherwise page table corruptions will be very difficult to
    debug.
    
    PMD and PTE tables are of size PAGE_SIZE, so none of the sub-PAGE_SIZE
    bits should be set.
    
    We also complement this with a check that the physical address the
    pud/pmd points to is valid memory.
    
    PowerPC was used as a guide while implementating this.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0eef331a3d0ee970dcbebd1bd5fcb57ca33ece01
Author: David S. Miller <davem@davemloft.net>
Date:   Sat May 3 22:52:50 2014 -0700

    sparc64: Use 'ILOG2_4MB' instead of constant '22'.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ee73887e92a69ae0a5cda21c68ea75a27804c944
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Apr 29 12:58:03 2014 -0700

    sparc64: Fix range check in kern_addr_valid().
    
    In commit b2d438348024b75a1ee8b66b85d77f569a5dfed8 ("sparc64: Make
    PAGE_OFFSET variable."), the MAX_PHYS_ADDRESS_BITS value was increased
    (to 47).
    
    This constant reference to '41UL' was missed.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 70ffc6ebaead783ac8dafb1e87df0039bb043596
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Apr 28 23:52:11 2014 -0700

    sparc64: Fix top-level fault handling bugs.
    
    Make get_user_insn() able to cope with huge PMDs.
    
    Next, make do_fault_siginfo() more robust when get_user_insn() can't
    actually fetch the instruction.  In particular, use the MMU announced
    fault address when that happens, instead of calling
    compute_effective_address() and computing garbage.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d037d16372bbe4d580342bebbb8826821ad9edf0
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Apr 28 23:50:08 2014 -0700

    sparc64: Handle 32-bit tasks properly in compute_effective_address().
    
    If we have a 32-bit task we must chop off the top 32-bits of the
    64-bit value just as the cpu would.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit eaf85da82669b057f20c4e438dc2566b51a83af6
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Apr 28 19:11:27 2014 -0700

    sparc64: Don't use _PAGE_PRESENT in pte_modify() mask.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c2e4e676adb40ea764af79d3e08be954e14a0f4c
Author: David S. Miller <davem@davemloft.net>
Date:   Sun Apr 27 21:01:56 2014 -0700

    sparc64: Fix hex values in comment above pte_modify().
    
    When _PAGE_SPECIAL and _PAGE_PMD_HUGE were added to the mask, the
    comment was not updated.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 04df419de34104d8818b8c5cffaa062fa36d20ea
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Apr 25 10:21:12 2014 -0700

    sparc64: Fix bugs in get_user_pages_fast() wrt. THP.
    
    The large PMD path needs to check _PAGE_VALID not _PAGE_PRESENT, to
    decide if it needs to bail and return 0.
    
    pmd_large() should therefore just check _PAGE_PMD_HUGE.
    
    Calls to gup_huge_pmd() are guarded with a check of pmd_large(), so we
    just need to add a valid bit check.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 51e5ef1bb7ab0e5fa7de4e802da5ab22fe35f0bf
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Apr 24 13:58:02 2014 -0700

    sparc64: Fix huge PMD invalidation.
    
    On sparc64 "present" and "valid" are seperate PTE bits, this allows us to
    naturally distinguish between the user explicitly asking for PROT_NONE
    with mprotect() and other situations.
    
    However we weren't handling this properly in the huge PMD paths.
    
    First of all, the page table walker in the TSB miss path only checks
    for _PAGE_PMD_HUGE.  So the generic pmdp_invalidate() would clear
    _PAGE_PRESENT but the TLB miss paths would still load it into the TLB
    as a valid huge PMD.
    
    Fix this by clearing the valid bit in pmdp_invalidate(), and also
    checking the valid bit in USER_PGTABLE_CHECK_PMD_HUGE using "brgez"
    since _PAGE_VALID is bit 63 in both the sun4u and sun4v pte layouts.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5b1e94fa439a3227beefad58c28c17f68287a8e9
Author: David S. Miller <davem@davemloft.net>
Date:   Sun Apr 20 21:55:01 2014 -0400

    sparc64: Fix executable bit testing in set_pmd_at() paths.
    
    This code was mistakenly using the exec bit from the PMD in all
    cases, even when the PMD isn't a huge PMD.
    
    If it's not a huge PMD, test the exec bit in the individual ptes down
    in tlb_batch_pmd_scan().
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 16ce8a30e6102d7aabd4e4518d255f330290fa3f
Author: David S. Miller <davem@davemloft.net>
Date:   Sat May 3 22:25:33 2014 -0700

    sparc64: Normalize NMI watchdog logging and behavior.
    
    Bring this code in line with the perf based generic NMI watchdog
    in kernel/watchdog.c (which we should convert over to at some
    point).
    
    In particular, don't do anything super fancy when the watchdog
    triggers, and specifically don't do a do_exit() which only makes
    things worse.
    
    Either panic(), or WARN().  The latter of which will do all of
    the actions such as give us a stack backtrace.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6ed07d45d09bc2aa60e27b845543db9972e22a38
Author: Daniele Forsi <dforsi@gmail.com>
Date:   Mon Apr 28 17:09:11 2014 +0200

    USB: Nokia 5300 should be treated as unusual dev
    
    Signed-off-by: Daniele Forsi <dforsi@gmail.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f0ef5d41792a46a1085dead9dfb0bdb2c574638e
Author: Victor A. Santos <victoraur.santos@gmail.com>
Date:   Sat Apr 26 23:20:14 2014 -0300

    USB: Nokia 305 should be treated as unusual dev
    
    Signed-off-by: Victor A. Santos <victoraur.santos@gmail.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 62a0d8d7c2b29f92850e4ee3c38e5dfd936e92b2
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Fri May 2 10:56:12 2014 -0400

    tty: Fix lockless tty buffer race
    
    Commit 6a20dbd6caa2358716136144bf524331d70b1e03,
    "tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
    correctly identifies an unsafe race condition between
    __tty_buffer_request_room() and flush_to_ldisc(), where the consumer
    flush_to_ldisc() prematurely advances the head before consuming the
    last of the data committed. For example:
    
               CPU 0                     |            CPU 1
    __tty_buffer_request_room            | flush_to_ldisc
      ...                                |   ...
                                         |   count = head->commit - head->read
      n = tty_buffer_alloc()             |
      b->commit = b->used                |
      b->next = n                        |
                                         |   if (!count)                /* T */
                                         |     if (head->next == NULL)  /* F */
                                         |     buf->head = head->next
    
    In this case, buf->head has been advanced but head->commit may have
    been updated with a new value.
    
    Instead of reintroducing an unnecessary lock, fix the race locklessly.
    Read the commit-next pair in the reverse order of writing, which guarantees
    the commit value read is the latest value written if the head is
    advancing.
    
    Reported-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
    Cc: <stable@vger.kernel.org> # 3.12.x+
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5fbf1a65dd53ef313783c34a0e93a6e29def6136
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Fri May 2 10:56:11 2014 -0400

    Revert "tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
    
    This reverts commit 6a20dbd6caa2358716136144bf524331d70b1e03.
    
    Although the commit correctly identifies an unsafe race condition
    between __tty_buffer_request_room() and flush_to_ldisc(), the commit
    fixes the race with an unnecessary spinlock in a lockless algorithm.
    
    The follow-on commit, "tty: Fix lockless tty buffer race" fixes
    the race locklessly.
    
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 501fed45b7e8836ee9373f4d31e2d85e3db6103a
Author: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Date:   Fri May 2 18:58:24 2014 -0400

    drivers/tty/hvc: don't free hvc_console_setup after init
    
    When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest,
    hvc console is setup within a kthread. However, that will cause SEGV
    and the boot will fail when the driver is builtin to the kernel,
    because currently hvc_console_setup() is annotated with '__init'. This
    patch removes '__init' to boot the guest successfully with 'console=hvc0'.
    
    Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4291086b1f081b869c6d79e5b7441633dc3ace00
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Sat May 3 14:04:59 2014 +0200

    n_tty: Fix n_tty_write crash when echoing in raw mode
    
    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST.  And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.
    
    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;
    
    so the race of the two can result in something like this:
                  A                                B
    __tty_buffer_request_room
                                      __tty_buffer_request_room
    memcpy(buf(tb->used), ...)
    tb->used += space;
                                      memcpy(buf(tb->used), ...) ->BOOM
    
    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.
    
    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes.  This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.
    
    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.
    
    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call
    
    References: CVE-2014-0196
    Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b790f210fe8423eff881b2a8a93ba5dbc45534d0
Author: Michael Welling <mwelling@ieee.org>
Date:   Fri Apr 25 19:27:48 2014 -0500

    tty: serial: 8250_core.c Bug fix for Exar chips.
    
    The sleep function was updated to put the serial port to sleep only when necessary.
    This appears to resolve the errant behavior of the driver as described in
    Kernel Bug 61961 – "My Exar Corp. XR17C/D152 Dual PCI UART modem does not
    work with 3.8.0".
    
    Signed-off-by: Michael Welling <mwelling@ieee.org>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d183c81929beeba842b74422f754446ef2b8b49c
Author: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
Date:   Mon Apr 28 19:23:44 2014 +0400

    fsl-usb: do not test for PHY_CLK_VALID bit on controller version 1.6
    
    Per reference manuals of Freescale P1020 and P2020 SoCs, USB controller
    present in these SoCs has bit 17 of USBx_CONTROL register marked as
    Reserved - there is no PHY_CLK_VALID bit there.
    
    Testing for this bit in ehci_fsl_setup_phy() behaves differently on two
    P1020RDB boards available here - on one board test passes and fsl-usb
    init succeeds, but on other board test fails, causing fsl-usb init to
    fail.
    
    This patch changes ehci_fsl_setup_phy() not to test PHY_CLK_VALID on
    controller version 1.6 that (per manual) does not have this bit.
    
    Signed-off-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit df602c2d2358f02c6e49cffc5b49b9daa16db033
Author: Daniele Forsi <dforsi@gmail.com>
Date:   Tue Apr 29 11:44:03 2014 +0200

    usb: storage: shuttle_usbat: fix discs being detected twice
    
    Even if the USB-to-ATAPI converter supported multiple LUNs, this
    driver would always detect the same physical device or media because
    it doesn't use srb->device->lun in any way.
    Tested with an Hewlett-Packard CD-Writer Plus 8200e.
    
    Signed-off-by: Daniele Forsi <dforsi@gmail.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4d7c0136a54f62501f8a34c4d08a5e0258d3d3ca
Author: Bjørn Mork <bjorn@mork.no>
Date:   Sun Apr 27 16:47:42 2014 +0200

    usb: qcserial: add a number of Dell devices
    
    Dan writes:
    
    "The Dell drivers use the same configuration for PIDs:
    
    81A2: Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card
    81A3: Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card
    81A4: Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card
    81A8: Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card
    81A9: Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card
    
    These devices are all clearly Sierra devices, but are also definitely
    Gobi-based.  The A8 might be the MC7700/7710 and A9 is likely a MC7750.
    
    >From DellGobi5kSetup.exe from the Dell drivers:
    
    usbif0: serial/firmware loader?
    usbif2: nmea
    usbif3: modem/ppp
    usbif8: net/QMI"
    
    Cc: <stable@vger.kernel.org>
    Reported-by: AceLan Kao <acelan.kao@canonical.com>
    Reported-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c1db30a2a79eb59997b13b8cabf2a50bea9f04e1
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu May 1 15:21:42 2014 -0400

    USB: OHCI: fix problem with global suspend on ATI controllers
    
    Some OHCI controllers from ATI/AMD seem to have difficulty with
    "global" USB suspend, that is, suspending an entire USB bus without
    setting the suspend feature for each port connected to a device.  When
    we try to resume the child devices, the controller gives timeout
    errors on the unsuspended ports, requiring resets, and can even cause
    ohci-hcd to hang; see
    
    	http://marc.info/?l=linux-usb&m=139514332820398&w=2
    
    and the following messages.
    
    This patch fixes the problem by adding a new quirk flag to ohci-hcd.
    The flag causes the ohci_rh_suspend() routine to suspend each
    unsuspended, enabled port before suspending the root hub.  This
    effectively converts the "global" suspend to an ordinary root-hub
    suspend.  There is no need to unsuspend these ports when the root hub
    is resumed, because the child devices will be resumed anyway in the
    course of a normal system resume ("global" suspend is never used for
    runtime PM).
    
    This patch should be applied to all stable kernels which include
    commit 0aa2832dd0d9 (USB: use "global suspend" for system sleep on
    USB-2 buses) or a backported version thereof.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Peter Münster <pmlists@free.fr>
    Tested-by: Peter Münster <pmlists@free.fr>
    CC: <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60942f2f235ce7b817166cdf355eed729094834d
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Fri May 2 15:38:39 2014 -0400

    dcache: don't need rcu in shrink_dentry_list()
    
    Since now the shrink list is private and nobody can free the dentry while
    it is on the shrink list, we can remove RCU protection from this.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 9c8c10e262e0f62cb2530f1b076de979123183dd
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Fri May 2 20:36:10 2014 -0400

    more graceful recovery in umount_collect()
    
    Start with shrink_dcache_parent(), then scan what remains.
    
    First of all, BUG() is very much an overkill here; we are holding
    ->s_umount, and hitting BUG() means that a lot of interesting stuff
    will be hanging after that point (sync(2), for example).  Moreover,
    in cases when there had been more than one leak, we'll be better
    off reporting all of them.  And more than just the last component
    of pathname - %pd is there for just such uses...
    
    That was the last user of dentry_lru_del(), so kill it off...
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit fe91522a7ba82ca1a51b07e19954b3825e4aaa22
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sat May 3 00:02:25 2014 -0400

    don't remove from shrink list in select_collect()
    
    	If we find something already on a shrink list, just increment
    data->found and do nothing else.  Loops in shrink_dcache_parent() and
    check_submounts_and_drop() will do the right thing - everything we
    did put into our list will be evicted and if there had been nothing,
    but data->found got non-zero, well, we have somebody else shrinking
    those guys; just try again.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 39076b047b160821110cb4deed13424ddfdf8d00
Author: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Date:   Wed Apr 30 13:28:51 2014 -0300

    net: mvmdio: Check for a valid interrupt instead of an error
    
    The following commit:
    
    commit 9ec36cafe43bf835f8f29273597a5b0cbc8267ef
    Author: Rob Herring <robh@kernel.org>
    Date:   Wed Apr 23 17:57:41 2014 -0500
    
        of/irq: do irq resolution in platform_get_irq
    
    changed platform_get_irq() which now returns EINVAL and EPROBE_DEFER,
    in addition to ENXIO. If there's no interrupt for mvmdio, platform_get_irq()
    returns EINVAL, but we currently check only for ENXIO.
    
    Fix this by looking for a positive integer, which is the proper way of
    validating a virtual interrupt number.
    
    While at it, add a proper handling for the deferral probe case.
    
    Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
    Reviewed-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e46e08b843d8ff8c46ad8d7b0b95acaacc4e6195
Author: Balakumaran Kannan <kumaran.4353@gmail.com>
Date:   Thu Apr 24 08:22:47 2014 +0530

    net phy: Check for aneg completion before setting state to PHY_RUNNING
    
    phy_state_machine should check whether auto-negotiatin is completed
    before changing phydev->state from PHY_NOLINK to PHY_RUNNING. If
    auto-negotiation is not completed phydev->state should be set to
    PHY_AN.
    
    Signed-off-by: Balakumaran Kannan <kumaran.4353@gmail.com>
    Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7040b6d1febfdbd9c1595efb751d492cd2503f96
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Thu May 1 12:20:22 2014 +0200

    ALSA: usb-audio: work around corrupted TEAC UD-H01 feedback data
    
    The TEAC UD-H01 firmware sends wrong feedback frequency values, thus
    causing the PC to send the samples at a wrong rate, which results in
    clicks and crackles in the output.
    
    Add a workaround to detect and fix the corruption.
    
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    [mick37@gmx.de: use sender->udh01_fb_quirk rather than
     ep->udh01_fb_quirk in snd_usb_handle_sync_urb()]
    Reported-and-tested-by: Mick <mick37@gmx.de>
    Reported-and-tested-by: Andrea Messa <andr.messa@tiscali.it>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 1ee23fe07ee83a38ecee927e701f762888ada942
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri May 2 18:17:06 2014 +0200

    ALSA: usb-audio: Fix deadlocks at resuming
    
    The recent addition of the USB audio mixer suspend/resume may lead to
    deadlocks when the driver tries to call usb_autopm_get_interface()
    recursively, since the function tries to sync with the finish of the
    other calls.  For avoiding it, introduce a flag indicating the resume
    operation and avoids the recursive usb_autopm_get_interface() calls
    during the resume.
    
    Reported-and-tested-by: Bryan Quigley <gquigs@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 1c53e7253ed8769a00afa0f06777d731dbe1ba6f
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri May 2 18:14:42 2014 +0200

    ALSA: usb-audio: Save mixer status only once at suspend
    
    The suspend callback of usb-audio driver may be called multiple times
    per suspend when multiple USB interfaces are bound to a single sound
    card instance.  In such a case, it's superfluous to save the mixer
    values multiple times.  This patch fixes it by checking the counter.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit b7a7723513dc89f83d6df13206df55d4dc26e825
Author: Sander Eikelenboom <linux@eikelenboom.it>
Date:   Fri May 2 15:09:27 2014 +0200

    ALSA: usb-audio: Prevent printk ratelimiting from spamming kernel log while DEBUG not defined
    
    This (widely used) construction:
    
    if(printk_ratelimit())
    	dev_dbg()
    
    Causes the ratelimiting to spam the kernel log with the "callbacks suppressed"
    message below, even while the dev_dbg it is supposed to rate limit wouldn't
    print anything because DEBUG is not defined for this device.
    
    [  533.803964] retire_playback_urb: 852 callbacks suppressed
    [  538.807930] retire_playback_urb: 852 callbacks suppressed
    [  543.811897] retire_playback_urb: 852 callbacks suppressed
    [  548.815745] retire_playback_urb: 852 callbacks suppressed
    [  553.819826] retire_playback_urb: 852 callbacks suppressed
    
    So use dev_dbg_ratelimited() instead of this construction.
    
    Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit c7e74306632c71398ce6db878cd316cb43072ffb
Author: Ben Skeggs <bskeggs@redhat.com>
Date:   Fri May 2 16:21:45 2014 +1000

    drm/gm107/gr: bump attrib cb size quite a bit
    
    When initially looking at traces, missed the fact the binary driver was
    using large pages.
    
    Fixes page faults when launching geometry shaders.
    
    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

commit 806cbc5026933a781b66adecf6d1658fde9138e6
Author: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Date:   Thu May 1 13:58:05 2014 +0200

    drm/nouveau: fix another lock unbalance in nouveau_crtc_page_flip
    
    Fixes a regression introduced by 060810d7abaabca "drm/nouveau: fix locking
    issues in page flipping paths".  chan->cli->mutex is unlocked a second time
    in the fail_unreserve path, fix this by moving mutex_unlock down.
    
    Cc: stable@vger.kernel.org # v3.11+
    Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

commit ce23b234d157f1dfea098fcc77cb5b6887d10df2
Author: Ben Skeggs <bskeggs@redhat.com>
Date:   Mon Mar 31 13:25:09 2014 +1000

    drm/nouveau/bios: fix shadowing from PROM on big-endian systems
    
    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

commit a3d0b1218d351c6e6f3cea36abe22236a08cb246
Author: Ilia Mirkin <imirkin@alum.mit.edu>
Date:   Wed Mar 26 19:37:21 2014 -0400

    drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi
    
    There appear to be a crop of new hardware where the vbios is not
    available from PROM/PRAMIN, but there is a valid _ROM method in ACPI.
    The data read from PCIROM almost invariably contains invalid
    instructions (still has the x86 opcodes), which makes this a low-risk
    way to try to obtain a valid vbios image.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=76475
    Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
    Cc: <stable@vger.kernel.org> # v2.6.35+
    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

commit 49b6c01f4c1de3b5e5427ac5aba80f9f6d27837a
Author: Kirill Tkhai <tkhai@yandex.ru>
Date:   Thu Apr 17 00:45:24 2014 +0400

    sparc64: Make itc_sync_lock raw
    
    One more place where we must not be able
    to be preempted or to be interrupted in RT.
    
    Always actually disable interrupts during
    synchronization cycle.
    
    Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit aa3449ee9c87d9b7660dd1493248abcc57769e31
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Apr 30 19:37:48 2014 -0700

    sparc64: Fix argument sign extension for compat_sys_futex().
    
    Only the second argument, 'op', is signed.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 41edf278fc2f042f4e22a12ed87d19c5201210e1
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Thu May 1 10:30:00 2014 -0400

    dentry_kill(): don't try to remove from shrink list
    
    If the victim in on the shrink list, don't remove it from there.
    If shrink_dentry_list() manages to remove it from the list before
    we are done - fine, we'll just free it as usual.  If not - mark
    it with new flag (DCACHE_MAY_FREE) and leave it there.
    
    Eventually, shrink_dentry_list() will get to it, remove the sucker
    from shrink list and call dentry_kill(dentry, 0).  Which is where
    we'll deal with freeing.
    
    Since now dentry_kill(dentry, 0) may happen after or during
    dentry_kill(dentry, 1), we need to recognize that (by seeing
    DCACHE_DENTRY_KILLED already set), unlock everything
    and either free the sucker (in case DCACHE_MAY_FREE has been
    set) or leave it for ongoing dentry_kill(dentry, 1) to deal with.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit aa019b791a3e138ca0eaa38e72b4ea97d482a7bc
Author: Alex Deucher <alexdeucher@gmail.com>
Date:   Wed Apr 30 09:27:15 2014 -0400

    drm/radeon/dp: check for errors in dpcd reads
    
    Check to make sure the transaction succeeded before
    using the register value.  Fixes occasional link training
    problems.
    
    Noticed-by: Sergei Antonov <saproj@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 3b333c55485fef0089ae7398906599d000df195e
Author: Christian König <christian.koenig@amd.com>
Date:   Thu Apr 24 18:39:59 2014 +0200

    drm/radeon: avoid high jitter with small frac divs
    
    Signed-off-by: Christian König <christian.koenig@amd.com>

commit 695daf1a8e731a4b5b89de89a61f32a4d7ad7094
Author: Leo Liu <leo.liu@amd.com>
Date:   Mon Apr 28 09:40:22 2014 -0400

    drm/radeon: check buffer relocation offset
    
    Signed-off-by: Leo Liu <leo.liu@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Cc: stable@vger.kernel.org

commit f5d636d2a74b755879feec35e14a259de52ccc07
Author: Christian König <christian.koenig@amd.com>
Date:   Wed Apr 23 20:46:06 2014 +0200

    drm/radeon: use pflip irq on R600+ v2
    
    Testing the update pending bit directly after issuing an
    update is nonsense cause depending on the pixel clock the
    CRTC needs a bit of time to execute the flip even when we
    are in the VBLANK period.
    
    This is just a non invasive patch to solve the problem at
    hand, a more complete and cleaner solution should follow
    in the next merge window.
    
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=76564
    
    v2: fix source IDs for CRTC2-6
    
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Cc: stable@vger.kernel.org

commit e45187620f9fc103edf68fa5ea78e73033e1668c
Author: Christian König <christian.koenig@amd.com>
Date:   Thu Apr 10 16:11:36 2014 +0200

    drm/radeon/uvd: use lower clocks on old UVD to boot v2
    
    Some RV7xx generation hardware crashes after you
    raise the UVD clocks for the first time. Try to
    avoid this by using the lower clocks to boot these.
    
    Workaround for: https://bugzilla.kernel.org/show_bug.cgi?id=71891
    
    v2: lower clocks on IB test as well
    
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org

commit 28c015a9daabe4ed3aeb0ccf669a3f1c2b8b81d5
Author: Murali Karicheri <m-karicheri2@ti.com>
Date:   Thu Mar 20 22:08:32 2014 +0200

    mtd: davinci-nand: disable subpage write for keystone-nand
    
    Sub page write doesn't work because of hw issue in controller found on
    Keystone SOCs. AEMIF controller is also used on DaVinci SOCs which
    don't seems to have any issue. So add "ti,keysone-nand" compatible
    to nand driver in order to set NAND_NO_SUBPAGE_WRITE option.
    
    Cc: Warner Losh <imp@bsdimp.com>
    Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
    Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@ti.com>
    Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>

commit 01b6035190b024240a43ac1d8e9c6f964f5f1c63
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue Apr 29 23:42:52 2014 -0400

    expand the call of dentry_lru_del() in dentry_kill()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit b4f0354e968f5fabd39bc85b99fedae4a97589fe
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue Apr 29 23:40:14 2014 -0400

    new helper: dentry_free()
    
    The part of old d_free() that dealt with actual freeing of dentry.
    Taken out of dentry_kill() into a separate function.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 5c47e6d0ad608987b91affbcf7d1fc12dfbe8fb4
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue Apr 29 16:13:18 2014 -0400

    fold try_prune_one_dentry()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 03b3b889e79cdb6b806fc0ba9be0d71c186bbfaa
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue Apr 29 15:45:28 2014 -0400

    fold d_kill() and d_free()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 22041fb05b66387b2854f789d1e1f55c7d07b4f4
Author: KY Srinivasan <kys@microsoft.com>
Date:   Wed Apr 30 11:58:25 2014 -0700

    hyperv: Properly handle checksum offload
    
    Do checksum offload only if the client of the driver wants checksum to be
    offloaded.
    
    In V1 version of this patch, I  addressed comments from
    Stephen Hemminger <stephen@networkplumber.org> and
    Eric Dumazet <eric.dumazet@gmail.com>.
    
    In this version of the patch I have addressed comments from
    David Miller.
    
    This patch fixes a bug that is exposed in gateway scenarios.
    
    Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
    Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6ce29b0e2a04ea85617cd21099af67449a76f589
Author: Claudiu Manoil <claudiu.manoil@freescale.com>
Date:   Wed Apr 30 14:27:21 2014 +0300

    gianfar: Avoid unnecessary reg accesses in adjust_link()
    
    For phy devices that don't issue interrupts upon link
    state changes, phylib polls the link state resulting in
    repeated calls to adjust_link(), even if the link state
    didn't change.  As a result, some mac registers are
    repeatedly read and written with the same values, which
    is not ok.
    
    To fix this, adjust_link() has been refactored to check
    first whether the link state has changed and to take action
    only if needed, updating mac registers and local state
    variables.  The 'new_state' local flag, set if one of the
    link params changed (link, speed or duplex), has been
    rendered useless and removed by this refactoring.
    
    Signed-off-by: Claudiu Manoil <claudiu.manoil@freescale.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0cda345d1b2201dd15591b163e3c92bad5191745
Author: Liu Yu <allanyuliu@tencent.com>
Date:   Wed Apr 30 17:34:09 2014 +0800

    tcp_cubic: fix the range of delayed_ack
    
    commit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent
    divide error) try to prevent divide error, but there is still a little
    chance that delayed_ack can reach zero. In case the param cnt get
    negative value, then ratio+cnt would overflow and may happen to be zero.
    As a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.
    
    In some old kernels, such as 2.6.32, there is a bug that would
    pass negative param, which then ultimately leads to this divide error.
    
    commit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count
    with skb MSS) fixed the negative param issue. However,
    it's safe that we fix the range of delayed_ack as well,
    to make sure we do not hit a divide by zero.
    
    CC: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: Liu Yu <allanyuliu@tencent.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e5744fe9d262d11131916d04ea79ea539fe296c0
Author: Brendan Hickey <bhickey@google.com>
Date:   Wed Apr 30 10:24:38 2014 +0200

    bpf_dbg: fix wrong register usage
    
    The AND instruction is erroneously using the X register instead
    of the K register.
    
    Signed-off-by: Brendan Hickey <bhickey@google.com>
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit f114890cdf84d753f6b41cd0cc44ba51d16313da
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Tue Apr 29 10:09:51 2014 -0400

    Revert "macvlan : fix checksums error when we are in bridge mode"
    
    This reverts commit 12a2856b604476c27d85a5f9a57ae1661fc46019.
    The commit above doesn't appear to be necessary any more as the
    checksums appear to be correctly computed/validated.
    
    Additionally the above commit breaks kvm configurations where
    one VM is using a device that support checksum offload (virtio) and
    the other VM does not.
    In this case, packets leaving virtio device will have CHECKSUM_PARTIAL
    set.  The packets is forwarded to a macvtap that has offload features
    turned off.  Since we use CHECKSUM_UNNECESSARY, the host does does not
    update the checksum and thus a bad checksum is passed up to
    the guest.
    
    CC: Daniel Lezcano <daniel.lezcano@free.fr>
    CC: Patrick McHardy <kaber@trash.net>
    CC: Andrian Nord <nightnord@gmail.com>
    CC: Eric Dumazet <eric.dumazet@gmail.com>
    CC: Michael S. Tsirkin <mst@redhat.com>
    CC: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit cbdb04279ccaefcc702c8757757eea8ed76e50cf
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Tue Apr 29 10:09:50 2014 -0400

    mactap: Fix checksum errors for non-gso packets in bridge mode
    
    The following is a problematic configuration:
    
     VM1: virtio-net device connected to macvtap0@eth0
     VM2: e1000 device connect to macvtap1@eth0
    
    The problem is is that virtio-net supports checksum offloading
    and thus sends the packets to the host with CHECKSUM_PARTIAL set.
    On the other hand, e1000 does not support any acceleration.
    
    For small TCP packets (and this includes the 3-way handshake),
    e1000 ends up receiving packets that only have a partial checksum
    set.  This causes TCP to fail checksum validation and to drop
    packets.  As a result tcp connections can not be established.
    
    Commit 3e4f8b787370978733ca6cae452720a4f0c296b8
    	macvtap: Perform GSO on forwarding path.
    fixes this issue for large packets wthat will end up undergoing GSO.
    This commit adds a check for the non-GSO case and attempts to
    compute the checksum for partially checksummed packets in the
    non-GSO case.
    
    CC: Daniel Lezcano <daniel.lezcano@free.fr>
    CC: Patrick McHardy <kaber@trash.net>
    CC: Andrian Nord <nightnord@gmail.com>
    CC: Eric Dumazet <eric.dumazet@gmail.com>
    CC: Michael S. Tsirkin <mst@redhat.com>
    CC: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit fc9f35010641ea85dd19d144b86cdd93156f1a1e
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Apr 28 22:00:29 2014 -0700

    tcp: increment retransmit counters in tlp and fast open
    
    Both TLP and Fast Open call __tcp_retransmit_skb() instead of
    tcp_retransmit_skb() to avoid changing tp->retrans_out.
    
    This has the side effect of missing SNMP counters increments as well
    as tcp_info tcpi_total_retrans updates.
    
    Fix this by moving the stats increments of into __tcp_retransmit_skb()
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Nandita Dukkipati <nanditad@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3dc638d13aced7baad40517a3d70b3b43bf6b90f
Author: Byungho An <bh74.an@samsung.com>
Date:   Tue Apr 29 13:15:27 2014 +0900

    net: sxgbe: Added set function for interrupt on complete
    
    This patch adds set_rx_int_on_com function for interrupt when
    dma is completed.
    
    Signed-off-by: Byungho An <bh74.an@samsung.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 325b94f7e63080f3e371e35f063a8be138c1873b
Author: Byungho An <bh74.an@samsung.com>
Date:   Tue Apr 29 13:15:17 2014 +0900

    net: sxgbe: Added rxqueue enable function
    
    This patch adds rxqueue enable function according to number of rxqueue
    and adds rxqueue disable function for removing.
    
    Signed-off-by: Byungho An <bh74.an@samsung.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0a0347b1e65d0757024d9db0ffdeafb41a9d14f4
Author: Byungho An <bh74.an@samsung.com>
Date:   Tue Apr 29 13:15:15 2014 +0900

    net: sxgbe: sw reset moved to probe function
    
    This patch moves sw reset to probe function because
    sw reset is needed early stage before open function.
    
    Signed-off-by: Byungho An <bh74.an@samsung.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d2e752db6d05374a35dddb2e17864fe310fbcf69
Author: Roland Dreier <roland@purestorage.com>
Date:   Mon Apr 28 17:36:20 2014 -0700

    cxgb4: Decode PCIe Gen3 link speed
    
    Add handling for " 8 GT/s" in print_port_info().
    
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 652f99ead8319941216c64d7f92c8dcdc9b95970
Author: Tobias Klauser <tobias.klauser@gmail.com>
Date:   Mon Apr 28 23:23:13 2014 +0200

    Altera TSE: Add missing include to silence sparse warnings
    
    This fixes the following sparse warnings:
    
    drivers/net/ethernet/altera/altera_msgdma.c:23:5: warning: symbol 'msgdma_initialize' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:28:6: warning: symbol 'msgdma_uninitialize' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:32:6: warning: symbol 'msgdma_reset' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:77:6: warning: symbol 'msgdma_disable_rxirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:83:6: warning: symbol 'msgdma_enable_rxirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:89:6: warning: symbol 'msgdma_disable_txirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:95:6: warning: symbol 'msgdma_enable_txirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:101:6: warning: symbol 'msgdma_clear_rxirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:107:6: warning: symbol 'msgdma_clear_txirq' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:114:5: warning: symbol 'msgdma_tx_buffer' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:129:5: warning: symbol 'msgdma_tx_completions' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:154:5: warning: symbol 'msgdma_add_rx_desc' was not declared. Should it be static?
    drivers/net/ethernet/altera/altera_msgdma.c:181:5: warning: symbol 'msgdma_rx_status' was not declared. Should it be static?
    
    Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
    Acked-by: Vince Bridgers <vbridgers2013@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1b4448815ee746f878ca4c6b8fffa23441f6d16c
Author: Tobias Klauser <tobias.klauser@gmail.com>
Date:   Mon Apr 28 23:23:01 2014 +0200

    Altera TSE: Fix DMA secriptor length initialization
    
    sgdma_descrip is a function name as well as the name of a struct. In
    sgdma_initialize(), we should initialize the descriptor length field
    with the actual length of a descriptor not with the size of the
    function. In order to prevent such things from happening in the future,
    rename the function to sgdma_setup_descrip().
    
    Found by sparse which yields the following warning:
    
    drivers/net/ethernet/altera/altera_sgdma.c:74:30: warning: expression using sizeof on a function
    
    Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 886c7c426d465732ec9d1b2bbdda5642fc2e7e05
Author: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Date:   Wed Mar 12 17:30:08 2014 +0100

    usb: gadget: at91-udc: fix irq and iomem resource retrieval
    
    When using dt resources retrieval (interrupts and reg properties) there is
    no predefined order for these resources in the platform dev resource
    table. Also don't expect the number of resource to be always 2.
    
    Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
    Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: stable <stable@vger.kernel.org> # 3.4
    Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 3234f5b06fc3094176a86772cc64baf3decc98fc
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sat Apr 26 21:59:04 2014 +0100

    rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()
    
    Fixes: a53268be0cb9 ('rtlwifi: rtl8192cu: Fix too long disable of IRQs')
    Cc: stable@vger.kernel.org
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 5f9186990ec4579ee5b7a99b3254c29eda479f36
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Fri Apr 25 10:05:43 2014 -0500

    rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb
    
    Beginning with kernel 3.13, this driver fails on some systems. The problem
    was bisected to:
    
    Commit 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac
    Author: Felix Fietkau <nbd@openwrt.org>
    Title: mac80211: send control port protocol frames to the VO queue
    
    There is noting wrong with the above commit. The regression occurs because
    V0 queue on RTL8192SE cards uses priority 6, not the usual 7. The fix is to
    modify the rtl8192se routine that sets the correct transmit queue.
    
    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=74541
    
    Reported-by: Alex Miller <almiller_1@yahoo.co.uk>
    Tested-by: Alex Miller <almiller_1@yahoo.co.uk>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Stable <stable@vger.kernel.org>    [3.13+]
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 62e54dbb599103ff461bb3fe6e32a3066da79754
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Mon Apr 28 18:32:12 2014 +0200

    ath9k: remove tid->paused flag
    
    There are some corner cases where the driver could get stuck with a full
    tid queue that is paused, leading to a software tx queue hang.
    
    Since the tx queueing rework, pausing per-tid queues on aggregation
    session setup is no longer necessary. The driver will assign sequence
    numbers to buffered frames when a new session is established, in order
    to get the correct starting sequence number.
    
    mac80211 prevents new frames from entering the queue during setup.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ae9c25a1826ca9602e89fe9c11700c63ce16d077
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Sun Apr 27 16:37:39 2014 +0200

    ath9k_hw: do not lower ANI setting below default on AR913x
    
    When the amount of noise fluctuates strongly, low immunity settings
    can sometimes disrupt signal detection on AR913x chips. When that
    happens, no OFDM/CCK errors are reported anymore, and ANI tunes the
    radio to the lowest immunity settings.
    Usually rx/tx fails as well in that case.
    
    To fix this, keep noise immunity settings at or above ANI default level,
    which will keep radio parameters at or above INI values.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 91943954e353fa56cc52a8e97346205afb9823ab
Author: Hui Wang <hui.wang@canonical.com>
Date:   Wed Apr 30 11:06:00 2014 +0800

    ALSA: hda - add headset mic detect quirk for a Dell laptop
    
    When we plug a 3-ring headset on the Dell machine (VID: 0x10ec0255,
    SID: 0x1028067e), the headset mic can't be detected, after apply this
    patch, the headset mic can work well.
    
    BugLink: https://bugs.launchpad.net/bugs/1297581
    Cc: David Henningsson <david.henningsson@canonical.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Hui Wang <hui.wang@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 9bbfd20abe5025adbb0ac75160bd2e41158a9e83
Author: Paulo Zanoni <paulo.r.zanoni@intel.com>
Date:   Tue Apr 29 11:00:22 2014 -0300

    drm/i915: don't try DP_LINK_BW_5_4 on HSW ULX
    
    Because the docs say ULX doesn't support it on HSW.
    
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>

commit cfa7c862982b431add7f2b362526bf31372fc7b0
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Apr 29 11:53:58 2014 +0200

    drm/i915: Sanitize the enable_ppgtt module option once
    
    Otherwise we'll end up spamming dmesg on every context creation on snb
    with vt-d enabled. This regression was introduced in
    
    commit 246cbfb5fb9a1ca0997fbb135464c1ff5bb9c549
    Author: Ben Widawsky <benjamin.widawsky@intel.com>
    Date:   Fri Dec 6 14:11:14 2013 -0800
    
        drm/i915: Reorganize intel_enable_ppgtt
    
    As the i915.enable_ppgtt is read-only it cannot be changed after the
    module is loaded and so we can perform an early sanitization of the
    values.
    
    v2:
    - Add comment and pimp commit message (Chris)
    - Use the param consistently (Jani)
    
    v3:
    - Fix init sequence on pre-gen6 by moving the sanitize_ppgtt call to
      gtt_init. Fixes boot hangs on pre-gen6.
    - Add a debug output for the sanitize ppgtt mode.
    
    References: https://lkml.org/lkml/2014/4/17/599
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77916
    Cc: Alessandro Suardi <alessandro.suardi@gmail.com>
    Cc: Ben Widawsky <ben@bwidawsk.net>
    Cc: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>

commit 3bd58143bafc56dbc07f4f085e4d7e018d332674
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Sun Apr 27 09:17:45 2014 +0800

    ceph: reserve caps for file layout/lock MDS requests
    
    Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit fd7b95cd1b58171a0b931b2063729a032bec4ac2
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Thu Apr 17 08:02:02 2014 +0800

    ceph: avoid releasing caps that are being used
    
    To avoid releasing caps that are being used, encode_inode_release()
    should send implemented caps to MDS.
    
    Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit 0a8a70f96fe1bd3e07c15bb86fd247e76102398a
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Mon Apr 14 13:13:02 2014 +0800

    ceph: clear directory's completeness when creating file
    
    When creating a file, ceph_set_dentry_offset() puts the new dentry
    at the end of directory's d_subdirs, then set the dentry's offset
    based on directory's max offset. The offset does not reflect the
    real postion of the dentry in directory. Later readdir reply from
    MDS may change the dentry's position/offset. This inconsistency
    can cause missing/duplicate entries in readdir result if readdir
    is partly satisfied by dcache_readdir().
    
    The fix is clear directory's completeness after creating/renaming
    file. It prevents later readdir from using dcache_readdir().
    
    Fixes: http://tracker.ceph.com/issues/8025
    Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit 92b2e75158f6b8316b5a567c73dcf5b3d8f6bbce
Author: Ilya Dryomov <ilya.dryomov@inktank.com>
Date:   Thu Apr 10 18:09:41 2014 +0400

    libceph: fix non-default values check in apply_primary_affinity()
    
    osd_primary_affinity array is indexed into incorrectly when checking
    for non-default primary-affinity values.  This nullifies the impact of
    the rest of the apply_primary_affinity() and results in misdirected
    requests.
    
                    if (osds[i] != CRUSH_ITEM_NONE &&
                        osdmap->osd_primary_affinity[i] !=
                                                    ^^^
                                            CEPH_OSD_DEFAULT_PRIMARY_AFFINITY) {
    
    For a pool with size 2, this always ends up checking osd0 and osd1
    primary_affinity values, instead of the values that correspond to the
    osds in question.  E.g., given a [2,3] up set and a [max,max,0,max]
    primary affinity vector, requests are still sent to osd2, because both
    osd0 and osd1 happen to have max primary_affinity values and therefore
    we return from apply_primary_affinity() early on the premise that all
    osds in the given set have max (default) values.  Fix it.
    
    Fixes: http://tracker.ceph.com/issues/7954
    
    Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit 6da5246dd4b077ab229481ca342802f7fdcdab59
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Wed Apr 9 09:35:19 2014 +0800

    ceph: use fpos_cmp() to compare dentry positions
    
    Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit 0081bd83c089ef3d0c9a4e4e869e2ab75f2cb379
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Tue Apr 8 21:42:59 2014 +0800

    ceph: check directory's completeness before emitting directory entry
    
    Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
    Reviewed-by: Sage Weil <sage@inktank.com>

commit 014f1b20108dc2c0bb0777d8383654a089c790f8
Author: Masanari Iida <standby24x7@gmail.com>
Date:   Tue Apr 29 00:41:21 2014 +0900

    net: bonding: Fix format string mismatch in bond_sysfs.c
    
    Fix format string mismatch in bonding_show_min_links().
    
    Signed-off-by: Masanari Iida <standby24x7@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e374c618b1465f0292047a9f4c244bd71ab5f1f0
Author: Julian Anastasov <ja@ssi.bg>
Date:   Mon Apr 28 10:51:56 2014 +0300

    net: ipv6: more places need LOOPBACK_IFINDEX for flowi6_iif
    
    To properly match iif in ip rules we have to provide
    LOOPBACK_IFINDEX in flowi6_iif, not 0. Some ip6mr_fib_lookup
    and fib6_rule_lookup callers need such fix.
    
    Signed-off-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1560c974dcd40a8d3f193283acd7cc6aee13dc13
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 16:43:44 2014 +0200

    fuse: add renameat2 support
    
    Support RENAME_EXCHANGE and RENAME_NOREPLACE flags on the userspace ABI.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 4ace1f85a7cdab5453c2e12029ff978dd4cd6155
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:25 2014 +0200

    fuse: clear MS_I_VERSION
    
    Fuse doesn't support i_version (yet).
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 3ad22c62dd23ad26c8737c300f455de60ba01f40
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:25 2014 +0200

    fuse: clear FUSE_I_CTIME_DIRTY flag on setattr
    
    The patch addresses two use-cases when the flag may be safely cleared:
    
    1. fuse_do_setattr() is called with ATTR_CTIME flag set in attr->ia_valid.
    In this case attr->ia_ctime bears actual value. In-kernel fuse must send it
    to the userspace server and then assign the value to inode->i_ctime.
    
    2. fuse_do_setattr() is called with ATTR_SIZE flag set in attr->ia_valid,
    whereas ATTR_CTIME is not set (truncate(2)).
    In this case in-kernel fuse must sent "now" to the userspace server and then
    assign the value to inode->i_ctime.
    
    In both cases we could clear I_DIRTY_SYNC, but that needs more thought.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 31f3267b4ba16b12fb9dd3b1953ea0f221cc2ab4
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:24 2014 +0200

    fuse: trust kernel i_ctime only
    
    Let the kernel maintain i_ctime locally: update i_ctime explicitly on
    truncate, fallocate, open(O_TRUNC), setxattr, removexattr, link, rename,
    unlink.
    
    The inode flag I_DIRTY_SYNC serves as indication that local i_ctime should
    be flushed to the server eventually.  The patch sets the flag and updates
    i_ctime in course of operations listed above.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 8b47e73e91c064cd75e8bf458ce738e1bfe2e700
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:24 2014 +0200

    fuse: remove .update_time
    
    This implements updating ctime as well as mtime on file_update_time().
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit ab9e13f7c771b511d8f71666e83cb27bcc635b98
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:24 2014 +0200

    fuse: allow ctime flushing to userspace
    
    The patch extends fuse_setattr_in, and extends the flush procedure
    (fuse_flush_times()) called on ->write_inode() to send the ctime as well as
    mtime.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit e27c9d3877a0d0479711a55f5cdd7ee91442da53
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:23 2014 +0200

    fuse: fuse: add time_gran to INIT_OUT
    
    Allow userspace fs to specify time granularity.
    
    This is needed because with writeback_cache mode the kernel is responsible
    for generating mtime and ctime, but if the underlying filesystem doesn't
    support nanosecond granularity then the cache will contain a different
    value from the one stored on the filesystem resulting in a change of times
    after a cache flush.
    
    Make the default granularity 1s.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 1e18bda86e2dcc4ecb176213ee34649c93ad1396
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:23 2014 +0200

    fuse: add .write_inode
    
    ...and flush mtime from this.  This allows us to use the kernel
    infrastructure for writing out dirty metadata (mtime at this point, but
    ctime in the next patches and also maybe atime).
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 22401e7b7a686bff02549cd648ba6f73f8dba868
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:23 2014 +0200

    fuse: clean up fsync
    
    Don't need to start I/O twice (once without i_mutex and one within).
    
    Also make sure that even if the userspace filesystem doesn't support FSYNC
    we do all the steps other than sending the message.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 93d2269d2ffb871fdfc5555cb5d4a7c0fc56e7fe
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:22 2014 +0200

    fuse: fuse: fallocate: use file_update_time()
    
    in preparation for getting rid of FUSE_I_MTIME_DIRTY.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 75caeecdf9c7151af5f7d972e2dabbff1bef30a7
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:22 2014 +0200

    fuse: update mtime on open(O_TRUNC) in atomic_o_trunc mode
    
    In case of fc->atomic_o_trunc is set, fuse does nothing in
    fuse_do_setattr() while handling open(O_TRUNC). Hence, i_mtime must be
    updated explicitly in fuse_finish_open(). The patch also adds extra locking
    encompassing open(O_TRUNC) operation to avoid races between the truncation
    and updating i_mtime.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 009dd694e82098a703b8b5c8dd9f54c131dbb9b3
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:22 2014 +0200

    fuse: update mtime on truncate(2)
    
    Handling truncate(2), VFS doesn't set ATTR_MTIME bit in iattr structure;
    only ATTR_SIZE bit is set. In-kernel fuse must handle the case by setting
    mtime fields of struct fuse_setattr_in to "now" and set FATTR_MTIME bit
    even though ATTR_MTIME was not set.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit d31433c8b06d44e27f7637574137dc4b5e6fd1d1
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Mon Apr 28 14:19:21 2014 +0200

    fuse: do not use uninitialized i_mode
    
    When inode is in I_NEW state, inode->i_mode is not initialized yet. Do not
    use it before fuse_init_inode() is called.
    
    Signed-off-by: Maxim Patlasov <MPatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit aeb4eb6b55261f44d3705f0a3b9e4906bfa5e416
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:21 2014 +0200

    fuse: fix mtime update error in fsync
    
    Bad case of shadowing.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 4adb83029de8ef5144a14dbb5c21de0f156c1a03
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Mon Apr 28 14:19:21 2014 +0200

    fuse: check fallocate mode
    
    Don't allow new fallocate modes until we figure out what (if anything) that
    takes.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 7736e8cc51bbfdbd538c1870c314eb3483fe04ed
Author: Fabian Frederick <fabf@skynet.be>
Date:   Wed Apr 23 18:14:42 2014 +0200

    fuse: add __exit to fuse_ctl_cleanup
    
    fuse_ctl_cleanup is only called by __exit fuse_exit
    
    Signed-off-by: Fabian Frederick <fabf@skynet.be>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

commit 8c2eab9097dba50bcd73ed4632baccc3f34857f9
Author: Karl Heiss <kheiss@gmail.com>
Date:   Fri Apr 25 14:26:30 2014 -0400

    net: sctp: Don't transition to PF state when transport has exhausted 'Path.Max.Retrans'.
    
    Don't transition to the PF state on every strike after 'Path.Max.Retrans'.
    Per draft-ietf-tsvwg-sctp-failover-03 Section 5.1.6:
    
       Additional (PMR - PFMR) consecutive timeouts on a PF destination
       confirm the path failure, upon which the destination transitions to the
       Inactive state.  As described in [RFC4960], the sender (i) SHOULD notify
       ULP about this state transition, and (ii) transmit heartbeats to the
       Inactive destination at a lower frequency as described in Section 8.3 of
       [RFC4960].
    
    This also prevents sending SCTP_ADDR_UNREACHABLE to the user as the state
    bounces between SCTP_INACTIVE and SCTP_PF for each subsequent strike.
    
    Signed-off-by: Karl Heiss <kheiss@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ddcde142bed44490e338ed1124cb149976d355bb
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Sat Apr 26 21:18:32 2014 +0200

    slip: fix spinlock variant
    
    With commit cc9fa74e2a ("slip/slcan: added locking in wakeup function") a
    formerly missing locking was added to slip.c and slcan.c by Andre Naujoks.
    
    Alexander Stein contributed the fix 367525c8c2 ("can: slcan: Fix spinlock
    variant") as the kernel lock debugging advised to use spin_lock_bh() instead
    of just using spin_lock().
    
    This fix has to be applied to the same code section in slip.c for the same
    reason too.
    
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6f10c5d1b1aeddb63d33070abb8bc5a177beeb1f
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:34 2014 +0200

    net: qmi_wwan: add a number of Dell devices
    
    Dan writes:
    
    "The Dell drivers use the same configuration for PIDs:
    
    81A2: Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card
    81A3: Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card
    81A4: Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card
    81A8: Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card
    81A9: Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card
    
    These devices are all clearly Sierra devices, but are also definitely
    Gobi-based.  The A8 might be the MC7700/7710 and A9 is likely a MC7750.
    
    >From DellGobi5kSetup.exe from the Dell drivers:
    
    usbif0: serial/firmware loader?
    usbif2: nmea
    usbif3: modem/ppp
    usbif8: net/QMI"
    
    Reported-by: AceLan Kao <acelan.kao@canonical.com>
    Reported-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 41be7d90993b1502d445bfc59e58348c258ce66a
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:33 2014 +0200

    net: qmi_wwan: add a number of CMOTech devices
    
    A number of older CMOTech modems are based on Qualcomm
    chips and exporting a QMI/wwan function.
    
    Reported-by: Lars Melin <larsm17@gmail.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 75573660c47a0db7cc931dcf154945610e02130a
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:32 2014 +0200

    net: qmi_wwan: add Alcatel L800MA
    
    Device interface layout:
    0: ff/ff/ff - serial
    1: ff/00/00 - serial AT+PPP
    2: ff/ff/ff - QMI/wwan
    3: 08/06/50 - storage
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit efc0b25c3add97717ece57bf5319792ca98f348e
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:31 2014 +0200

    net: qmi_wwan: add Olivetti Olicard 500
    
    Device interface layout:
    0: ff/ff/ff - serial
    1: ff/ff/ff - serial AT+PPP
    2: 08/06/50 - storage
    3: ff/ff/ff - serial
    4: ff/ff/ff - QMI/wwan
    
    Reported-by: Julio Araujo <julio.araujo@wllctel.com.br>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9214224e43e4264b02686ea8b455f310935607b5
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:30 2014 +0200

    net: qmi_wwan: add Sierra Wireless MC7305/MC7355
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1c138607a7be64074d7fba68d0d533ec38f9d17b
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:29 2014 +0200

    net: qmi_wwan: add Sierra Wireless MC73xx
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b85f5deaf052340021d025e120a9858f084a1d79
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 19:00:28 2014 +0200

    net: qmi_wwan: add Sierra Wireless EM7355
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 85350871317a5adb35519d9dc6fc9e80809d42ad
Author: Xufeng Zhang <xufeng.zhang@windriver.com>
Date:   Fri Apr 25 16:55:41 2014 +0800

    sctp: reset flowi4_oif parameter on route lookup
    
    commit 813b3b5db83 (ipv4: Use caller's on-stack flowi as-is
    in output route lookups.) introduces another regression which
    is very similar to the problem of commit e6b45241c (ipv4: reset
    flowi parameters on route connect) wants to fix:
    Before we call ip_route_output_key() in sctp_v4_get_dst() to
    get a dst that matches a bind address as the source address,
    we have already called this function previously and the flowi
    parameters have been initialized including flowi4_oif, so when
    we call this function again, the process in __ip_route_output_key()
    will be different because of the setting of flowi4_oif, and we'll
    get a networking device which corresponds to the inputted flowi4_oif
    as the output device, this is wrong because we'll never hit this
    place if the previously returned source address of dst match one
    of the bound addresses.
    
    To reproduce this problem, a vlan setting is enough:
      # ifconfig eth0 up
      # route del default
      # vconfig add eth0 2
      # vconfig add eth0 3
      # ifconfig eth0.2 10.0.1.14 netmask 255.255.255.0
      # route add default gw 10.0.1.254 dev eth0.2
      # ifconfig eth0.3 10.0.0.14 netmask 255.255.255.0
      # ip rule add from 10.0.0.14 table 4
      # ip route add table 4 default via 10.0.0.254 src 10.0.0.14 dev eth0.3
      # sctp_darn -H 10.0.0.14 -P 36422 -h 10.1.4.134 -p 36422 -s -I
    You'll detect that all the flow are routed to eth0.2(10.0.1.254).
    
    Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
    Signed-off-by: Julian Anastasov <ja@ssi.bg>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 88154c96ee2dab84ae78ad41562b4a3a23d83788
Author: Heiko Stübner <heiko@sntech.de>
Date:   Fri Apr 25 10:06:13 2014 +0200

    arc_emac: add clock handling
    
    This adds ability for the arc_emac to really handle its supplying clock.
    To get the needed clock-frequency either a real clock or the previous
    clock-frequency property must be provided.
    
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Tested-by: Max Schwarz <max.schwarz@online.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 796bec1efbbd3be98d84cd68279c6ec03a4782f9
Author: Heiko Stübner <heiko@sntech.de>
Date:   Fri Apr 25 10:03:29 2014 +0200

    arc_emac: fix probe error path
    
    The probe function at the moment only frees the netdev but does not disconnect
    the phy or removes the mdio bus it registered.
    
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 30313a3d5794472c3548d7288e306a5492030370
Author: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Date:   Fri Apr 25 17:01:18 2014 +0900

    bridge: Handle IFLA_ADDRESS correctly when creating bridge device
    
    When bridge device is created with IFLA_ADDRESS, we are not calling
    br_stp_change_bridge_id(), which leads to incorrect local fdb
    management and bridge id calculation, and prevents us from receiving
    frames on the bridge device.
    
    Reported-by: Tom Gundersen <teg@jklm.no>
    Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 535cdf3c195ed4125414f6bb780382aed1b4e19c
Author: Hariprasad Shenai <hariprasad@chelsio.com>
Date:   Fri Apr 25 18:00:12 2014 +0530

    cxgb4: Update Kconfig to include Chelsio T5 adapter
    
    Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit cafa1fca9de584dcd920629cf075091a7df64bb0
Author: Jacob Keller <jacob.e.keller@intel.com>
Date:   Thu Apr 24 18:05:03 2014 -0700

    i40e: fix Timesync Tx interrupt handler code
    
    This patch fixes the PTP Tx timestamp interrupt handler. The original
    code misinterpreted the interrupt handler design. We were clearing the
    ena_mask bit for the Timesync interrupts. This is done to indicate that
    the interrupt will be handled in a scheduled work item (instead of
    immediately) and that work item is responsible for re-enabling the
    interrupts. However, the Tx timestamp was being handled immediately and
    nothing was ever re-enabling it. This resulted in a single interrupt
    working for the life of the driver.
    
    This patch fixes the issue by instead clearing the bit from icr0 which
    is used to indicate that the interrupt was immediately handled and can
    be re-enabled right away. This patch also clears up a related issue due
    to writing the PRTTSYN_STAT_0 register, which was unintentionally
    clearing the cause bits for Timesync interrupts.
    
    Change-ID: I057bd70d53c302f60fab78246989cbdfa469d83b
    Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
    Acked-by: Anjali Singhai Jain <anjali.singhai@intel.com>
    Acked-by: Shannon Nelson <shannon.nelson@intel.com>
    Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 99514e116c2e297e03a1434eb7e9f4e8fd2a492b
Author: Vince Bridgers <vbridger@altera.com>
Date:   Thu Apr 24 16:58:11 2014 -0500

    Altera TSE: Change driver name used by Ethtool
    
    This patch changes the name used by Ethtool to something more
    conventional in preparation for TSE Ethtool register dump
    support to be added in the near future.
    
    Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a76420092d3d9f2e52ad7469c210c0e2fa962fe4
Author: Vince Bridgers <vbridger@altera.com>
Date:   Thu Apr 24 16:58:10 2014 -0500

    Altera TSE: Fix Panic in probe routine when phy probe fails
    
    This patch addresses a fault in the error recovery path of the probe
    routine where the netdev structure was not being unregistered properly
    leading to a panic only when the phy probe failed.
    
    Abbreviated panic stack seen is as follows:
    
    (free_netdev+0xXX) from (altera_tse_probe+0xXX)
    (altera_tse_probe+0xXX) from (platform_drv_probe+0xXX)
    (platform_drv_probe+0xXX) from (driver_probe_device+0xXX)
    (driver_probe_device+0xXX) from (__driver_attach+0xXX)
    (__driver_attach+0xXX) from (bus_for_each_dev+0xXX)
    (bus_for_each_dev+0xXX) from (driver_attach+0xXX)
    (driver_attach+0xXX) from (bus_add_driver+0xXX)
    (bus_add_driver+0xXX) from (driver_register+0xXX)
    (driver_register+0xXX) from (__platform_driver_register+0xXX)
    (__platform_driver_register+0xXX) from (altera_tse_driver_init+0xXX)
    (altera_tse_driver_init+0xXX) from (do_one_initcall+0xXX)
    (do_one_initcall+0xXX) from (kernel_init_freeable+0xXX)
    (kernel_init_freeable+0xXX) from (kernel_init+0xXX)
    (kernel_init+0xXX) from (ret_from_fork+0xXX)
    
    Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5aec4ee3724ad93ee63cafc6f6b5f9cd40adda52
Author: Vince Bridgers <vbridger@altera.com>
Date:   Thu Apr 24 16:58:09 2014 -0500

    Altera TSE: Set the Pause Quanta value to the IEEE default value
    
    This patch initializes the pause quanta set for transmitted pause frames
    to the IEEE specified default of 0xffff.
    
    Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 37c0ffaad21401eacc6618a121cc2c501131026f
Author: Vince Bridgers <vbridger@altera.com>
Date:   Thu Apr 24 16:58:08 2014 -0500

    Altera TSE: Work around unaligned DMA receive packet issue with Altera SGDMA
    
    This patch works around a recently discovered unaligned receive dma problem
    with the Altera SGMDA. The Altera SGDMA component cannot be configured to
    DMA data to unaligned addresses for receive packet operations from the
    Triple Speed Ethernet component because of a potential data transfer
    corruption that can occur. This patch addresses this issue by
    utilizing the shift 16 bits feature of the Altera Triple Speed Ethernet
    component and modifying the receive buffer physical addresses accordingly
    such that the target receive DMA address is always aligned on a 32-bit
    boundary.
    
    Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
    Tested-by: Matthew Gerlach <mgerlach@altera.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ab15f86b8d3c3e7a1437010bb57ea543fc422463
Author: Narender Kumar <narender.kumar@qlogic.com>
Date:   Thu Apr 24 19:29:54 2014 +0300

    bnx2x: Fix failure to configure VF multicast filters
    
    Commit 2dc33bbc "bnx2x: Remove the sriov VFOP mechanism" caused a regression,
    preventing VFs from configuring multicast filters.
    
    Signed-off-by: Naredner Kumar <narender.kumar@qlogic.com>
    Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
    Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1a3d94240bc5e969e7e8cef661fbad24296ba36f
Author: Yuval Mintz <Yuval.Mintz@qlogic.com>
Date:   Thu Apr 24 19:29:53 2014 +0300

    bnx2x: Fix vlan credit issues for VFs
    
    Starting with commit 2dc33bbc "bnx2x: Remove the sriov VFOP mechanism",
    the bnx2x started enforcing vlan credits for all vlan configurations.
    This exposed 2 issues:
      - Vlan credits are not returned once a VF is removed; this causes a leak
        of credits, and eventually will lead to VFs with no vlan credits.
      - A vlan credit must be set aside for the Hypervisor to use, and should
        not be visible to the VF.
    
    Although linux VFs at the moment do not support vlan configuration [from the
    VF side] which causes them to be resilient to this sort of issue, Windows VF
    over linux hypervisors might fail to load as the vlan credits become depleted.
    
    Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
    Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e2a367f8e3c2afd5cfd5f0892844c74960ecc031
Author: Yuval Mintz <Yuval.Mintz@qlogic.com>
Date:   Thu Apr 24 19:29:52 2014 +0300

    bnx2x: Memory leak during VF removal
    
    When removing a VF interface, the driver fails to release that VF's mailbox
    and bulletin board allocated memory.
    
    Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
    Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit bbc28134e915d2e2e8cac0254d1d056db0ae3247
Author: Doug Anderson <dianders@chromium.org>
Date:   Tue Apr 22 01:03:00 2014 +0100

    iio: adc: Nothing in ADC should be a bool CONFIG
    
    The whole IIO subsystem can be built as modules.  If you make it a
    module then stuff marked as "Y" in the adc directory simply won't be
    linked in properly.
    
    The two configs that were wrong were EXYNOS_ADC and LP8788_ADC.  I
    know for a fact that EXYNOS_ADC will work as a module. I assume
    LP8788_ADC will also be fine.
    
    Signed-off-by: Doug Anderson <dianders@chromium.org>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>

commit 3d821a1747a0abbb7a179af10188ad7ad9b35b72
Author: Naveen Krishna Ch <ch.naveen@samsung.com>
Date:   Fri Apr 25 11:14:00 2014 +0100

    iio: exynos_adc: use indio_dev->dev structure to handle child nodes
    
    Using pdev->dev with device_for_each_child() would iterate over all
    of the children of the platform device and delete them.
    Thus, causing crashes during module unload.
    
    We should be using the indio_dev->dev structure for
    registering/unregistering child nodes.
    
    Reported-by: Doug Anderson <dianders@chromium.org>
    Signed-off-by: Naveen Krishna Ch <ch.naveen@samsung.com>
    Reviewed-by: Doug Anderson <dianders@chromium.org>
    Tested-by: Doug Anderson <dianders@chromium.org>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>

commit b9b3a41893c3f1be67b5aacfa525969914bea0e9
Author: Atilla Filiz <atilla.filiz@essensium.com>
Date:   Fri Apr 11 16:51:23 2014 +0200

    iio:imu:mpu6050: Fixed segfault in Invensens MPU driver due to null dereference
    
    The driver segfaults when the kernel boots with device tree as the
    platform data is then not present and the pointer is deferenced without
    checking it is not null.  This patch introduces such a check avoiding the
    crash.
    
    Signed-off-by: Atilla Filiz <atilla.filiz@essensium.com>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>
    Cc: Stable@vger.kernel.org

commit c60e5760b0a62b072ba00ac07643d9b6fb29f2b4
Author: Jimmy Li <coder.liss@gmail.com>
Date:   Fri Apr 25 03:52:00 2014 +0100

    staging:iio:ad2s1200 fix missing parenthesis in a for statment.
    
    Signed-off-by: Jimmy Li <coder.liss@gmail.com>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>

commit 7f1950fbb989e8fc5463b307e062b4529d51c862
Author: Egbert Eich <eich@suse.de>
Date:   Fri Apr 25 10:56:22 2014 +0200

    drm/i915: Break encoder->crtc link separately in intel_sanitize_crtc()
    
    Depending on the SDVO output_flags SDVO may have multiple connectors
    linking to the same encoder (in intel_connector->encoder->base).
    Only one of those connectors should be active (ie link to the encoder
    thru drm_connector->encoder).
    If intel_connector_break_all_links() is called from intel_sanitize_crtc()
    we may break the crtc connection of an encoder thru an inactive connector
    in which case intel_connector_break_all_links() will not be called again
    for the active connector if this happens to come later in the list due to:
        if (connector->encoder->base.crtc != &crtc->base)
                                     continue;
    in intel_sanitize_crtc().
    This will however leave the drm_connector->encoder linkage for this
    active connector in place. Subsequently this will cause multiple
    warnings in intel_connector_check_state() to trigger and the driver
    will eventually die in drm_encoder_crtc_ok() (because of crtc == NULL).
    
    To avoid this remove intel_connector_break_all_links() and move its
    code to its two calling functions: intel_sanitize_crtc() and
    intel_sanitize_encoder().
    This allows to implement the link breaking more flexibly matching
    the surrounding code: ie. in intel_sanitize_crtc() we can break the
    crtc link separatly after the links to the encoders have been
    broken which avoids above problem.
    
    This regression has been introduced in:
    
    commit 24929352481f085c5f85d4d4cbc919ddf106d381
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Mon Jul 2 20:28:59 2012 +0200
    
        drm/i915: read out the modeset hw state at load and resume time
    
    so goes back to the very beginning of the modeset rework.
    
    v2: This patch takes care of the concernes voiced by Chris Wilson
    and Daniel Vetter that only breaking links if the drm_connector
    is linked to an encoder may miss some links.
    v3: move all encoder handling to encoder loop as suggested by
    Daniel Vetter.
    
    Signed-off-by: Egbert Eich <eich@suse.de>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: stable@vger.kernel.org
    Cc: Jani Nikula <jani.nikula@linux.intel.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>

commit c16134976fb27d325ae037a8b39b537a77ba1d12
Author: Dr. H. Nikolaus Schaller <hns@goldelico.com>
Date:   Thu Apr 24 23:43:36 2014 -0700

    Input: tca8418 - fix loading this driver as a module from a device tree
    
    Loading the tca8418 driver as a module on a device tree based system needs
    a MODULE_ALIAS because the driver name does not match the automatic
    name generation rules of a 'compatible' entry on i2c bus.
    
    Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit ef3714fdbc8d4bb0af2eff584519f9687aed0fcb
Author: Dr. H. Nikolaus Schaller <hns@goldelico.com>
Date:   Thu Apr 24 23:42:43 2014 -0700

    Input: bma150 - extend chip detection for bma180
    
    This driver has been used while on the OpenPhoenux GTA04 with a BMA180.
    
    Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 1fb4e09a7e780b915dbd172592ae7e2a4c071065
Author: Mohammed Habibulla <moch@chromium.org>
Date:   Thu Apr 17 11:37:13 2014 -0700

    Bluetooth: Add support for Lite-on [04ca:3007]
    
    Add support for the AR9462 chip
    
    T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#=  3 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3007 Rev= 0.01
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Mohammed Habibulla <moch@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

commit 09da1f3463eb81d59685df723b1c5950b7570340
Author: Johan Hedberg <johan.hedberg@intel.com>
Date:   Fri Apr 11 12:02:32 2014 -0700

    Bluetooth: Fix redundant encryption request for reauthentication
    
    When we're performing reauthentication (in order to elevate the
    security level from an unauthenticated key to an authenticated one) we
    do not need to issue any encryption command once authentication
    completes. Since the trigger for the encryption HCI command is the
    ENCRYPT_PEND flag this flag should not be set in this scenario.
    Instead, the REAUTH_PEND flag takes care of all necessary steps for
    reauthentication.
    
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Cc: stable@vger.kernel.org

commit 9eb1fbfa0a737fd4d3a6d12d71c5ea9af622b887
Author: Johan Hedberg <johan.hedberg@intel.com>
Date:   Fri Apr 11 12:02:31 2014 -0700

    Bluetooth: Fix triggering BR/EDR L2CAP Connect too early
    
    Commit 1c2e004183178 introduced an event handler for the encryption key
    refresh complete event with the intent of fixing some LE/SMP cases.
    However, this event is shared with BR/EDR and there we actually want to
    act only on the auth_complete event (which comes after the key refresh).
    
    If we do not do this we may trigger an L2CAP Connect Request too early
    and cause the remote side to return a security block error.
    
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Cc: stable@vger.kernel.org

commit 3c49aa852e00978ba2f1a4d1e4598a0c669a5347
Author: Marcel Holtmann <marcel@holtmann.org>
Date:   Tue Apr 22 14:04:16 2014 -0700

    Revert "Bluetooth: Enable autosuspend for Intel Bluetooth device"
    
    This reverts commit d2bee8fb6e18f6116aada39851918473761f7ab1.
    
    Enabling autosuspend for Intel Bluetooth devices has been shown to not
    work reliable. It does work for some people with certain combinations
    of USB host controllers, but for others it puts the device to sleep and
    it will not wake up for any event.
    
    These events can be important ones like HCI Inquiry Complete or HCI
    Connection Request. The events will arrive as soon as you poke the
    device with a new command, but that is not something we can do in
    these cases.
    
    Initially there were patches to the xHCI USB controller that fixed
    this for some people, but not for all. This could be well a problem
    somewhere in the USB subsystem or in the USB host controllers or
    just plain a hardware issue somewhere. At this moment we just do
    not know and the only safe action is to revert this patch.
    
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Cc: Tedd Ho-Jeong An <tedd.an@intel.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

commit 3d725caa9dcc78c3dc9e7ea0c04f626468edd9c9
Author: Sheng-Liang Song <ssl@chromium.org>
Date:   Thu Apr 24 16:28:29 2014 -0700

    Input: atkbd - fix keyboard not working on some LG laptops
    
    After issuing ATKBD_CMD_RESET_DIS, keyboard on some LG laptops stops
    working. The workaround is to stop issuing ATKBD_CMD_RESET_DIS commands.
    
    In order to keep changes in atkbd driver to the minimum we check DMI
    signature and only skip ATKBD_CMD_RESET_DIS if we are running on LG
    LW25-B7HV or P1-J273B.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Sheng-Liang Song <ssl@chromium.org>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit ffa216bb5eecfce0f01b0b2a95d5c320dde90005
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Apr 23 12:20:55 2014 +0200

    brcmfmac: Fix brcmf_chip_ai_coredisable not applying reset bits to BCMA_IOCTL
    
    brcmfmac has been broken on my cubietruck with a BCM43362:
    
    brcmfmac: brcmf_chip_recognition: found AXI chip: BCM43362, rev=1
    brcmfmac: brcmf_c_preinit_dcmds: Firmware version = wl0:
            Apr 22 2013 14:50:00 version 5.90.195.89.6 FWID 01-b30a427d
    
    since commit 53036261033: "brcmfmac: update core reset and disable routines".
    
    The problem is that since this commit brcmf_chip_ai_resetcore no longer sets
    BCMA_IOCTL itself before bringing the core out of reset, instead relying on
    brcmf_chip_ai_coredisable to do so. But brcmf_chip_ai_coredisable is a nop
    of the chip is already in reset. This patch modifies brcmf_chip_ai_coredisable
    to always set BCMA_IOCTL even if the core is already in reset.
    
    This fixes brcmfmac hanging in firmware loading on my board.
    
    Cc: stable@vger.kernel.org # v3.14
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Acked-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 8c7ae357cc5b6bd037ad2d666e9f3789cf882925
Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Date:   Wed Apr 23 15:07:57 2014 +0530

    ath9k: fix race in setting ATH_OP_INVALID
    
    The commit "ath9k: move sc_flags to ath_common" moved setting
    ATH_OP_INVALID flag below ieee80211_register_hw. This is causing
    the flag never being cleared randomly as the drv_start is called
    prior to setting flag. Fix this by setting the flag prior to
    register_hw.
    
    Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 1c2658545816088477e91860c3a645053719cb54
Author: Kumar Sundararajan <kumar@fb.com>
Date:   Thu Apr 24 09:48:53 2014 -0400

    ipv6: fib: fix fib dump restart
    
    When the ipv6 fib changes during a table dump, the walk is
    restarted and the number of nodes dumped are skipped. But the existing
    code doesn't advance to the next node after a node is skipped. This can
    cause the dump to loop or produce lots of duplicates when the fib
    is modified during the dump.
    
    This change advances the walk to the next node if the current node is
    skipped after a restart.
    
    Signed-off-by: Kumar Sundararajan <kumar@fb.com>
    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 367525c8c20a34560afe1d0c7cca52a44ccd62e9
Author: Alexander Stein <alexander.stein@systec-electronic.com>
Date:   Tue Apr 15 16:51:04 2014 +0200

    can: slcan: Fix spinlock variant
    
    slc_xmit is called within softirq context and locks sl->lock, but
    slcan_write_wakeup is not softirq context, so we need to use
    spin_[un]lock_bh!
    Detected using kernel lock debugging mechanism.
    
    Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit d482443244b820f03a5a07d1bca6a0f5e2b4804c
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Wed Apr 23 22:10:55 2014 +0200

    can: fix return value from can_get_bittiming()
    
    When trying to set a data bitrate on non CAN FD devices the 'ip' tool
    answers with:
    
    	RTNETLINK answers: Unknown error 524
    
    Rename '-ENOTSUPP' to '-EOPNOTSUPP' so that 'ip' answers correctly:
    
           RTNETLINK answers: Operation not supported
    
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit a9edcdedbd3d8f3ffcd7bdcab5812707a25e554e
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Tue Apr 15 19:30:00 2014 +0200

    can: sja1000_isa: add locking for indirect register access mode
    
    When accessing the SJA1000 controller registers in the indirect access mode,
    writing the register number and reading/writing the data has to be an atomic
    attempt.
    
    As the sja1000_isa driver is an old style driver with a fixed number of
    instances the locking variable depends on the same index like all the other
    configuration elements given on the module command line.
    
    As a positive side effect dev->dev_id is populated by the instance index,
    which was missing in 3e66d0138c05d9 ("can: populate netdev::dev_id for udev
    discrimination").
    
    Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 78c181bc8a75d3f0624eaf24aa8265d441990c8c
Author: Wolfgang Grandegger <wg@grandegger.com>
Date:   Thu Apr 3 20:41:24 2014 +0200

    can: c_can_pci: enable PCI bus master only for MSI
    
    Coverity complains that c_can_pci_probe() calls pci_enable_msi() without
    checking the result:
    
    CID 712278 (#1 of 1): Unchecked return value (CHECKED_RETURN) 3. check_return:
    Calling pci_enable_msi_block without checking return value (as is done
    elsewhere 88 out of 105 times).
     88        pci_enable_msi(pdev);
    
    This is CID 712278.
    
    Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
    Reported-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit f323d7a1d2868c00b2604dca36ad82e8ecbe4270
Author: Wolfram Sang <wsa@sang-engineering.com>
Date:   Thu Apr 17 10:57:18 2014 +0200

    can: c_can: use proper type for 'instance'
    
    Commit 6439fbce1075 (can: c_can: fix error checking of priv->instance in
    probe()) found the warning but applied a suboptimal solution. Since, both
    pdev->id and of_alias_get_id() return integers, it makes sense to convert the
    variable to an integer and avoid the cast.
    
    Signed-off-by: Wolfram Sang <wsa@sang-engineering.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 939415973fdfb2c16a474e2575ba2581b828ccac
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:22 2014 +0000

    can: c_can: Speed up tx buffer invalidation
    
    It's suffcient to kill the TXIE bit in the message control register
    even if the documentation of C and D CAN says that it's not allowed to
    do that while MSGVAL is set. Reality tells a different story and this
    change gives us another 2% of CPU back for not waiting on I/O.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 35bdafb576c5c0a06815e7a681571c3ab950ff7e
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:22 2014 +0000

    can: c_can: Remove tx locking
    
    Mark suggested to use one IF for the softirq and the other for the
    xmit function to avoid the xmit lock.
    
    That requires to write the frame into the interface first, then handle
    the echo skb and store the dlc before committing the TX request to the
    message ram.
    
    We use an atomic to handle the active buffers instead of reading the
    MSGVAL register as thats way faster especially on PCH/x86.
    
    Suggested-by: Mark <mark5@del-llc.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit d48071be6cb94912cf3c3ac0b4d520438fab4778
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:21 2014 +0000

    can: c_can: Use proper u32 variables in c_can_write_msg_object()
    
    Instead of obfuscating the code by artificial 16 bit splits use the
    proper 32 bit assignments and split the result when writing to the
    interface.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 23ef0a895dd3f115909ca70958aeb3d04f374b0d
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:21 2014 +0000

    can: c_can: Cleanup c_can_write_msg_object()
    
    Remove the MASK from the TX transfer side.
    
    Make the code readable and get rid of the annoying IFX_WRITE_XXX_16BIT
    macros which are just obfuscating the code.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 7af28630b87d0b2eefeee8547ad52df7e0e1b1c4
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:20 2014 +0000

    can: c_can: Cleanup c_can_msg_obj_put/get()
    
    Sigh!
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit b07faaaf1f60c2b76604917fc5a9937974d78e92
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:19 2014 +0000

    can: c_can: Cleanup c_can_inval_msg_object()
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 8ff2de0fb41560cfdf072eb41b5a5b4799d126ea
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:18 2014 +0000

    can: c_can: Cleanup setup of receive buffers
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 4fb6dccd13b27651998f773755e2a1db461c62f1
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:18 2014 +0000

    can: c_can: Cleanup c_can_read_msg_object()
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 2d5f4f85695623fab5fac7db19fd0290ef54eca8
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:17 2014 +0000

    can: c_can: Cleanup irq enable/disable
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit d61d09de023320b95a536eb4d31941e67002a93c
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:17 2014 +0000

    can: c_can: Work around C_CAN RX wreckage
    
    Alexander reported that the new optimized handling of the RX fifo
    causes random packet loss on Intel PCH C_CAN hardware.
    
    After a few fruitless debugging sessions I got hold of a PCH (eg20t)
    afflicted system. That machine does not have the CAN interface wired
    up, but it was possible to reproduce the issue with the HW loopback
    mode.
    
    As Alexander observed correctly, clearing the NewDat flag along with
    reading out the message buffer causes that issue on C_CAN, while D_CAN
    handles that correctly.
    
    Instead of restoring the original message buffer handling horror the
    following workaround solves the issue:
    
        transfer buffer to IF without clearing the NewDat
        handle the message
        clear NewDat bit
    
    That's similar to the original code but conditional for C_CAN.
    
    I really wonder why all user manuals (C_CAN, Intel PCH and some more)
    recommend to clear the NewDat bit right away. The knows it all Oracle
    operated by Gurgle does not unearth any useful information either. I
    simply cannot believe that we are the first to uncover that HW issue.
    
    Reported-and-tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 2b9aecdce227e099349b73e3a074936d3c51f2a9
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:16 2014 +0000

    can: c_can: Disable rx split as workaround
    
    The RX buffer split causes packet loss in the hardware:
    
    What happens is:
    
    RX Packet 1 --> message buffer 1 (newdat bit is not cleared)
    RX Packet 2 --> message buffer 2 (newdat bit is not cleared)
    RX Packet 3 --> message buffer 3 (newdat bit is not cleared)
    RX Packet 4 --> message buffer 4 (newdat bit is not cleared)
    RX Packet 5 --> message buffer 5 (newdat bit is not cleared)
    RX Packet 6 --> message buffer 6 (newdat bit is not cleared)
    RX Packet 7 --> message buffer 7 (newdat bit is not cleared)
    RX Packet 8 --> message buffer 8 (newdat bit is not cleared)
    
    Clear newdat bit in message buffer 1
    Clear newdat bit in message buffer 2
    Clear newdat bit in message buffer 3
    Clear newdat bit in message buffer 4
    Clear newdat bit in message buffer 5
    Clear newdat bit in message buffer 6
    Clear newdat bit in message buffer 7
    Clear newdat bit in message buffer 8
    
    Now if during that clearing of newdat bits, a new message comes in,
    the HW gets confused and drops it.
    
    It does not matter how many of them you clear. I put a delay between
    clear of buffer 1 and buffer 2 which was long enough that the message
    should have been queued either in buffer 1 or buffer 9. But it did not
    show up anywhere. The next message ended up in buffer 1. So the
    hardware lost a packet of course without telling it via one of the
    error handlers.
    
    That does not happen on all clear newdat bit events. I see one of 10k
    packets dropped in the scenario which allows us to reproduce. But the
    trace looks always the same.
    
    Not splitting the RX Buffer avoids the packet loss but can cause
    reordering. It's hard to trigger, but it CAN happen.
    
    With that mode we use the HW as it was probably designed for. We read
    from the buffer 1 upwards and clear the buffer as we get the
    message. That's how all microcontrollers use it. So I assume that the
    way we handle the buffers was never really tested. According to the
    public documentation it should just work :)
    
    Let the user decide which evil is the lesser one.
    
    [ Oliver Hartkopp: Provided a sane config option and help text and
      made me switch to favour potential and unlikely reordering over
      packet loss ]
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit fa39b54ccf28a0a85256f04881297cd75b8ef204
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:15 2014 +0000

    can: c_can: Get rid of pointless interrupts
    
    The driver handles pointlessly TWO interrupts per packet. The reason
    is that it enables the status interrupt which fires for each rx and tx
    packet and it enables the per message object interrupts as well.
    
    The status interrupt merily acks or in case of D_CAN ignores the TX/RX
    state and then the message object interrupt fires.
    
    The message objects interrupts are only useful if all message objects
    have hardware filters activated.
    
    But we don't have that and its not simple to implement in that driver
    without rewriting it completely.
    
    So we can ditch the message object interrupts and handle the RX/TX
    right away from the status interrupt. Instead of TWO we handle ONE.
    
    Note: We must keep the TXIE/RXIE bits in the message buffers because
    the status interrupt alone is not reliable enough in corner cases.
    
    If we ever have the need for HW filtering, then this code needs a
    complete overhaul and we can think about it then. For now we prefer a
    lower interrupt load.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit b9011aae9389c8853c1ccc2236f500a6e648c525
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:15 2014 +0000

    can: c_can: Avoid status register update for D_CAN
    
    On D_CAN the RXOK, TXOK and LEC bits are cleared/set on read of the
    status register. No need to update them.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 6b48ff8d934ab5ca6697b0e311e7869ff4a1d3f3
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:14 2014 +0000

    can: c_can: Simplify buffer reenabling
    
    Instead of writing to the message object we can simply clear the
    NewDat bit with the get method.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 1da394d889b4110bda954813ef32601c06118376
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:13 2014 +0000

    can: c_can: Always update error stats
    
    If the allocation of the error skb fails, we still want to see the
    error statistics.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 097aec19689d8f2f76fd0c1becacf32801ae94c7
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:13 2014 +0000

    can: c_can: Fix berr reporting
    
    Reading the LEC type with
    
      return (mode & ENABLED) && (status & LEC_MASK);
    
    is not guaranteed to return (status & LEC_MASK) if the enabled bit in
    mode is set. It's guaranteed to return 0 or !=0.
    
    Remove the inline function and call unconditionally into the
    berr_handling code and return early when the reporting is disabled.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit f058d548e8071a1d148d6ebd94888d011c3ca71e
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:12 2014 +0000

    can: c_can: Handle state change correctly
    
    If the allocation of an error skb fails, the state change handling
    returns w/o doing any work. That leaves the interface in a wreckaged
    state as the internal status is wrong.
    
    Split the interface handling and the skb handling.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 9c64863a49bd23c5a3a983680eb500f7796c81be
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:12 2014 +0000

    can: c_can: Do not access skb after net_receive_skb()
    
    There is no guarantee that the skb is in the same state after calling
    net_receive_skb(). It might be freed or reused. Not really harmful as
    its a read access, except you turn on the proper debugging options
    which catch a use after free.
    
    The whole can subsystem is full of this. Copy and paste ....
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit ef1d2e286a2d8876e03a3f58ea1a1f549727e518
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:11 2014 +0000

    can: c_can: Make bus off interrupt disable logic work
    
    The state change handler is called with device interrupts disabled
    already. So no point in disabling them again when we enter bus off
    state.
    
    But what's worse is that we reenable the interrupts at the end of NAPI
    poll unconditionally. So c_can_start() which is called from the
    restart timer can trigger interrupts which confuse the hell out of the
    half reinitialized driver/hw.
    
    Remove the pointless device interrupt disable in the BUS_OFF handler
    and prevent reenabling the device interrupts at the end of the poll
    routine when the current state is BUS_OFF.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit bed11db3d4095e5f818f5e8bf7f43ef2beb36d4e
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:10 2014 +0000

    can: c_can: Fix startup logic
    
    c_can_start() enables interrupts way too early. The first enabling
    happens when setting the control mode in c_can_chip_config() and then
    again at the end of the function.
    
    But that happens before napi_enable() and that means that an interrupt
    which comes in will disable interrupts again and call napi_schedule,
    which ignores the request and the later napi_enable() is not making
    thinks work either. So the interface is up with all device interrupts
    disabled.
    
    Move the device interrupt after napi_enable() and add it to the other
    callsites of c_can_start() in c_can_set_mode() and c_can_power_up()
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 129eef2184218f4603f406945552ff4e58b05cf1
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Apr 11 08:13:10 2014 +0000

    can: c_can_pci: Set the type of the IP core
    
    All type checks in c_can.c are != BOSCH_D_CAN so nobody noticed so far
    that the pci code does not update the type information.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit c53864fd60227de025cb79e05493b13f69843971
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Thu Apr 24 10:22:36 2014 +1000

    rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set
    
    Since 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with
    buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST
    attribute if they were solicited by a GETLINK message containing an
    IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.
    
    That was done because some user programs broke when they received more data
    than expected - because IFLA_VFINFO_LIST contains information for each VF
    it can become large if there are many VFs.
    
    However, the IFLA_VF_PORTS attribute, supplied for devices which implement
    ndo_get_vf_port (currently the 'enic' driver only), has the same problem.
    It supplies per-VF information and can therefore become large, but it is
    not currently conditional on the IFLA_EXT_MASK value.
    
    Worse, it interacts badly with the existing EXT_MASK handling.  When
    IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at
    NLMSG_GOODSIZE.  If the information for IFLA_VF_PORTS exceeds this, then
    rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.
    netlink_dump() will misinterpret this as having finished the listing and
    omit data for this interface and all subsequent ones.  That can cause
    getifaddrs(3) to enter an infinite loop.
    
    This patch addresses the problem by only supplying IFLA_VF_PORTS when
    IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.
    
    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Reviewed-by: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 973462bbde79bb827824c73b59027a0aed5c9ca6
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Thu Apr 24 10:22:35 2014 +1000

    rtnetlink: Warn when interface's information won't fit in our packet
    
    Without IFLA_EXT_MASK specified, the information reported for a single
    interface in response to RTM_GETLINK is expected to fit within a netlink
    packet of NLMSG_GOODSIZE.
    
    If it doesn't, however, things will go badly wrong,  When listing all
    interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first
    message in a packet as the end of the listing and omit information for
    that interface and all subsequent ones.  This can cause getifaddrs(3) to
    enter an infinite loop.
    
    This patch won't fix the problem, but it will WARN_ON() making it easier to
    track down what's going wrong.
    
    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Reviewed-by: Jiri Pirko <jpirko@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a64d90fd962c2956da7505f98a302408450365e2
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Apr 24 13:51:29 2014 -0400

    netfilter: Fix warning in nfnetlink_receive().
    
    net/netfilter/nfnetlink.c: In function ‘nfnetlink_rcv’:
    net/netfilter/nfnetlink.c:371:14: warning: unused variable ‘net’ [-Wunused-variable]
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 90f62cf30a78721641e08737bda787552428061e
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Apr 23 14:29:27 2014 -0700

    net: Use netlink_ns_capable to verify the permisions of netlink messages
    
    It is possible by passing a netlink socket to a more privileged
    executable and then to fool that executable into writing to the socket
    data that happens to be valid netlink message to do something that
    privileged executable did not intend to do.
    
    To keep this from happening replace bare capable and ns_capable calls
    with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
    Which act the same as the previous calls except they verify that the
    opener of the socket had the desired permissions as well.
    
    Reported-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit aa4cf9452f469f16cea8c96283b641b4576d4a7b
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Apr 23 14:28:03 2014 -0700

    net: Add variants of capable for use on netlink messages
    
    netlink_net_capable - The common case use, for operations that are safe on a network namespace
    netlink_capable - For operations that are only known to be safe for the global root
    netlink_ns_capable - The general case of capable used to handle special cases
    
    __netlink_ns_capable - Same as netlink_ns_capable except taking a netlink_skb_parms instead of
    		       the skbuff of a netlink message.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Apr 23 14:26:56 2014 -0700

    net: Add variants of capable for use on on sockets
    
    sk_net_capable - The common case, operations that are safe in a network namespace.
    sk_capable - Operations that are not known to be safe in a network namespace
    sk_ns_capable - The general case for special cases.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a53b72c83a4216f2eb883ed45a0cbce014b8e62d
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Apr 23 14:26:25 2014 -0700

    net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump
    
    The permission check in sock_diag_put_filterinfo is wrong, and it is so removed
    from it's sources it is not clear why it is wrong.  Move the computation
    into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.
    
    This does not yet correct the capability check but instead simply moves it to make
    it clear what is going on.
    
    Reported-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5187cd055b6e81fc6526109456f8b20623148d5f
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Apr 23 14:25:48 2014 -0700

    netlink: Rename netlink_capable netlink_allowed
    
    netlink_capable is a static internal function in af_netlink.c and we
    have better uses for the name netlink_capable.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 98a46d46d1bc983125b6ff9a0e831050a7011713
Author: Claudiu Manoil <claudiu.manoil@freescale.com>
Date:   Wed Apr 23 16:38:47 2014 +0300

    gianfar: Check if phydev present on ethtool -A
    
    This fixes a seg fault on 'ethtool -A' entry if the
    interface is down.  Obviously we need to have the
    phy device initialized / "connected" (see of_phy_connect())
    to be able to advertise pause frame capabilities.
    
    Fixes: 23402bddf9e56eecb27bbd1e5467b3b79b3dbe58
    Signed-off-by: Claudiu Manoil <claudiu.manoil@freescale.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ab0648e8b6426a009a0e929b137037481b1c2e1e
Author: Rajesh Borundia <rajesh.borundia@qlogic.com>
Date:   Wed Apr 23 09:59:56 2014 -0400

    qlcnic: Fix memory leak.
    
    o In case QLC_83XX_MBX_CMD_NO_WAIT command type the calling
      function does not free the memory as it does not wait for
      response. So free it when get a response from adapter after
      sending the command.
    
    Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
    Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2c97e9e2633f3a4a3a301e5071fb0fe0d0d7543b
Author: Sony Chacko <sony.chacko@qlogic.com>
Date:   Wed Apr 23 09:59:55 2014 -0400

    qlcnic: Reset firmware API lock at driver load time
    
    Some firmware versions fails to reset the lock during
    initialization. Force reset firmware API lock during driver
    probe to ensure lock availability.
    
    Signed-off-by: Sony Chacko <sony.chacko@qlogic.com>
    Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ed2da03c6907800871234f5cae42db7d80de8dfc
Author: Jiri Pirko <jiri@resnulli.us>
Date:   Wed Apr 23 14:17:55 2014 +0200

    team: forbid incorrect fall-through in notifier
    
    There are two breaks missing there. The result is that userspace
    receives multiple messages which might be confusing.
    
    Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
    Signed-off-by: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8ea2b17c99b926e2229696eed7f49ac2f73f4619
Author: Jean Delvare <jdelvare@suse.de>
Date:   Wed Apr 23 10:40:12 2014 +0200

    net: cadence: Fix architecture dependencies
    
    I was told that the Cadence macb driver is also useful on Microblaze.
    
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Michal Simek <monstr@monstr.eu>
    Cc: Mark Brown <broonie@kernel.org>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a450a685791d12c0a477b75d630d6ae66acab9a7
Author: Zi Shen Lim <zlim.lnx@gmail.com>
Date:   Tue Apr 22 20:04:42 2014 -0700

    smc91x: improve definition of debug macros
    
    Redefine some macros that were conditioned upon SMC_DEBUG level.
    
    By allowing compiler to verify parameters used by these macros
    unconditionally, we can flag compilation failures.
    
    Compiler will still optimize out the unused code path depending on
    SMC_DEBUG, so this is a net gain.
    
    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 66668991c3515855e7a9881788feb7026f9f729f
Author: Peter Chen <peter.chen@freescale.com>
Date:   Thu Mar 13 15:22:51 2014 +0800

    usb: phy: fsm: change "|" to "||" for condition OTG_STATE_A_WAIT_BCON at statemachine
    
    We should be using logical "or" not bitwise "or".
    
    Signed-off-by: Peter Chen <peter.chen@freescale.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 2284bb35503ce7b05fce8f0dc8e1cb2a3134ae4e
Author: Li Jun <B47624@freescale.com>
Date:   Thu Mar 13 15:22:50 2014 +0800

    usb: phy: fsm: update OTG HNP state transition
    
    According to:"On-The-Go and Embedded Host Supplement to the USB Revision 2.0
    Specification July 27, 2012 Revision 2.0 version 1.1a"
    
    - add a_wait_vrise to a_wait_vfall
    - update condition from a_wait_vrise to a_wait_bcon
    
    Signed-off-by: Li Jun <b47624@freescale.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 7c7606a2464fee1cf50efef34aa44aee1edf453a
Author: Tomas Sokorai <tsokorai@gmail.com>
Date:   Wed Apr 23 10:42:41 2014 -0400

    HID: multitouch: add support of EliteGroup 05D8 panels
    
    They need to have the class SERIAL.
    
    Note: it is a Win 7 panel, not Win 8 certified.
    
    Signed-off-by: Tomas Sokorai <tsokorai@gmail.com>
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>

commit 27a38856a948c3e8de30dc71647ff9e1778c99fc
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Apr 23 13:02:35 2014 -0700

    Input: synaptics - add min/max quirk for ThinkPad Edge E431
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 83d5b7ef99c9f05e87333b334a638de1264ab8e4
Author: Alexei Starovoitov <ast@plumgrid.com>
Date:   Tue Apr 22 20:18:57 2014 -0700

    net: filter: initialize A and X registers
    
    exisiting BPF verifier allows uninitialized access to registers,
    'ret A' is considered to be a valid filter.
    So initialize A and X to zero to prevent leaking kernel memory
    In the future BPF verifier will be rejecting such filters
    
    Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
    Cc: Daniel Borkmann <dborkman@redhat.com>
    Acked-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c06cbcb6052edd8f4ee00d65f874b26404ac8f96
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Tue Apr 22 17:29:42 2014 +0100

    net: Update my email address
    
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9e4b93f905bc0ca1363a07b0f039455d9117d6bc
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date:   Tue Apr 22 15:01:30 2014 +0200

    vxlan: ensure to advertise the right fdb remote
    
    The goal of this patch is to fix rtnelink notification. The main problem was
    about notification for fdb entry with more than one remote. Before the patch,
    when a remote was added to an existing fdb entry, the kernel advertised the
    first remote instead of the added one. Also when a remote was removed from a fdb
    entry with several remotes, the deleted remote was not advertised.
    
    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6a1197457f9ec085871d2f842e1bbbe9d13216da
Author: Hubert Chaumette <hchaumette@adeneo-embedded.com>
Date:   Tue Apr 22 15:01:04 2014 +0200

    net/phy: micrel: fix bugged test on device tree loading for ksz9021
    
    In ksz9021_load_values_from_of() val2 to val4 aren't tested against their
    initialization value.
    This causes the test to always succeed, and this value to be used as if it
    was loaded from the devicetree instead of being ignored, in case of a
    missing/invalid property in the ethernet OF device node.
    As a result, the value "0" is written to the relevant registers.
    
    Change the conditions to test against the right initialization value.
    
    Signed-off-by: Hubert Chaumette <hchaumette@adeneo-embedded.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6a51b5e4d59e00051e65e836520912cd7c717be1
Author: Julia Lawall <Julia.Lawall@lip6.fr>
Date:   Sun Apr 20 11:48:33 2014 +0200

    hisax/icc: add missing semicolon after label
    
    A label just before a brace needs a following semicolon (empty statement).
    
    Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 702b3468c9eed1495067f6af2094372d75b9b23b
Author: Zi Shen Lim <zlim.lnx@gmail.com>
Date:   Fri Apr 18 20:47:30 2014 -0700

    smc91x: fix compile error when SMC_DEBUG >= 2
    
    When SMC_DEBUG >= 2, we hit the following compilation error:
    
    drivers/net/ethernet/smsc/smc91x.c:85:0:
    drivers/net/ethernet/smsc/smc91x.c: In function ‘smc_findirq’:
    drivers/net/ethernet/smsc/smc91x.c:1784:9: error: ‘dev’ undeclared (first use in this function)
      DBG(2, dev, "%s: %s\n", CARDNAME, __func__);
             ^
    Fix it by passing in the appropriate netdev pointer.
    
    Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7b07bd4e5187e8553d7776f5225e19f00b9fb863
Author: Byungho An <bh74.an@samsung.com>
Date:   Fri Apr 18 20:59:39 2014 +0900

    net: sxgbe: Added phy_found error path
    
    This patch adds phy_found error path when there is no phy device
    and changes bus_name.
    
    Signed-off-by: Byungho An <bh74.an@samsung.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3ee2b7c4b6785aab45a548b161b4c42ac6522592
Author: Byungho An <bh74.an@samsung.com>
Date:   Fri Apr 18 20:59:36 2014 +0900

    net: sxgbe: rearrange dma descriptor
    
    This patch moves cksum_ctl to tx_rd_des23 from cksum_pktlen for correct checksum
    offloading and modifies size for Tx/Rx descriptor.
    
    Signed-off-by: Byungho An <bh74.an@samsung.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c18e9cd623b8aa88090615602c3db7f1386a139d
Author: Amos Kong <akong@redhat.com>
Date:   Fri Apr 18 13:45:41 2014 +0800

    virtio_net: zero is an invald queue_pairs number
    
    Execute "ethtool -L eth0 combined 0" in guest, if multiqueue
    is enabled, virtnet_send_command() will return -EINVAL error,
    there is a validation in QEMU.
    
    But if multiqueue is disabled, virtnet_set_queues() will just
    return zero (success). We should return error for this situation.
    
    Signed-off-by: Amos Kong <akong@redhat.com>
    Acked-by:  Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 235a251abad38910120ba2dbd77296983c1d71b2
Author: Max Schwarz <max.schwarz@online.de>
Date:   Fri Apr 18 02:17:32 2014 +0200

    arc_emac: write initial MAC address from devicetree to hw
    
    The MAC address retrieved from dt was not actually written to the
    hardware. This meant proper communication was only possible after
    changing the MAC address.
    
    Fix that by always writing the mac address during probing.
    
    Signed-off-by: Max Schwarz <max.schwarz@online.de>
    Acked-by: Heiko Stuebner <heiko@sntech.de>
    Tested-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c82552c5b0cb1735dbcbad78b1ffc6d3c212dc56
Author: Tim Harvey <tharvey@gateworks.com>
Date:   Mon Apr 21 16:14:57 2014 -0700

    ath9k: add a recv budget
    
    Implement a recv budget so that in cases of high traffic we still allow other
    taskets to get processed.
    
    Without this, we can encounter a host of issues during high wireless traffic
    reception depending on system load including rcu stall's detected (ARM),
    soft lockups, failure to service critical tasks such as watchdog resets,
    and triggering of the tx stuck tasklet.
    
    The same thing was proposed previously by Ben:
     http://www.spinics.net/lists/linux-wireless/msg112891.html
    
    The only difference here is that I make sure only processed packets are counted
    in the budget by checking at the end of the rx loop.
    
    Signed-off-by: Tim Harvey <tharvey@gateworks.com>
    Acked-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 3a758134e66ca74a9df792616b5288b2fa2cfd7f
Author: Tim Harvey <tharvey@gateworks.com>
Date:   Mon Apr 21 16:14:56 2014 -0700

    ath9k: fix possible hang on flush
    
    If a flush is requested, make sure to clear the descriptor once we've
    processed it.
    
    This resolves a hang that will occur if all RX descriptors are full when a
    flush is requested.
    
    Signed-off-by: Tim Harvey <tharvey@gateworks.com>
    Acked-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 328e203fc35f0b4f6df1c4943f74cf553bcc04f8
Author: Colin Ian King <colin.king@canonical.com>
Date:   Mon Apr 21 17:38:44 2014 +0100

    rtlwifi: rtl8188ee: initialize packet_beacon
    
    static code analysis from cppcheck reports:
    
    [drivers/net/wireless/rtlwifi/rtl8188ee/trx.c:322]:
      (error) Uninitialized variable: packet_beacon
    
    packet_beacon is not initialized and hence packet_beacon
    contains garbage from the stack, so set it to false.
    
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Cc: Stable <stable@vger.kernel.org> [3.10+]
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 929f84b975448db900f3463000fafcd021ed261a
Author: Gertjan van Wingerde <gwingerde@gmail.com>
Date:   Sat Apr 19 19:48:31 2014 +0200

    rt2x00: Remove myself as maintainer.
    
    Let's formalize what must have been blatantly clear from my level
    of activity is the past year(s).
    I simply do not have time for this anymore.
    
    Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
    Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
    Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 8834d3608cc516f13e2e510f4057c263f3d2ce42
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Thu Apr 17 11:08:47 2014 +0200

    rt2x00: fix beaconing on USB
    
    When disable beaconing we clear register with beacon and newer set it
    back, what make we stop send beacons infinitely.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 78541c1dc60b65ecfce5a6a096fc260219d6784e
Author: Andrew Lutomirski <luto@amacapital.net>
Date:   Wed Apr 16 21:41:34 2014 -0700

    net: Fix ns_capable check in sock_diag_put_filterinfo
    
    The caller needs capabilities on the namespace being queried, not on
    their own namespace.  This is a security bug, although it likely has
    only a minor impact.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b0bda3853266121363a5ad8c786fa82d233538c1
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Mon Apr 21 09:12:08 2014 -0700

    MAINTAINERS: SXGBE authors update
    
    The mail address for Siva Reddy Kallam is bouncing, remove the email
    address from the MAINTAINERS entry for Samsung's SXGBE driver.
    
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 22213318af7ae265bc6cd8aef2febbc2d69a2440
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sat Apr 19 12:30:58 2014 -0400

    fix races between __d_instantiate() and checks of dentry flags
    
    in non-lazy walk we need to be careful about dentry switching from
    negative to positive - both ->d_flags and ->d_inode are updated,
    and in some places we might see only one store.  The cases where
    dentry has been obtained by dcache lookup with ->i_mutex held on
    parent are safe - ->d_lock and ->i_mutex provide all the barriers
    we need.  However, there are several places where we run into
    trouble:
    	* do_last() fetches ->d_inode, then checks ->d_flags and
    assumes that inode won't be NULL unless d_is_negative() is true.
    Race with e.g. creat() - we might have fetched the old value of
    ->d_inode (still NULL) and new value of ->d_flags (already not
    DCACHE_MISS_TYPE).  Lin Ming has observed and reported the resulting
    oops.
    	* a bunch of places checks ->d_inode for being non-NULL,
    then checks ->d_flags for "is it a symlink".  Race with symlink(2)
    in case if our CPU sees ->d_inode update first - we see non-NULL
    there, but ->d_flags still contains DCACHE_MISS_TYPE instead of
    DCACHE_SYMLINK_TYPE.  Result: false negative on "should we follow
    link here?", with subsequent unpleasantness.
    
    Cc: stable@vger.kernel.org # 3.13 and 3.14 need that one
    Reported-and-tested-by: Lin Ming <minggr@gmail.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit c5ffe7e1f745984b37b8ffe03b03f3d716a072f3
Author: Jakub Kicinski <kubakici@wp.pl>
Date:   Wed Apr 2 10:33:22 2014 +0000

    e1000e/igb/ixgbe/i40e: fix message terminations
    
    Add \n at the end of messages where missing, remove all \r.
    
    Reported-by: Joe Perches <joe@perches.com>
    Signed-off-by: Jakub Kicinski <kubakici@wp.pl>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit eda183c21a444aef5800cef98d63d62914d2a81a
Author: Jakub Kicinski <kubakici@wp.pl>
Date:   Wed Apr 2 10:33:28 2014 +0000

    ixgbe: clean up Rx time stamping code
    
    Time stamping resources are per-interface so there is no need
    to keep separate last_rx_timestamp for each Rx ring, move
    last_rx_timestamp to the adapter structure.
    
    With last_rx_timestamp inside adapter, ixgbe_ptp_rx_hwtstamp()
    inline function is reduced to a single if statement so it is
    no longer necessary. If statement is placed directly in
    ixgbe_process_skb_fields() fixing likely/unlikely marking.
    
    Checks for q_vector or adapter to be NULL are superfluous.
    
    Comment about taking I/O hit is a leftover from previous design.
    
    Signed-off-by: Jakub Kicinski <kubakici@wp.pl>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit e66c083aab32842f225bae2a2c30744bf96abaec
Author: Todd Fujinaka <todd.fujinaka@intel.com>
Date:   Tue Apr 8 05:36:15 2014 +0000

    igb: fix stats for i210 rx_fifo_errors
    
    RQDPC on i210/i211 is R/W not ReadClear. Clear after reading.
    
    Signed-off-by: Todd Fujinaka <todd.fujinaka@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit 3e7986f67c0e444b2419f25c48815e17ebbab836
Author: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Date:   Tue Apr 15 08:20:19 2014 +0000

    e1000e: Enclose e1000e_pm_thaw() with CONFIG_PM_SLEEP
    
    Fix following compilation warning:
    drivers/net/ethernet/intel/e1000e/netdev.c:6238:12: warning
    ‘e1000e_pm_thaw’ defined but not used [-Wunused-function]
     static int e1000e_pm_thaw(struct device *dev)
                ^
    Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit c751a3d58cf2dae89ec941a259025b0175d67b0c
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Sat Apr 5 06:25:26 2014 +0000

    e1000e: Correctly include VLAN_HLEN when changing interface MTU
    
    When changing the interface mtu, the driver starts with a value
    that doesn't include VLAN_HLEN.  Later tests in the driver
    set the rx_buffer_len based on the mtu.  As a result, when
    the user increases the mtu to 1504 (to support 802.1AD for example),
    the driver rx_buffer_len does not change and frames longer
    the 1522 bytes are rejected as too long.
    
    Include VLAN_HLEN from the start so that an user mtu greater then
    1500 bytes is correctly reflected in the driver rx_buffer_len.
    
    CC: e1000-devel@lists.sourceforge.net
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit 059dab69652da3525d320d77ac5422ec708ced14
Author: Jesse Brandeburg <jesse.brandeburg@intel.com>
Date:   Tue Apr 1 09:07:20 2014 +0000

    i40e: fix TCP flag replication for hardware offload
    
    As reported by Eric Dumazet, the i40e driver was allowing the hardware
    to replicate the PSH flag on all segments of a TSO operation.
    
    This patch fixes the first/middle/last TCP flags settings which
    makes the TSO operations work correctly.
    
    With this change we are now configuring the CWR bit to only be set
    in the first packet of a TSO, so this patch also enables TSO_ECN,
    in order to advertise to the stack that we do the right thing
    on the wire.
    
    Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
    Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit dd225bc675bc16972cc11f73fa0dc3ccb1ed9da1
Author: Francois Romieu <romieu@fr.zoreil.com>
Date:   Sun Mar 30 03:14:48 2014 +0000

    i40e: remove open-coded skb_cow_head
    
    Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
    Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
    Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

commit cfe8255f0afcf5d2d1dbfa093223cafe38773fa7
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Thu Apr 10 02:40:00 2014 +0400

    xtensa: xt2000: drop redundant sysmem initialization
    
    sysmem structure initialization in xt2000 platform_init is identical to
    the one done in init_arch just before the call to platform_init.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 9c602629e34bad88a464e08de08118e80beee0d8
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Apr 28 19:15:56 2013 +0400

    xtensa: add support for KC705
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 08a7bbf624072bed1cb35e5b4db7d538580f731c
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Feb 23 03:48:32 2014 +0400

    xtensa: xtfpga: introduce SoC I/O bus
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 65559100655c6ed6ce2e17ffc8d4f3852bc2858a
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Tue Feb 4 02:17:09 2014 +0400

    xtensa: add HIGHMEM support
    
    Introduce fixmap area just below the vmalloc region. Use it for atomic
    mapping of high memory pages.
    High memory on cores with cache aliasing is not supported and is still
    to be implemented. Fail build for such configurations for now.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 04c6b3e2b5e5c1dbd99ad7620033eafd05ff4c26
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Fri Feb 14 14:08:48 2014 +0400

    xtensa: optimize local_flush_tlb_kernel_range
    
    Don't flush whole TLB if only a small kernel range is requested.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 8585b316bbed9339412d267c1fd8839dd059d69f
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Mar 23 03:26:46 2014 +0400

    xtensa: dump sysmem from the bootmem_init
    
    Debug dump of physical memory configuration. Useful for inspection of
    resulting memory map, esp. in the presence of memmap= kernel option.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 06bd2824f7dcbfb8dcd13519239a53d13298d238
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Fri Mar 21 21:04:40 2014 +0400

    xtensa: handle memmap kernel option
    
    This option is useful for reserving memory regions for secondary cores
    in AMP configurations.
    
    Implement the following memmap variants:
    - memmap=nn[KMG]@ss[KMG]: force usage of a specific region of memory;
    - memmap=nn[KMG]$ss[KMG]: mark specified memory as reserved;
    - memmap=nn[KMG]: set end of memory.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 6232791833785ae591b211609f6f7c4faa7c6e55
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Mar 23 03:24:45 2014 +0400

    xtensa: keep sysmem banks ordered in mem_reserve
    
    Rewrite mem_reserve so that it keeps bank order.
    Also make its return code more traditional.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 9d4b52df4b1242e6ba9a00db5f8d62083a56709f
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Mar 23 03:34:44 2014 +0400

    xtensa: keep sysmem banks ordered in add_sysmem_bank
    
    Rewrite add_sysmem_bank so that it keeps bank order and merges
    adjacent/overlapping banks.
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 9ba067f93f1eec0d241f002812806b873dd4f802
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Sun Mar 23 03:17:43 2014 +0400

    xtensa: split bootparam and kernel meminfo
    
    Bootparam meminfo is a bootloader ABI, kernel meminfo is for the kernel
    bookkeeping, keep them separate. Kernel doesn't care of memory region
    types, so drop the type field and don't pass it to add_sysmem_bank.
    Move kernel sysmem structures and prototypes to asm/sysmem.h and sysmem
    variable and add_sysmem_bank to mm/init.c
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit 25df8198f4b257cf6db4d4f000c53accfa9c28f8
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Tue Feb 18 15:29:11 2014 +0400

    xtensa: enable sorting extable at build time
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
    Acked-by: David Daney <ddaney.cavm@gmail.com>

commit a3cfda9d2f9ca067a2757b9d85d98cfbaf1e8c63
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Fri Mar 21 21:05:16 2014 +0400

    xtensa: export __{invalidate,flush}_dcache_range
    
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

commit eb8451e0aee1816395506e97965d0917754072de
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Thu Feb 27 14:41:14 2014 +0100

    xtensa: Export __invalidate_icache_range
    
    When modular code calls flush_icache_range():
    
        ERROR: "__invalidate_icache_range" [drivers/misc/lkdtm.ko] undefined!
        make[1]: *** [__modpost] Error 1
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
arch/alpha/kernel/systbls.S: remove debug check

-mm only patch, I guess.

My old gas-2.16.1 says

arch/alpha/kernel/systbls.S: Assembler messages:
arch/alpha/kernel/systbls.S:523: Error: non-constant expression in ".if" statement
arch/alpha/kernel/systbls.S:524: Error: .err encountered

Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
I need old gcc

Old, unsupported cross-compiler :(

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
MAINTAINERS: akpm maintenance

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
drivers/rtc/rtc-hym8563.c: set uie_unsupported

The alarm of the hym8563 only supports a minute accuracy, while the uie
wants an alarm one second in the future.  Therefore things like the
select() syscall will fail with a timeout, because the next alarm will
happen in a worst case of 60 seconds.

Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
MAINTAINERS: update maintainership of LTP

Also remove sf.net git repo which is no longer available and update link
to LTP web pages.

Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Caspar Zhang <caspar@casparzhang.com>
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: Stanislav Kholmanskikh <stanislav.kholmanskikh@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm: postpone the disabling of kmemleak early logging

Commit 8910ae896c8c ("kmemleak: change some global variables to int"), in
addition to the atomic -> int conversion, moved the kmemleak_early_log
disabling at the beginning of the kmemleak_init() function, before the
full kmemleak tracing is actually enabled.  In this small window,
kmem_cache_create() is called by kmemleak which triggers additional memory
allocation that are not traced.  This patch restores the original logic
with kmemleak_early_log disabling when kmemleak is fully functional.

Fixes: 8910ae896c8c (kmemleak: change some global variables to int)

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm, thp: close race between mremap() and split_huge_page()

It's critical for split_huge_page() (and migration) to catch and freeze
all PMDs on rmap walk.  It gets tricky if there's concurrent fork() or
mremap() since usually we copy/move page table entries on dup_mm() or
move_page_tables() without rmap lock taken.  To get it work we rely on
rmap walk order to not miss any entry.  We expect to see destination VMA
after source one to work correctly.

But after switching rmap implementation to interval tree it's not always
possible to preserve expected walk order.

It works fine for dup_mm() since new VMA has the same vma_start_pgoff() /
vma_last_pgoff() and explicitly insert dst VMA after src one with
vma_interval_tree_insert_after().

But on move_vma() destination VMA can be merged into adjacent one and as
result shifted left in interval tree.  Fortunately, we can detect the
situation and prevent race with rmap walk by moving page table entries
under rmap lock.  See commit 38a76013ad80.

Problem is that we miss the lock when we move transhuge PMD.  Most likely
this bug caused the crash[1].

[1] http://thread.gmane.org/gmane.linux.kernel.mm/96473

Fixes: 108d6642ad81 ("mm anon rmap: remove anon_vma_moveto_tail")

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Acked-by: Michel Lespinasse <walken@google.com>
Cc: Dave Jones <davej@redhat.com>
Cc: David Miller <davem@davemloft.net>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>        [3.7+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
x86: require x86-64 for automatic NUMA balancing

32-bit support for NUMA is an oddity on its own but with automatic NUMA
balancing on top there is a reasonable risk that the CPUPID information
cannot be stored in the page flags.  This patch removes support for
automatic NUMA support on 32-bit x86.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Steven Noonan <steven@uplinklabs.net>
Cc: Rik van Riel <riel@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
x86: define _PAGE_NUMA by reusing software bits on the PMD and PTE levels

_PAGE_NUMA is currently an alias of _PROT_PROTNONE to trap NUMA hinting
faults on x86.  Care is taken such that _PAGE_NUMA is used only in
situations where the VMA flags distinguish between NUMA hinting faults and
prot_none faults.  This decision was x86-specific and conceptually it is
difficult requiring special casing to distinguish between PROTNONE and
NUMA ptes based on context.

Fundamentally, we only need the _PAGE_NUMA bit to tell the difference
between an entry that is really unmapped and a page that is protected for
NUMA hinting faults as if the PTE is not present then a fault will be
trapped.

Swap PTEs on x86-64 use the bits after _PAGE_GLOBAL for the offset.  This
patch shrinks the maximum possible swap size and uses the bit to uniquely
distinguish between NUMA hinting ptes and swap ptes.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Steven Noonan <steven@uplinklabs.net>
Cc: Rik van Riel <riel@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
x86: define _PAGE_NUMA by reusing software bits on the PMD and PTE levels -fix 2

powerpc has NUMA_BALANCING and non-NUMA_BALANCING versions of pte_present
and I missed that when testing cross-compiling.  This patch replaces
x86-define-_page_numa-by-reusing-software-bits-on-the-pmd-and-pte-levels-fix.patch

Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Steven Noonan <steven@uplinklabs.net>
Cc: Rik van Riel <riel@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
x86, mm: probe memory block size for generic x86 64bit

On system with 2TiB ram, current x86_64 have 128M as section size, and one
memory_block only include one section.  So will have 16400 entries under
/sys/devices/system/memory/.

Current code try to use block id to find block pointer in /sys
for any section, and reuse that block pointer. that finding will take some time
even after

| commit 7c243c7168dcc1bc2081fc0494923cd7cc808fb6
| Author: Russ Anderson <rja@sgi.com>
| Date:   Mon Apr 29 15:07:59 2013 -0700
|    mm: speedup in __early_pfn_to_nid

that will skip the search in that case during booting up.

So solution could be increase block size just like SGI UV system did. 
(harded code to 2g).

This patch is trying to probe the block size to make it match mmio remap
size.  for example, Intel Nehalem later system will have memory range [0,
TOML), [4g, TOMH].  If the memory hole is 2g and total is 128g, TOM will
be 2g, and TOM2 will be 130g.

We could use 2g as block size instead of default 128M.  That will reduce
number of entries in /sys/devices/system/memory/

On system 6TiB system will reduce boot time by 35 seconds.

Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/ceph: replace pr_warning by pr_warn

Update the last pr_warning callsites in fs branch

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Sage Weil <sage@inktank.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/ceph/debugfs.c: replace seq_printf by seq_puts

Replace seq_printf where possible.

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Sage Weil <sage@inktank.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/cifs: remove obsolete __constant

Replace all __constant_foo to foo() except in smb2status.h (1700 lines to
update).

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Steve French <sfrench@samba.org>
Cc: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/jfs/jfs_logmgr.c: remove NULL assignment on static

Static values are automatically initialized to NULL

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Dave Kleikamp <shaggy@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/jfs/super.c: remove 0 assignement to static + code clean-up

-Static values are automatically initialized to NULL
-Coalesce format fragments
-Remove unnecessary {}
-Small typo fixes
-Fix lines > 80 characters

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Dave Kleikamp <shaggy@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/fscache: convert printk to pr_foo()

-All printk converted to pr_foo() except internal.h: printk(KERN_DEBUG

-Coalesce formats.

-Add pr_fmt

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/fscache: replace seq_printf by seq_puts

Replace seq_printf where possible + coalesce formats from 2 existing
seq_puts

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fanotify: FAN_MARK_FLUSH: avoid having to provide a fake/invalid fd and path

Originally from Tvrtko Ursulin (https://lkml.org/lkml/2011/1/12/112)

Avoid having to provide a fake/invalid fd and path when flushing marks

Currently for a group to flush marks it has set it needs to provide a fake
or invalid (but resolvable) file descriptor and path when calling
fanotify_mark.  This patch pulls the flush handling a bit up so file
descriptor and path are completely ignored when flushing.

I reworked the patch to be applicable again (the signature of fanotify_mark
has changed since Tvrtko's work).

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
Reviewed-by: Jan Kara <jack@suse.cz>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>