d2: get kernel up to date with upstream

Squashed commit of the following:

commit 64e8d9cb20d3973c043921616fed4756cef65c9f
Merge: e2f63b7 f3a0f0e
Author: hedwig34 <hedwig34@gmail.com>
Date:   Fri Sep 5 11:22:22 2014 -0400

    Merge remote-tracking branch 'cm/cm-11.0' into kk4.4merge

    Conflicts:
    	Documentation/filesystems/f2fs.txt
    	Makefile
    	arch/arm/configs/cyanogen_apexq_defconfig
    	fs/exfat/Kconfig
    	fs/f2fs/checkpoint.c
    	fs/f2fs/data.c
    	fs/f2fs/debug.c
    	fs/f2fs/f2fs.h
    	fs/f2fs/file.c
    	fs/f2fs/gc.c
    	fs/f2fs/inline.c
    	fs/f2fs/inode.c
    	fs/f2fs/node.c
    	fs/f2fs/recovery.c
    	fs/f2fs/segment.c
    	fs/f2fs/segment.h
    	fs/f2fs/super.c
    	include/net/inetpeer.h
    	include/trace/events/f2fs.h
    	net/ipv6/ip6_output.c

commit f3a0f0e134fb3e83d07eee3d3eec222b44a282c3
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Tue Sep 2 21:12:44 2014 -0500

    exfat: don't turn on by default

    Change-Id: I36ec727e3dc0a1ce97042f4e5b401f9aca7090d0

commit 87f5fcaf7afef878914c3fcca2c2fd395f285902
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Mon Sep 1 22:18:53 2014 -0500

    defconfigs: disable exfat and ntfs

    * fuse is used for these anyway, they're useless to be in-kernel

    Change-Id: I14432f6a6fffe27c380b691cf2c35a39ae187732

commit 82866f01de5c1f8679f486477ba001f7e85a4d7a
Author: Nick Kralevich <nnk@google.com>
Date:   Wed Mar 7 17:34:38 2012 -0800

    staging: android: ram_console: honor dmesg_restrict

    The Linux kernel has a setting called dmesg_restrict. When true,
    only processes with CAP_SYSLOG can view the kernel dmesg logs. This
    helps prevent leaking of kernel information into user space.

    On Android, it's possible to bypass these restrictions by viewing
    /proc/last_kmsg.

    This change makes /proc/last_kmsg require the same permissions as
    dmesg.

    CC: Android Kernel Team <kernel-team@android.com>
    Signed-off-by: Nick Kralevich <nnk@google.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b410ba83696b64b04625072d8280c9599c2f662f
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Aug 4 10:10:07 2014 +0800

    f2fs: use for_each_set_bit to simplify the code

    This patch uses for_each_set_bit to simplify some codes in f2fs.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 53492d4efbf256acb0313be196e2584b34ba6e93
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Aug 4 10:11:17 2014 +0800

    f2fs: add f2fs_balance_fs for expand_inode_data

    This patch adds f2fs_balance_fs in expand_inode_data to avoid allocation failure
    with segment.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit b0b71d72efd09592d31c922b0357948fd90133e3
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Aug 4 09:54:58 2014 +0800

    f2fs: invalidate xattr node page when evict inode

    When inode is evicted, all the page cache belong to this inode should be
    released including the xattr node page. But previously we didn't do this, this
    patch fixed this issue.

    v2:
     o reposition invalidate_mapping_pages() to the right place suggested by
    Jaegeuk Kim.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 7e8b1c883e8f9ebb4238929559518d830fd3e2cb
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Sat Aug 2 15:26:04 2014 +0800

    f2fs: avoid skipping recover_inline_xattr after recover_inline_data

    When we recover data of inode in roll-forward procedure, and the inode has both
    inline data and inline xattr. We may skip recovering inline xattr if we recover
    inline data form node page first.
    This patch will fix the problem that we lost inline xattr data in above
    scenario.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 1f210381fed3770d83385bbf9d82f7713f4fd54a
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Jul 31 21:11:22 2014 +0800

    f2fs: add tracepoint for f2fs_direct_IO

    This patch adds a tracepoint for f2fs_direct_IO.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

    Conflicts:
    	fs/f2fs/data.c

    Change-Id: I4153a8bd8bd5fb46c42c2917ec3405e3b4a4dce8

commit 56810b27668c7bbf22c596a7f456a648ec6b0334
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Jul 3 18:58:39 2014 +0800

    f2fs: reduce competition among node page writes

    We do not need to block on ->node_write among different node page writers e.g.
    fsync/flush, unless we have a node page writer from write_checkpoint.
    So it's better use rw_semaphore instead of mutex type for ->node_write to
    promote performance.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 9b153da8291569f3b8cb15d15570c1362fa952d9
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Wed Jul 30 17:25:54 2014 -0700

    f2fs: fix coding style

    This patch fixes wrong coding style.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 0c08502ba23df54cb501e6807c8db2bb2cc0f715
Author: Dongho Sim <dh.sim@samsung.com>
Date:   Wed Jul 30 06:52:41 2014 +0000

    f2fs: remove redundant lines in allocate_data_block

    There are redundant lines in allocate_data_block.

    In this function, we call refresh_sit_entry with old seg and old curseg.
    After that, we call locate_dirty_segment with old curseg.

    But, the new address is always allocated from old curseg and
    we call locate_dirty_segment with old curseg in refresh_sit_entry.
    So, we do not need to call locate_dirty_segment with old curseg again.

    We've discussed like below:

    Jaegeuk said:
     "When considering SSR, we need to take care of the following scenario.
      - old segno : X
      - new address : Z
      - old curseg : Y
      This means, a new block is supposed to be written to Z from X.
      And Z is newly allocated in the same path from Y.

      In that case, we should trigger locate_dirty_segment for Y, since
      it was a current_segment and can be dirty owing to SSR.
      But that was not included in the dirty list."

    Changman said:
     "We already choosed old curseg(Y) and then we allocate new address(Z) from old
      curseg(Y). After that we call refresh_sit_entry(old address, new address).
      In the funcation, we call locate_dirty_segment with old seg and old curseg.
      So calling locate_dirty_segment after refresh_sit_entry again is redundant."

    Jaegeuk said:
     "Right. The new address is always allocated from old_curseg."

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Dongho Sim <dh.sim@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 25f4dde88ae87cebe3c99c19c6d7eb1b10b24828
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 17:46:10 2014 -0700

    f2fs: add tracepoint for f2fs_issue_flush

    This patch adds a tracepoint for f2fs_issue_flush.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 6bbd7f5340a3401b98e63896d988160ffc13bc5d
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 15:47:23 2014 -0700

    f2fs: test before set/clear bits

    If the bit is already set, we don't need to reset it, and vice versa.
    Because we don't need to make the caches dirty for that.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 58d25337a39b30c5b3ba70984d783d0885b44c59
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 07:41:43 2014 -0700

    f2fs: fix wrong condition for unlikely

    This patch fixes the wrongly used unlikely condition.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 1d9c719b004cd33c3ac91e218a0f53c6ccad0655
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Thu Jul 24 19:11:43 2014 -0700

    f2fs: enable in-place-update for fdatasync

    This patch enforces in-place-updates only when fdatasync is requested.
    If we adopt this in-place-updates for the fdatasync, we can skip to write the
    recovery information.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit da9a9b4c190a4f36efe871af194a63e742eda81b
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Thu Jul 24 19:08:02 2014 -0700

    f2fs: skip unnecessary data writes during fsync

    This patch intends to improve the fsync performance by skipping remaining the
    recovery information, only when there is no data that we should recover.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit f1e8bd6755754c58d12ba3e5095414b401b25d16
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 07:40:59 2014 -0700

    f2fs: add info of appended or updated data writes

    This patch introduces a inode number list in which represents inodes having
    appended data writes or updated data writes after last checkpoint.
    This will be used at fsync to determine whether the recovery information
    should be written or not.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

    Conflicts:
    	fs/f2fs/inode.c

    Change-Id: I94293cce161b66f4ac5f66dea230b9613aa9d68a

commit f36f2a68dcefd3e927ef406e9e3ab1598b2bc185
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Thu Jul 24 18:15:17 2014 -0700

    f2fs: use radix_tree for ino management

    For better ino management, this patch replaces the data structure from list
    to radix tree.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit bb9fdfc36650004dcf7142eff40637ea5423ae79
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 15:47:17 2014 -0700

    f2fs: add infra for ino management

    This patch changes the naming of orphan-related data structures to use as
    inode numbers managed globally.
    Later, we can use this facility for managing any inode number lists.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit e395f5bb832005d5d77f28dfa36d154dc15f5058
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jul 25 15:47:16 2014 -0700

    f2fs: punch the core function for inode management

    This patch punches out the core functions to manage the inode numbers.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit e62d5d7f8494cb95e180831fb9bb98a683aeccbf
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Wed Jul 23 09:57:31 2014 -0700

    f2fs: add nobarrier mount option

    This patch adds a mount option, nobarrier, in f2fs.
    The assumption in here is that file system keeps the IO ordering, but
    doesn't care about cache flushes inside the storages.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

    Conflicts:
    	Documentation/filesystems/f2fs.txt

    Change-Id: I2947cb10128efcf5647eff432d5fd959b2d2f5bc

commit b088d05d50b545d1963347f1e690609c64699ee5
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Fri Jul 25 12:55:09 2014 +0800

    f2fs: fix to put root inode in error path of fill_super

    We should put root inode correctly in error path of fill_super, otherwise we
    may encounter a leak case of inode resource.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Reviewed-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 9267378db5ee8aa510e52c94b640b672cac29aac
Author: Huang Ying <ying.huang@intel.com>
Date:   Sat Jul 12 20:10:00 2014 +0800

    f2fs: add f2fs_balance_fs for direct IO

    Otherwise, if a large amount of direct IO writes were done, the
    segment allocation may be failed because no enough segments are gced.

    Changes:

    v2: add f2fs_balance_fs into __get_data_block instead of f2fs_direct_IO.

    Signed-off-by: Huang, Ying <ying.huang@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 10eb4beaa4da0fe6e7f84a2a39125cf2eed99388
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Jul 14 16:45:15 2014 +0800

    f2fs: reduce searching region of segmap when free section

    In __set_test_and_free we will check whether all segment are free in one section
    When free one segment, in order to set section to free status.
    But the searching region of segmap is from start segno to last segno of f2fs,
    it's not necessary. So let's just only check all segment bitmap of target
    section.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 7f16df33f51bcf5637945105c0f392744d661eff
Merge: 0091a49 cedb4a5
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Tue Aug 19 22:05:02 2014 -0500

    Merge remote-tracking branch 'caf/LNX.LA.2.7.4' into cm-11.0

    Conflicts:
    	drivers/video/msm/msm_fb.h
    	net/ipv4/ping.c

    Change-Id: Ia5456cdb69259afee0c65b3b36b00914f3cce5fd

commit 0091a499c65bc6de233224ecb53853d100a0d44b
Merge: e1557ad 9f089cf
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Wed Aug 13 21:42:40 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	include/net/secure_seq.h

    Change-Id: I217d1f8d0c8601be3ea1c972b35c84cba779dd54

commit 9f089cfb4be27efe7c1cd1d6261da02496820441
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Aug 14 09:07:43 2014 +0800

    Linux 3.4.103

commit 0ace429a33ac4e4f7909fa7976dcf94b997ea353
Author: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Date:   Mon Aug 4 23:47:41 2014 +0300

    arch/sparc/math-emu/math_32.c: drop stray break operator

    [ Upstream commit 093758e3daede29cb4ce6aedb111becf9d4bfc57 ]

    This commit is a guesswork, but it seems to make sense to drop this
    break, as otherwise the following line is never executed and becomes
    dead code. And that following line actually saves the result of
    local calculation by the pointer given in function argument. So the
    proposed change makes sense if this code in the whole makes sense (but I
    am unable to analyze it in the whole).

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81641
    Reported-by: David Binderman <dcb314@hotmail.com>
    Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 29fa649b993693ce21d10b841e93c07d1d8f2c7e
Author: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Date:   Fri Aug 1 09:50:40 2014 -0400

    sparc64: ldc_connect() should not return EINVAL when handshake is in progress.

    [ Upstream commit 4ec1b01029b4facb651b8ef70bc20a4be4cebc63 ]

    The LDC handshake could have been asynchronously triggered
    after ldc_bind() enables the ldc_rx() receive interrupt-handler
    (and thus intercepts incoming control packets)
    and before vio_port_up() calls ldc_connect(). If that is the case,
    ldc_connect() should return 0 and let the state-machine
    progress.

    Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
    Acked-by: Karl Volz <karl.volz@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a46e9456f1516e8238d43dcff766595452c0ed48
Author: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
Date:   Sun Aug 3 16:01:53 2014 +0200

    sunsab: Fix detection of BREAK on sunsab serial console

    [ Upstream commit fe418231b195c205701c0cc550a03f6c9758fd9e ]

    Fix detection of BREAK on sunsab serial console: BREAK detection was only
    performed when there were also serial characters received simultaneously.
    To handle all BREAKs correctly, the check for BREAK and the corresponding
    call to uart_handle_break() must also be done if count == 0, therefore
    duplicate this code fragment and pull it out of the loop over the received
    characters.

    Patch applies to 3.16-rc6.

    Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7554c49edacf3caacdc71736bf92fc840e46d986
Author: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
Date:   Sun Aug 3 15:44:52 2014 +0200

    bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000

    [ Upstream commit 5cdceab3d5e02eb69ea0f5d8fa9181800baf6f77 ]

    Fix regression in bbc i2c temperature and fan control on some Sun systems
    that causes the driver to refuse to load due to the bbc_i2c_bussel resource not
    being present on the (second) i2c bus where the temperature sensors and fan
    control are located. (The check for the number of resources was removed when
    the driver was ported to a pure OF driver in mid 2008.)

    Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7bcdfe04e385f4420b2a8d22d62dbf48935da4f
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Aug 4 20:07:37 2014 -0700

    sparc64: Guard against flushing openfirmware mappings.

    [ Upstream commit 4ca9a23765da3260058db3431faf5b4efd8cf926 ]

    Based almost entirely upon a patch by Christopher Alexander Tobias
    Schulze.

    In commit db64fe02258f1507e13fe5212a989922323685ce ("mm: rewrite vmap
    layer") lazy VMAP tlb flushing was added to the vmalloc layer.  This
    causes problems on sparc64.

    Sparc64 has two VMAP mapped regions and they are not contiguous with
    eachother.  First we have the malloc mapping area, then another
    unrelated region, then the vmalloc region.

    This "another unrelated region" is where the firmware is mapped.

    If the lazy TLB flushing logic in the vmalloc code triggers after
    we've had both a module unload and a vfree or similar, it will pass an
    address range that goes from somewhere inside the malloc region to
    somewhere inside the vmalloc region, and thus covering the
    openfirmware area entirely.

    The sparc64 kernel learns about openfirmware's dynamic mappings in
    this region early in the boot, and then services TLB misses in this
    area.  But openfirmware has some locked TLB entries which are not
    mentioned in those dynamic mappings and we should thus not disturb
    them.

    These huge lazy TLB flush ranges causes those openfirmware locked TLB
    entries to be removed, resulting in all kinds of problems including
    hard hangs and crashes during reboot/reset.

    Besides causing problems like this, such huge TLB flush ranges are
    also incredibly inefficient.  A plea has been made with the author of
    the VMAP lazy TLB flushing code, but for now we'll put a safety guard
    into our flush_tlb_kernel_range() implementation.

    Since the implementation has become non-trivial, stop defining it as a
    macro and instead make it a function in a C source file.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afa9b047624f638f1cabc3c5bcbcbd86bea47ab3
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Aug 4 16:34:01 2014 -0700

    sparc64: Do not insert non-valid PTEs into the TSB hash table.

    [ Upstream commit 18f38132528c3e603c66ea464727b29e9bbcb91b ]

    The assumption was that update_mmu_cache() (and the equivalent for PMDs) would
    only be called when the PTE being installed will be accessible by the user.

    This is not true for code paths originating from remove_migration_pte().

    There are dire consequences for placing a non-valid PTE into the TSB.  The TLB
    miss frramework assumes thatwhen a TSB entry matches we can just load it into
    the TLB and return from the TLB miss trap.

    So if a non-valid PTE is in there, we will deadlock taking the TLB miss over
    and over, never satisfying the miss.

    Just exit early from update_mmu_cache() and friends in this situation.

    Based upon a report and patch from Christopher Alexander Tobias Schulze.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e8955a262de468c34c83203375c1d405b9d6840
Author: David S. Miller <davem@davemloft.net>
Date:   Sat May 17 11:28:05 2014 -0700

    sparc64: Add membar to Niagara2 memcpy code.

    [ Upstream commit 5aa4ecfd0ddb1e6dcd1c886e6c49677550f581aa ]

    This is the prevent previous stores from overlapping the block stores
    done by the memcpy loop.

    Based upon a glibc patch by Jose E. Marchesi

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fdd880110209aa34e5334797891e594b877c38aa
Author: David S. Miller <davem@davemloft.net>
Date:   Wed May 7 14:07:32 2014 -0700

    sparc64: Fix huge TSB mapping on pre-UltraSPARC-III cpus.

    [ Upstream commit b18eb2d779240631a098626cb6841ee2dd34fda0 ]

    Access to the TSB hash tables during TLB misses requires that there be
    an atomic 128-bit quad load available so that we fetch a matching TAG
    and DATA field at the same time.

    On cpus prior to UltraSPARC-III only virtual address based quad loads
    are available.  UltraSPARC-III and later provide physical address
    based variants which are easier to use.

    When we only have virtual address based quad loads available this
    means that we have to lock the TSB into the TLB at a fixed virtual
    address on each cpu when it runs that process.  We can't just access
    the PAGE_OFFSET based aliased mapping of these TSBs because we cannot
    take a recursive TLB miss inside of the TLB miss handler without
    risking running out of hardware trap levels (some trap combinations
    can be deep, such as those generated by register window spill and fill
    traps).

    Without huge pages it's working perfectly fine, but when the huge TSB
    got added another chunk of fixed virtual address space was not
    allocated for this second TSB mapping.

    So we were mapping both the 8K and 4MB TSBs to the same exact virtual
    address, causing multiple TLB matches which gives undefined behavior.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0de492190948948d0ff5d3ad8f7e1f0942f0379e
Author: David S. Miller <davem@davemloft.net>
Date:   Tue May 6 21:27:37 2014 -0700

    sparc64: Don't bark so loudly about 32-bit tasks generating 64-bit fault addresses.

    [ Upstream commit e5c460f46ae7ee94831cb55cb980f942aa9e5a85 ]

    This was found using Dave Jone's trinity tool.

    When a user process which is 32-bit performs a load or a store, the
    cpu chops off the top 32-bits of the effective address before
    translating it.

    This is because we run 32-bit tasks with the PSTATE_AM (address
    masking) bit set.

    We can't run the kernel with that bit set, so when the kernel accesses
    userspace no address masking occurs.

    Since a 32-bit process will have no mappings in that region we will
    properly fault, so we don't try to handle this using access_ok(),
    which can safely just be a NOP on sparc64.

    Real faults from 32-bit processes should never generate such addresses
    so a bug check was added long ago, and it barks in the logs if this
    happens.

    But it also barks when a kernel user access causes this condition, and
    that _can_ happen.  For example, if a pointer passed into a system call
    is "0xfffffffc" and the kernel access 4 bytes offset from that pointer.

    Just handle such faults normally via the exception entries.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86982cf46cf082ef705237b1ed7372ec772f3f8e
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Apr 28 23:52:11 2014 -0700

    sparc64: Fix top-level fault handling bugs.

    [ Upstream commit 70ffc6ebaead783ac8dafb1e87df0039bb043596 ]

    Make get_user_insn() able to cope with huge PMDs.

    Next, make do_fault_siginfo() more robust when get_user_insn() can't
    actually fetch the instruction.  In particular, use the MMU announced
    fault address when that happens, instead of calling
    compute_effective_address() and computing garbage.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2671e681d044d236c7a39b8c4b718216f2261df
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Apr 28 23:50:08 2014 -0700

    sparc64: Handle 32-bit tasks properly in compute_effective_address().

    [ Upstream commit d037d16372bbe4d580342bebbb8826821ad9edf0 ]

    If we have a 32-bit task we must chop off the top 32-bits of the
    64-bit value just as the cpu would.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fdf73fb4a781e9b74e540d251a533fa7b2af8df
Author: Kirill Tkhai <tkhai@yandex.ru>
Date:   Thu Apr 17 00:45:24 2014 +0400

    sparc64: Make itc_sync_lock raw

    [ Upstream commit 49b6c01f4c1de3b5e5427ac5aba80f9f6d27837a ]

    One more place where we must not be able
    to be preempted or to be interrupted in RT.

    Always actually disable interrupts during
    synchronization cycle.

    Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0da96858de3417f557410c3e6d585b928394e198
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Apr 30 19:37:48 2014 -0700

    sparc64: Fix argument sign extension for compat_sys_futex().

    [ Upstream commit aa3449ee9c87d9b7660dd1493248abcc57769e31 ]

    Only the second argument, 'op', is signed.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5c19acccf5233d73ed6c58440e301ba6828aa0c1
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Aug 5 16:49:52 2014 +0200

    sctp: fix possible seqlock seadlock in sctp_packet_transmit()

    [ Upstream commit 757efd32d5ce31f67193cc0e6a56e4dffcc42fb1 ]

    Dave reported following splat, caused by improper use of
    IP_INC_STATS_BH() in process context.

    BUG: using __this_cpu_add() in preemptible [00000000] code: trinity-c117/14551
    caller is __this_cpu_preempt_check+0x13/0x20
    CPU: 3 PID: 14551 Comm: trinity-c117 Not tainted 3.16.0+ #33
     ffffffff9ec898f0 0000000047ea7e23 ffff88022d32f7f0 ffffffff9e7ee207
     0000000000000003 ffff88022d32f818 ffffffff9e397eaa ffff88023ee70b40
     ffff88022d32f970 ffff8801c026d580 ffff88022d32f828 ffffffff9e397ee3
    Call Trace:
     [<ffffffff9e7ee207>] dump_stack+0x4e/0x7a
     [<ffffffff9e397eaa>] check_preemption_disabled+0xfa/0x100
     [<ffffffff9e397ee3>] __this_cpu_preempt_check+0x13/0x20
     [<ffffffffc0839872>] sctp_packet_transmit+0x692/0x710 [sctp]
     [<ffffffffc082a7f2>] sctp_outq_flush+0x2a2/0xc30 [sctp]
     [<ffffffff9e0d985c>] ? mark_held_locks+0x7c/0xb0
     [<ffffffff9e7f8c6d>] ? _raw_spin_unlock_irqrestore+0x5d/0x80
     [<ffffffffc082b99a>] sctp_outq_uncork+0x1a/0x20 [sctp]
     [<ffffffffc081e112>] sctp_cmd_interpreter.isra.23+0x1142/0x13f0 [sctp]
     [<ffffffffc081c86b>] sctp_do_sm+0xdb/0x330 [sctp]
     [<ffffffff9e0b8f1b>] ? preempt_count_sub+0xab/0x100
     [<ffffffffc083b350>] ? sctp_cname+0x70/0x70 [sctp]
     [<ffffffffc08389ca>] sctp_primitive_ASSOCIATE+0x3a/0x50 [sctp]
     [<ffffffffc083358f>] sctp_sendmsg+0x88f/0xe30 [sctp]
     [<ffffffff9e0d673a>] ? lock_release_holdtime.part.28+0x9a/0x160
     [<ffffffff9e0d62ce>] ? put_lock_stats.isra.27+0xe/0x30
     [<ffffffff9e73b624>] inet_sendmsg+0x104/0x220
     [<ffffffff9e73b525>] ? inet_sendmsg+0x5/0x220
     [<ffffffff9e68ac4e>] sock_sendmsg+0x9e/0xe0
     [<ffffffff9e1c0c09>] ? might_fault+0xb9/0xc0
     [<ffffffff9e1c0bae>] ? might_fault+0x5e/0xc0
     [<ffffffff9e68b234>] SYSC_sendto+0x124/0x1c0
     [<ffffffff9e0136b0>] ? syscall_trace_enter+0x250/0x330
     [<ffffffff9e68c3ce>] SyS_sendto+0xe/0x10
     [<ffffffff9e7f9be4>] tracesys+0xdd/0xe2

    This is a followup of commits f1d8cba61c3c4b ("inet: fix possible
    seqlock deadlocks") and 7f88c6b23afbd315 ("ipv6: fix possible seqlock
    deadlock in ip6_finish_output2")

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Reported-by: Dave Jones <davej@redhat.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fbbef088e95f015f89cc155a02fe64017905765
Author: Sasha Levin <sasha.levin@oracle.com>
Date:   Thu Jul 31 23:00:35 2014 -0400

    iovec: make sure the caller actually wants anything in memcpy_fromiovecend

    [ Upstream commit 06ebb06d49486676272a3c030bfeef4bd969a8e6 ]

    Check for cases when the caller requests 0 bytes instead of running off
    and dereferencing potentially invalid iovecs.

    Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80db1671bd9bf67acf9c3b21350442b4b77e7cc4
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Thu Jul 31 10:33:06 2014 -0400

    net: Correctly set segment mac_len in skb_segment().

    [ Upstream commit fcdfe3a7fa4cb74391d42b6a26dc07c20dab1d82 ]

    When performing segmentation, the mac_len value is copied right
    out of the original skb.  However, this value is not always set correctly
    (like when the packet is VLAN-tagged) and we'll end up copying a bad
    value.

    One way to demonstrate this is to configure a VM which tags
    packets internally and turn off VLAN acceleration on the forwarding
    bridge port.  The packets show up corrupt like this:
    16:18:24.985548 52:54:00:ab:be:25 > 52:54:00:26:ce:a3, ethertype 802.1Q
    (0x8100), length 1518: vlan 100, p 0, ethertype 0x05e0,
            0x0000:  8cdb 1c7c 8cdb 0064 4006 b59d 0a00 6402 ...|...d@.....d.
            0x0010:  0a00 6401 9e0d b441 0a5e 64ec 0330 14fa ..d....A.^d..0..
            0x0020:  29e3 01c9 f871 0000 0101 080a 000a e833)....q.........3
            0x0030:  000f 8c75 6e65 7470 6572 6600 6e65 7470 ...unetperf.netp
            0x0040:  6572 6600 6e65 7470 6572 6600 6e65 7470 erf.netperf.netp
            0x0050:  6572 6600 6e65 7470 6572 6600 6e65 7470 erf.netperf.netp
            0x0060:  6572 6600 6e65 7470 6572 6600 6e65 7470 erf.netperf.netp
            ...

    This also leads to awful throughput as GSO packets are dropped and
    cause retransmissions.

    The solution is to set the mac_len using the values already available
    in then new skb.  We've already adjusted all of the header offset, so we
    might as well correctly figure out the mac_len using skb_reset_mac_len().
    After this change, packets are segmented correctly and performance
    is restored.

    CC: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e2a2802ad1526fbdf1dc989c27ecd203f2de7f5c
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Thu Jul 31 10:30:25 2014 -0400

    macvlan: Initialize vlan_features to turn on offload support.

    [ Upstream commit 081e83a78db9b0ae1f5eabc2dedecc865f509b98 ]

    Macvlan devices do not initialize vlan_features.  As a result,
    any vlan devices configured on top of macvlans perform very poorly.
    Initialize vlan_features based on the vlan features of the lower-level
    device.

    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0fd6471aacff6a6eb9c19b8686813cb3ff503466
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Tue Jul 22 15:22:45 2014 +0200

    net: sctp: inherit auth_capable on INIT collisions

    [ Upstream commit 1be9a950c646c9092fb3618197f7b6bfb50e82aa ]

    Jason reported an oops caused by SCTP on his ARM machine with
    SCTP authentication enabled:

    Internal error: Oops: 17 [#1] ARM
    CPU: 0 PID: 104 Comm: sctp-test Not tainted 3.13.0-68744-g3632f30c9b20-dirty #1
    task: c6eefa40 ti: c6f52000 task.ti: c6f52000
    PC is at sctp_auth_calculate_hmac+0xc4/0x10c
    LR is at sg_init_table+0x20/0x38
    pc : [<c024bb80>]    lr : [<c00f32dc>]    psr: 40000013
    sp : c6f538e8  ip : 00000000  fp : c6f53924
    r10: c6f50d80  r9 : 00000000  r8 : 00010000
    r7 : 00000000  r6 : c7be4000  r5 : 00000000  r4 : c6f56254
    r3 : c00c8170  r2 : 00000001  r1 : 00000008  r0 : c6f1e660
    Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
    Control: 0005397f  Table: 06f28000  DAC: 00000015
    Process sctp-test (pid: 104, stack limit = 0xc6f521c0)
    Stack: (0xc6f538e8 to 0xc6f54000)
    [...]
    Backtrace:
    [<c024babc>] (sctp_auth_calculate_hmac+0x0/0x10c) from [<c0249af8>] (sctp_packet_transmit+0x33c/0x5c8)
    [<c02497bc>] (sctp_packet_transmit+0x0/0x5c8) from [<c023e96c>] (sctp_outq_flush+0x7fc/0x844)
    [<c023e170>] (sctp_outq_flush+0x0/0x844) from [<c023ef78>] (sctp_outq_uncork+0x24/0x28)
    [<c023ef54>] (sctp_outq_uncork+0x0/0x28) from [<c0234364>] (sctp_side_effects+0x1134/0x1220)
    [<c0233230>] (sctp_side_effects+0x0/0x1220) from [<c02330b0>] (sctp_do_sm+0xac/0xd4)
    [<c0233004>] (sctp_do_sm+0x0/0xd4) from [<c023675c>] (sctp_assoc_bh_rcv+0x118/0x160)
    [<c0236644>] (sctp_assoc_bh_rcv+0x0/0x160) from [<c023d5bc>] (sctp_inq_push+0x6c/0x74)
    [<c023d550>] (sctp_inq_push+0x0/0x74) from [<c024a6b0>] (sctp_rcv+0x7d8/0x888)

    While we already had various kind of bugs in that area
    ec0223ec48a9 ("net: sctp: fix sctp_sf_do_5_1D_ce to verify if
    we/peer is AUTH capable") and b14878ccb7fa ("net: sctp: cache
    auth_enable per endpoint"), this one is a bit of a different
    kind.

    Giving a bit more background on why SCTP authentication is
    needed can be found in RFC4895:

      SCTP uses 32-bit verification tags to protect itself against
      blind attackers. These values are not changed during the
      lifetime of an SCTP association.

      Looking at new SCTP extensions, there is the need to have a
      method of proving that an SCTP chunk(s) was really sent by
      the original peer that started the association and not by a
      malicious attacker.

    To cause this bug, we're triggering an INIT collision between
    peers; normal SCTP handshake where both sides intent to
    authenticate packets contains RANDOM; CHUNKS; HMAC-ALGO
    parameters that are being negotiated among peers:

      ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
      <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
      -------------------- COOKIE-ECHO -------------------->
      <-------------------- COOKIE-ACK ---------------------

    RFC4895 says that each endpoint therefore knows its own random
    number and the peer's random number *after* the association
    has been established. The local and peer's random number along
    with the shared key are then part of the secret used for
    calculating the HMAC in the AUTH chunk.

    Now, in our scenario, we have 2 threads with 1 non-blocking
    SEQ_PACKET socket each, setting up common shared SCTP_AUTH_KEY
    and SCTP_AUTH_ACTIVE_KEY properly, and each of them calling
    sctp_bindx(3), listen(2) and connect(2) against each other,
    thus the handshake looks similar to this, e.g.:

      ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
      <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
      <--------- INIT[RANDOM; CHUNKS; HMAC-ALGO] -----------
      -------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] -------->
      ...

    Since such collisions can also happen with verification tags,
    the RFC4895 for AUTH rather vaguely says under section 6.1:

      In case of INIT collision, the rules governing the handling
      of this Random Number follow the same pattern as those for
      the Verification Tag, as explained in Section 5.2.4 of
      RFC 2960 [5]. Therefore, each endpoint knows its own Random
      Number and the peer's Random Number after the association
      has been established.

    In RFC2960, section 5.2.4, we're eventually hitting Action B:

      B) In this case, both sides may be attempting to start an
         association at about the same time but the peer endpoint
         started its INIT after responding to the local endpoint's
         INIT. Thus it may have picked a new Verification Tag not
         being aware of the previous Tag it had sent this endpoint.
         The endpoint should stay in or enter the ESTABLISHED
         state but it MUST update its peer's Verification Tag from
         the State Cookie, stop any init or cookie timers that may
         running and send a COOKIE ACK.

    In other words, the handling of the Random parameter is the
    same as behavior for the Verification Tag as described in
    Action B of section 5.2.4.

    Looking at the code, we exactly hit the sctp_sf_do_dupcook_b()
    case which triggers an SCTP_CMD_UPDATE_ASSOC command to the
    side effect interpreter, and in fact it properly copies over
    peer_{random, hmacs, chunks} parameters from the newly created
    association to update the existing one.

    Also, the old asoc_shared_key is being released and based on
    the new params, sctp_auth_asoc_init_active_key() updated.
    However, the issue observed in this case is that the previous
    asoc->peer.auth_capable was 0, and has *not* been updated, so
    that instead of creating a new secret, we're doing an early
    return from the function sctp_auth_asoc_init_active_key()
    leaving asoc->asoc_shared_key as NULL. However, we now have to
    authenticate chunks from the updated chunk list (e.g. COOKIE-ACK).

    That in fact causes the server side when responding with ...

      <------------------ AUTH; COOKIE-ACK -----------------

    ... to trigger a NULL pointer dereference, since in
    sctp_packet_transmit(), it discovers that an AUTH chunk is
    being queued for xmit, and thus it calls sctp_auth_calculate_hmac().

    Since the asoc->active_key_id is still inherited from the
    endpoint, and the same as encoded into the chunk, it uses
    asoc->asoc_shared_key, which is still NULL, as an asoc_key
    and dereferences it in ...

      crypto_hash_setkey(desc.tfm, &asoc_key->data[0], asoc_key->len)

    ... causing an oops. All this happens because sctp_make_cookie_ack()
    called with the *new* association has the peer.auth_capable=1
    and therefore marks the chunk with auth=1 after checking
    sctp_auth_send_cid(), but it is *actually* sent later on over
    the then *updated* association's transport that didn't initialize
    its shared key due to peer.auth_capable=0. Since control chunks
    in that case are not sent by the temporary association which
    are scheduled for deletion, they are issued for xmit via
    SCTP_CMD_REPLY in the interpreter with the context of the
    *updated* association. peer.auth_capable was 0 in the updated
    association (which went from COOKIE_WAIT into ESTABLISHED state),
    since all previous processing that performed sctp_process_init()
    was being done on temporary associations, that we eventually
    throw away each time.

    The correct fix is to update to the new peer.auth_capable
    value as well in the collision case via sctp_assoc_update(),
    so that in case the collision migrated from 0 -> 1,
    sctp_auth_asoc_init_active_key() can properly recalculate
    the secret. This therefore fixes the observed server panic.

    Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing")
    Reported-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Tested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
    Cc: Vlad Yasevich <vyasevich@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d06a70abffa9d6bd52cef880105458e432294d4
Author: Christoph Paasch <christoph.paasch@uclouvain.be>
Date:   Tue Jul 29 13:40:57 2014 +0200

    tcp: Fix integer-overflow in TCP vegas

    [ Upstream commit 1f74e613ded11517db90b2bd57e9464d9e0fb161 ]

    In vegas we do a multiplication of the cwnd and the rtt. This
    may overflow and thus their result is stored in a u64. However, we first
    need to cast the cwnd so that actually 64-bit arithmetic is done.

    Then, we need to do do_div to allow this to be used on 32-bit arches.

    Cc: Stephen Hemminger <stephen@networkplumber.org>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: David Laight <David.Laight@ACULAB.COM>
    Cc: Doug Leith <doug.leith@nuim.ie>
    Fixes: 8d3a564da34e (tcp: tcp_vegas cong avoid fix)
    Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1f9480d282a68d14ac2a650ae74063fd889bfdcd
Author: Christoph Paasch <christoph.paasch@uclouvain.be>
Date:   Tue Jul 29 12:07:27 2014 +0200

    tcp: Fix integer-overflows in TCP veno

    [ Upstream commit 45a07695bc64b3ab5d6d2215f9677e5b8c05a7d0 ]

    In veno we do a multiplication of the cwnd and the rtt. This
    may overflow and thus their result is stored in a u64. However, we first
    need to cast the cwnd so that actually 64-bit arithmetic is done.

    A first attempt at fixing 76f1017757aa0 ([TCP]: TCP Veno congestion
    control) was made by 159131149c2 (tcp: Overflow bug in Vegas), but it
    failed to add the required cast in tcp_veno_cong_avoid().

    Fixes: 76f1017757aa0 ([TCP]: TCP Veno congestion control)
    Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c28d71cac875c4419cef60e33b5a1f260b0002dc
Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Date:   Sat Jul 26 21:26:58 2014 +0400

    net: sendmsg: fix NULL pointer dereference

    [ Upstream commit 40eea803c6b2cfaab092f053248cbeab3f368412 ]

    Sasha's report:
    	> While fuzzing with trinity inside a KVM tools guest running the latest -next
    	> kernel with the KASAN patchset, I've stumbled on the following spew:
    	>
    	> [ 4448.949424] ==================================================================
    	> [ 4448.951737] AddressSanitizer: user-memory-access on address 0
    	> [ 4448.952988] Read of size 2 by thread T19638:
    	> [ 4448.954510] CPU: 28 PID: 19638 Comm: trinity-c76 Not tainted 3.16.0-rc4-next-20140711-sasha-00046-g07d3099-dirty #813
    	> [ 4448.956823]  ffff88046d86ca40 0000000000000000 ffff880082f37e78 ffff880082f37a40
    	> [ 4448.958233]  ffffffffb6e47068 ffff880082f37a68 ffff880082f37a58 ffffffffb242708d
    	> [ 4448.959552]  0000000000000000 ffff880082f37a88 ffffffffb24255b1 0000000000000000
    	> [ 4448.961266] Call Trace:
    	> [ 4448.963158] dump_stack (lib/dump_stack.c:52)
    	> [ 4448.964244] kasan_report_user_access (mm/kasan/report.c:184)
    	> [ 4448.965507] __asan_load2 (mm/kasan/kasan.c:352)
    	> [ 4448.966482] ? netlink_sendmsg (net/netlink/af_netlink.c:2339)
    	> [ 4448.967541] netlink_sendmsg (net/netlink/af_netlink.c:2339)
    	> [ 4448.968537] ? get_parent_ip (kernel/sched/core.c:2555)
    	> [ 4448.970103] sock_sendmsg (net/socket.c:654)
    	> [ 4448.971584] ? might_fault (mm/memory.c:3741)
    	> [ 4448.972526] ? might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3740)
    	> [ 4448.973596] ? verify_iovec (net/core/iovec.c:64)
    	> [ 4448.974522] ___sys_sendmsg (net/socket.c:2096)
    	> [ 4448.975797] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
    	> [ 4448.977030] ? lock_release_holdtime (kernel/locking/lockdep.c:273)
    	> [ 4448.978197] ? lock_release_non_nested (kernel/locking/lockdep.c:3434 (discriminator 1))
    	> [ 4448.979346] ? check_chain_key (kernel/locking/lockdep.c:2188)
    	> [ 4448.980535] __sys_sendmmsg (net/socket.c:2181)
    	> [ 4448.981592] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
    	> [ 4448.982773] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
    	> [ 4448.984458] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2))
    	> [ 4448.985621] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
    	> [ 4448.986754] SyS_sendmmsg (net/socket.c:2201)
    	> [ 4448.987708] tracesys (arch/x86/kernel/entry_64.S:542)
    	> [ 4448.988929] ==================================================================

    This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0.

    After this report there was no usual "Unable to handle kernel NULL pointer dereference"
    and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.

    This bug was introduced in f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
    (net: rework recvmsg handler msg_name and msg_namelen logic).
    Commit message states that:
    	"Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
    	 non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
    	 affect sendto as it would bail out earlier while trying to copy-in the
    	 address."
    But in fact this affects sendto when address 0 is mapped and contains
    socket address structure in it. In such case copy-in address will succeed,
    verify_iovec() function will successfully exit with msg->msg_namelen > 0
    and msg->msg_name == NULL.

    This patch fixes it by setting msg_namelen to 0 if msg_name == NULL.

    Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: <stable@vger.kernel.org>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 509a15a5d6b0cfd3e4e396844615df6335ff4c62
Author: Eric Dumazet <edumazet@google.com>
Date:   Sat Jul 26 08:58:10 2014 +0200

    ip: make IP identifiers less predictable

    [ Upstream commit 04ca6973f7c1a0d8537f2d9906a0cf8e69886d75 ]

    In "Counting Packets Sent Between Arbitrary Internet Hosts", Jeffrey and
    Jedidiah describe ways exploiting linux IP identifier generation to
    infer whether two machines are exchanging packets.

    With commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count"), we
    changed IP id generation, but this does not really prevent this
    side-channel technique.

    This patch adds a random amount of perturbation so that IP identifiers
    for a given destination [1] are no longer monotonically increasing after
    an idle period.

    Note that prandom_u32_max(1) returns 0, so if generator is used at most
    once per jiffy, this patch inserts no hole in the ID suite and do not
    increase collision probability.

    This is jiffies based, so in the worst case (HZ=1000), the id can
    rollover after ~65 seconds of idle time, which should be fine.

    We also change the hash used in __ip_select_ident() to not only hash
    on daddr, but also saddr and protocol, so that ICMP probes can not be
    used to infer information for other protocols.

    For IPv6, adds saddr into the hash as well, but not nexthdr.

    If I ping the patched target, we can see ID are now hard to predict.

    21:57:11.008086 IP (...)
        A > target: ICMP echo request, seq 1, length 64
    21:57:11.010752 IP (... id 2081 ...)
        target > A: ICMP echo reply, seq 1, length 64

    21:57:12.013133 IP (...)
        A > target: ICMP echo request, seq 2, length 64
    21:57:12.015737 IP (... id 3039 ...)
        target > A: ICMP echo reply, seq 2, length 64

    21:57:13.016580 IP (...)
        A > target: ICMP echo request, seq 3, length 64
    21:57:13.019251 IP (... id 3437 ...)
        target > A: ICMP echo reply, seq 3, length 64

    [1] TCP sessions uses a per flow ID generator not changed by this patch.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Jeffrey Knockel <jeffk@cs.unm.edu>
    Reported-by: Jedidiah R. Crandall <crandall@cs.unm.edu>
    Cc: Willy Tarreau <w@1wt.eu>
    Cc: Hannes Frederic Sowa <hannes@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ad52eef552c7896ec6024ee72fc126167fe5c4e2
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Jun 2 05:26:03 2014 -0700

    inetpeer: get rid of ip_id_count

    [ Upstream commit 73f156a6e8c1074ac6327e0abd1169e95eb66463 ]

    Ideally, we would need to generate IP ID using a per destination IP
    generator.

    linux kernels used inet_peer cache for this purpose, but this had a huge
    cost on servers disabling MTU discovery.

    1) each inet_peer struct consumes 192 bytes

    2) inetpeer cache uses a binary tree of inet_peer structs,
       with a nominal size of ~66000 elements under load.

    3) lookups in this tree are hitting a lot of cache lines, as tree depth
       is about 20.

    4) If server deals with many tcp flows, we have a high probability of
       not finding the inet_peer, allocating a fresh one, inserting it in
       the tree with same initial ip_id_count, (cf secure_ip_id())

    5) We garbage collect inet_peer aggressively.

    IP ID generation do not have to be 'perfect'

    Goal is trying to avoid duplicates in a short period of time,
    so that reassembly units have a chance to complete reassembly of
    fragments belonging to one message before receiving other fragments
    with a recycled ID.

    We simply use an array of generators, and a Jenkin hash using the dst IP
    as a key.

    ipv6_select_ident() is put back into net/ipv6/ip6_output.c where it
    belongs (it is only used from this file)

    secure_ip_id() and secure_ipv6_id() no longer are needed.

    Rename ip_select_ident_more() to ip_select_ident_segs() to avoid
    unnecessary decrement/increment of the number of segments.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e1557ad0ce32b19813750f4028d6f02d1a4b7134
Merge: c013559 c201ba5
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Sun Aug 10 20:14:26 2014 -0500

    Merge remote-tracking branch 'caf/kk_2.7_rb1.42' into cm-11.0

    Conflicts:
    	net/ipv4/ping.c

    Change-Id: I828218201ee602f5deec3110f950265920b47296

commit c013559630ab01b818caa42188301fafb8703066
Author: Zach Frank <zachf714@gmail.com>
Date:   Sat Aug 9 00:00:00 2014 -0400

    sched/core: Fix missed printk_sched

    * renamed to printk_deferred in previous commit

    Change-Id: Ida094e87cdaa211b8b1edd17111455b68a6af24f

commit ed6b983319d1e28ca4669ae4da8ff95c26ee04ed
Merge: 477f654 0a9d91d
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Sun Aug 10 17:31:44 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit 0a9d91dca3b9f797f2fc615486c12afa59f19a3b
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Aug 7 13:54:57 2014 -0700

    Linux 3.4.102

commit a066704c52563ec7300dd7fe8cdc9dad23a3e654
Author: Gao feng <gaofeng@cn.fujitsu.com>
Date:   Fri Jan 24 16:29:11 2014 +0800

    ipv6: reallocate addrconf router for ipv6 address when lo device up

    commit 33d99113b1102c2d2f8603b9ba72d89d915c13f5 upstream.

    commit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f
    "net IPv6 : Fix broken IPv6 routing table after loopback down-up"
    allocates addrconf router for ipv6 address when lo device up.
    but commit a881ae1f625c599b460cc8f8a7fcb1c438f699ad
    "ipv6:don't call addrconf_dst_alloc again when enable lo" breaks
    this behavior.

    Since the addrconf router is moved to the garbage list when
    lo device down, we should release this router and rellocate
    a new one for ipv6 address when lo device up.

    This patch solves bug 67951 on bugzilla
    https://bugzilla.kernel.org/show_bug.cgi?id=67951

    change from v1:
    use ip6_rt_put to repleace ip6_del_rt, thanks Hannes!
    change code style, suggested by Sergei.

    CC: Sabrina Dubroca <sd@queasysnail.net>
    CC: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Reported-by: Weilong Chen <chenweilong@huawei.com>
    Signed-off-by: Weilong Chen <chenweilong@huawei.com>
    Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [weilong: s/ip6_rt_put/dst_release]
    Signed-off-by: Chen Weilong <chenweilong@huawei.com>
    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21dbd45fb3355f60ac73371e4612a3aa26d07124
Author: Vlastimil Babka <vbabka@suse.cz>
Date:   Mon Apr 7 15:37:50 2014 -0700

    mm: try_to_unmap_cluster() should lock_page() before mlocking

    commit 57e68e9cd65b4b8eb4045a1e0d0746458502554c upstream.

    A BUG_ON(!PageLocked) was triggered in mlock_vma_page() by Sasha Levin
    fuzzing with trinity.  The call site try_to_unmap_cluster() does not lock
    the pages other than its check_page parameter (which is already locked).

    The BUG_ON in mlock_vma_page() is not documented and its purpose is
    somewhat unclear, but apparently it serializes against page migration,
    which could otherwise fail to transfer the PG_mlocked flag.  This would
    not be fatal, as the page would be eventually encountered again, but
    NR_MLOCK accounting would become distorted nevertheless.  This patch adds
    a comment to the BUG_ON in mlock_vma_page() and munlock_vma_page() to that
    effect.

    The call site try_to_unmap_cluster() is fixed so that for page !=
    check_page, trylock_page() is attempted (to avoid possible deadlocks as we
    already have check_page locked) and mlock_vma_page() is performed only
    upon success.  If the page lock cannot be obtained, the page is left
    without PG_mlocked, which is again not a problem in the whole unevictable
    memory design.

    Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
    Signed-off-by: Bob Liu <bob.liu@oracle.com>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
    Cc: Michel Lespinasse <walken@google.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Acked-by: Rik van Riel <riel@redhat.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c98268072b611fab39eee633e3f2e7b2d8c64da
Author: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Date:   Wed Jul 9 13:18:18 2014 -0400

    x86/espfix/xen: Fix allocation of pages for paravirt page tables

    commit 8762e5092828c4dc0f49da5a47a644c670df77f3 upstream.

    init_espfix_ap() is currently off by one level when informing hypervisor
    that allocated pages will be used for ministacks' page tables.

    The most immediate effect of this on a PV guest is that if
    'stack_page = __get_free_page()' returns a non-zeroed-out page the hypervisor
    will refuse to use it for a page table (which it shouldn't be anyway). This will
    result in warnings by both Xen and Linux.

    More importantly, a subsequent write to that page (again, by a PV guest) is
    likely to result in fatal page fault.

    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Link: http://lkml.kernel.org/r/1404926298-5565-1-git-send-email-boris.ostrovsky@oracle.com
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cca69958eee770a0b618bc73fec41b32d2b50387
Author: Minfei Huang <huangminfei@ucloud.cn>
Date:   Wed Jun 4 16:11:53 2014 -0700

    lib/btree.c: fix leak of whole btree nodes

    commit c75b53af2f0043aff500af0a6f878497bef41bca upstream.

    I use btree from 3.14-rc2 in my own module.  When the btree module is
    removed, a warning arises:

     kmem_cache_destroy btree_node: Slab cache still has objects
     CPU: 13 PID: 9150 Comm: rmmod Tainted: GF          O 3.14.0-rc2 #1
     Hardware name: Inspur NF5270M3/NF5270M3, BIOS CHEETAH_2.1.3 09/10/2013
     Call Trace:
       dump_stack+0x49/0x5d
       kmem_cache_destroy+0xcf/0xe0
       btree_module_exit+0x10/0x12 [btree]
       SyS_delete_module+0x198/0x1f0
       system_call_fastpath+0x16/0x1b

    The cause is that it doesn't release the last btree node, when height = 1
    and fill = 1.

    [akpm@linux-foundation.org: remove unneeded test of NULL]
    Signed-off-by: Minfei Huang <huangminfei@ucloud.cn>
    Cc: Joern Engel <joern@logfs.org>
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 56a2a6f68b6cf7dec64a53c8c7497fa5b36cbb15
Author: Sasha Levin <sasha.levin@oracle.com>
Date:   Mon Jul 14 17:02:31 2014 -0700

    net/l2tp: don't fall back on UDP [get|set]sockopt

    commit 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf upstream.

    The l2tp [get|set]sockopt() code has fallen back to the UDP functions
    for socket option levels != SOL_PPPOL2TP since day one, but that has
    never actually worked, since the l2tp socket isn't an inet socket.

    As David Miller points out:

      "If we wanted this to work, it'd have to look up the tunnel and then
       use tunnel->sk, but I wonder how useful that would be"

    Since this can never have worked so nobody could possibly have depended
    on that functionality, just remove the broken code and return -EINVAL.

    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Acked-by: James Chapman <jchapman@katalix.com>
    Acked-by: David Miller <davem@davemloft.net>
    Cc: Phil Turnbull <phil.turnbull@oracle.com>
    Cc: Vegard Nossum <vegard.nossum@oracle.com>
    Cc: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 68199d62034a736cae12fee49b0dad5342612583
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Aug 4 21:42:10 2014 -0700

    Revert: "net: ip, ipv6: handle gso skbs in forwarding path"

    This reverts commit 29a3cd46644ec8098dbe1c12f89643b5c11831a9 which is
    commit fe6cc55f3a9a053482a76f5a6b2257cee51b4663 upstream.

    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: Marcelo Ricardo Leitner <mleitner@redhat.com>
    Cc: Florian Westphal <fw@strlen.de>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 473d8a237b359c41225458f3d7c6aa2e5beb40d5
Author: Andy Lutomirski <luto@amacapital.net>
Date:   Wed Jul 23 08:34:11 2014 -0700

    x86_64/entry/xen: Do not invoke espfix64 on Xen

    commit 7209a75d2009dbf7745e2fd354abf25c3deb3ca3 upstream.

    This moves the espfix64 logic into native_iret.  To make this work,
    it gets rid of the native patch for INTERRUPT_RETURN:
    INTERRUPT_RETURN on native kernels is now 'jmp native_iret'.

    This changes the 16-bit SS behavior on Xen from OOPSing to leaking
    some bits of the Xen hypervisor's RSP (I think).

    [ hpa: this is a nonzero cost on native, but probably not enough to
      measure. Xen needs to fix this in their own code, probably doing
      something equivalent to espfix64. ]

    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Link: http://lkml.kernel.org/r/7b8f1d8ef6597cb16ae004a43c56980a7de3cf94.1406129132.git.luto@amacapital.net
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a0db8af65056ec1a60607d4286b782934a2a03b
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Sun May 4 10:36:22 2014 -0700

    x86, espfix: Make it possible to disable 16-bit support

    commit 34273f41d57ee8d854dcd2a1d754cbb546cb548f upstream.

    Embedded systems, which may be very memory-size-sensitive, are
    extremely unlikely to ever encounter any 16-bit software, so make it
    a CONFIG_EXPERT option to turn off support for any 16-bit software
    whatsoever.

    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b6354ea6bfbe20f68c248ee5a846b1d3f76863d
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Sun May 4 10:00:49 2014 -0700

    x86, espfix: Make espfix64 a Kconfig option, fix UML

    commit 197725de65477bc8509b41388157c1a2283542bb upstream.

    Make espfix64 a hidden Kconfig option.  This fixes the x86-64 UML
    build which had broken due to the non-existence of init_espfix_bsp()
    in UML: since UML uses its own Kconfig, this option does not appear in
    the UML build.

    This also makes it possible to make support for 16-bit segments a
    configuration option, for the people who want to minimize the size of
    the kernel.

    Reported-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: Richard Weinberger <richard@nod.at>
    Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 111f0ce4598291dcd2d354a20ab94de834c1e109
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Fri May 2 11:33:51 2014 -0700

    x86, espfix: Fix broken header guard

    commit 20b68535cd27183ebd3651ff313afb2b97dac941 upstream.

    Header guard is #ifndef, not #ifdef...

    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18e63ea35d8424f9b99ad4c53cd51f777ea17fca
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Thu May 1 14:12:23 2014 -0700

    x86, espfix: Move espfix definitions into a separate header file

    commit e1fe9ed8d2a4937510d0d60e20705035c2609aea upstream.

    Sparse warns that the percpu variables aren't declared before they are
    defined.  Rather than hacking around it, move espfix definitions into
    a proper header file.

    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3989298cbdafdaf0536f23677df9f29bfc44f8ad
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Tue Apr 29 16:46:09 2014 -0700

    x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack

    commit 3891a04aafd668686239349ea58f3314ea2af86b upstream.

    The IRET instruction, when returning to a 16-bit segment, only
    restores the bottom 16 bits of the user space stack pointer.  This
    causes some 16-bit software to break, but it also leaks kernel state
    to user space.  We have a software workaround for that ("espfix") for
    the 32-bit kernel, but it relies on a nonzero stack segment base which
    is not available in 64-bit mode.

    In checkin:

        b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

    we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
    the logic that 16-bit support is crippled on 64-bit kernels anyway (no
    V86 support), but it turns out that people are doing stuff like
    running old Win16 binaries under Wine and expect it to work.

    This works around this by creating percpu "ministacks", each of which
    is mapped 2^16 times 64K apart.  When we detect that the return SS is
    on the LDT, we copy the IRET frame to the ministack and use the
    relevant alias to return to userspace.  The ministacks are mapped
    readonly, so if IRET faults we promote #GP to #DF which is an IST
    vector and thus has its own stack; we then do the fixup in the #DF
    handler.

    (Making #GP an IST exception would make the msr_safe functions unsafe
    in NMI/MC context, and quite possibly have other effects.)

    Special thanks to:

    - Andy Lutomirski, for the suggestion of using very small stack slots
      and copy (as opposed to map) the IRET frame there, and for the
      suggestion to mark them readonly and let the fault promote to #DF.
    - Konrad Wilk for paravirt fixup and testing.
    - Borislav Petkov for testing help and useful comments.

    Reported-by: Brian Gerst <brgerst@gmail.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Andrew Lutomriski <amluto@gmail.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Dirk Hohndel <dirk@hohndel.org>
    Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
    Cc: comex <comexk@gmail.com>
    Cc: Alexander van Heukelum <heukelum@fastmail.fm>
    Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c7e43ada5875cb1592046242f22f2fa54b09ca0
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Wed May 21 10:22:59 2014 -0700

    Revert "x86-64, modify_ldt: Make support for 16-bit segments a runtime option"

    commit 7ed6fb9b5a5510e4ef78ab27419184741169978a upstream.

    This reverts commit fa81511bb0bbb2b1aace3695ce869da9762624ff in
    preparation of merging in the proper fix (espfix64).

    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fbbb7208969e8bfbd07782bbec069878a29d3267
Author: Jan Kara <jack@suse.cz>
Date:   Fri Aug 1 12:20:02 2014 +0200

    timer: Fix lock inversion between hrtimer_bases.lock and scheduler locks

    commit 504d58745c9ca28d33572e2d8a9990b43e06075d upstream.

    clockevents_increase_min_delta() calls printk() from under
    hrtimer_bases.lock. That causes lock inversion on scheduler locks because
    printk() can call into the scheduler. Lockdep puts it as:

    ======================================================
    [ INFO: possible circular locking dependency detected ]
    3.15.0-rc8-06195-g939f04b #2 Not tainted
    -------------------------------------------------------
    trinity-main/74 is trying to acquire lock:
     (&port_lock_key){-.....}, at: [<811c60be>] serial8250_console_write+0x8c/0x10c

    but task is already holding lock:
     (hrtimer_bases.lock){-.-...}, at: [<8103caeb>] hrtimer_try_to_cancel+0x13/0x66

    which lock already depends on the new lock.

    the existing dependency chain (in reverse order) is:

    -> #5 (hrtimer_bases.lock){-.-...}:
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f11d>] _raw_spin_lock_irqsave+0x2e/0x3e
           [<8103c918>] __hrtimer_start_range_ns+0x1c/0x197
           [<8107ec20>] perf_swevent_start_hrtimer.part.41+0x7a/0x85
           [<81080792>] task_clock_event_start+0x3a/0x3f
           [<810807a4>] task_clock_event_add+0xd/0x14
           [<8108259a>] event_sched_in+0xb6/0x17a
           [<810826a2>] group_sched_in+0x44/0x122
           [<81082885>] ctx_sched_in.isra.67+0x105/0x11f
           [<810828e6>] perf_event_sched_in.isra.70+0x47/0x4b
           [<81082bf6>] __perf_install_in_context+0x8b/0xa3
           [<8107eb8e>] remote_function+0x12/0x2a
           [<8105f5af>] smp_call_function_single+0x2d/0x53
           [<8107e17d>] task_function_call+0x30/0x36
           [<8107fb82>] perf_install_in_context+0x87/0xbb
           [<810852c9>] SYSC_perf_event_open+0x5c6/0x701
           [<810856f9>] SyS_perf_event_open+0x17/0x19
           [<8142f8ee>] syscall_call+0x7/0xb

    -> #4 (&ctx->lock){......}:
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f04c>] _raw_spin_lock+0x21/0x30
           [<81081df3>] __perf_event_task_sched_out+0x1dc/0x34f
           [<8142cacc>] __schedule+0x4c6/0x4cb
           [<8142cae0>] schedule+0xf/0x11
           [<8142f9a6>] work_resched+0x5/0x30

    -> #3 (&rq->lock){-.-.-.}:
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f04c>] _raw_spin_lock+0x21/0x30
           [<81040873>] __task_rq_lock+0x33/0x3a
           [<8104184c>] wake_up_new_task+0x25/0xc2
           [<8102474b>] do_fork+0x15c/0x2a0
           [<810248a9>] kernel_thread+0x1a/0x1f
           [<814232a2>] rest_init+0x1a/0x10e
           [<817af949>] start_kernel+0x303/0x308
           [<817af2ab>] i386_start_kernel+0x79/0x7d

    -> #2 (&p->pi_lock){-.-...}:
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f11d>] _raw_spin_lock_irqsave+0x2e/0x3e
           [<810413dd>] try_to_wake_up+0x1d/0xd6
           [<810414cd>] default_wake_function+0xb/0xd
           [<810461f3>] __wake_up_common+0x39/0x59
           [<81046346>] __wake_up+0x29/0x3b
           [<811b8733>] tty_wakeup+0x49/0x51
           [<811c3568>] uart_write_wakeup+0x17/0x19
           [<811c5dc1>] serial8250_tx_chars+0xbc/0xfb
           [<811c5f28>] serial8250_handle_irq+0x54/0x6a
           [<811c5f57>] serial8250_default_handle_irq+0x19/0x1c
           [<811c56d8>] serial8250_interrupt+0x38/0x9e
           [<810510e7>] handle_irq_event_percpu+0x5f/0x1e2
           [<81051296>] handle_irq_event+0x2c/0x43
           [<81052cee>] handle_level_irq+0x57/0x80
           [<81002a72>] handle_irq+0x46/0x5c
           [<810027df>] do_IRQ+0x32/0x89
           [<8143036e>] common_interrupt+0x2e/0x33
           [<8142f23c>] _raw_spin_unlock_irqrestore+0x3f/0x49
           [<811c25a4>] uart_start+0x2d/0x32
           [<811c2c04>] uart_write+0xc7/0xd6
           [<811bc6f6>] n_tty_write+0xb8/0x35e
           [<811b9beb>] tty_write+0x163/0x1e4
           [<811b9cd9>] redirected_tty_write+0x6d/0x75
           [<810b6ed6>] vfs_write+0x75/0xb0
           [<810b7265>] SyS_write+0x44/0x77
           [<8142f8ee>] syscall_call+0x7/0xb

    -> #1 (&tty->write_wait){-.....}:
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f11d>] _raw_spin_lock_irqsave+0x2e/0x3e
           [<81046332>] __wake_up+0x15/0x3b
           [<811b8733>] tty_wakeup+0x49/0x51
           [<811c3568>] uart_write_wakeup+0x17/0x19
           [<811c5dc1>] serial8250_tx_chars+0xbc/0xfb
           [<811c5f28>] serial8250_handle_irq+0x54/0x6a
           [<811c5f57>] serial8250_default_handle_irq+0x19/0x1c
           [<811c56d8>] serial8250_interrupt+0x38/0x9e
           [<810510e7>] handle_irq_event_percpu+0x5f/0x1e2
           [<81051296>] handle_irq_event+0x2c/0x43
           [<81052cee>] handle_level_irq+0x57/0x80
           [<81002a72>] handle_irq+0x46/0x5c
           [<810027df>] do_IRQ+0x32/0x89
           [<8143036e>] common_interrupt+0x2e/0x33
           [<8142f23c>] _raw_spin_unlock_irqrestore+0x3f/0x49
           [<811c25a4>] uart_start+0x2d/0x32
           [<811c2c04>] uart_write+0xc7/0xd6
           [<811bc6f6>] n_tty_write+0xb8/0x35e
           [<811b9beb>] tty_write+0x163/0x1e4
           [<811b9cd9>] redirected_tty_write+0x6d/0x75
           [<810b6ed6>] vfs_write+0x75/0xb0
           [<810b7265>] SyS_write+0x44/0x77
           [<8142f8ee>] syscall_call+0x7/0xb

    -> #0 (&port_lock_key){-.....}:
           [<8104a62d>] __lock_acquire+0x9ea/0xc6d
           [<8104a942>] lock_acquire+0x92/0x101
           [<8142f11d>] _raw_spin_lock_irqsave+0x2e/0x3e
           [<811c60be>] serial8250_console_write+0x8c/0x10c
           [<8104e402>] call_console_drivers.constprop.31+0x87/0x118
           [<8104f5d5>] console_unlock+0x1d7/0x398
           [<8104fb70>] vprintk_emit+0x3da/0x3e4
           [<81425f76>] printk+0x17/0x19
           [<8105bfa0>] clockevents_program_min_delta+0x104/0x116
           [<8105c548>] clockevents_program_event+0xe7/0xf3
           [<8105cc1c>] tick_program_event+0x1e/0x23
           [<8103c43c>] hrtimer_force_reprogram+0x88/0x8f
           [<8103c49e>] __remove_hrtimer+0x5b/0x79
           [<8103cb21>] hrtimer_try_to_cancel+0x49/0x66
           [<8103cb4b>] hrtimer_cancel+0xd/0x18
           [<8107f102>] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
           [<81080705>] task_clock_event_stop+0x20/0x64
           [<81080756>] task_clock_event_del+0xd/0xf
           [<81081350>] event_sched_out+0xab/0x11e
           [<810813e0>] group_sched_out+0x1d/0x66
           [<81081682>] ctx_sched_out+0xaf/0xbf
           [<81081e04>] __perf_event_task_sched_out+0x1ed/0x34f
           [<8142cacc>] __schedule+0x4c6/0x4cb
           [<8142cae0>] schedule+0xf/0x11
           [<8142f9a6>] work_resched+0x5/0x30

    other info that might help us debug this:

    Chain exists of:
      &port_lock_key --> &ctx->lock --> hrtimer_bases.lock

     Possible unsafe locking scenario:

           CPU0                    CPU1
           ----                    ----
      lock(hrtimer_bases.lock);
                                   lock(&ctx->lock);
                                   lock(hrtimer_bases.lock);
      lock(&port_lock_key);

     *** DEADLOCK ***

    4 locks held by trinity-main/74:
     #0:  (&rq->lock){-.-.-.}, at: [<8142c6f3>] __schedule+0xed/0x4cb
     #1:  (&ctx->lock){......}, at: [<81081df3>] __perf_event_task_sched_out+0x1dc/0x34f
     #2:  (hrtimer_bases.lock){-.-...}, at: [<8103caeb>] hrtimer_try_to_cancel+0x13/0x66
     #3:  (console_lock){+.+...}, at: [<8104fb5d>] vprintk_emit+0x3c7/0x3e4

    stack backtrace:
    CPU: 0 PID: 74 Comm: trinity-main Not tainted 3.15.0-rc8-06195-g939f04b #2
     00000000 81c3a310 8b995c14 81426f69 8b995c44 81425a99 8161f671 8161f570
     8161f538 8161f559 8161f538 8b995c78 8b142bb0 00000004 8b142fdc 8b142bb0
     8b995ca8 8104a62d 8b142fac 000016f2 81c3a310 00000001 00000001 00000003
    Call Trace:
     [<81426f69>] dump_stack+0x16/0x18
     [<81425a99>] print_circular_bug+0x18f/0x19c
     [<8104a62d>] __lock_acquire+0x9ea/0xc6d
     [<8104a942>] lock_acquire+0x92/0x101
     [<811c60be>] ? serial8250_console_write+0x8c/0x10c
     [<811c6032>] ? wait_for_xmitr+0x76/0x76
     [<8142f11d>] _raw_spin_lock_irqsave+0x2e/0x3e
     [<811c60be>] ? serial8250_console_write+0x8c/0x10c
     [<811c60be>] serial8250_console_write+0x8c/0x10c
     [<8104af87>] ? lock_release+0x191/0x223
     [<811c6032>] ? wait_for_xmitr+0x76/0x76
     [<8104e402>] call_console_drivers.constprop.31+0x87/0x118
     [<8104f5d5>] console_unlock+0x1d7/0x398
     [<8104fb70>] vprintk_emit+0x3da/0x3e4
     [<81425f76>] printk+0x17/0x19
     [<8105bfa0>] clockevents_program_min_delta+0x104/0x116
     [<8105cc1c>] tick_program_event+0x1e/0x23
     [<8103c43c>] hrtimer_force_reprogram+0x88/0x8f
     [<8103c49e>] __remove_hrtimer+0x5b/0x79
     [<8103cb21>] hrtimer_try_to_cancel+0x49/0x66
     [<8103cb4b>] hrtimer_cancel+0xd/0x18
     [<8107f102>] perf_swevent_cancel_hrtimer.part.60+0x2b/0x30
     [<81080705>] task_clock_event_stop+0x20/0x64
     [<81080756>] task_clock_event_del+0xd/0xf
     [<81081350>] event_sched_out+0xab/0x11e
     [<810813e0>] group_sched_out+0x1d/0x66
     [<81081682>] ctx_sched_out+0xaf/0xbf
     [<81081e04>] __perf_event_task_sched_out+0x1ed/0x34f
     [<8104416d>] ? __dequeue_entity+0x23/0x27
     [<81044505>] ? pick_next_task_fair+0xb1/0x120
     [<8142cacc>] __schedule+0x4c6/0x4cb
     [<81047574>] ? trace_hardirqs_off_caller+0xd7/0x108
     [<810475b0>] ? trace_hardirqs_off+0xb/0xd
     [<81056346>] ? rcu_irq_exit+0x64/0x77

    Fix the problem by using printk_deferred() which does not call into the
    scheduler.

    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f73ff697833654ee578b606ea746d15dc1220aab
Author: John Stultz <john.stultz@linaro.org>
Date:   Wed Jun 4 16:11:40 2014 -0700

    printk: rename printk_sched to printk_deferred

    commit aac74dc495456412c4130a1167ce4beb6c1f0b38 upstream.

    After learning we'll need some sort of deferred printk functionality in
    the timekeeping core, Peter suggested we rename the printk_sched function
    so it can be reused by needed subsystems.

    This only changes the function name. No logic changes.

    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
    Cc: Jan Kara <jack@suse.cz>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Jiri Bohac <jbohac@suse.cz>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f6c1deb02e6ac110645c87fd2446594803a8a72
Author: David Rientjes <rientjes@google.com>
Date:   Wed Jul 30 16:08:24 2014 -0700

    mm, thp: do not allow thp faults to avoid cpuset restrictions

    commit b104a35d32025ca740539db2808aa3385d0f30eb upstream.

    The page allocator relies on __GFP_WAIT to determine if ALLOC_CPUSET
    should be set in allocflags.  ALLOC_CPUSET controls if a page allocation
    should be restricted only to the set of allowed cpuset mems.

    Transparent hugepages clears __GFP_WAIT when defrag is disabled to prevent
    the fault path from using memory compaction or direct reclaim.  Thus, it
    is unfairly able to allocate outside of its cpuset mems restriction as a
    side-effect.

    This patch ensures that ALLOC_CPUSET is only cleared when the gfp mask is
    truly GFP_ATOMIC by verifying it is also not a thp allocation.

    Signed-off-by: David Rientjes <rientjes@google.com>
    Reported-by: Alex Thorlton <athorlton@sgi.com>
    Tested-by: Alex Thorlton <athorlton@sgi.com>
    Cc: Bob Liu <lliubbo@gmail.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Hedi Berriche <hedi@sgi.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e04ec4d3c1ada2049c9b852ab63fba416c6df8d
Author: James Bottomley <JBottomley@Parallels.com>
Date:   Thu Jul 3 19:17:34 2014 +0200

    scsi: handle flush errors properly

    commit 89fb4cd1f717a871ef79fa7debbe840e3225cd54 upstream.

    Flush commands don't transfer data and thus need to be special cased
    in the I/O completion handler so that we can propagate errors to
    the block layer and filesystem.

    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Reported-by: Steven Haber <steven@qumulo.com>
    Tested-by: Steven Haber <steven@qumulo.com>
    Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e926a6b962cfc154818fd0796c4815df6ed09d0
Author: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
Date:   Fri Jul 25 09:17:12 2014 +0100

    ARM: 8115/1: LPAE: reduce damage caused by idmap to virtual memory layout

    commit 811a2407a3cf7bbd027fbe92d73416f17485a3d8 upstream.

    On LPAE, each level 1 (pgd) page table entry maps 1GiB, and the level 2
    (pmd) entries map 2MiB.

    When the identity mapping is created on LPAE, the pgd pointers are copied
    from the swapper_pg_dir.  If we find that we need to modify the contents
    of a pmd, we allocate a new empty pmd table and insert it into the
    appropriate 1GB slot, before then filling it with the identity mapping.

    However, if the 1GB slot covers the kernel lowmem mappings, we obliterate
    those mappings.

    When replacing a PMD, first copy the old PMD contents to the new PMD, so
    that we preserve the existing mappings, particularly the mappings of the
    kernel itself.

    [rewrote commit message and added code comment -- rmk]

    Fixes: ae2de101739c ("ARM: LPAE: Add identity mapping support for the 3-level page table format")
    Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 44ce8f87254b3aea12296aa8275b76fa86c07ca6
Author: Milan Broz <gmazyland@gmail.com>
Date:   Tue Jul 29 18:41:09 2014 +0000

    crypto: af_alg - properly label AF_ALG socket

    commit 4c63f83c2c2e16a13ce274ee678e28246bd33645 upstream.

    Th AF_ALG socket was missing a security label (e.g. SELinux)
    which means that socket was in "unlabeled" state.

    This was recently demonstrated in the cryptsetup package
    (cryptsetup v1.6.5 and later.)
    See https://bugzilla.redhat.com/show_bug.cgi?id=1115120

    This patch clones the sock's label from the parent sock
    and resolves the issue (similar to AF_BLUETOOTH protocol family).

    Signed-off-by: Milan Broz <gmazyland@gmail.com>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cedb4a53b0ac8504cf96633150507823a0a7b139
Merge: 19901b2 4abc766
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Aug 5 04:31:40 2014 -0700

    Merge "ASoC: msm: qdsp6v2: add support to enable TTY during VoLTE call"

commit 477f6548b24f3c05e4eb5d61d3dc0d775b63f4aa
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Mon Aug 4 14:33:35 2014 -0500

    d2: defconfig: Fix bcmdhd fw path

    Upon concating revision for bcmdhd, the bcmdhd driver appends the
    chip version to fw path. The current fw path can cause issues upon
    enablement due to setting the firmware path to:

        /system/etc/wifi/bcmdhd_sta.bin_b2_b2

    Change-Id: I664bd3e4594673c1fce91219d99df3821661274e
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit d7ba36a9aea0dac7e257395c2586ff62f970c367
Author: jt1134 <jt1134@gmail.com>
Date:   Sat Aug 2 15:03:39 2014 -0700

    expressatt: disable modules and compile prima into kernel image

    Change-Id: Ib3451601a4e773b6d3b0c8109a27396c567ce84e

commit 411b45359d1b97248eca5de9114548d910d4621b
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Jun 21 20:50:42 2012 -0700

    rcu: Stop rcu_do_batch() from multiplexing the "count" variable

    Commit b1420f1c (Make rcu_barrier() less disruptive) rearranged the
    code in rcu_do_batch(), moving the ->qlen manipulation to follow
    the requeueing of the callbacks.  Unfortunately, this rearrangement
    clobbered the value of the "count" local variable before the value
    of rdp->qlen was adjusted, resulting in the value of rdp->qlen being
    inaccurate.  This commit therefore introduces an index variable "i",
    avoiding the inadvertent multiplexing.

    CRs-fixed: 657837
    Change-Id: I1d7eab79a8e4105b407be87be3300129c32172ae
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Reviewed-by: Josh Triplett <josh@joshtriplett.org>
    Git-commit: b41772abebc27c61dd578b76da99aa5240b4c99a
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 16043dc0b04e173ee0b017f7b78dd8b18393e407
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Mon Jul 2 07:08:42 2012 -0700

    Revert "rcu: Move PREEMPT_RCU preemption to switch_to() invocation"

    This reverts commit 616c310e83b872024271c915c1b9ab505b9efad9.
    (Move PREEMPT_RCU preemption to switch_to() invocation).
    Testing by Sasha Levin <levinsasha928@gmail.com> showed that this
    can result in deadlock due to invoking the scheduler when one of
    the runqueue locks is held.  Because this commit was simply a
    performance optimization, revert it.

    CRs-fixed: 657837
    Change-Id: Idc7a560cf2d1696d8cd7d24c99747cdca227bcc2
    Reported-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Sasha Levin <levinsasha928@gmail.com>
    Git-commit: cba6d0d64ee53772b285d0c0c288deefbeaf7775
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 03fe9a10585dc12781e503aee4f4eb5c35a26fa4
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu May 10 16:41:44 2012 -0700

    rcu: Precompute RCU_FAST_NO_HZ timer offsets

    When a CPU is entering dyntick-idle mode, tick_nohz_stop_sched_tick()
    calls rcu_needs_cpu() see if RCU needs that CPU, and, if not, computes the
    next wakeup time based on the timer wheels.  Only later, when actually
    entering the idle loop, rcu_prepare_for_idle() will be invoked.  In some
    cases, rcu_prepare_for_idle() will post timers to wake the CPU back up.
    But all for naught: The next wakeup time for the CPU has already been
    computed, and posting a timer afterwards does not force that wakeup
    time to be recomputed.  This means that rcu_prepare_for_idle()'s have
    no effect.

    This is not a problem on a busy system because something else will wake
    up the CPU soon enough.  However, on lightly loaded systems, the CPU
    might stay asleep for a considerable length of time.  If that CPU has
    a callback that the rest of the system is waiting on, the system might
    run very slowly or (in theory) even hang.

    This commit avoids this problem by having rcu_needs_cpu() give
    tick_nohz_stop_sched_tick() an estimate of when RCU will need the CPU
    to wake back up, which tick_nohz_stop_sched_tick() takes into account
    when programming the CPU's wakeup time.  An alternative approach is
    for rcu_prepare_for_idle() to use hrtimers instead of normal timers,
    but timers are much more efficient than are hrtimers for frequently
    and repeatedly posting and cancelling a given timer, which is exactly
    what RCU_FAST_NO_HZ does.

    CRs-fixed: 657837
    Change-Id: I45c9163678240ca0b6fcac06b025d4cdb140907c
    Reported-by: Pascal Chapperon <pascal.chapperon@wanadoo.fr>
    Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Tested-by: Pascal Chapperon <pascal.chapperon@wanadoo.fr>
    Git-commit: aa9b16306e3243229580ff889cc59fd66bf77973
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 29bba8cb5f4e480e1e6c48aa822525b467802a2b
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Wed May 9 12:07:05 2012 -0700

    rcu: Move RCU_FAST_NO_HZ per-CPU variables to rcu_dynticks structure

    The RCU_FAST_NO_HZ code relies on a number of per-CPU variables.
    This works, but is hidden from someone scanning the data structures
    in rcutree.h.  This commit therefore converts these per-CPU variables
    to fields in the per-CPU rcu_dynticks structures.

    CRs-fixed: 657837
    Change-Id: I03e65c434b0156d4ab035421591aafb697ecd86b
    Suggested-by: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Tested-by: Pascal Chapperon <pascal.chapperon@wanadoo.fr>
    Git-commit: 5955f7eecd77d6b440db278b266cfecdb72ecd00
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit aecc686c542117a5acb79953d92c250f58179739
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Sat May 5 19:10:35 2012 -0700

    rcu: Update RCU_FAST_NO_HZ tracing for lazy callbacks

    In the current code, a short dyntick-idle interval (where there is
    at least one non-lazy callback on the CPU) and a long dyntick-idle
    interval (where there are only lazy callbacks on the CPU) are traced
    identically, which can be less than helpful.  This commit therefore
    emits different event traces in these two cases.

    CRs-fixed: 657837
    Change-Id: I0392bf0b9ffe3e319bdf54e7ff77f86ce5a8f212
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Tested-by: Pascal Chapperon <pascal.chapperon@wanadoo.fr>
    Git-commit: fd4b352687fd8604d49c190c4c9ea9e369fd42d5
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 1a0352409b9375c7ad7d04b3bf2bf5d1999f5b40
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Apr 26 10:52:27 2012 -0700

    timer: Fix mod_timer_pinned() header comment

    The mod_timer_pinned() header comment states that it prevents timers
    from being migrated to a different CPU.  This is not the case, instead,
    it ensures that the timer is posted to the current CPU, but does nothing
    to prevent CPU-hotplug operations from migrating the timer.

    This commit therefore brings the comment header into alignment with
    reality.

    CRs-fixed: 657837
    Change-Id: I244c4c385cd1c47df216feda7b580b2876fab723
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Acked-by: Steven Rostedt <rostedt@goodmis.org>
    Git-commit: 048a0e8f5e1d94c01a5fc70f5b2f2fd2f4527326
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit e6ca9894b9de586c3c401a56dda98f705fd924eb
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Mar 1 13:18:08 2012 -0800

    rcu: Make rcu_barrier() less disruptive

    The rcu_barrier() primitive interrupts each and every CPU, registering
    a callback on every CPU.  Once all of these callbacks have been invoked,
    rcu_barrier() knows that every callback that was registered before
    the call to rcu_barrier() has also been invoked.

    However, there is no point in registering a callback on a CPU that
    currently has no callbacks, most especially if that CPU is in a
    deep idle state.  This commit therefore makes rcu_barrier() avoid
    interrupting CPUs that have no callbacks.  Doing this requires reworking
    the handling of orphaned callbacks, otherwise callbacks could slip through
    rcu_barrier()'s net by being orphaned from a CPU that rcu_barrier() had
    not yet interrupted to a CPU that rcu_barrier() had already interrupted.
    This reworking was needed anyway to take a first step towards weaning
    RCU from the CPU_DYING notifier's use of stop_cpu().

    CRs-fixed: 657837
    Change-Id: Icb4392d9dc2cd25d9c9ea05b93ea9e2a99d24bcb
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: b1420f1c8bfc30ecf6380a31d0f686884834b599
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit ad99ff578f2c6d76a71beb47de554400d9cbc240
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu May 3 15:38:10 2012 -0700

    rcu: Explicitly initialize RCU_FAST_NO_HZ per-CPU variables

    The current initialization of the RCU_FAST_NO_HZ per-CPU variables makes
    needless and fragile assumptions about the initial value of things like
    the jiffies counter.  This commit therefore explicitly initializes all of
    them that are better started with a non-zero value.  It also adds some
    comments describing the per-CPU state variables.

    CRs-fixed: 657837
    Change-Id: Ia82aae8f5441a73be7e427f5fb74ec107144fa6e
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: 98248a0e24327bc64eb7518145c44bff7bebebc3
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit ca84f708990ee2714e57498f10b4778959cc1537
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Mon Apr 30 14:16:19 2012 -0700

    rcu: Make RCU_FAST_NO_HZ handle timer migration

    The current RCU_FAST_NO_HZ assumes that timers do not migrate unless a
    CPU goes offline, in which case it assumes that the CPU will have to come
    out of dyntick-idle mode (cancelling the timer) in order to go offline.
    This is important because when RCU_FAST_NO_HZ permits a CPU to enter
    dyntick-idle mode despite having RCU callbacks pending, it posts a timer
    on that CPU to force a wakeup on that CPU.  This wakeup ensures that the
    CPU will eventually handle the end of the grace period, including invoking
    its RCU callbacks.

    However, Pascal Chapperon's test setup shows that the timer handler
    rcu_idle_gp_timer_func() really does get invoked in some cases.  This is
    problematic because this can cause the CPU that entered dyntick-idle
    mode despite still having RCU callbacks pending to remain in
    dyntick-idle mode indefinitely, which means that its RCU callbacks might
    never be invoked.  This situation can result in grace-period delays or
    even system hangs, which matches Pascal's observations of slow boot-up
    and shutdown (https://lkml.org/lkml/2012/4/5/142).  See also the bugzilla:

    	https://bugzilla.redhat.com/show_bug.cgi?id=806548

    This commit therefore causes the "should never be invoked" timer handler
    rcu_idle_gp_timer_func() to use smp_call_function_single() to wake up
    the CPU for which the timer was intended, allowing that CPU to invoke
    its RCU callbacks in a timely manner.

    CRs-fixed: 657837
    Change-Id: I39cc0c8bf36d2e3aa9c136e3cd399ab939daad2d
    Reported-by: Pascal Chapperon <pascal.chapperon@wanadoo.fr>
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: 21e52e15666323078b8517a4312712579176b56f
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 4e9063e382b457fd6525e0f9a2a3b2e88a613668
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Fri Apr 13 12:54:22 2012 -0700

    rcu: Make exit_rcu() more precise and consolidate

    When running preemptible RCU, if a task exits in an RCU read-side
    critical section having blocked within that same RCU read-side critical
    section, the task must be removed from the list of tasks blocking a
    grace period (perhaps the current grace period, perhaps the next grace
    period, depending on timing).  The exit() path invokes exit_rcu() to
    do this cleanup.

    However, the current implementation of exit_rcu() needlessly does the
    cleanup even if the task did not block within the current RCU read-side
    critical section, which wastes time and needlessly increases the size
    of the state space.  Fix this by only doing the cleanup if the current
    task is actually on the list of tasks blocking some grace period.

    While we are at it, consolidate the two identical exit_rcu() functions
    into a single function.

    CRs-fixed: 657837
    Change-Id: I59504aedb12064fcd6ce03973d441b547749076a
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Git-commit: 9dd8fb16c36178df2066387d2abd44d8b4dca8c8
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [rggupt@codeaurora.org: resolve trivial merge conflicts]
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

    Conflicts:
    	kernel/rcupdate.c

commit efc9c3ad9036b63baf2556e46a32f7a2a771e9f8
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Tue Mar 27 16:02:08 2012 -0700

    rcu: Move PREEMPT_RCU preemption to switch_to() invocation

    Currently, PREEMPT_RCU readers are enqueued upon entry to the scheduler.
    This is inefficient because enqueuing is required only if there is a
    context switch, and entry to the scheduler does not guarantee a context
    switch.

    The commit therefore moves the enqueuing to immediately precede the
    call to switch_to() from the scheduler.

    CRs-fixed: 657837
    Change-Id: I7d824196483cafb82371b978f3d995a3ab1696a0
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Git-commit: 616c310e83b872024271c915c1b9ab505b9efad9
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit de89027b4da169671e7de29b76e98d21235a2ffd
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Mar 15 12:16:26 2012 -0700

    rcu: Ensure that RCU_FAST_NO_HZ timers expire on correct CPU

    Timers are subject to migration, which can lead to the following
    system-hang scenario when CONFIG_RCU_FAST_NO_HZ=y:

    1.	CPU 0 executes synchronize_rcu(), which posts an RCU callback.

    2.	CPU 0 then goes idle.  It cannot immediately invoke the callback,
    	but there is nothing RCU needs from ti, so it enters dyntick-idle
    	mode after posting a timer.

    3.	The timer gets migrated to CPU 1.

    4.	CPU 0 never wakes up, so the synchronize_rcu() never returns, so
    	the system hangs.

    This commit fixes this problem by using mod_timer_pinned(), as suggested
    by Peter Zijlstra, to ensure that the timer is actually posted on the
    running CPU.

    CRs-fixed: 657837
    Change-Id: Id4b3d586dc08db9b9a80739c3a05163b3be69e72
    Reported-by: Dipankar Sarma <dipankar@in.ibm.com>
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: f511fc624642f0bb8cf65aaa28979737514d4746
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 225e491bd845382e5889830d7c4ff8c15cf2810b
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Mon Apr 23 10:06:39 2012 -0700

    rcu: Add warning for RCU_FAST_NO_HZ timer firing

    RCU_FAST_NO_HZ uses a timer to limit the time that a CPU with callbacks
    can remain in dyntick-idle mode.  This timer is cancelled when the CPU
    exits idle, and therefore should never fire.  However, if the timer
    were migrated to some other CPU for whatever reason (1) the timer could
    actually fire and (2) firing on some other CPU would fail to wake up the
    CPU with callbacks, possibly resulting in sluggishness or a system hang.

    This commit therfore adds a WARN_ON_ONCE() to the timer handler in order
    to detect this condition.

    CRs-fixed: 657837
    Change-Id: Ie667bd7ee157668b2f0fca7eaf67cb746be1d674
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: 79b9a75fb703b6a2670e46b9dc495af5bc7029b3
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 994396487bd7567290a31bf32f95fc6a278063b4
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Tue Feb 28 11:02:21 2012 -0800

    rcu: Make RCU_FAST_NO_HZ account for pauses out of idle

    Both Steven Rostedt's new idle-capable trace macros and the RCU_NONIDLE()
    macro can cause RCU to momentarily pause out of idle without the rest
    of the system being involved.  This can cause rcu_prepare_for_idle()
    to run through its state machine too quickly, which can in turn result
    in needless scheduling-clock interrupts.

    This commit therefore adds code to enable rcu_prepare_for_idle() to
    distinguish between an initial entry to idle on the one hand (which needs
    to advance the rcu_prepare_for_idle() state machine) and an idle reentry
    due to idle-capable trace macros and RCU_NONIDLE() on the other hand
    (which should avoid advancing the rcu_prepare_for_idle() state machine).
    Additional state is maintained to allow the timer to be correctly reposted
    when returning after a momentary pause out of idle, and even more state
    is maintained to detect when new non-lazy callbacks have been enqueued
    (which may require re-evaluation of the approach to idleness).

    CRs-fixed: 657837
    Change-Id: I7c5ef8183d42982876a50b500da080f15c61b848
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: c57afe80db4e169135eb675acc2d241e26cc064e
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit 38121e3e4d0ba5794d2ec21203a4c52fffe54a5e
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Feb 23 17:13:19 2012 -0800

    rcu: Make RCU_FAST_NO_HZ use timer rather than hrtimer

    The RCU_FAST_NO_HZ facility uses an hrtimer to wake up a CPU when
    it is allowed to go into dyntick-idle mode, which is almost always
    cancelled soon after.  This is not what hrtimers are good at, so
    this commit switches to the timer wheel.

    CRs-fixed: 657837
    Change-Id: Ic528055544c929251f239c729c221cfcee539cfa
    Reported-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: 2ee3dc80660ac8285a37e662fd91b2e45c46f06a
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit fa82ab19fa34b61e30278df09df0a0b8e53d11cf
Author: Paul E. McKenney <paul.mckenney@linaro.org>
Date:   Thu Feb 23 15:58:29 2012 -0800

    rcu: Add RCU_FAST_NO_HZ tracing for idle exit

    Traces of rcu_prep_idle events can be confusing because
    rcu_cleanup_after_idle() does no tracing.  This commit therefore adds
    this tracing.

    CRs-fixed: 657837
    Change-Id: I8ce6251d06e25f3ff26fe016aae456a33c40a466
    Signed-off-by: Paul E. McKenney <paul.mckenney@linaro.org>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Git-commit: 2fdbb31b662787f78bb78b3e4e18f1a072058ffc
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Ramesh Gupta Guntha <rggupt@codeaurora.org>

commit c201ba589e918b7edb49efff5868664bc2714aa8
Merge: f7d6043 f496d6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Aug 1 08:49:21 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.04.007.065 on remote branch"

commit 19901b2c1a54d1c20de019fdb0b2633c1328949d
Merge: afdd667 313d974
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Aug 1 07:28:37 2014 -0700

    Merge "msm: kgsl: Force the ME off before reading the microcode"

commit afdd667e07fd08b77d1abd57cd31574d7fcf0f5b
Merge: 1f5f936 31dd557
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Aug 1 07:28:37 2014 -0700

    Merge "msm: kgsl: Increase the timeout value for fault detection"

commit f496d6f44ab11604dd31e6413a985fdd76e36a96
Merge: f7d6043 5bfc8718
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Aug 1 07:38:19 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.04.007.065 on remote branch

    Change-Id: I0397dd597c03ed6e6e230dfb0291cebaa42ed540

commit 36199189085507355db36ca5a5296a437d7ee055
Merge: 3407591 7e561db
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Fri Aug 1 04:07:20 2014 +0000

    Merge "Revert "crypto: msm: add suspend/resume callback for qcedev driver"" into cm-11.0

commit 34075919bd57b65af2dba47897425e61d10852a4
Merge: fa30745 91f7c8c
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Thu Jul 31 22:49:08 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit 91f7c8cbc8fd1a4ef69005347e4bc30016cd60ec
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jul 31 14:56:22 2014 -0700

    Linux 3.4.101

commit 7e561db94a00e9432fde3304eaa825908b03de91
Author: jt1134 <jt1134@gmail.com>
Date:   Thu Jul 31 11:52:29 2014 -0700

    Revert "crypto: msm: add suspend/resume callback for qcedev driver"

    This reverts commit 9ccca3beb1f21c0cd8cbeb3f98770c7be9bb469b.

    This commit is incomplete and breaks qcedev module compile. This
    snowballs and breaks all modules, breaking wifi on apex and express.

    Change-Id: I68605bf9e8a8149f85531ed19ca2517b5eb79d0c

commit 7e2e611849fa3786431f86411346ecb70c3f4283
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Tue Nov 12 15:07:45 2013 -0800

    mm: kmemleak: avoid false negatives on vmalloc'ed objects

    commit 7f88f88f83ed609650a01b18572e605ea50cd163 upstream.

    Commit 248ac0e1943a ("mm/vmalloc: remove guard page from between vmap
    blocks") had the side effect of making vmap_area.va_end member point to
    the next vmap_area.va_start.  This was creating an artificial reference
    to vmalloc'ed objects and kmemleak was rarely reporting vmalloc() leaks.

    This patch marks the vmap_area containing pointers explicitly and
    reduces the min ref_count to 2 as vm_struct still contains a reference
    to the vmalloc'ed object.  The kmemleak add_scan_area() function has
    been improved to allow a SIZE_MAX argument covering the rest of the
    object (for simpler calling sites).

    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [hq: Backported to 3.4: Adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b06b5c6204bdc7c571feedb6b16188ba62feb9a6
Author: Xi Wang <xi.wang@gmail.com>
Date:   Thu May 31 16:26:04 2012 -0700

    introduce SIZE_MAX

    commit a3860c1c5dd1137db23d7786d284939c5761d517 upstream.

    ULONG_MAX is often used to check for integer overflow when calculating
    allocation size.  While ULONG_MAX happens to work on most systems, there
    is no guarantee that `size_t' must be the same size as `long'.

    This patch introduces SIZE_MAX, the maximum value of `size_t', to improve
    portability and readability for allocation size validation.

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Acked-by: Alex Elder <elder@dreamhost.com>
    Cc: David Airlie <airlied@linux.ie>
    Cc: Pekka Enberg <penberg@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 883ea134ae75eb03c9f08553a81957a808cee96b
Author: Martin Schwidefsky <schwidefsky@de.ibm.com>
Date:   Mon Jun 23 15:29:40 2014 +0200

    s390/ptrace: fix PSW mask check

    commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream.

    The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect.
    The PSW_MASK_USER define contains the PSW_MASK_ASC bits, the ptrace
    interface accepts all combinations for the address-space-control
    bits. To protect the kernel space the PSW mask check in ptrace needs
    to reject the address-space-control bit combination for home space.

    Fixes CVE-2014-3534

    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5c662d1f7ced868472bdf3abb4215202c0e467f
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Jul 26 14:52:01 2014 -0700

    Fix gcc-4.9.0 miscompilation of load_balance() in scheduler

    commit 2062afb4f804afef61cbe62a30cac9a46e58e067 upstream.

    Michel Dänzer and a couple of other people reported inexplicable random
    oopses in the scheduler, and the cause turns out to be gcc mis-compiling
    the load_balance() function when debugging is enabled.  The gcc bug
    apparently goes back to gcc-4.5, but slight optimization changes means
    that it now showed up as a problem in 4.9.0 and 4.9.1.

    The instruction scheduling problem causes gcc to schedule a spill
    operation to before the stack frame has been created, which in turn can
    corrupt the spilled value if an interrupt comes in.  There may be other
    effects of this bug too, but that's the code generation problem seen in
    Michel's case.

    This is fixed in current gcc HEAD, but the workaround as suggested by
    Markus Trippelsdorf is pretty simple: use -fno-var-tracking-assignments
    when compiling the kernel, which disables the gcc code that causes the
    problem.  This can result in slightly worse debug information for
    variable accesses, but that is infinitely preferable to actual code
    generation problems.

    Doing this unconditionally (not just for CONFIG_DEBUG_INFO) also allows
    non-debug builds to verify that the debug build would be identical: we
    can do

        export GCC_COMPARE_DEBUG=1

    to make gcc internally verify that the result of the build is
    independent of the "-g" flag (it will make the compiler build everything
    twice, toggling the debug flag, and compare the results).

    Without the "-fno-var-tracking-assignments" option, the build would fail
    (even with 4.8.3 that didn't show the actual stack frame bug) with a gcc
    compare failure.

    See also gcc bugzilla:

      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61801

    Reported-by: Michel Dänzer <michel@daenzer.net>
    Suggested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 97f5dabba097a693e3e79d235b549db5de701f0f
Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date:   Wed Jul 23 14:00:19 2014 -0700

    mm: hugetlb: fix copy_hugetlb_page_range()

    commit 0253d634e0803a8376a0d88efee0bf523d8673f9 upstream.

    Commit 4a705fef9862 ("hugetlb: fix copy_hugetlb_page_range() to handle
    migration/hwpoisoned entry") changed the order of
    huge_ptep_set_wrprotect() and huge_ptep_get(), which leads to breakage
    in some workloads like hugepage-backed heap allocation via libhugetlbfs.
    This patch fixes it.

    The test program for the problem is shown below:

      $ cat heap.c
      #include <unistd.h>
      #include <stdlib.h>
      #include <string.h>

      #define HPS 0x200000

      int main() {
      	int i;
      	char *p = malloc(HPS);
      	memset(p, '1', HPS);
      	for (i = 0; i < 5; i++) {
      		if (!fork()) {
      			memset(p, '2', HPS);
      			p = malloc(HPS);
      			memset(p, '3', HPS);
      			free(p);
      			return 0;
      		}
      	}
      	sleep(1);
      	free(p);
      	return 0;
      }

      $ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./heap

    Fixes 4a705fef9862 ("hugetlb: fix copy_hugetlb_page_range() to handle
    migration/hwpoisoned entry"), so is applicable to -stable kernels which
    include it.

    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Reported-by: Guillaume Morin <guillaume@morinfr.org>
    Suggested-by: Guillaume Morin <guillaume@morinfr.org>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4aedd4b0545222fed4bb7318fc144025eda8e119
Author: Sven Wegener <sven.wegener@stealer.net>
Date:   Tue Jul 22 10:26:06 2014 +0200

    x86_32, entry: Store badsys error code in %eax

    commit 8142b215501f8b291a108a202b3a053a265b03dd upstream.

    Commit 554086d ("x86_32, entry: Do syscall exit work on badsys
    (CVE-2014-4508)") introduced a regression in the x86_32 syscall entry
    code, resulting in syscall() not returning proper errors for undefined
    syscalls on CPUs supporting the sysenter feature.

    The following code:

    > int result = syscall(666);
    > printf("result=%d errno=%d error=%s\n", result, errno, strerror(errno));

    results in:

    > result=666 errno=0 error=Success

    Obviously, the syscall return value is the called syscall number, but it
    should have been an ENOSYS error. When run under ptrace it behaves
    correctly, which makes it hard to debug in the wild:

    > result=-1 errno=38 error=Function not implemented

    The %eax register is the return value register. For debugging via ptrace
    the syscall entry code stores the complete register context on the
    stack. The badsys handlers only store the ENOSYS error code in the
    ptrace register set and do not set %eax like a regular syscall handler
    would. The old resume_userspace call chain contains code that clobbers
    %eax and it restores %eax from the ptrace registers afterwards. The same
    goes for the ptrace-enabled call chain. When ptrace is not used, the
    syscall return value is the passed-in syscall number from the untouched
    %eax register.

    Use %eax as the return value register in syscall_badsys and
    sysenter_badsys, like a real syscall handler does, and have the caller
    push the value onto the stack for ptrace access.

    Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
    Link: http://lkml.kernel.org/r/alpine.LNX.2.11.1407221022380.31021@titan.int.lan.stealer.net
    Reviewed-and-tested-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 46005527d70f86028b688ff48d1bde86313dcf78
Author: Romain Degez <romain.degez@gmail.com>
Date:   Fri Jul 11 18:08:13 2014 +0200

    ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode)

    commit b32bfc06aefab61acc872dec3222624e6cd867ed upstream.

    Add support of the Promise FastTrak TX8660 SATA HBA in ahci mode by
    registering the board in the ahci_pci_tbl[].

    Note: this HBA also provide a hardware RAID mode when activated in
    BIOS but specific drivers from the manufacturer are required in this
    case.

    Signed-off-by: Romain Degez <romain.degez@gmail.com>
    Tested-by: Romain Degez <romain.degez@gmail.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80cd492c4ed16b106113c60a004171e858aff88a
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Jul 23 09:05:27 2014 -0400

    libata: introduce ata_host->n_tags to avoid oops on SAS controllers

    commit 1a112d10f03e83fb3a2fdc4c9165865dec8a3ca6 upstream.

    1871ee134b73 ("libata: support the ata host which implements a queue
    depth less than 32") directly used ata_port->scsi_host->can_queue from
    ata_qc_new() to determine the number of tags supported by the host;
    unfortunately, SAS controllers doing SATA don't initialize ->scsi_host
    leading to the following oops.

     BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
     IP: [<ffffffff814e0618>] ata_qc_new_init+0x188/0x1b0
     PGD 0
     Oops: 0002 [#1] SMP
     Modules linked in: isci libsas scsi_transport_sas mgag200 drm_kms_helper ttm
     CPU: 1 PID: 518 Comm: udevd Not tainted 3.16.0-rc6+ #62
     Hardware name: Intel Corporation S2600CO/S2600CO, BIOS SE5C600.86B.02.02.0002.122320131210 12/23/2013
     task: ffff880c1a00b280 ti: ffff88061a000000 task.ti: ffff88061a000000
     RIP: 0010:[<ffffffff814e0618>]  [<ffffffff814e0618>] ata_qc_new_init+0x188/0x1b0
     RSP: 0018:ffff88061a003ae8  EFLAGS: 00010012
     RAX: 0000000000000001 RBX: ffff88000241ca80 RCX: 00000000000000fa
     RDX: 0000000000000020 RSI: 0000000000000020 RDI: ffff8806194aa298
     RBP: ffff88061a003ae8 R08: ffff8806194a8000 R09: 0000000000000000
     R10: 0000000000000000 R11: ffff88000241ca80 R12: ffff88061ad58200
     R13: ffff8806194aa298 R14: ffffffff814e67a0 R15: ffff8806194a8000
     FS:  00007f3ad7fe3840(0000) GS:ffff880627620000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000058 CR3: 000000061a118000 CR4: 00000000001407e0
     Stack:
      ffff88061a003b20 ffffffff814e96e1 ffff88000241ca80 ffff88061ad58200
      ffff8800b6bf6000 ffff880c1c988000 ffff880619903850 ffff88061a003b68
      ffffffffa0056ce1 ffff88061a003b48 0000000013d6e6f8 ffff88000241ca80
     Call Trace:
      [<ffffffff814e96e1>] ata_sas_queuecmd+0xa1/0x430
      [<ffffffffa0056ce1>] sas_queuecommand+0x191/0x220 [libsas]
      [<ffffffff8149afee>] scsi_dispatch_cmd+0x10e/0x300 [<ffffffff814a3bc5>] scsi_request_fn+0x2f5/0x550
      [<ffffffff81317613>] __blk_run_queue+0x33/0x40
      [<ffffffff8131781a>] queue_unplugged+0x2a/0x90
      [<ffffffff8131ceb4>] blk_flush_plug_list+0x1b4/0x210
      [<ffffffff8131d274>] blk_finish_plug+0x14/0x50
      [<ffffffff8117eaa8>] __do_page_cache_readahead+0x198/0x1f0
      [<ffffffff8117ee21>] force_page_cache_readahead+0x31/0x50
      [<ffffffff8117ee7e>] page_cache_sync_readahead+0x3e/0x50
      [<ffffffff81172ac6>] generic_file_read_iter+0x496/0x5a0
      [<ffffffff81219897>] blkdev_read_iter+0x37/0x40
      [<ffffffff811e307e>] new_sync_read+0x7e/0xb0
      [<ffffffff811e3734>] vfs_read+0x94/0x170
      [<ffffffff811e43c6>] SyS_read+0x46/0xb0
      [<ffffffff811e33d1>] ? SyS_lseek+0x91/0xb0
      [<ffffffff8171ee29>] system_call_fastpath+0x16/0x1b
     Code: 00 00 00 88 50 29 83 7f 08 01 19 d2 83 e2 f0 83 ea 50 88 50 34 c6 81 1d 02 00 00 40 c6 81 17 02 00 00 00 5d c3 66 0f 1f 44 00 00 <89> 14 25 58 00 00 00

    Fix it by introducing ata_host->n_tags which is initialized to
    ATA_MAX_QUEUE - 1 in ata_host_init() for SAS controllers and set to
    scsi_host_template->can_queue in ata_host_register() for !SAS ones.
    As SAS hosts are never registered, this will give them the same
    ATA_MAX_QUEUE - 1 as before.  Note that we can't use
    scsi_host->can_queue directly for SAS hosts anyway as they can go
    higher than the libata maximum.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Mike Qiu <qiudayu@linux.vnet.ibm.com>
    Reported-by: Jesse Brandeburg <jesse.brandeburg@gmail.com>
    Reported-by: Peter Hurley <peter@hurleysoftware.com>
    Reported-by: Peter Zijlstra <peterz@infradead.org>
    Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
    Fixes: 1871ee134b73 ("libata: support the ata host which implements a queue depth less than 32")
    Cc: Kevin Hao <haokexin@gmail.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6f0844c44da00772a8ab116fe8bb8549517a8859
Author: Kevin Hao <haokexin@gmail.com>
Date:   Sat Jul 12 12:08:24 2014 +0800

    libata: support the ata host which implements a queue depth less than 32

    commit 1871ee134b73fb4cadab75752a7152ed2813c751 upstream.

    The sata on fsl mpc8315e is broken after the commit 8a4aeec8d2d6
    ("libata/ahci: accommodate tag ordered controllers"). The reason is
    that the ata controller on this SoC only implement a queue depth of
    16. When issuing the commands in tag order, all the commands in tag
    16 ~ 31 are mapped to tag 0 unconditionally and then causes the sata
    malfunction. It makes no senses to use a 32 queue in software while
    the hardware has less queue depth. So consider the queue depth
    implemented by the hardware when requesting a command tag.

    Fixes: 8a4aeec8d2d6 ("libata/ahci: accommodate tag ordered controllers")
    Signed-off-by: Kevin Hao <haokexin@gmail.com>
    Acked-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 696acd9dc0b30f29ed9732b237c4670034e91863
Author: Christoph Hellwig <hch@lst.de>
Date:   Tue Jul 8 12:25:28 2014 +0200

    block: don't assume last put of shared tags is for the host

    commit d45b3279a5a2252cafcd665bbf2db8c9b31ef783 upstream.

    There is no inherent reason why the last put of a tag structure must be
    the one for the Scsi_Host, as device model objects can be held for
    arbitrary periods.  Merge blk_free_tags and __blk_free_tags into a single
    funtion that just release a references and get rid of the BUG() when the
    host reference wasn't the last.

    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 313d974c89ee2cb93987353f39d66401057b7523
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Tue Jan 14 10:02:01 2014 -0700

    msm: kgsl: Force the ME off before reading the microcode

    On A3XX reading the microcode while the CP is running is dangerous
    beyond words.  By setting the offset address for the read, we are
    essentially changing the instruction pointer for the ME while it
    is running causing opcode errors, gpu faults and/or system errors.

    We do not want to stop the CP at the beginning of the snapshot
    process beacuse doing so changes the RBBM status and the state of
    the CP registers which may damage the debug effort.  But by the
    time we get to the microcode read we no longer care about the state
    of the registers so we can freely halt the ME just before starting
    the read.

    Conflicts:
    	drivers/gpu/msm/adreno_a3xx_snapshot.c

    Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit 31dd557cdf82dd43358be10a0dcfe29184fdda7d
Author: Shubhraprakash Das <sadas@codeaurora.org>
Date:   Wed Mar 26 16:06:29 2014 -0700

    msm: kgsl: Increase the timeout value for fault detection

    Increment the timeout value for detecting faults from 50ms to
    200ms. The fault detection mechanism is a backup to hardware
    fault detection. 50ms is small since it has been observed that
    this mechanism triggers false positives with 50ms.

    CRs-Fixed: 672164
    Change-Id: I8f382051e06bdc47f152309a2868092e1980604e
    Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
    Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit fa3074586ab500cca87b319574b4456bcc7c707d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jul 3 21:48:20 2014 -0400

    d2 and friends: enable ARM optimized AES and SHA1

    Change-Id: I582f918646548d6e9ec309587b8492e3d62d2732

    Conflicts:
    	arch/arm/configs/cyanogen_d2_defconfig

commit b42d3458f8dfd3318be5f1ed463908c6ff2066c4
Author: David McCullough <david_mccullough@mcafee.com>
Date:   Fri Sep 7 04:17:02 2012 +0800

    arm/crypto: Add optimized AES and SHA1 routines

    Add assembler versions of AES and SHA1 for ARM platforms.  This has provided
    up to a 50% improvement in IPsec/TCP throughout for tunnels using AES128/SHA1.

    Platform   CPU SPeed    Endian   Before (bps)   After (bps)   Improvement

    IXP425      533 MHz      big     11217042        15566294        ~38%
    KS8695      166 MHz     little    3828549         5795373        ~51%

    Signed-off-by: David McCullough <ucdevel@gmail.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit b600bcccb7c3ec6e3061c68167f7aad8e121926a
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jul 3 17:58:04 2014 -0400

    apexq: update sensor config

    Change-Id: I3e76c881a9d7a269f04d3f9c0287e67f4b825f5b

commit 95e35a0db0a21ab284df0d21ea263112d8b98f4b
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Jun 11 21:19:05 2014 -0500

    inv_mpu: Makefile/Kconfig: Fix up & simplify some configs

    Seems Samsung might have derp'd a few config-related changes.
    This allows for proper usage of the MPU_SENSORS_MPU6050_GYRO config
    and makes selftest parts optional.

    Fixes:
      drivers/misc/inv_mpu/Kconfig:52:warning: defaults for choice values not supported

    Change-Id: I80c476c3e8723403a580c9d25ecfe38bc84ddb3b
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 6ef59c41dc20d5128157fd6091fd76df78fc4c14
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:52:19 2012 +0200

    PM / Sleep: Look for wakeup events in later stages of device suspend

    Currently, the device suspend code in drivers/base/power/main.c
    only checks if there have been any wakeup events, and therefore the
    ongoing system transition to a sleep state should be aborted, during
    the first (i.e. "suspend") device suspend phase.  However, wakeup
    events may be reported later as well, so it's reasonable to look for
    them in the in the subsequent (i.e. "late suspend" and "suspend
    noirq") phases.

    Change-Id: Idc55bb84fd820c4f0b5e037186fb337daa612fb4
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Git-commit: 52d136cc2cf6659ee247dbcc88c9e7bd7428ad06
    Git-repo: git://codeaurora.org/kernel/msm.git
    Signed-off-by: Anurag Singh <anursing@codeaurora.org>

commit ada47184f639bd45ea1f1ef93e1f83ee5aa7baef
Author: Deva Ramasubramanian <dramasub@codeaurora.org>
Date:   Wed Apr 3 15:36:12 2013 -0700

    switch: Reset device's drvdata before destroying it

    dev_set_drvdata() sets the device specific driver data at
    dev->p->driver_data.  However, dev is destroyed and has it's
    context memory freed in device_destroy().  As a result, calling
    dev_set_drvdata() causes a fault when accessing dev->p.

    Change-Id: Id6cc72e1c635d6c4e69db3404bf57ebbab35d464
    Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>

commit e259c230b895391a2827db63d59cd5bd053c30c6
Author: Manu Gautam <mgautam@codeaurora.org>
Date:   Thu May 23 12:16:01 2013 +0530

    USB: ci13xxx_udc: Reduce busywait time from 100msec to 25msec

    Commit 037476 "lib: spinlock_debug: Avoid livelock in
    do_raw_spin_lock" reduced timeout value in spin_try_lock from
    1sec to 62msec. Once this timeout happens, system would then
    crash detecting spinlock lockup.
    USB driver is currently using 100msec as timeout during busywait
    loops with spinlock acquired. It may result in above spin lockup
    crash whenever timeout happens due to some hardware issue.
    Fix this by reducing timeout to 25msec as confirmed by h/w team.

    CRs-Fixed: 487591
    Change-Id: Idadcbe4b21fea456256586657ef07dfcb578f5c1
    Signed-off-by: Manu Gautam <mgautam@codeaurora.org>

commit e966503a2d25d9faee49865375b70b91b16b366d
Author: Vikram Mulukutla <markivx@codeaurora.org>
Date:   Thu Aug 2 13:18:15 2012 -0700

    lib: spinlock_debug: Avoid livelock in do_raw_spin_lock

    The logic in do_raw_spin_lock attempts to acquire a spinlock
    by invoking arch_spin_trylock in a loop with a delay between
    each attempt. Now consider the following situation in a 2
    CPU system:

    1. Cpu 0 continually acquires and releases a spinlock in a
       tight loop; it stays in this loop until some condition X
       is satisfied. X can only be satisfied by another CPU.

    2. Cpu 1 tries to acquire the same spinlock, in an attempt
       to satisfy the aforementioned condition X. However, it
       never sees the unlocked value of the lock because the
       debug spinlock code uses trylock instead of just lock;
       it checks at all the wrong moments - whenever Cpu 0 has
       locked the lock.

    Now in the absence of debug spinlocks, the architecture specific
    spinlock code can correctly allow Cpu1 to wait in a "queue"
    (e.g., ticket spinlocks), ensuring that it acquires the lock at
    some point. However, with the debug spinlock code, livelock
    can easily occur due to the use of try_lock, which obviously
    cannot put the CPU in that "queue".

    Address this by actually attempting arch_spin_lock once it is
    suspected that there is a spinlock lockup. If we're in a
    situation that is described above, the arch_spin_lock should
    succeed; otherwise other timeout mechanisms (e.g., watchdog)
    should alert the system of a lockup.

    Additionally, the delay between each trylock attempt adds up
    to a total delay of 1 second. On some embedded architectures,
    this is an unacceptably large value. Reduce this to a ~62 ms
    delay.

    CRs-Fixed: 393351
    Change-Id: I56f0d8f5e483cd7e8167fc7a363b9de7777a0830
    Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

commit c1d02510e76eb862f8050c9fc66706f421497736
Author: Ashwin <ashwin.bhat@broadcom.com>
Date:   Tue Jul 22 18:04:46 2014 -0700

    net: wireless: bcmdhd: Add support for hidden ssid PNO scan

    Changes to support hidden ssid config to be sent to FW. Earlier
    all ssids were hard coded as hidden, now only those indicated
    as such by supplicant will be.

    Conflicts:
    	drivers/net/wireless/bcmdhd/dhd_pno.c
    	drivers/net/wireless/bcmdhd/include/wlioctl.h
    	drivers/net/wireless/bcmdhd/wl_android.c
    	drivers/net/wireless/bcmdhd/wl_cfg80211.c

    Change-Id: I927030fe12f162c52c93277b2ebfb4bf55daef4a
    Signed-off-by: Ashwin <ashwin.bhat@broadcom.com>

commit b60d3ad249fac64d9b390907a181ea58aae98bc0
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:52:19 2012 +0200

    PM / Sleep: Look for wakeup events in later stages of device suspend

    Currently, the device suspend code in drivers/base/power/main.c
    only checks if there have been any wakeup events, and therefore the
    ongoing system transition to a sleep state should be aborted, during
    the first (i.e. "suspend") device suspend phase.  However, wakeup
    events may be reported later as well, so it's reasonable to look for
    them in the in the subsequent (i.e. "late suspend" and "suspend
    noirq") phases.

    Change-Id: Idc55bb84fd820c4f0b5e037186fb337daa612fb4
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Git-commit: 52d136cc2cf6659ee247dbcc88c9e7bd7428ad06
    Git-repo: git://codeaurora.org/kernel/msm.git
    Signed-off-by: Anurag Singh <anursing@codeaurora.org>

commit 1df25cf3519f3efb7fc93d7db62b7b611cd85d00
Author: Deva Ramasubramanian <dramasub@codeaurora.org>
Date:   Wed Apr 3 15:36:12 2013 -0700

    switch: Reset device's drvdata before destroying it

    dev_set_drvdata() sets the device specific driver data at
    dev->p->driver_data.  However, dev is destroyed and has it's
    context memory freed in device_destroy().  As a result, calling
    dev_set_drvdata() causes a fault when accessing dev->p.

    Change-Id: Id6cc72e1c635d6c4e69db3404bf57ebbab35d464
    Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>

commit 2be83ca6dd1627d6012617f633bf92873c729356
Author: Manu Gautam <mgautam@codeaurora.org>
Date:   Thu May 23 12:16:01 2013 +0530

    USB: ci13xxx_udc: Reduce busywait time from 100msec to 25msec

    Commit 037476 "lib: spinlock_debug: Avoid livelock in
    do_raw_spin_lock" reduced timeout value in spin_try_lock from
    1sec to 62msec. Once this timeout happens, system would then
    crash detecting spinlock lockup.
    USB driver is currently using 100msec as timeout during busywait
    loops with spinlock acquired. It may result in above spin lockup
    crash whenever timeout happens due to some hardware issue.
    Fix this by reducing timeout to 25msec as confirmed by h/w team.

    CRs-Fixed: 487591
    Change-Id: Idadcbe4b21fea456256586657ef07dfcb578f5c1
    Signed-off-by: Manu Gautam <mgautam@codeaurora.org>

commit 2a2651a996088b6807fdea9e38ce010f0f68c4f4
Author: Vikram Mulukutla <markivx@codeaurora.org>
Date:   Thu Aug 2 13:18:15 2012 -0700

    lib: spinlock_debug: Avoid livelock in do_raw_spin_lock

    The logic in do_raw_spin_lock attempts to acquire a spinlock
    by invoking arch_spin_trylock in a loop with a delay between
    each attempt. Now consider the following situation in a 2
    CPU system:

    1. Cpu 0 continually acquires and releases a spinlock in a
       tight loop; it stays in this loop until some condition X
       is satisfied. X can only be satisfied by another CPU.

    2. Cpu 1 tries to acquire the same spinlock, in an attempt
       to satisfy the aforementioned condition X. However, it
       never sees the unlocked value of the lock because the
       debug spinlock code uses trylock instead of just lock;
       it checks at all the wrong moments - whenever Cpu 0 has
       locked the lock.

    Now in the absence of debug spinlocks, the architecture specific
    spinlock code can correctly allow Cpu1 to wait in a "queue"
    (e.g., ticket spinlocks), ensuring that it acquires the lock at
    some point. However, with the debug spinlock code, livelock
    can easily occur due to the use of try_lock, which obviously
    cannot put the CPU in that "queue".

    Address this by actually attempting arch_spin_lock once it is
    suspected that there is a spinlock lockup. If we're in a
    situation that is described above, the arch_spin_lock should
    succeed; otherwise other timeout mechanisms (e.g., watchdog)
    should alert the system of a lockup.

    Additionally, the delay between each trylock attempt adds up
    to a total delay of 1 second. On some embedded architectures,
    this is an unacceptably large value. Reduce this to a ~62 ms
    delay.

    CRs-Fixed: 393351
    Change-Id: I56f0d8f5e483cd7e8167fc7a363b9de7777a0830
    Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

commit fba3b9a9381bfde18ea92f537e27d9b705c89b85
Merge: 217a973 82f9c4a
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jul 28 22:08:07 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Change-Id: I9865b46774a419850183db1f378a0ff83c25a1fe

commit 217a9737a324fbd0f7069077c263c38f62e924d0
Author: John Stultz <john.stultz@linaro.org>
Date:   Mon Jul 7 14:06:11 2014 -0700

    alarmtimer: Fix bug where relative alarm timers were treated as absolute

    Sharvil noticed with the posix timer_settime interface, using the
    CLOCK_REALTIME_ALARM or CLOCK_BOOTTIME_ALARM clockid, if the users
    tried to specify a relative time timer, it would incorrectly be
    treated as absolute regardless of the state of the flags argument.

    This patch corrects this, properly checking the absolute/relative flag,
    as well as adds further error checking that no invalid flag bits are set.

    Reported-by: Sharvil Nanavati <sharvil@google.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Prarit Bhargava <prarit@redhat.com>
    Cc: Sharvil Nanavati <sharvil@google.com>
    Cc: stable <stable@vger.kernel.org> #3.0+
    Link: http://lkml.kernel.org/r/1404767171-6902-1-git-send-email-john.stultz@linaro.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit 82f9c4a309835df86bddcb3051e392fccfb57fcf
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Jul 28 07:07:01 2014 -0700

    Linux 3.4.100

commit 21870a3ce73bc351e2e3adffdea863e681556f2d
Author: Takao Indoh <indou.takao@jp.fujitsu.com>
Date:   Tue Apr 23 17:35:03 2013 +0900

    iommu/vt-d: Disable translation if already enabled

    commit 3a93c841c2b3b14824f7728dd74bd00a1cedb806 upstream.

    This patch disables translation(dma-remapping) before its initialization
    if it is already enabled.

    This is needed for kexec/kdump boot. If dma-remapping is enabled in the
    first kernel, it need to be disabled before initializing its page table
    during second kernel boot. Wei Hu also reported that this is needed
    when second kernel boots with intel_iommu=off.

    Basically iommu->gcmd is used to know whether translation is enabled or
    disabled, but it is always zero at boot time even when translation is
    enabled since iommu->gcmd is initialized without considering such a
    case. Therefor this patch synchronizes iommu->gcmd value with global
    command register when iommu structure is allocated.

    Signed-off-by: Takao Indoh <indou.takao@jp.fujitsu.com>
    Signed-off-by: Joerg Roedel <joro@8bytes.org>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5dc1c8851364ffb79cb9403f72c712ee83cce755
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Jul 15 08:51:27 2014 +0200

    PM / sleep: Fix request_firmware() error at resume

    commit 4320f6b1d9db4ca912c5eb6ecb328b2e090e1586 upstream.

    The commit [247bc037: PM / Sleep: Mitigate race between the freezer
    and request_firmware()] introduced the finer state control, but it
    also leads to a new bug; for example, a bug report regarding the
    firmware loading of intel BT device at suspend/resume:
      https://bugzilla.novell.com/show_bug.cgi?id=873790

    The root cause seems to be a small window between the process resume
    and the clear of usermodehelper lock.  The request_firmware() function
    checks the UMH lock and gives up when it's in UMH_DISABLE state.  This
    is for avoiding the invalid  f/w loading during suspend/resume phase.
    The problem is, however, that usermodehelper_enable() is called at the
    end of thaw_processes().  Thus, a thawed process in between can kick
    off the f/w loader code path (in this case, via btusb_setup_intel())
    even before the call of usermodehelper_enable().  Then
    usermodehelper_read_trylock() returns an error and request_firmware()
    spews WARN_ON() in the end.

    This oneliner patch fixes the issue just by setting to UMH_FREEZING
    state again before restarting tasks, so that the call of
    request_firmware() will be blocked until the end of this function
    instead of returning an error.

    Fixes: 247bc0374254 (PM / Sleep: Mitigate race between the freezer and request_firmware())
    Link: https://bugzilla.novell.com/show_bug.cgi?id=873790
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 299e667e26e9e3382fa471370121b117fa8ae987
Author: John Stultz <john.stultz@linaro.org>
Date:   Mon Jul 7 14:06:11 2014 -0700

    alarmtimer: Fix bug where relative alarm timers were treated as absolute

    commit 16927776ae757d0d132bdbfabbfe2c498342bd59 upstream.

    Sharvil noticed with the posix timer_settime interface, using the
    CLOCK_REALTIME_ALARM or CLOCK_BOOTTIME_ALARM clockid, if the users
    tried to specify a relative time timer, it would incorrectly be
    treated as absolute regardless of the state of the flags argument.

    This patch corrects this, properly checking the absolute/relative flag,
    as well as adds further error checking that no invalid flag bits are set.

    Reported-by: Sharvil Nanavati <sharvil@google.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Prarit Bhargava <prarit@redhat.com>
    Cc: Sharvil Nanavati <sharvil@google.com>
    Link: http://lkml.kernel.org/r/1404767171-6902-1-git-send-email-john.stultz@linaro.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b63dd4c81b9eccf95c1d08775bb7f2d05d70c8f1
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Jul 14 17:57:19 2014 -0400

    drm/radeon: avoid leaking edid data

    commit 0ac66effe7fcdee55bda6d5d10d3372c95a41920 upstream.

    In some cases we fetch the edid in the detect() callback
    in order to determine what sort of monitor is connected.
    If that happens, don't fetch the edid again in the get_modes()
    callback or we will leak the edid.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed379762fda2d66dd4907035c79467daafe7d70b
Author: Amitkumar Karwar <akarwar@marvell.com>
Date:   Fri Jun 20 11:45:25 2014 -0700

    mwifiex: fix Tx timeout issue

    commit d76744a93246eccdca1106037e8ee29debf48277 upstream.

    https://bugzilla.kernel.org/show_bug.cgi?id=70191
    https://bugzilla.kernel.org/show_bug.cgi?id=77581

    It is observed that sometimes Tx packet is downloaded without
    adding driver's txpd header. This results in firmware parsing
    garbage data as packet length. Sometimes firmware is unable
    to read the packet if length comes out as invalid. This stops
    further traffic and timeout occurs.

    The root cause is uninitialized fields in tx_info(skb->cb) of
    packet used to get garbage values. In this case if
    MWIFIEX_BUF_FLAG_REQUEUED_PKT flag is mistakenly set, txpd
    header was skipped. This patch makes sure that tx_info is
    correctly initialized to fix the problem.

    Reported-by: Andrew Wiley <wiley.andrew.j@gmail.com>
    Reported-by: Linus Gasser <list@markas-al-nour.org>
    Reported-by: Michael Hirsch <hirsch@teufel.de>
    Tested-by: Xinming Hu <huxm@marvell.com>
    Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
    Signed-off-by: Maithili Hinge <maithili@marvell.com>
    Signed-off-by: Avinash Patil <patila@marvell.com>
    Signed-off-by: Bing Zhao <bzhao@marvell.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2b2c0307e994401075d0cb255cd522cf6373080
Author: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
Date:   Wed Jun 25 10:09:07 2014 +0900

    perf/x86/intel: ignore CondChgd bit to avoid false NMI handling

    commit b292d7a10487aee6e74b1c18b8d95b92f40d4a4f upstream.

    Currently, any NMI is falsely handled by a NMI handler of NMI watchdog
    if CondChgd bit in MSR_CORE_PERF_GLOBAL_STATUS MSR is set.

    For example, we use external NMI to make system panic to get crash
    dump, but in this case, the external NMI is falsely handled do to the
    issue.

    This commit deals with the issue simply by ignoring CondChgd bit.

    Here is explanation in detail.

    On x86 NMI watchdog uses performance monitoring feature to
    periodically signal NMI each time performance counter gets overflowed.

    intel_pmu_handle_irq() is called as a NMI_LOCAL handler from a NMI
    handler of NMI watchdog, perf_event_nmi_handler(). It identifies an
    owner of a given NMI by looking at overflow status bits in
    MSR_CORE_PERF_GLOBAL_STATUS MSR. If some of the bits are set, then it
    handles the given NMI as its own NMI.

    The problem is that the intel_pmu_handle_irq() doesn't distinguish
    CondChgd bit from other bits. Unlike the other status bits, CondChgd
    bit doesn't represent overflow status for performance counters. Thus,
    CondChgd bit cannot be thought of as a mark indicating a given NMI is
    NMI watchdog's.

    As a result, if CondChgd bit is set, any NMI is falsely handled by the
    NMI handler of NMI watchdog. Also, if type of the falsely handled NMI
    is either NMI_UNKNOWN, NMI_SERR or NMI_IO_CHECK, the corresponding
    action is never performed until CondChgd bit is cleared.

    I noticed this behavior on systems with Ivy Bridge processors: Intel
    Xeon CPU E5-2630 v2 and Intel Xeon CPU E7-8890 v2. On both systems,
    CondChgd bit in MSR_CORE_PERF_GLOBAL_STATUS MSR has already been set
    in the beginning at boot. Then the CondChgd bit is immediately cleared
    by next wrmsr to MSR_CORE_PERF_GLOBAL_CTRL MSR and appears to remain
    0.

    On the other hand, on older processors such as Nehalem, Xeon E7540,
    CondChgd bit is not set in the beginning at boot.

    I'm not sure about exact behavior of CondChgd bit, in particular when
    this bit is set. Although I read Intel System Programmer's Manual to
    figure out that, the descriptions I found are:

      In 18.9.1:

      "The MSR_PERF_GLOBAL_STATUS MSR also provides a ¡sticky bit¢ to
       indicate changes to the state of performancmonitoring hardware"

      In Table 35-2 IA-32 Architectural MSRs

      63 CondChg: status bits of this register has changed.

    These are different from the bahviour I see on the actual system as I
    explained above.

    At least, I think ignoring CondChgd bit should be enough for NMI
    watchdog perspective.

    Signed-off-by: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
    Acked-by: Don Zickus <dzickus@redhat.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: linux-kernel@vger.kernel.org
    Link: http://lkml.kernel.org/r/20140625.103503.409316067.d.hatayama@jp.fujitsu.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 26adeae37fe36e3212e4fe6799fcdfc01c935347
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Jul 21 07:17:42 2014 +0200

    ipv4: fix buffer overflow in ip_options_compile()

    [ Upstream commit 10ec9472f05b45c94db3c854d22581a20b97db41 ]

    There is a benign buffer overflow in ip_options_compile spotted by
    AddressSanitizer[1] :

    Its benign because we always can access one extra byte in skb->head
    (because header is followed by struct skb_shared_info), and in this case
    this byte is not even used.

    [28504.910798] ==================================================================
    [28504.912046] AddressSanitizer: heap-buffer-overflow in ip_options_compile
    [28504.913170] Read of size 1 by thread T15843:
    [28504.914026]  [<ffffffff81802f91>] ip_options_compile+0x121/0x9c0
    [28504.915394]  [<ffffffff81804a0d>] ip_options_get_from_user+0xad/0x120
    [28504.916843]  [<ffffffff8180dedf>] do_ip_setsockopt.isra.15+0x8df/0x1630
    [28504.918175]  [<ffffffff8180ec60>] ip_setsockopt+0x30/0xa0
    [28504.919490]  [<ffffffff8181e59b>] tcp_setsockopt+0x5b/0x90
    [28504.920835]  [<ffffffff8177462f>] sock_common_setsockopt+0x5f/0x70
    [28504.922208]  [<ffffffff817729c2>] SyS_setsockopt+0xa2/0x140
    [28504.923459]  [<ffffffff818cfb69>] system_call_fastpath+0x16/0x1b
    [28504.924722]
    [28504.925106] Allocated by thread T15843:
    [28504.925815]  [<ffffffff81804995>] ip_options_get_from_user+0x35/0x120
    [28504.926884]  [<ffffffff8180dedf>] do_ip_setsockopt.isra.15+0x8df/0x1630
    [28504.927975]  [<ffffffff8180ec60>] ip_setsockopt+0x30/0xa0
    [28504.929175]  [<ffffffff8181e59b>] tcp_setsockopt+0x5b/0x90
    [28504.930400]  [<ffffffff8177462f>] sock_common_setsockopt+0x5f/0x70
    [28504.931677]  [<ffffffff817729c2>] SyS_setsockopt+0xa2/0x140
    [28504.932851]  [<ffffffff818cfb69>] system_call_fastpath+0x16/0x1b
    [28504.934018]
    [28504.934377] The buggy address ffff880026382828 is located 0 bytes to the right
    [28504.934377]  of 40-byte region [ffff880026382800, ffff880026382828)
    [28504.937144]
    [28504.937474] Memory state around the buggy address:
    [28504.938430]  ffff880026382300: ........ rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.939884]  ffff880026382400: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.941294]  ffff880026382500: .....rrr rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.942504]  ffff880026382600: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.943483]  ffff880026382700: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.944511] >ffff880026382800: .....rrr rrrrrrrr rrrrrrrr rrrrrrrr
    [28504.945573]                         ^
    [28504.946277]  ffff880026382900: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28505.094949]  ffff880026382a00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28505.096114]  ffff880026382b00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28505.097116]  ffff880026382c00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28505.098472]  ffff880026382d00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr
    [28505.099804] Legend:
    [28505.100269]  f - 8 freed bytes
    [28505.100884]  r - 8 redzone bytes
    [28505.101649]  . - 8 allocated bytes
    [28505.102406]  x=1..7 - x allocated bytes + (8-x) redzone bytes
    [28505.103637] ==================================================================

    [1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4427f9abd5547fa76a4b5ebeda0043fd9b0b01c7
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon Jul 21 00:06:48 2014 +0100

    dns_resolver: Null-terminate the right string

    [ Upstream commit 640d7efe4c08f06c4ae5d31b79bd8740e7f6790a ]

    *_result[len] is parsed as *(_result[len]) which is not at all what we
    want to touch here.

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Fixes: 84a7c0b1db1c ("dns_resolver: assure that dns_query() result is null-terminated")
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c304a23b4e46a1f2adb59f2e134162cfbbf35e4f
Author: Manuel Schölling <manuel.schoelling@gmx.de>
Date:   Sat Jun 7 23:57:25 2014 +0200

    dns_resolver: assure that dns_query() result is null-terminated

    [ Upstream commit 84a7c0b1db1c17d5ded8d3800228a608e1070b40 ]

    dns_query() credulously assumes that keys are null-terminated and
    returns a copy of a memory block that is off by one.

    Signed-off-by: Manuel Schölling <manuel.schoelling@gmx.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7670d47228460135a71d9d8c1f88543eba30988f
Author: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Date:   Wed Jul 16 10:02:26 2014 -0400

    sunvnet: clean up objects created in vnet_new() on vnet_exit()

    [ Upstream commit a4b70a07ed12a71131cab7adce2ce91c71b37060 ]

    Nothing cleans up the objects created by
    vnet_new(), they are completely leaked.

    vnet_exit(), after doing the vio_unregister_driver() to clean
    up ports, should call a helper function that iterates over vnet_list
    and cleans up those objects. This includes unregister_netdevice()
    as well as free_netdev().

    Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
    Acked-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Reviewed-by: Karl Volz <karl.volz@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 48b83dfd85c307282147fe604251046732fb7483
Author: Christoph Schulz <develop@kristov.de>
Date:   Sun Jul 13 00:53:15 2014 +0200

    net: pppoe: use correct channel MTU when using Multilink PPP

    [ Upstream commit a8a3e41c67d24eb12f9ab9680cbb85e24fcd9711 ]

    The PPP channel MTU is used with Multilink PPP when ppp_mp_explode() (see
    ppp_generic module) tries to determine how big a fragment might be. According
    to RFC 1661, the MTU excludes the 2-byte PPP protocol field, see the
    corresponding comment and code in ppp_mp_explode():

    		/*
    		 * hdrlen includes the 2-byte PPP protocol field, but the
    		 * MTU counts only the payload excluding the protocol field.
    		 * (RFC1661 Section 2)
    		 */
    		mtu = pch->chan->mtu - (hdrlen - 2);

    However, the pppoe module *does* include the PPP protocol field in the channel
    MTU, which is wrong as it causes the PPP payload to be 1-2 bytes too big under
    certain circumstances (one byte if PPP protocol compression is used, two
    otherwise), causing the generated Ethernet packets to be dropped. So the pppoe
    module has to subtract two bytes from the channel MTU. This error only
    manifests itself when using Multilink PPP, as otherwise the channel MTU is not
    used anywhere.

    In the following, I will describe how to reproduce this bug. We configure two
    pppd instances for multilink PPP over two PPPoE links, say eth2 and eth3, with
    a MTU of 1492 bytes for each link and a MRRU of 2976 bytes. (This MRRU is
    computed by adding the two link MTUs and subtracting the MP header twice, which
    is 4 bytes long.) The necessary pppd statements on both sides are "multilink
    mtu 1492 mru 1492 mrru 2976". On the client side, we additionally need "plugin
    rp-pppoe.so eth2" and "plugin rp-pppoe.so eth3", respectively; on the server
    side, we additionally need to start two pppoe-server instances to be able to
    establish two PPPoE sessions, one over eth2 and one over eth3. We set the MTU
    of the PPP network interface to the MRRU (2976) on both sides of the connection
    in order to make use of the higher bandwidth. (If we didn't do that, IP
    fragmentation would kick in, which we want to avoid.)

    Now we send a ICMPv4 echo request with a payload of 2948 bytes from client to
    server over the PPP link. This results in the following network packet:

       2948 (echo payload)
     +    8 (ICMPv4 header)
     +   20 (IPv4 header)
    ---------------------
       2976 (PPP payload)

    These 2976 bytes do not exceed the MTU of the PPP network interface, so the
    IP packet is not fragmented. Now the multilink PPP code in ppp_mp_explode()
    prepends one protocol byte (0x21 for IPv4), making the packet one byte bigger
    than the negotiated MRRU. So this packet would have to be divided in three
    fragments. But this does not happen as each link MTU is assumed to be two bytes
    larger. So this packet is diveded into two fragments only, one of size 1489 and
    one of size 1488. Now we have for that bigger fragment:

       1489 (PPP payload)
     +    4 (MP header)
     +    2 (PPP protocol field for the MP payload (0x3d))
     +    6 (PPPoE header)
    --------------------------
       1501 (Ethernet payload)

    This packet exceeds the link MTU and is discarded.

    If one configures the link MTU on the client side to 1501, one can see the
    discarded Ethernet frames with tcpdump running on the client. A

    ping -s 2948 -c 1 192.168.15.254

    leads to the smaller fragment that is correctly received on the server side:

    (tcpdump -vvvne -i eth3 pppoes and ppp proto 0x3d)
    52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),
      length 1514: PPPoE  [ses 0x3] MLPPP (0x003d), length 1494: seq 0x000,
      Flags [end], length 1492

    and to the bigger fragment that is not received on the server side:

    (tcpdump -vvvne -i eth2 pppoes and ppp proto 0x3d)
    52:54:00:70:9e:89 > 52:54:00:5d:6f:b0, ethertype PPPoE S (0x8864),
      length 1515: PPPoE  [ses 0x5] MLPPP (0x003d), length 1495: seq 0x000,
      Flags [begin], length 1493

    With the patch below, we correctly obtain three fragments:

    52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),
      length 1514: PPPoE  [ses 0x1] MLPPP (0x003d), length 1494: seq 0x000,
      Flags [begin], length 1492
    52:54:00:70:9e:89 > 52:54:00:5d:6f:b0, ethertype PPPoE S (0x8864),
      length 1514: PPPoE  [ses 0x1] MLPPP (0x003d), length 1494: seq 0x000,
      Flags [none], length 1492
    52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),
      length 27: PPPoE  [ses 0x1] MLPPP (0x003d), length 7: seq 0x000,
      Flags [end], length 5

    And the ICMPv4 echo request is successfully received at the server side:

    IP (tos 0x0, ttl 64, id 21925, offset 0, flags [DF], proto ICMP (1),
      length 2976)
        192.168.222.2 > 192.168.15.254: ICMP echo request, id 30530, seq 0,
          length 2956

    The bug was introduced in commit c9aa6895371b2a257401f59d3393c9f7ac5a8698
    ("[PPPOE]: Advertise PPPoE MTU") from the very beginning. This patch applies
    to 3.10 upwards but the fix can be applied (with minor modifications) to
    kernels as old as 2.6.32.

    Signed-off-by: Christoph Schulz <develop@kristov.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9de2be635e77b3591e698d6a08abad98fb21693d
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Sat Jul 12 20:30:35 2014 +0200

    net: sctp: fix information leaks in ulpevent layer

    [ Upstream commit 8f2e5ae40ec193bc0a0ed99e95315c3eebca84ea ]

    While working on some other SCTP code, I noticed that some
    structures shared with user space are leaking uninitialized
    stack or heap buffer. In particular, struct sctp_sndrcvinfo
    has a 2 bytes hole between .sinfo_flags and .sinfo_ppid that
    remains unfilled by us in sctp_ulpevent_read_sndrcvinfo() when
    putting this into cmsg. But also struct sctp_remote_error
    contains a 2 bytes hole that we don't fill but place into a skb
    through skb_copy_expand() via sctp_ulpevent_make_remote_error().

    Both structures are defined by the IETF in RFC6458:

    * Section 5.3.2. SCTP Header Information Structure:

      The sctp_sndrcvinfo structure is defined below:

      struct sctp_sndrcvinfo {
        uint16_t sinfo_stream;
        uint16_t sinfo_ssn;
        uint16_t sinfo_flags;
        <-- 2 bytes hole  -->
        uint32_t sinfo_ppid;
        uint32_t sinfo_context;
        uint32_t sinfo_timetolive;
        uint32_t sinfo_tsn;
        uint32_t sinfo_cumtsn;
        sctp_assoc_t sinfo_assoc_id;
      };

    * 6.1.3. SCTP_REMOTE_ERROR:

      A remote peer may send an Operation Error message to its peer.
      This message indicates a variety of error conditions on an
      association. The entire ERROR chunk as it appears on the wire
      is included in an SCTP_REMOTE_ERROR event. Please refer to the
      SCTP specification [RFC4960] and any extensions for a list of
      possible error formats. An SCTP error notification has the
      following format:

      struct sctp_remote_error {
        uint16_t sre_type;
        uint16_t sre_flags;
        uint32_t sre_length;
        uint16_t sre_error;
        <-- 2 bytes hole  -->
        sctp_assoc_t sre_assoc_id;
        uint8_t  sre_data[];
      };

    Fix this by setting both to 0 before filling them out. We also
    have other structures shared between user and kernel space in
    SCTP that contains holes (e.g. struct sctp_paddrthlds), but we
    copy that buffer over from user space first and thus don't need
    to care about it in that cases.

    While at it, we can also remove lengthy comments copied from
    the draft, instead, we update the comment with the correct RFC
    number where one can look it up.

    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d1558f713d5a4963f1bf95573bc870b816651f91
Author: Jon Paul Maloy <jon.maloy@ericsson.com>
Date:   Fri Jul 11 08:45:27 2014 -0400

    tipc: clear 'next'-pointer of message fragments before reassembly

    [ Upstream commit 999417549c16dd0e3a382aa9f6ae61688db03181 ]

    If the 'next' pointer of the last fragment buffer in a message is not
    zeroed before reassembly, we risk ending up with a corrupt message,
    since the reassembly function itself isn't doing this.

    Currently, when a buffer is retrieved from the deferred queue of the
    broadcast link, the next pointer is not cleared, with the result as
    described above.

    This commit corrects this, and thereby fixes a bug that may occur when
    long broadcast messages are transmitted across dual interfaces. The bug
    has been present since 40ba3cdf542a469aaa9083fa041656e59b109b90 ("tipc:
    message reassembly using fragment chain")

    This commit should be applied to both net and net-next.

    Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c656d481c5ed4285a955fcd3e8e8779d664a30e
Author: Suresh Reddy <Suresh.Reddy@emulex.com>
Date:   Fri Jul 11 14:03:01 2014 +0530

    be2net: set EQ DB clear-intr bit in be_open()

    [ Upstream commit 4cad9f3b61c7268fa89ab8096e23202300399b5d ]

    On BE3, if the clear-interrupt bit of the EQ doorbell is not set the first
    time it is armed, ocassionally we have observed that the EQ doesn't raise
    anymore interrupts even if it is in armed state.
    This patch fixes this by setting the clear-interrupt bit when EQs are
    armed for the first time in be_open().

    Signed-off-by: Suresh Reddy <Suresh.Reddy@emulex.com>
    Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3fa1f507bc20f61bc8ec94139b62a113b0bf1a50
Author: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Date:   Mon Jul 7 23:22:50 2014 +0300

    appletalk: Fix socket referencing in skb

    [ Upstream commit 36beddc272c111689f3042bf3d10a64d8a805f93 ]

    Setting just skb->sk without taking its reference and setting a
    destructor is invalid. However, in the places where this was done, skb
    is used in a way not requiring skb->sk setting. So dropping the setting
    of skb->sk.
    Thanks to Eric Dumazet <eric.dumazet@gmail.com> for correct solution.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79441
    Reported-by: Ed Martin <edman007@edman007.com>
    Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f37e491349d9dae99f2386585873abb1551ead55
Author: Yuchung Cheng <ycheng@google.com>
Date:   Wed Jul 2 12:07:16 2014 -0700

    tcp: fix false undo corner cases

    [ Upstream commit 6e08d5e3c8236e7484229e46fdf92006e1dd4c49 ]

    The undo code assumes that, upon entering loss recovery, TCP
    1) always retransmit something
    2) the retransmission never fails locally (e.g., qdisc drop)

    so undo_marker is set in tcp_enter_recovery() and undo_retrans is
    incremented only when tcp_retransmit_skb() is successful.

    When the assumption is broken because TCP's cwnd is too small to
    retransmit or the retransmit fails locally. The next (DUP)ACK
    would incorrectly revert the cwnd and the congestion state in
    tcp_try_undo_dsack() or tcp_may_undo(). Subsequent (DUP)ACKs
    may enter the recovery state. The sender repeatedly enter and
    (incorrectly) exit recovery states if the retransmits continue to
    fail locally while receiving (DUP)ACKs.

    The fix is to initialize undo_retrans to -1 and start counting on
    the first retransmission. Always increment undo_retrans even if the
    retransmissions fail locally because they couldn't cause DSACKs to
    undo the cwnd reduction.

    Signed-off-by: Yuchung Cheng <ycheng@google.com>
    Signed-off-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fbaf3a0b58bbdb2f26060689da8ac0820649d53a
Author: dingtianhong <dingtianhong@huawei.com>
Date:   Wed Jul 2 13:50:48 2014 +0800

    igmp: fix the problem when mc leave group

    [ Upstream commit 52ad353a5344f1f700c5b777175bdfa41d3cd65a ]

    The problem was triggered by these steps:

    1) create socket, bind and then setsockopt for add mc group.
       mreq.imr_multiaddr.s_addr = inet_addr("255.0.0.37");
       mreq.imr_interface.s_addr = inet_addr("192.168.1.2");
       setsockopt(sockfd, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq));

    2) drop the mc group for this socket.
       mreq.imr_multiaddr.s_addr = inet_addr("255.0.0.37");
       mreq.imr_interface.s_addr = inet_addr("0.0.0.0");
       setsockopt(sockfd, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreq, sizeof(mreq));

    3) and then drop the socket, I found the mc group was still used by the dev:

       netstat -g

       Interface       RefCnt Group
       --------------- ------ ---------------------
       eth2		   1	  255.0.0.37

    Normally even though the IP_DROP_MEMBERSHIP return error, the mc group still need
    to be released for the netdev when drop the socket, but this process was broken when
    route default is NULL, the reason is that:

    The ip_mc_leave_group() will choose the in_dev by the imr_interface.s_addr, if input addr
    is NULL, the default route dev will be chosen, then the ifindex is got from the dev,
    then polling the inet->mc_list and return -ENODEV, but if the default route dev is NULL,
    the in_dev and ifIndex is both NULL, when polling the inet->mc_list, the mc group will be
    released from the mc_list, but the dev didn't dec the refcnt for this mc group, so
    when dropping the socket, the mc_list is NULL and the dev still keep this group.

    v1->v2: According Hideaki's suggestion, we should align with IPv6 (RFC3493) and BSDs,
    	so I add the checking for the in_dev before polling the mc_list, make sure when
    	we remove the mc group, dec the refcnt to the real dev which was using the mc address.
    	The problem would never happened again.

    Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7f54732a3b231407417caf3c2cf08b8bceaa34a
Author: Li RongQing <roy.qing.li@gmail.com>
Date:   Wed Jun 18 13:46:02 2014 +0800

    8021q: fix a potential memory leak

    [ Upstream commit 916c1689a09bc1ca81f2d7a34876f8d35aadd11b ]

    skb_cow called in vlan_reorder_header does not free the skb when it failed,
    and vlan_reorder_header returns NULL to reset original skb when it is called
    in vlan_untag, lead to a memory leak.

    Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 06c84e9853a3be378e67fa06c528c805cd43468f
Author: Neal Cardwell <ncardwell@google.com>
Date:   Wed Jun 18 21:15:03 2014 -0400

    tcp: fix tcp_match_skb_to_sack() for unaligned SACK at end of an skb

    [ Upstream commit 2cd0d743b05e87445c54ca124a9916f22f16742e ]

    If there is an MSS change (or misbehaving receiver) that causes a SACK
    to arrive that covers the end of an skb but is less than one MSS, then
    tcp_match_skb_to_sack() was rounding up pkt_len to the full length of
    the skb ("Round if necessary..."), then chopping all bytes off the skb
    and creating a zero-byte skb in the write queue.

    This was visible now because the recently simplified TLP logic in
    bef1909ee3ed1c ("tcp: fixing TLP's FIN recovery") could find that 0-byte
    skb at the end of the write queue, and now that we do not check that
    skb's length we could send it as a TLP probe.

    Consider the following example scenario:

     mss: 1000
     skb: seq: 0 end_seq: 4000  len: 4000
     SACK: start_seq: 3999 end_seq: 4000

    The tcp_match_skb_to_sack() code will compute:

     in_sack = false
     pkt_len = start_seq - TCP_SKB_CB(skb)->seq = 3999 - 0 = 3999
     new_len = (pkt_len / mss) * mss = (3999/1000)*1000 = 3000
     new_len += mss = 4000

    Previously we would find the new_len > skb->len check failing, so we
    would fall through and set pkt_len = new_len = 4000 and chop off
    pkt_len of 4000 from the 4000-byte skb, leaving a 0-byte segment
    afterward in the write queue.

    With this new commit, we notice that the new new_len >= skb->len check
    succeeds, so that we return without trying to fragment.

    Fixes: adb92db857ee ("tcp: Make SACK code to split only at mss boundaries")
    Reported-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Neal Cardwell <ncardwell@google.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Ilpo Jarvinen <ilpo.jarvinen@helsinki.fi>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21618a8f0f46ff327acd6a079bc05c065561e4c0
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Jul 23 14:00:13 2014 -0700

    shmem: fix splicing from a hole while it's punched

    commit b1a366500bd537b50c3aad26dc7df083ec03a448 upstream.

    shmem_fault() is the actual culprit in trinity's hole-punch starvation,
    and the most significant cause of such problems: since a page faulted is
    one that then appears page_mapped(), needing unmap_mapping_range() and
    i_mmap_mutex to be unmapped again.

    But it is not the only way in which a page can be brought into a hole in
    the radix_tree while that hole is being punched; and Vlastimil's testing
    implies that if enough other processors are busy filling in the hole,
    then shmem_undo_range() can be kept from completing indefinitely.

    shmem_file_splice_read() is the main other user of SGP_CACHE, which can
    instantiate shmem pagecache pages in the read-only case (without holding
    i_mutex, so perhaps concurrently with a hole-punch).  Probably it's
    silly not to use SGP_READ already (using the ZERO_PAGE for holes): which
    ought to be safe, but might bring surprises - not a change to be rushed.

    shmem_read_mapping_page_gfp() is an internal interface used by
    drivers/gpu/drm GEM (and next by uprobes): it should be okay.  And
    shmem_file_read_iter() uses the SGP_DIRTY variant of SGP_CACHE, when
    called internally by the kernel (perhaps for a stacking filesystem,
    which might rely on holes to be reserved): it's unclear whether it could
    be provoked to keep hole-punch busy or not.

    We could apply the same umbrella as now used in shmem_fault() to
    shmem_file_splice_read() and the others; but it looks ugly, and use over
    a range raises questions - should it actually be per page? can these get
    starved themselves?

    The origin of this part of the problem is my v3.1 commit d0823576bf4b
    ("mm: pincer in truncate_inode_pages_range"), once it was duplicated
    into shmem.c.  It seemed like a nice idea at the time, to ensure
    (barring RCU lookup fuzziness) that there's an instant when the entire
    hole is empty; but the indefinitely repeated scans to ensure that make
    it vulnerable.

    Revert that "enhancement" to hole-punch from shmem_undo_range(), but
    retain the unproblematic rescanning when it's truncating; add a couple
    of comments there.

    Remove the "indices[0] >= end" test: that is now handled satisfactorily
    by the inner loop, and mem_cgroup_uncharge_start()/end() are too light
    to be worth avoiding here.

    But if we do not always loop indefinitely, we do need to handle the case
    of swap swizzled back to page before shmem_free_swap() gets it: add a
    retry for that case, as suggested by Konstantin Khlebnikov; and for the
    case of page swizzled back to swap, as suggested by Johannes Weiner.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Suggested-by: Vlastimil Babka <vbabka@suse.cz>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Lukas Czerner <lczerner@redhat.com>
    Cc: Dave Jones <davej@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0f5a4a003f5d440c09f414f0c6fc6c591baa8b15
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Jul 23 14:00:10 2014 -0700

    shmem: fix faulting into a hole, not taking i_mutex

    commit 8e205f779d1443a94b5ae81aa359cb535dd3021e upstream.

    Commit f00cdc6df7d7 ("shmem: fix faulting into a hole while it's
    punched") was buggy: Sasha sent a lockdep report to remind us that
    grabbing i_mutex in the fault path is a no-no (write syscall may already
    hold i_mutex while faulting user buffer).

    We tried a completely different approach (see following patch) but that
    proved inadequate: good enough for a rational workload, but not good
    enough against trinity - which forks off so many mappings of the object
    that contention on i_mmap_mutex while hole-puncher holds i_mutex builds
    into serious starvation when concurrent faults force the puncher to fall
    back to single-page unmap_mapping_range() searches of the i_mmap tree.

    So return to the original umbrella approach, but keep away from i_mutex
    this time.  We really don't want to bloat every shmem inode with a new
    mutex or completion, just to protect this unlikely case from trinity.
    So extend the original with wait_queue_head on stack at the hole-punch
    end, and wait_queue item on the stack at the fault end.

    This involves further use of i_lock to guard against the races: lockdep
    has been happy so far, and I see fs/inode.c:unlock_new_inode() holds
    i_lock around wake_up_bit(), which is comparable to what we do here.
    i_lock is more convenient, but we could switch to shmem's info->lock.

    This issue has been tagged with CVE-2014-4171, which will require commit
    f00cdc6df7d7 and this and the following patch to be backported: we
    suggest to 3.1+, though in fact the trinity forkbomb effect might go
    back as far as 2.6.16, when madvise(,,MADV_REMOVE) came in - or might
    not, since much has changed, with i_mmap_mutex a spinlock before 3.0.
    Anyone running trinity on 3.0 and earlier? I don't think we need care.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Tested-by: Sasha Levin <sasha.levin@oracle.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Lukas Czerner <lczerner@redhat.com>
    Cc: Dave Jones <davej@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a62f374abb72830e1319d45ecb5e597b1944c8cd
Author: Hugh Dickins <hughd@google.com>
Date:   Mon Jun 23 13:22:06 2014 -0700

    shmem: fix faulting into a hole while it's punched

    commit f00cdc6df7d7cfcabb5b740911e6788cb0802bdb upstream.

    Trinity finds that mmap access to a hole while it's punched from shmem
    can prevent the madvise(MADV_REMOVE) or fallocate(FALLOC_FL_PUNCH_HOLE)
    from completing, until the reader chooses to stop; with the puncher's
    hold on i_mutex locking out all other writers until it can complete.

    It appears that the tmpfs fault path is too light in comparison with its
    hole-punching path, lacking an i_data_sem to obstruct it; but we don't
    want to slow down the common case.

    Extend shmem_fallocate()'s existing range notification mechanism, so
    shmem_fault() can refrain from faulting pages into the hole while it's
    punched, waiting instead on i_mutex (when safe to sleep; or repeatedly
    faulting when not).

    [akpm@linux-foundation.org: coding-style fixes]
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Tested-by: Sasha Levin <sasha.levin@oracle.com>
    Cc: Dave Jones <davej@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64fb4e2b0f802ac31f7350fbcba01de67845d4fb
Author: Markus F.X.J. Oberhumer <markus@oberhumer.com>
Date:   Sun Oct 14 15:39:04 2012 +0200

    crypto: testmgr - update LZO compression test vectors

    commit 0ec7382036922be063b515b2a3f1d6f7a607392c upstream.

    Update the LZO compression test vectors according to the latest compressor
    version.

    Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
    Cc: Derrick Pallas <pallas@meraki.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8b20855d06e6fe88097acc118ff57888dfbae466
Author: Tanya Brokhman <tlinder@codeaurora.org>
Date:   Sun Jun 22 16:11:03 2014 +0300

    block: row: Fix crash when adding a new field in bio struct

    When adding new field to struct bio there is a crash in the removed
    code lines. This issue was introduced by commit
    80a8f0f87bee18283e9ca0a8966ec97ad9f084e5 "block: row-iosched idling
    triggered by readahead pages"

    (Partly) reverting this patch till root cause is fixed (on FS level).

    Change-Id: Ie82bc806ea52a6370b57aa15455c85b2db10d0da
    Signed-off-by: Tanya Brokhman <tlinder@codeaurora.org>

commit 027342da6dad49c42c45b84490bdccbe940e150e
Author: Tatyana Brokhman <tlinder@codeaurora.org>
Date:   Thu Jul 25 13:45:21 2013 +0300

    block: row: Remove warning massage from add_request

    Regular priority queues is marked as "starved" if it skipped a dispatch
    due to being empty. When a new request is added to a "starved" queue
    it will be marked as urgent.
    The removed WARN_ON was warning about an impossible case when a regular
    priority (read) queue was marked as starved but wasn't empty. This is
    a possible case due to the bellow:
    If the device driver fetched a read request that is pending for
    transmission and an URGENT request arrives, the fetched read will be
    reinserted back to the scheduler. Its possible that the queue it will be
    reinserted to was marked as "starved" in the meanwhile due to being empty.

    CRs-fixed: 517800
    Change-Id: Iaae642ea0ed9c817c41745b0e8ae2217cc684f0c
    Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>

commit 0dd718a49e010ccc9f759cd9912cda76dbab55b7
Author: Tatyana Brokhman <tlinder@codeaurora.org>
Date:   Tue Jul 2 14:43:13 2013 +0300

    block: row: change hrtimer_cancel to hrtimer_try_to_cancel

    Calling hrtimer_cancel with interrupts disabled can result in a livelock.
    When flushing plug list in the block layer interrupts are disabled and an
    hrtimer is used when adding requests from that plug list to the scheduler.
    In this code flow, if the hrtimer (which is used for idling) is set, it's
    being canceled by calling hrtimer_cancel. hrtimer_cancel will perform
    the following in an endless loop:
    1. try cancel the timer
    2. if fails - rest_cpu
    the cancellation can fail if the timer function already started. Since
    interrupts are disabled it can never complete.
    This patch reduced the number of times the hrtimer lock is taken while
    interrupts are disabled by calling hrtimer_try_co_cancel. the later will
    try to cancel the timer just once and return with an error code if fails.

    CRs-fixed: 499887
    Change-Id: I25f79c357426d72ad67c261ce7cb503ae97dc7b9
    Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>

commit 664cc6c4a48432873556463ff8d470381f9f3251
Author: Lee Susman <lsusman@codeaurora.org>
Date:   Sun Jun 23 16:27:40 2013 +0300

    block: row-iosched idling triggered by readahead pages

    In the current implementation idling is triggered only by request
    insertion frequency. This heuristic is not very accurate and may hit
    random requests that shouldn't trigger idling. This patch uses the
    PG_readahead flag in struct page's flags, which indicates that the page
    is part of a readahead window, to start idling upon dispatch of a request
    associated with a readahead page.

    The above readehead flag is used together with the existing
    insertion-frequency trigger. The frequency timer will catch read requests
    which are not part of a readahead window, but are still part of a
    sequential stream (and therefore dispatched in small time intervals).

    Change-Id: Icb7145199c007408de3f267645ccb842e051fd00
    Signed-off-by: Lee Susman <lsusman@codeaurora.org>

commit 4e39bb78b58a110b51a7dcfdec832e22a3507c4f
Author: Pavankumar Kondeti <pkondeti@codeaurora.org>
Date:   Thu Dec 26 13:24:40 2013 +0530

    usb: core: Limit HCD old enumeration scheme request to root ports

    HCD_OLD_ENUM HCD flag is introduced to use old (or short) enumeration
    scheme for the devices attached on the corresponding USB bus. The old
    enumeration scheme is used by the MSM HSIC controller to avoid multiple
    reset during enumeration. This is useful when a known device is attached
    to the USB bus, which is the case with MSM HSIC. When a HSIC HUB is
    connected, any device can be connected on the HSIC USB bus. The new
    enumeration scheme supports wide variety of USB devices. Hence limit
    the old enumeration scheme request of a HCD to only root ports.

    Change-Id: I6035c2a766787819eb8d0e1fa774e0c79d6e958b
    Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

commit 9ccca3beb1f21c0cd8cbeb3f98770c7be9bb469b
Author: William Clark <wclark@codeaurora.org>
Date:   Fri Jun 27 11:10:38 2014 -0700

    crypto: msm: add suspend/resume callback for qcedev driver

    Make chanegs to add suspend/resume callback for qcedev driver, and
    disable ce clocks when entering suspend and re-enable clocks in resume.
    CRs-Fixed:  661994

    Change-Id: Ibeab1e7cb531af79ae973d7ff0d0ed2d776f6d6f
    Signed-off-by: Zhen Kong <zkong@codeaurora.org>
    Signed-off-by: William Clark <wclark@codeaurora.org>

commit c83a4672190f25c81ac3f0905a9d91bebb8afbef
Author: Avijit Kanti Das <avijitnsec@codeaurora.org>
Date:   Wed May 14 11:03:56 2014 -0700

    net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

    memset() the structure ethtool_wolinfo that has padded bytes
    but the padded bytes have not been zeroed out.

    Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>

commit 129ad1044cbf068ed3cff65e4ba766800f4a96d9
Author: Mark Salyzyn <salyzyn@google.com>
Date:   Wed Jul 23 14:29:49 2014 +0000

    Revert "s3c2410_wdt: Add locking to cpu frequency transition notifier"

    This reverts commit 037e771d330cfc51d38782543bc965ec61370820.

    Change-Id: I32a81c1fb2d9ac2eb8570438699e8f9ff01f4c93

commit 51b30b0c2f8b447927858d786ecc3f30034a6e68
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Thu Jan 10 10:08:44 2013 +0100

    cgroup: Fix use after free of cgrp (cgrp->css_sets)

    Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
    (arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
    errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
    free_css_set_work as the function making the problematic list_del call.

    I've tracked this doen to a use after free of the cgrp struct, specifically
    of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

    Since free_css_set_work runs form a workqueue, it is possible for it to not be
    done with clearing the list when the cgrp gets free-ed. To avoid this the code
    adding the links increases cgrp->count, and the freeing code running from the
    workqueue decreases cgrp->count *after* doing list_del, and then if the count
    goes to 0 calls cgroup_wakeup_rmdir_waiter().

    However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
    to still continue with the rmdir (which leads to the free-ing of the cgrp),
    before free_css_set_work is done. Sometimes the free-ed memory is re-used
    before free_css_set_work gets around to unlinking link->cgrp_link_list,
    triggering the list_del list corruption messages.

    This patch fixes this by properly checking for cgrp->count != 0 and waiting
    for the cgroup_rmdir_waitq in that case.

    Change-Id: I9dbc02a0a75d5dffa1b65d67456e00139dea57c3
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>

commit a9c6cc132058b4c9c66a569fdbeded471cae745d
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Fri Jan 11 13:19:27 2013 +0100

    cgroup: Take css_set_lock from cgroup_css_sets_empty()

    As indicated in the comment above cgroup_css_sets_empty it needs the
    css_set_lock. But neither of the 2 call points have it, so rather then fixing
    the callers just take the lock inside cgroup_css_sets_empty().

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Change-Id: If7aea71824f6d0e3f2cc6c1ce236c3ae6be2037b

commit 04bd9cf968ca061c2d1a333f6d120854fc8a2bbe
Author: Anson Jacob <ansonkuzhumbil@gmail.com>
Date:   Mon Jun 23 19:07:44 2014 +0800

    usb: gadget: f_accessory: Enabled Zero Length Packet (ZLP) for acc_write

    Accessory connected to Android Device requires
    Zero Length Packet (ZLP) to be written when data
    transferred out from the Android device are multiples
    of wMaxPacketSize (64bytes (Full-Speed) / 512bytes (High-Speed))
    to end the transfer.

    Change-Id: Ib2c2c0ab98ef9afa10e74a720142deca5c0ed476
    Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>

commit 4abc766f35314bb799d66e62a794df0702fc0dbe
Author: Venkata Narendra Kumar Gutta <vgutta@codeaurora.org>
Date:   Thu Jul 17 16:47:47 2014 +0530

    ASoC: msm: qdsp6v2: add support to enable TTY during VoLTE call

    Enable of TTY during VoLTE call is not supported. Add support to
    enable TTY during VoLTE call.

    CRs-Fixed: 697463
    Change-Id: Ie104eddd7b404f278a0d4def770a3f6fffef901c
    Signed-off-by: Venkata Narendra Kumar Gutta <vgutta@codeaurora.org>

commit 134a33e462a3c2742c8aa09eeada043e722e443d
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Wed Jul 23 00:29:54 2014 -0500

    d2: spring break '98, going moduleless!

    Change-Id: I428d07318a6a7f065f753c4af4545b7deeb2b72d

commit e97859727174f4aeaf64876dee3cda37481a9bdb
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Fri May 9 08:29:00 2014 -0500

    bcmdhd: build into the kernel if modules are disabled

    Change-Id: I202d7f55a446460e541888bbbeb101a0926d5e99

commit 1f5f9362c63fd695e93f15ec692ae6286b2fc685
Merge: 53358dd 893562b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 22 00:53:43 2014 -0700

    Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()"

commit f7d604308de774d2641c1f8cf18fd06cc5db93e3
Merge: 5fd0131 9e566ac
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 21 18:14:54 2014 -0700

    Merge "Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()""

commit 893562b90771723d69be4807824413cfbcef3684
Author: Avijit Kanti Das <avijitnsec@codeaurora.org>
Date:   Wed May 14 11:03:56 2014 -0700

    net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

    memset() the structure ethtool_wolinfo that has padded bytes
    but the padded bytes have not been zeroed out.

    Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>

commit 5fd01315780917440e1a50a8e8cf7a1358db9392
Merge: 5f9867a a76adab
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 21 14:54:18 2014 -0700

    Merge "Merge "msm: camera: Propogate vpe subdev init error""

commit 9e566ac90e005dfb0d5dbef18305ce73c7961d8f
Merge: a76adab 803da50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 21 13:42:08 2014 -0700

    Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()"

commit 53358ddb469d6b321cc0d7e0b35795a2f0287a61
Merge: 4fa28e2 2fd61634
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 21 12:45:42 2014 -0700

    Merge "msm: camera: Propogate vpe subdev init error"

commit a76adab8684d4f87b985b1ade68ef61741450338
Merge: fed29b9 f49114d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 21 11:04:16 2014 -0700

    Merge "msm: camera: Propogate vpe subdev init error"

commit 803da50dc655d9bbd544a3afb9e9ad11b813065f
Author: Avijit Kanti Das <avijitnsec@codeaurora.org>
Date:   Wed May 14 11:03:56 2014 -0700

    net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

    memset() the structure ethtool_wolinfo that has padded bytes
    but the padded bytes have not been zeroed out.

    Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>

commit 79a777724d371536f45bd9a93683bc1d726ef838
Merge: 7c3860b dd3fc0e
Author: Dave Daynard <nardholio@gmail.com>
Date:   Fri Jul 18 02:10:00 2014 +0000

    Merge "f2fs: Update to proper 3.4 support" into cm-11.0

commit dd3fc0e15a475f76535785a8d9dbdada818f1542
Author: Evan McClain <aeroevan@gmail.com>
Date:   Thu Jul 17 21:16:35 2014 -0400

    f2fs: Update to proper 3.4 support

    http://git.kernel.org/cgit/linux/kernel/git/jaegeuk/f2fs.git/log/?h=linux-3.4

    Change-Id: Ica17871e847d4807c7ef24ea77dd4bff5451f5c7

commit 7c3860bf676ba0ff726c408d67b41e4ec8667446
Merge: 58c9e97 0758142
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jul 17 19:59:13 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Change-Id: I56cb76987f99101496208101cca029aafbffc11b

commit 0758142f8a850928b886978753b1d8c473d6eee2
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jul 17 15:55:52 2014 -0700

    Linux 3.4.99

commit cd0c28d2281c65aa0ae89be80abcbf8e21c885b4
Author: Lan Tianyu <tianyu.lan@intel.com>
Date:   Mon Jul 7 15:47:12 2014 +0800

    ACPI / battery: Retry to get battery information if failed during probing

    commit 75646e758a0ecbed5024454507d5be5b9ea9dcbf upstream.

    Some machines (eg. Lenovo Z480) ECs are not stable during boot up
    and causes battery driver fails to be loaded due to failure of getting
    battery information from EC sometimes. After several retries, the
    operation will work. This patch is to retry to get battery information 5
    times if the first try fails.

    [ backport to 3.14.5: removed second parameter in acpi_battery_update(),
    introduced by the commit 9e50bc14a7f58b5d8a55973b2d69355852ae2dae (ACPI /
    battery: Accelerate battery resume callback)]

    [naszar <naszar@ya.ru>: backport to 3.14.5]
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=75581
    Reported-and-tested-by: naszar <naszar@ya.ru>
    Cc: All applicable <stable@vger.kernel.org>
    Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d824be9bc8017b84364f7e5f207fd29119270196
Author: Roland Dreier <roland@purestorage.com>
Date:   Fri May 2 11:18:41 2014 -0700

    x86, ioremap: Speed up check for RAM pages

    commit c81c8a1eeede61e92a15103748c23d100880cc8a upstream.

    In __ioremap_caller() (the guts of ioremap), we loop over the range of
    pfns being remapped and checks each one individually with page_is_ram().
    For large ioremaps, this can be very slow.  For example, we have a
    device with a 256 GiB PCI BAR, and ioremapping this BAR can take 20+
    seconds -- sometimes long enough to trigger the soft lockup detector!

    Internally, page_is_ram() calls walk_system_ram_range() on a single
    page.  Instead, we can make a single call to walk_system_ram_range()
    from __ioremap_caller(), and do our further checks only for any RAM
    pages that we find.  For the common case of MMIO, this saves an enormous
    amount of work, since the range being ioremapped doesn't intersect
    system RAM at all.

    With this change, ioremap on our 256 GiB BAR takes less than 1 second.

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Link: http://lkml.kernel.org/r/1399054721-1331-1-git-send-email-roland@kernel.org
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2a77794da631ec2b2d2243b83fa6793676cdf411
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Wed Jun 11 18:44:04 2014 +0000

    rtmutex: Plug slow unlock race

    commit 27e35715df54cbc4f2d044f681802ae30479e7fb upstream.

    When the rtmutex fast path is enabled the slow unlock function can
    create the following situation:

    spin_lock(foo->m->wait_lock);
    foo->m->owner = NULL;
    	    			rt_mutex_lock(foo->m); <-- fast path
    				free = atomic_dec_and_test(foo->refcnt);
    				rt_mutex_unlock(foo->m); <-- fast path
    				if (free)
    				   kfree(foo);

    spin_unlock(foo->m->wait_lock); <--- Use after free.

    Plug the race by changing the slow unlock to the following scheme:

         while (!rt_mutex_has_waiters(m)) {
         	    /* Clear the waiters bit in m->owner */
    	    clear_rt_mutex_waiters(m);
          	    owner = rt_mutex_owner(m);
          	    spin_unlock(m->wait_lock);
          	    if (cmpxchg(m->owner, owner, 0) == owner)
          	       return;
          	    spin_lock(m->wait_lock);
         }

    So in case of a new waiter incoming while the owner tries the slow
    path unlock we have two situations:

     unlock(wait_lock);
    					lock(wait_lock);
     cmpxchg(p, owner, 0) == owner
     	    	   			mark_rt_mutex_waiters(lock);
    	 				acquire(lock);

    Or:

     unlock(wait_lock);
    					lock(wait_lock);
    	 				mark_rt_mutex_waiters(lock);
     cmpxchg(p, owner, 0) != owner
    					enqueue_waiter();
    					unlock(wait_lock);
     lock(wait_lock);
     wakeup_next waiter();
     unlock(wait_lock);
    					lock(wait_lock);
    					acquire(lock);

    If the fast path is disabled, then the simple

       m->owner = NULL;
       unlock(m->wait_lock);

    is sufficient as all access to m->owner is serialized via
    m->wait_lock;

    Also document and clarify the wakeup_next_waiter function as suggested
    by Oleg Nesterov.

    Reported-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/20140611183852.937945560@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea018da95368adfb700689bd9842714f7c3db665
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Thu Jun 5 12:34:23 2014 +0200

    rtmutex: Handle deadlock detection smarter

    commit 3d5c9340d1949733eb37616abd15db36aef9a57c upstream.

    Even in the case when deadlock detection is not requested by the
    caller, we can detect deadlocks. Right now the code stops the lock
    chain walk and keeps the waiter enqueued, even on itself. Silly not to
    yell when such a scenario is detected and to keep the waiter enqueued.

    Return -EDEADLK unconditionally and handle it at the call sites.

    The futex calls return -EDEADLK. The non futex ones dequeue the
    waiter, throw a warning and put the task into a schedule loop.

    Tagged for stable as it makes the code more robust.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Brad Mouring <bmouring@ni.com>
    Link: http://lkml.kernel.org/r/20140605152801.836501969@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 307e2e09be9993d7fe403a7310b28ab2d8e2f6ce
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Thu Jun 5 11:16:12 2014 +0200

    rtmutex: Detect changes in the pi lock chain

    commit 82084984383babe728e6e3c9a8e5c46278091315 upstream.

    When we walk the lock chain, we drop all locks after each step. So the
    lock chain can change under us before we reacquire the locks. That's
    harmless in principle as we just follow the wrong lock path. But it
    can lead to a false positive in the dead lock detection logic:

    T0 holds L0
    T0 blocks on L1 held by T1
    T1 blocks on L2 held by T2
    T2 blocks on L3 held by T3
    T4 blocks on L4 held by T4

    Now we walk the chain

    lock T1 -> lock L2 -> adjust L2 -> unlock T1 ->
         lock T2 ->  adjust T2 ->  drop locks

    T2 times out and blocks on L0

    Now we continue:

    lock T2 -> lock L0 -> deadlock detected, but it's not a deadlock at all.

    Brad tried to work around that in the deadlock detection logic itself,
    but the more I looked at it the less I liked it, because it's crystal
    ball magic after the fact.

    We actually can detect a chain change very simple:

    lock T1 -> lock L2 -> adjust L2 -> unlock T1 -> lock T2 -> adjust T2 ->

         next_lock = T2->pi_blocked_on->lock;

    drop locks

    T2 times out and blocks on L0

    Now we continue:

    lock T2 ->

         if (next_lock != T2->pi_blocked_on->lock)
         	   return;

    So if we detect that T2 is now blocked on a different lock we stop the
    chain walk. That's also correct in the following scenario:

    lock T1 -> lock L2 -> adjust L2 -> unlock T1 -> lock T2 -> adjust T2 ->

         next_lock = T2->pi_blocked_on->lock;

    drop locks

    T3 times out and drops L3
    T2 acquires L3 and blocks on L4 now

    Now we continue:

    lock T2 ->

         if (next_lock != T2->pi_blocked_on->lock)
         	   return;

    We don't have to follow up the chain at that point, because T2
    propagated our priority up to T4 already.

    [ Folded a cleanup patch from peterz ]

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reported-by: Brad Mouring <bmouring@ni.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/20140605152801.930031935@linutronix.de
    Signed-off-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90b421b52720b30644e104da002505f08a77c07a
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Thu May 22 03:25:39 2014 +0000

    rtmutex: Fix deadlock detector for real

    commit 397335f004f41e5fcf7a795e94eb3ab83411a17c upstream.

    The current deadlock detection logic does not work reliably due to the
    following early exit path:

    	/*
    	 * Drop out, when the task has no waiters. Note,
    	 * top_waiter can be NULL, when we are in the deboosting
    	 * mode!
    	 */
    	if (top_waiter && (!task_has_pi_waiters(task) ||
    			   top_waiter != task_top_pi_waiter(task)))
    		goto out_unlock_pi;

    So this not only exits when the task has no waiters, it also exits
    unconditionally when the current waiter is not the top priority waiter
    of the task.

    So in a nested locking scenario, it might abort the lock chain walk
    and therefor miss a potential deadlock.

    Simple fix: Continue the chain walk, when deadlock detection is
    enabled.

    We also avoid the whole enqueue, if we detect the deadlock right away
    (A-A). It's an optimization, but also prevents that another waiter who
    comes in after the detection and before the task has undone the damage
    observes the situation and detects the deadlock and returns
    -EDEADLOCK, which is wrong as the other task is not in a deadlock
    situation.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Link: http://lkml.kernel.org/r/20140522031949.725272460@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf09db97205d46b3e083582eb2799aedddd9953b
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Tue Jun 24 23:50:09 2014 -0400

    tracing: Remove ftrace_stop/start() from reading the trace file

    commit 099ed151675cd1d2dbeae1dac697975f6a68716d upstream.

    Disabling reading and writing to the trace file should not be able to
    disable all function tracing callbacks. There's other users today
    (like kprobes and perf). Reading a trace file should not stop those
    from happening.

    Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa1bd9b16b3432bce7937a5a4b5d75ab2f5b634c
Author: Christian König <christian.koenig@amd.com>
Date:   Wed Jun 4 15:29:56 2014 +0200

    drm/radeon: stop poisoning the GART TLB

    commit 0986c1a55ca64b44ee126a2f719a6e9f28cbe0ed upstream.

    When we set the valid bit on invalid GART entries they are
    loaded into the TLB when an adjacent entry is loaded. This
    poisons the TLB with invalid entries which are sometimes
    not correctly removed on TLB flush.

    For stable inclusion the patch probably needs to be modified a bit.

    Signed-off-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ef018263c824ec34d06419502555dbd8889e8182
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sat Jul 5 18:40:52 2014 -0400

    ext4: clarify error count warning messages

    commit ae0f78de2c43b6fadd007c231a352b13b5be8ed2 upstream.

    Make it clear that values printed are times, and that it is error
    since last fsck. Also add note about fsck version required.

    Signed-off-by: Pavel Machek <pavel@ucw.cz>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Reviewed-by: Andreas Dilger <adilger@dilger.ca>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b9eab8f52499099d3b6351a7fd4277455666fa7
Author: Anton Blanchard <anton@samba.org>
Date:   Thu May 29 08:15:38 2014 +1000

    powerpc/perf: Never program book3s PMCs with values >= 0x80000000

    commit f56029410a13cae3652d1f34788045c40a13ffc7 upstream.

    We are seeing a lot of PMU warnings on POWER8:

        Can't find PMC that caused IRQ

    Looking closer, the active PMC is 0 at this point and we took a PMU
    exception on the transition from negative to 0. Some versions of POWER8
    have an issue where they edge detect and not level detect PMC overflows.

    A number of places program the PMC with (0x80000000 - period_left),
    where period_left can be negative. We can either fix all of these or
    just ensure that period_left is always >= 1.

    This patch takes the second option.

    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30bbd3940f341bfd836e3afcac424c5a9ae19115
Author: Axel Lin <axel.lin@ingics.com>
Date:   Wed Jul 2 08:29:55 2014 +0800

    hwmon: (adm1029) Ensure the fan_div cache is updated in set_fan_div

    commit 1035a9e3e9c76b64a860a774f5b867d28d34acc2 upstream.

    Writing to fanX_div does not clear the cache. As a result, reading
    from fanX_div may return the old value for up to two seconds
    after writing a new value.

    This patch ensures the fan_div cache is updated in set_fan_div().

    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5cc80fb26bb491e88f6aa8761ba0371693f73bd8
Author: Axel Lin <axel.lin@ingics.com>
Date:   Wed Jul 2 07:44:44 2014 +0800

    hwmon: (amc6821) Fix permissions for temp2_input

    commit df86754b746e9a0ff6f863f690b1c01d408e3cdc upstream.

    temp2_input should not be writable, fix it.

    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f54e04114e99817aae34261901fa5b54e6e2c336
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Wed Jun 25 09:57:18 2014 +0800

    cpuset,mempolicy: fix sleeping function called from invalid context

    commit 391acf970d21219a2a5446282d3b20eace0c0d7a upstream.

    When runing with the kernel(3.15-rc7+), the follow bug occurs:
    [ 9969.258987] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:586
    [ 9969.359906] in_atomic(): 1, irqs_disabled(): 0, pid: 160655, name: python
    [ 9969.441175] INFO: lockdep is turned off.
    [ 9969.488184] CPU: 26 PID: 160655 Comm: python Tainted: G       A      3.15.0-rc7+ #85
    [ 9969.581032] Hardware name: FUJITSU-SV PRIMEQUEST 1800E/SB, BIOS PRIMEQUEST 1000 Series BIOS Version 1.39 11/16/2012
    [ 9969.706052]  ffffffff81a20e60 ffff8803e941fbd0 ffffffff8162f523 ffff8803e941fd18
    [ 9969.795323]  ffff8803e941fbe0 ffffffff8109995a ffff8803e941fc58 ffffffff81633e6c
    [ 9969.884710]  ffffffff811ba5dc ffff880405c6b480 ffff88041fdd90a0 0000000000002000
    [ 9969.974071] Call Trace:
    [ 9970.003403]  [<ffffffff8162f523>] dump_stack+0x4d/0x66
    [ 9970.065074]  [<ffffffff8109995a>] __might_sleep+0xfa/0x130
    [ 9970.130743]  [<ffffffff81633e6c>] mutex_lock_nested+0x3c/0x4f0
    [ 9970.200638]  [<ffffffff811ba5dc>] ? kmem_cache_alloc+0x1bc/0x210
    [ 9970.272610]  [<ffffffff81105807>] cpuset_mems_allowed+0x27/0x140
    [ 9970.344584]  [<ffffffff811b1303>] ? __mpol_dup+0x63/0x150
    [ 9970.409282]  [<ffffffff811b1385>] __mpol_dup+0xe5/0x150
    [ 9970.471897]  [<ffffffff811b1303>] ? __mpol_dup+0x63/0x150
    [ 9970.536585]  [<ffffffff81068c86>] ? copy_process.part.23+0x606/0x1d40
    [ 9970.613763]  [<ffffffff810bf28d>] ? trace_hardirqs_on+0xd/0x10
    [ 9970.683660]  [<ffffffff810ddddf>] ? monotonic_to_bootbased+0x2f/0x50
    [ 9970.759795]  [<ffffffff81068cf0>] copy_process.part.23+0x670/0x1d40
    [ 9970.834885]  [<ffffffff8106a598>] do_fork+0xd8/0x380
    [ 9970.894375]  [<ffffffff81110e4c>] ? __audit_syscall_entry+0x9c/0xf0
    [ 9970.969470]  [<ffffffff8106a8c6>] SyS_clone+0x16/0x20
    [ 9971.030011]  [<ffffffff81642009>] stub_clone+0x69/0x90
    [ 9971.091573]  [<ffffffff81641c29>] ? system_call_fastpath+0x16/0x1b

    The cause is that cpuset_mems_allowed() try to take
    mutex_lock(&callback_mutex) under the rcu_read_lock(which was hold in
    __mpol_dup()). And in cpuset_mems_allowed(), the access to cpuset is
    under rcu_read_lock, so in __mpol_dup, we can reduce the rcu_read_lock
    protection region to protect the access to cpuset only in
    current_cpuset_is_being_rebound(). So that we can avoid this bug.

    This patch is a temporary solution that just addresses the bug
    mentioned above, can not fix the long-standing issue about cpuset.mems
    rebinding on fork():

    "When the forker's task_struct is duplicated (which includes
     ->mems_allowed) and it races with an update to cpuset_being_rebound
     in update_tasks_nodemask() then the task's mems_allowed doesn't get
     updated. And the child task's mems_allowed can be wrong if the
     cpuset's nodemask changes before the child has been added to the
     cgroup's tasklist."

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Acked-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d06191b3d67e11142db2d601a8393535e58de5e3
Author: Bert Vermeulen <bert@biot.com>
Date:   Tue Jul 8 14:42:23 2014 +0200

    USB: ftdi_sio: Add extra PID.

    commit 5a7fbe7e9ea0b1b9d7ffdba64db1faa3a259164c upstream.

    This patch adds PID 0x0003 to the VID 0x128d (Testo). At least the
    Testo 435-4 uses this, likely other gear as well.

    Signed-off-by: Bert Vermeulen <bert@biot.com>
    Cc: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d45a2380fbf09c49b2f595171ef6b89fb019445b
Author: Andras Kovacs <andras@sth.sze.hu>
Date:   Fri Jun 27 14:50:11 2014 +0200

    USB: cp210x: add support for Corsair usb dongle

    commit b9326057a3d8447f5d2e74a7b521ccf21add2ec0 upstream.

    Corsair USB Dongles are shipped with Corsair AXi series PSUs.
    These are cp210x serial usb devices, so make driver detect these.
    I have a program, that can get information from these PSUs.

    Tested with 2 different dongles shipped with Corsair AX860i and
    AX1200i units.

    Signed-off-by: Andras Kovacs <andras@sth.sze.hu>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fd7afe29185bf592cb13a698f9a34dc60758447e
Author: Bernd Wachter <bernd.wachter@jolla.com>
Date:   Wed Jul 2 12:36:48 2014 +0300

    usb: option: Add ID for Telewell TW-LTE 4G v2

    commit 3d28bd840b2d3981cd28caf5fe1df38f1344dd60 upstream.

    Add ID of the Telewell 4G v2 hardware to option driver to get legacy
    serial interface working

    Signed-off-by: Bernd Wachter <bernd.wachter@jolla.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fa28e220368027da304ad1147e15a8e4ca7da0d
Merge: b182270 3c9b9e6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 13:19:41 2014 -0700

    Merge "net: ipv4: current group_info should be put after using."

commit 5f9867a14b9d2dfc0198cb98b6a7c7a1c5c5a854
Merge: 375366e fed29b9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 11:50:08 2014 -0700

    Merge "Merge "net: ipv4: current group_info should be put after using.""

commit 3c9b9e6fcdf49a2bae4554747f55e2df16a2ca4a
Author: Wang, Xiaoming <xiaoming.wang@intel.com>
Date:   Mon Apr 14 12:30:45 2014 -0400

    net: ipv4: current group_info should be put after using.

    Plug a group_info refcount leak in ping_init.
    group_info is only needed during initialization and
    the code failed to release the reference on exit.
    While here move grabbing the reference to a place
    where it is actually needed.

    Change-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca
    Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
    Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
    Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Git-commit:b04c46190219a4f845e46a459e3102137b7f6cac
    Git-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
    Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
    [rsiddoji@codeaurora.org: resolve trivial merge conflicts]
    Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>

commit fed29b91eadc9623232c962168612b267295c8d4
Merge: b8d5c41 d21fa7b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 08:31:04 2014 -0700

    Merge "net: ipv4: current group_info should be put after using."

commit b182270e1ca2d06142c619e1b077dd4d4b8c0df2
Merge: 0351df3 9195b6e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 07:31:10 2014 -0700

    Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)"

commit 0351df33c990e05e1c9d47fbd7d63830d81f9292
Merge: e58b56b e7e9373
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 03:37:21 2014 -0700

    Merge "msm: kgsl: fix a race condition when calling kref_put"

commit e58b56b282e38ba26c55647902642cc962eeb675
Merge: 6004283 c665651
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 16 01:40:14 2014 -0700

    Merge "msm: kgsl: Fix Z180 memory leak"

commit c6656512a09a0a9cde2c838037bee18cd15cc6cd
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Wed Mar 26 19:43:57 2014 +0530

    msm: kgsl: Fix Z180 memory leak

    Decerement entry refcount, which incremented
    in kgsl_sharedmem_find_region.

    CRs-Fixed: 635747
    Change-Id: I621ba8f8e119a9ab8ba5455b28a565e3cae2f7cd
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit e7e9373f302cebca6110d3321f5fe6df0a980242
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Thu Mar 27 11:51:52 2014 +0530

    msm: kgsl: fix a race condition when calling kref_put

    Fix a race condition which can occur if a thread tries to acquire
    a reference to a mem_entry or context while another thread has
    already decremented the refcount to 0 and is in the process of
    destroying said mem_entry or context.

    CRs-Fixed: 635747
    Change-Id: I6be64ca75f9cb12b03e870b9ca83588197c64e5e
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 375366ec3b1a9a30b888021d4f531870d81bf342
Merge: 7aa13db b8d5c41
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 15 06:42:19 2014 -0700

    Merge "Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)""

commit 9195b6e4d836325ee3e9eb8f396c835b7384fc13
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

    If uaddr == uaddr2, then we have broken the rule of only requeueing from
    a non-pi futex to a pi futex with this call.  If we attempt this, then
    dangling pointers may be left for rt_waiter resulting in an exploitable
    condition.

    This change brings futex_requeue() in line with futex_wait_requeue_pi()
    which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
    uaddr == uaddr2 in futex_wait_requeue_pi()")

    [ tglx: Compare the resulting keys as well, as uaddrs might be
      	different depending on the mapping ]

    Fixes CVE-2014-3153.

    Reported-by: Pinkie Pie
    Signed-off-by: Will Drewry <wad@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reviewed-by: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
    Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Divya Sharma <c_shard@codeaurora.org>

commit b8d5c41005fad104dcb8b129ecceee6560624318
Merge: 4086854 ecab17b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 15 02:31:29 2014 -0700

    Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)"

commit 60042830a642207e55d712dfaec3c4a1e0d0fbb4
Merge: 713301d e35fa75
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 14 11:51:17 2014 -0700

    Merge "Staging: android: binder: More offset validation."

commit 7aa13db11db9551be619f9e07b5b4d642857458e
Merge: 6c06ef3 4086854
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 14 10:34:11 2014 -0700

    Merge "Merge "Staging: android: binder: More offset validation.""

commit e35fa754547a19e444c3d5732cb8d8797f802960
Author: Arve Hjønnevåg <arve@android.com>
Date:   Thu Feb 13 20:25:06 2014 -0800

    Staging: android: binder: More offset validation.

    Make sure offsets don't point to overlapping flat_binder_object
    structs.

    Conflicts:
    	drivers/staging/android/binder.c

    Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    Git-commit: 457c3cd05958b8397211ae1f6dd3c3d325f4c0ea
    Git-repo: https://android.googlesource.com/kernel/common/
    Signed-off-by: Neeti Desai <neetid@codeaurora.org>
    Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 4086854692fb065567bbee22c10236c3ee5a3c0d
Merge: 9ef9dc3 8880d5b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 14 07:58:19 2014 -0700

    Merge "Staging: android: binder: More offset validation."

commit 713301d474be8c1c7a44544c17fa3d3b76613cea
Merge: 4227da1 273387d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jul 14 03:47:42 2014 -0700

    Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"

commit 6c06ef3f5e50cf64f2af8203c9de1bbdc0dc2aa0
Merge: 3d3a2a0 9ef9dc3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Jul 12 01:31:20 2014 -0700

    Merge "Merge "msm_bam_rmnet: Fix potential memory corruption""

commit 4227da1b8aaacd535bc0f8d6b33c5b4d84c67617
Merge: 72e4b3a 47af311
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Jul 12 01:18:23 2014 -0700

    Merge "msm_bam_rmnet: Fix potential memory corruption"

commit 47af311b3624e577020df9cc17b68bcdaa93935f
Author: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Date:   Mon Jun 2 16:14:43 2014 -0600

    msm_bam_rmnet: Fix potential memory corruption

    Usage of legacy string manipulation function sprintf could lead to
    memory corruption as the number of bytes to be written to the
    destination is not bounded. Replace sprintf with snprintf where the
    number of bytes to be written is explicitly specified.

    CRs-fixed: 672202
    Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
    Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

commit 9ef9dc3030e71d359e3477aa1ed7bb70d9718669
Merge: 07c8228 7eb7890
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Jul 11 21:28:19 2014 -0700

    Merge "msm_bam_rmnet: Fix potential memory corruption"

commit 3d3a2a0cead41d2ccc478681b28bcc613dcb3f83
Merge: 75b38de 07c8228
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Jul 11 17:32:05 2014 -0700

    Merge "Merge "n_tty: Fix n_tty_write crash when echoing in raw mode""

commit 273387d87d2ea3b1e388cb0d441fa49f0632553f
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Tue May 13 14:36:46 2014 -0700

    n_tty: Fix n_tty_write crash when echoing in raw mode

    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST. And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.

    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;

    so the race of the two can result in something like this:
              A                             B
       __tty_buffer_request_room
                                      __tty_buffer_request_room
       memcpy(buf(tb->used), ...)
       tb->used += space;
                                     memcpy(buf(tb->used), ...) ->BOOM

    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.

    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes. This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.

    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.

    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call

    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
    Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
    [rsiddoji@codeaurora.org: resolve trivial merge conflicts]
    Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>

commit 7eb7890163fd90ec8c2abace8bd9ffc61ce573c4
Author: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Date:   Mon Jun 2 16:14:43 2014 -0600

    msm_bam_rmnet: Fix potential memory corruption

    Usage of legacy string manipulation function sprintf could lead to
    memory corruption as the number of bytes to be written to the
    destination is not bounded. Replace sprintf with snprintf where the
    number of bytes to be written is explicitly specified.

    CRs-fixed: 672202
    Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
    Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

commit 58c9e9707e235351c27d497c42395665f8c8840f
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Sat Jun 28 01:00:41 2014 +0900

    f2fs: check bdi->dirty_exceeded when trying to skip data writes

    If we don't check the current backing device status, balance_dirty_pages can
    fall into infinite pausing routine.

    This can be occurred when a lot of directories make a small number of dirty
    dentry pages including files.

    Reported-by: Brian Chadwick <brianchad@westnet.com.au>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 4bb41768fc56c1de512a3c9b3f7f7590f3a7b72e
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Mon Jun 30 18:09:55 2014 +0900

    f2fs: do checkpoint for the renamed inode

    If an inode is renamed, it should be registered as file_lost_pino to conduct
    checkpoint at f2fs_sync_file.
    Otherwise, the inode cannot be recovered due to no dent_mark in the following
    scenario.

    Note that, this scenario is from xfstests/322.

    1. create "a"
    2. fsync "a"
    3. rename "a" to "b"
    4. fsync "b"
    5. Sudden power-cut

    After recovery is done, "b" should be seen.
    However, the result shows "a", since the recovery procedure does not enter
    recover_dentry due to no dent_mark.

    The reason is like below.
    - The nid of "a" is checkpointed during #2, f2fs_sync_file.
    - The inode page for "b" produced by #3 is written without dent_mark by
    sync_node_pages.

    So, this patch fixes this bug by assinging file_lost_pino to the "a"'s inode.
    If the pino is lost, f2fs_sync_file conducts checkpoint, and then recovers
    the latest pino and its dentry information for further recovery.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit a1e4b93612e7535fb384cf32c1cc5a5b4f5992ad
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Jun 24 14:13:13 2014 +0800

    f2fs: release new entry page correctly in error path of f2fs_rename

    This patch correct releasing code of new_page to avoid BUG_ON in error patch of
    f2fs_rename.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 502450ba402455a77edc98fbb4f26197b84ff9a4
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Jun 24 10:34:00 2014 +0800

    f2fs: fix error path in init_inode_metadata

    If we fail in this path:
    ->init_inode_metadata
      ->make_empty_dir
        ->get_new_data_page
          ->grab_cache_page return -ENOMEM

    We will bug on in error path of init_inode_metadata when call remove_inode_page
    because i_block = 2 (one inode block will be released later & one dentry block).

    We should release the dentry block in init_inode_metadata to avoid this BUG_ON,
    and avoid leak of dentry block resource, because we never have second chance to
    release that block in ->evict_inode as in upper error path we make this inode
    'bad'.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 0c0180ae75d236456e58012185d322394ca782ee
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Jun 12 13:23:41 2014 +0800

    f2fs: check lower bound nid value in check_nid_range

    This patch add lower bound verification for nid in check_nid_range, so nids
    reserved like 0, node, meta passed by caller could be checked there.

    And then check_nid_range could be used in f2fs_nfs_get_inode for simplifying
    code.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 8d9b376773c08fa04afc12734d829b54941a14ae
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Wed Jun 11 18:32:23 2014 +0800

    f2fs: remove unused variables in f2fs_sm_info

    Remove unused variables in struct f2fs_sm_info.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit f5e134094afe55cdefc826a0ff0f453f06bd991c
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jun 13 13:07:31 2014 +0900

    f2fs: fix not to allocate unnecessary blocks during fallocate

    This patch fixes the fallocate bug like below. (See xfstests/255)

    In fallocate(fd, 0, 20480),
    expand_inode_data processes
    	for (index = pg_start; index <= pg_end; index++) {
    		f2fs_reserve_block();
    		...
    	}

    So, even though fallocate requests 20480, 5 blocks, f2fs allocates 6 blocks
    including pg_end.
    So, this patch adds one condition to avoid block allocation.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 89aaaac0a7d2e2d8b8d7f9aec14b5603b97a84d1
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jun 13 13:05:55 2014 +0900

    f2fs: recover fallocated data and its i_size together

    This patch arranges the f2fs_locks to cover the fallocated data and its i_size.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit b2532be4a56d89352c58612f94b8ae2fe66daa13
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jun 13 13:02:11 2014 +0900

    f2fs: fix to report newly allocate region as extent

    Previous get_block in f2fs didn't report the newly allocated region which has
    NEW_ADDR.
    For reader, it should not report, but fiemap needs this.
    So, this patch introduces two get_block sharing core function.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit fd9e51e11054023ef4f90a9a7204816ea65d8d25
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Sun Jun 8 04:30:14 2014 +0900

    f2fs: support f2fs_fiemap

    This patch links f2fs_fiemap with generic function with get_block.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit bb0f45e4188bef0d610db695bef56ecb2ab71c3b
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Sat Jun 7 03:05:03 2014 +0900

    f2fs: avoid not to call remove_dirty_inode

    There is an errorneous case during the recovery like below.

    In recovery_dentry,
     1) dir = f2fs_iget();
     2) mark the dir with FI_DELAY_IPUT
     3) goto unmap_out

    After the end of recovery routine, there is no dirty dentries so the dir cannot
    be released by iput in remove_dirty_dir_inode.

    This patch fixes such the bug case by handling the iget and iput in the
    recovery_dentry procedure.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 47b69505249c128581184ed0a970a3acefeb35e9
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Fri Jun 6 02:12:59 2014 +0900

    f2fs: recover fallocated space

    If a fallocated file is fsynced, we should recover the i_size after sudden
    power cut.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 8427691a9c515625dde4796c74016e3140f0616a
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Wed Jun 4 00:39:42 2014 +0900

    f2fs: fix to recover data written by dio

    If data are overwritten through dio, previous f2fs doesn't remain the fsync mark
    due to no additional node writes.

    Note that this patch should resolve the xfstests:311.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit b20cae653112060b2e312b6d325f3676c05eb614
Author: Changman Lee <cm224.lee@samsung.com>
Date:   Mon May 12 12:27:43 2014 +0900

    f2fs: large volume support

    f2fs's cp has one page which consists of struct f2fs_checkpoint and
    version bitmap of sit and nat. To support lots of segments, we need more
    blocks for sit bitmap. So let's arrange sit bitmap as following:
    +-----------------+------------+
    | f2fs_checkpoint | sit bitmap |
    | + nat bitmap    |            |
    +-----------------+------------+
    0                 4k        N blocks

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    [Jaegeuk Kim: simple code change for readability]
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 07c8228730c901dfb7ab93b42ada3a9efefe851a
Merge: 8a8b012 6a3aa61
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Jul 11 13:33:10 2014 -0700

    Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"

commit 481c90798bf51a2f3e466893129e7c5b0b50d3a8
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 27 08:41:07 2014 +0800

    f2fs: avoid crash when trace f2fs_submit_page_mbio event in ra_sum_pages

    Previously we allocate pages with no mapping in ra_sum_pages(), so we may
    encounter a crash in event trace of f2fs_submit_page_mbio where we access
    mapping data of the page.

    We'd better allocate pages in bd_inode mapping and invalidate these pages after
    we restore data from pages. It could avoid crash in above scenario.

    Changes from V1
     o remove redundant code in ra_sum_pages() suggested by Jaegeuk Kim.

    Call Trace:
     [<f1031630>] ? ftrace_raw_event_f2fs_write_checkpoint+0x80/0x80 [f2fs]
     [<f10377bb>] f2fs_submit_page_mbio+0x1cb/0x200 [f2fs]
     [<f103c5da>] restore_node_summary+0x13a/0x280 [f2fs]
     [<f103e22d>] build_curseg+0x2bd/0x620 [f2fs]
     [<f104043b>] build_segment_manager+0x1cb/0x920 [f2fs]
     [<f1032c85>] f2fs_fill_super+0x535/0x8e0 [f2fs]
     [<c115b66a>] mount_bdev+0x16a/0x1a0
     [<f102f63f>] f2fs_mount+0x1f/0x30 [f2fs]
     [<c115c096>] mount_fs+0x36/0x170
     [<c1173635>] vfs_kern_mount+0x55/0xe0
     [<c1175388>] do_mount+0x1e8/0x900
     [<c1175d72>] SyS_mount+0x82/0xc0
     [<c16059cc>] sysenter_do_call+0x12/0x22

    Suggested-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 924642c7283cd97b89f10d80162a3acf33c6967e
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Wed May 28 08:56:09 2014 +0800

    f2fs: avoid overflow when large directory feathure is enabled

    When large directory feathure is enable, We have one case which could cause
    overflow in dir_buckets() as following:
    special case: level + dir_level >= 32 and level < MAX_DIR_HASH_DEPTH / 2.

    Here we define MAX_DIR_BUCKETS to limit the return value when the condition
    could trigger potential overflow.

    Changes from V1
     o modify description of calculation in f2fs.txt suggested by Changman Lee.

    Suggested-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 778d7a8f7809d4f886749fd350dbd4895d8b013a
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date:   Sun Jun 1 23:24:30 2014 +0900

    f2fs: fix recursive lock by f2fs_setxattr

    This patch should resolve the following recursive lock.

    [<ffffffff8135a9c3>] call_rwsem_down_write_failed+0x13/0x20
    [<ffffffffa01749dc>] f2fs_setxattr+0x5c/0xa0 [f2fs]
    [<ffffffffa0174c99>] __f2fs_set_acl+0x1b9/0x340 [f2fs]
    [<ffffffffa017515a>] f2fs_init_acl+0x4a/0xcb [f2fs]
    [<ffffffffa0159abe>] __f2fs_add_link+0x26e/0x780 [f2fs]
    [<ffffffffa015d4d8>] f2fs_mkdir+0xb8/0x150 [f2fs]
    [<ffffffff811cebd7>] vfs_mkdir+0xb7/0x160
    [<ffffffff811cf89b>] SyS_mkdir+0xab/0xe0
    [<ffffffff817244bf>] tracesys+0xe1/0xe6
    [<ffffffffffffffff>] 0xffffffffffffffff

    The call path indicates:
    - f2fs_add_link
       : down_write(&fi->i_sem);

     - init_inode_metadata
       - f2fs_init_acl
         - __f2fs_set_acl
           - f2fs_setxattr
             : down_write(&fi->i_sem);

    Here we should not call f2fs_setxattr, but __f2fs_setxattr.
    But __f2fs_setxattr is a static function in xattr.c, so that I found the other
    generic approach to use f2fs_setxattr.

    In f2fs_setxattr, the page pointer is only given from init_inode_metadata.
    So, this patch adds this condition to avoid this in f2fs_setxattr.

    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

commit 61dfc364af5b3bebc66a43489c1dfef369ea085f
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 6 16:53:08 2014 +0800

    f2fs: add a tracepoint for f2fs_read_data_page

    This patch adds a tracepoint for f2fs_read_data_page to trace when page is
    readed by user.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit c2d652166be90b00cb832da93e7194d57347fa8c
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 6 16:51:24 2014 +0800

    f2fs: add a tracepoint for f2fs_write_{meta,node,data}_pages

    This patch adds a tracepoint for f2fs_write_{meta,node,data}_pages to trace when
    pages are fsyncing/flushing.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit bb4147c173ed940dd598b74b9fa4a2875241b531
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 6 16:48:26 2014 +0800

    f2fs: add a tracepoint for f2fs_write_{meta,node,data}_page

    This patch adds a tracepoint for f2fs_write_{meta,node,data}_page to trace when
    page is writting out.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ebf082ae58c524a528129b881744795f82a0d44b
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 6 16:47:23 2014 +0800

    f2fs: add a tracepoint for f2fs_write_end

    This patch adds a tracepoint for f2fs_write_end to trace write op of user.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit b9b1b9d6d09757f75f682e1f9d671706c4e68323
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue May 6 16:46:04 2014 +0800

    f2fs: add a tracepoint for f2fs_write_begin

    This patch adds a tracepoint for f2fs_write_begin to trace write op of user.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit e422aaf3f1554e5b2288e945505e2dccef7e682a
Author: Zhang Zhen <zhenzhang.zhang@huawei.com>
Date:   Sun May 4 16:37:06 2014 +0800

    f2fs: fix checkpatch warning

    fix the following checkpatch warning:
    WARNING: do {} while (0) macros should not be semicolon terminated

    Signed-off-by: Zhang Zhen <zhenzhang.zhang@huawei.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 9e116196e12cc6143a67595b14fb5373594ab30d
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 30 09:22:45 2014 +0900

    f2fs: decrease the lock granularity during write_begin

    This patch reduces the lock granularity during write_begin.
    When the system is under memory pressure, it would be better to reduce
    the locking time for the data pages.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 207ed413ef0974046827d175f74f4877704aa7a4
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 30 09:18:53 2014 +0900

    f2fs: no need to wait on page writebck to meta pages

    This patch removes grab_cache_page_write_begin for meta pages.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 141c94550a2b7af0f167d062d6db958685d17c58
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 29 17:35:10 2014 +0900

    f2fs: avoid grab_cache_page_write_begin for data pages

    We don't need to wait on page writeback for these cases.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 674c0ab06d2346e31250e7523fd224458eaa9924
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 29 17:28:32 2014 +0900

    f2fs: split grab_cache_page and wait_on_page_writeback for node pages

    This patch splits grab_cache_page_write_begin into grab_cache_page and
    wait_on_page_writeback for node pages.

    This patch intends to enhance the latency to get node pages by alleviating
    unnecessary wait_on_page_writeback.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit be587662400f8e3c191445845eb1748ab5300352
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Apr 29 09:03:03 2014 +0800

    f2fs: fix to truncate inline data in inode page when setattr

    Previous we do not truncate inline data in inode page when setattr, so following
    case could still read the inline data which has already truncated:

    1.write inline data
    2.ftruncate size to 0
    3.ftruncate size to max inline data size
    4.read from offset 0

    This patch introduces truncate_inline_data() to fix this problem.

    change log from v1:
     o fix a bug and do not truncate first page data after truncate inline data.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 4c69dbc822348e768108c3c99289053a8c07a0f2
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Apr 28 17:59:43 2014 +0800

    f2fs: readahead multi pages of directory for performance

    We have no so such readahead mechanism in ->iterate() path as the one in
    ->read() path, it cause low performance when we read large directory.
    This patch add readahead in f2fs_readdir() for better performance.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    Conflicts:
    	fs/f2fs/dir.c

    Change-Id: I2c3c4e204a32dc6486f1a04551f7db619a9e63e8

commit 1a75d30b1ff31723da1435193cd7e9b91867e34d
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Apr 28 17:58:34 2014 +0800

    f2fs: set errno when f2fs_iget failed in recover_dentry

    We should set the error number correctly when we fail in recover_dentry(), so
    the recover flow could stop for the reason as error number shows instead of
    continuing.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f6ca2086cf123e2e726140ee6f3b53b6d47e3e90
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Sat Apr 26 19:59:52 2014 +0800

    f2fs: introduce help macro ADDRS_PER_PAGE()

    Introduce help macro ADDRS_PER_PAGE() to get the number of address pointers in
    direct node or inode.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 1ad2e5a1523993fd6dc4a3ef01e6c49cd7ec2c20
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Apr 24 09:49:52 2014 +0900

    f2fs: submit bio at the reclaim path

    If f2fs_write_data_page is called through the reclaim path, we should submit
    the bio right away.

    This patch resolves the following issue that Marc Dietrich reported.
    "It took me a while to bisect a problem which causes my ARM (tegra2) netbook to
    frequently stall for 5-10 seconds when I enable EXA acceleration (opentegra
    experimental ddx)."
    And this patch fixes that.

    Reported-by: Marc Dietrich <marvin24@gmx.de>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 8ecf404e9c5a9107cac9c0d67346f93e4ab7f8ec
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 23 12:28:18 2014 +0900

    f2fs: return errors right after checking them

    This patch adds two error conditions early in the setxattr operations.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 4fa719c755595f905e32ac3f8c421d3ab3745504
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 23 12:23:14 2014 +0900

    f2fs: pass flags field to setxattr functions

    This patch passes the "flags" field to the low level setxattr functions
    to use XATTR_REPLACE in the following patches.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 57b1194b5c40311bb96d50d50071ff3406780813
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 23 12:17:25 2014 +0900

    f2fs: clean up long variable names

    This patch includes simple clean-ups to reduce unnecessary long variable names.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 68a29e8c53410802d3aad988febe80cca133d5c0
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Apr 22 13:34:01 2014 +0800

    f2fs: handle inline data independently in f2fs_bmap

    We'd better handle inline data case independently in f2fs_bmap().
    It can reduce our handling time in f2fs_bmap().

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit e0bb18f2c7653a3a3922fb1003fc50e8c7f18102
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 16 10:47:06 2014 +0900

    f2fs: adjust free mem size to flush dentry blocks

    If so many dirty dentry blocks are cached, not reached to the flush condition,
    we should fall into livelock in balance_dirty_pages.
    So, let's consider the mem size for the condition.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit b2ce24619015d58ae71bca4c427b102717844eee
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Apr 17 10:51:05 2014 +0800

    f2fs: introduce raw_nat_from_node_info() to simplfy codes

    This patch introduce raw_nat_from_node_info() to simplfy some codes, and also
    use exist function node_info_from_raw_nat() to do the same job.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 1bf53ee12f257693594c88dc9cf01f1d0f338146
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Apr 18 15:21:04 2014 +0900

    f2fs: avoid BUG_ON when mouting corrupted image having garbage blocks

    If the disk has some garbage blocks, F2FS is able to face with BUG_ON when
    recovering direct node blocks.
    This patch detects the error case and avoids that prior to reaching BUG_ON.

    Alexey Khoroshilov addressed the potential security issues as follows.
    "An ability to trigger a BUG_ON assert by mounting a crafted image is
    usually considered as a local denial of service [1-3]. As far as I
    understand, the reason is that some kernel data may become inconsistent
    that can lead to further problems.

    [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3353
    [2] http://www.openwall.com/lists/oss-security/2011/06/24/4
    [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2928
    etc."

    Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru>
    Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ea046115256934c4a3f67ef2820dcf675df153c7
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Apr 18 11:14:37 2014 +0900

    f2fs: add available_nids to fix handling max_nid correctly

    This patch introduces available_nids for alloc_nids() and fixes max_nid for
    build_free_nids() and scan_nat_pages().

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 31c581b69204d5b526280609377ae34db057cd7c
Author: Fabian Frederick <fabf@skynet.be>
Date:   Thu Apr 17 17:51:06 2014 +0200

    f2fs: add static to get_max_meta_blks

    inline get_max_meta_blks is only used in checkpoint.c
    Use standard static inline format.

    Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Fabian Frederick <fabf@skynet.be>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit a6f35719b0e1e10384b405326ced08b8c656d505
Author: Zhang Zhen <zhenzhang.zhang@huawei.com>
Date:   Tue Apr 15 14:19:38 2014 +0800

    f2fs: atomically set inode->i_flags in f2fs_set_inode_flags()

    Use set_mask_bits() to atomically set i_flags instead of clearing out the
    S_IMMUTABLE, S_APPEND, etc. flags and then setting them from the
    FS_IMMUTABLE_FL, FS_APPEND_FL, etc. flags, since this opens up a race
    where an immutable file has the immutable flag cleared for a brief
    window of time.

    Signed-off-by: Zhang Zhen <zhenzhang.zhang@huawei.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 0e8030a4383ccde3828ec412433de1395486f007
Author: Jingoo Han <jg1.han@samsung.com>
Date:   Tue Apr 15 17:51:05 2014 +0900

    f2fs: make recover_inline_xattr() static

    Make recover_inline_xattr() static, because this function is
    used only in this file.

    Signed-off-by: Jingoo Han <jg1.han@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 28f5f0d3be20a943ad71cc7db57a9229b5ce8130
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 15 11:19:28 2014 +0900

    f2fs: remove costly dirty_dir_inode operations

    This patch removes list opeations in handling dirty dir inodes.
    Previously, F2FS traverses whole the list of dirty dir inodes to check whether
    there is an existing inode or not, resulting in heavy CPU overheads.

    So this patch removes such the traverse operations by adding FI_DIRTY_DIR to
    indicate the inode lies on the list or not.
    Through this simple flag, we can remove redundant operations gracefully.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 9a0f6dc3b9fb66efe68919421a1944d349085803
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Apr 16 14:22:50 2014 +0900

    f2fs: fix to unlock f2fs_lock at the omitted error case

    If it occurs an error, we should call f2fs_unlock_op.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 567572da435f5bc70672090d5bbc99a03ea6e9c1
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 15 16:04:15 2014 +0900

    f2fs: call redirty_page_for_writepage

    This patch replace some general codes with redirty_page_for_writepage, which
    can be enabled after consideration on additional procedure like counting dirty
    pages appropriately.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit d8be3481091443869343c1239f23aaf63ce35897
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 15 13:57:55 2014 +0900

    f2fs: avoid to conduct roll-forward due to the remained garbage blocks

    The f2fs always scans the next chain of direct node blocks.
    But some garbage blocks are able to be remained due to no discard support or
    SSR triggers.
    This occasionally wreaks recovering wrong inodes that were used or BUG_ONs
    due to reallocating node ids as follows.

    When mount this f2fs image:
    http://linuxtesting.org/downloads/f2fs_fault_image.zip
    BUG_ON is triggered in f2fs driver (messages below are generated on
    kernel 3.13.2; for other kernels output is similar):

    kernel BUG at fs/f2fs/node.c:215!
     Call Trace:
     [<ffffffffa032ebad>] recover_inode_page+0x1fd/0x3e0 [f2fs]
     [<ffffffff811446e7>] ? __lock_page+0x67/0x70
     [<ffffffff81089990>] ? autoremove_wake_function+0x50/0x50
     [<ffffffffa0337788>] recover_fsync_data+0x1398/0x15d0 [f2fs]
     [<ffffffff812b9e5c>] ? selinux_d_instantiate+0x1c/0x20
     [<ffffffff811cb20b>] ? d_instantiate+0x5b/0x80
     [<ffffffffa0321044>] f2fs_fill_super+0xb04/0xbf0 [f2fs]
     [<ffffffff811b861e>] ? mount_bdev+0x7e/0x210
     [<ffffffff811b8769>] mount_bdev+0x1c9/0x210
     [<ffffffffa0320540>] ? validate_superblock+0x210/0x210 [f2fs]
     [<ffffffffa031cf8d>] f2fs_mount+0x1d/0x30 [f2fs]
     [<ffffffff811b9497>] mount_fs+0x47/0x1c0
     [<ffffffff81166e00>] ? __alloc_percpu+0x10/0x20
     [<ffffffff811d4032>] vfs_kern_mount+0x72/0x110
     [<ffffffff811d6763>] do_mount+0x493/0x910
     [<ffffffff811615cb>] ? strndup_user+0x5b/0x80
     [<ffffffff811d6c70>] SyS_mount+0x90/0xe0
     [<ffffffff8166f8d9>] system_call_fastpath+0x16/0x1b

    Found by Linux File System Verification project (linuxtesting.org).

    Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 74f63707cb36bb55dd24fce6c77cdf2bff5c484c
Author: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Date:   Mon Jun 2 16:14:43 2014 -0600

    msm_bam_rmnet: Fix potential memory corruption

    Usage of legacy string manipulation function sprintf could lead to
    memory corruption as the number of bytes to be written to the
    destination is not bounded. Replace sprintf with snprintf where the
    number of bytes to be written is explicitly specified.

    CRs-fixed: 672202
    Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
    Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

commit 6a3aa61a68d662cce468af1ed326fddf54109ad1
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Tue May 13 14:36:46 2014 -0700

    n_tty: Fix n_tty_write crash when echoing in raw mode

    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST. And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.

    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;

    so the race of the two can result in something like this:
              A                             B
       __tty_buffer_request_room
                                      __tty_buffer_request_room
       memcpy(buf(tb->used), ...)
       tb->used += space;
                                     memcpy(buf(tb->used), ...) ->BOOM

    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.

    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes. This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.

    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.

    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call

    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
    Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
    [rsiddoji@codeaurora.org: resolve trivial merge conflicts]
    Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>

commit 2fd6163465b5b3254a8330acbb8e0da7eae6d47d
Author: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Date:   Fri Jul 11 13:42:01 2014 +0530

    msm: camera: Propogate vpe subdev init error

    Propogate vpe subdev init error so that we dont end up
    in NULL pointer dereference.

    CRs-Fixed: 637459
    Change-Id: I4582a8a673576c525ad3b59a3c6a8e983a1d0941
    Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

commit f49114d75a2ce4b7143f8b555491290447c66519
Author: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Date:   Fri Jul 11 13:42:01 2014 +0530

    msm: camera: Propogate vpe subdev init error

    Propogate vpe subdev init error so that we dont end up
    in NULL pointer dereference.

    CRs-Fixed: 637459
    Change-Id: I4582a8a673576c525ad3b59a3c6a8e983a1d0941
    Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

commit 7fcfad3215daef3afc7fee20d352bfb43de7afdb
Author: Jiri Pirko <jiri@resnulli.us>
Date:   Fri Jun 27 14:25:28 2014 +0530

    [PATCH] netlink: add signed types

    Signed types might be needed in NL communication from time to time
    (I need s32 in team driver), so add them.

    Change-Id: Icc6c8286a1d55313fcc7993d8b02267fe1ef2bdc
    CRs-Fixed: 677858
    Signed-off-by: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 65d27c29229b138d89583e54b2fa29bab4b9747f
Author: Sreeram Ramachandran <sreeram@google.com>
Date:   Tue Jul 8 11:37:03 2014 -0700

    Handle 'sk' being NULL in UID-based routing.

    Bug: 15413527
    Change-Id: If33bebb7b52c0ebfa8dac2452607bce0c2b0faa0
    Signed-off-by: Sreeram Ramachandran <sreeram@google.com>

commit b7a4ec408cf6df7259e7e9bb237dee89e02c1d0a
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Mon Mar 31 16:23:51 2014 +0900

    net: core: Support UID-based routing.

    This contains the following commits:

    1. 0149763 net: core: Add a UID range to fib rules.
    2. 1650474 net: core: Use the socket UID in routing lookups.
    3. 0b16771 net: ipv4: Add the UID to the route cache.
    4. ee058f1 net: core: Add a RTA_UID attribute to routes.
        This is so that userspace can do per-UID route lookups.

    Bug: 15413527
    Change-Id: I1285474c6734614d3bda6f61d88dfe89a4af7892
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

commit 963f37ddb7f6f37b9d4a9686870568125d6fe3a2
Author: Mark Salyzyn <salyzyn@google.com>
Date:   Fri May 9 16:32:55 2014 -0700

    s3c2410_wdt: Add locking to cpu frequency transition notifier

    Signed-of-by: Mark Salyzyn <salyzyn@google.com>
    Bug: 8173205
    Change-Id: I72b2571909fb464ae47a35922049b40eb0486d53

commit bc3a17ae5d64548cbc9e420441463b152012f51e
Merge: 9f3ee8a 0bbbf93
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Jul 9 18:55:19 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	net/bluetooth/hci_event.c

    Change-Id: If491cdb639d2101d0ee224df4ea0ec0198c24092

commit 0bbbf93fb1ca152cc556aa80f83d653dd0bcb242
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Jul 9 10:52:25 2014 -0700

    Linux 3.4.98

commit 50a28baa75d832d8f74e1f6bf7ca247eb92b77be
Author: Hugh Dickins <hughd@google.com>
Date:   Mon Jun 23 13:22:07 2014 -0700

    mm: fix crashes from mbind() merging vmas

    commit d05f0cdcbe6388723f1900c549b4850360545201 upstream.

    In v2.6.34 commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem")
    introduced vma merging to mbind(), but it should have also changed the
    convention of passing start vma from queue_pages_range() (formerly
    check_range()) to new_vma_page(): vma merging may have already freed
    that structure, resulting in BUG at mm/mempolicy.c:1738 and probably
    worse crashes.

    Fixes: 9d8cebd4bcd7 ("mm: fix mbind vma merge problem")
    Reported-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Acked-by: Christoph Lameter <cl@linux.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Minchan Kim <minchan.kim@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2bcdd4933ff4dc46445dcae93cb37c648283b782
Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date:   Mon Jun 23 13:22:03 2014 -0700

    hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned entry

    commit 4a705fef986231a3e7a6b1a6d3c37025f021f49f upstream.

    There's a race between fork() and hugepage migration, as a result we try
    to "dereference" a swap entry as a normal pte, causing kernel panic.
    The cause of the problem is that copy_hugetlb_page_range() can't handle
    "swap entry" family (migration entry and hwpoisoned entry) so let's fix
    it.

    [akpm@linux-foundation.org: coding-style fixes]
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: <stable@vger.kernel.org>	[2.6.37+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08ccce4afe13b2dcad0ac2a86b7bc138207814ff
Author: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
Date:   Wed Oct 2 00:34:10 2013 +0530

    powerpc/sysfs: Disable writing to PURR in guest mode

    commit d1211af3049f4c9c1d8d4eb8f8098cc4f4f0d0c7 upstream.

    arch/powerpc/kernel/sysfs.c exports PURR with write permission.
    This may be valid for kernel in phyp mode. But writing to
    the file in guest mode causes crash due to a priviledge violation

    Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    [Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit badd9b71c5651a687d042966a5fa8d195e9cffe4
Author: Gustavo Maciel Dias Vieira <gustavo@sagui.org>
Date:   Mon Mar 4 15:23:37 2013 +0000

    ACPI video: ignore BIOS backlight value for HP dm4

    commit 771d09b3c4c45d4d534a83a68e6331b97fd82e15 upstream.

    On a HP Pavilion dm4 laptop the BIOS sets minimum backlight on boot,
    completely dimming the screen. Ignore this initial value for this
    machine.

    Signed-off-by: Gustavo Maciel Dias Vieira <gustavo@sagui.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e1ba6fccd86b50c3d893e5128515f355df6b066
Author: Anton Blanchard <anton@samba.org>
Date:   Sun Nov 17 11:39:05 2013 +1100

    powerpc/pseries: Duplicate dtl entries sometimes sent to userspace

    commit 84b073868b9d9e754ae48b828337633d1b386482 upstream.

    When reading from the dispatch trace log (dtl) userspace interface, I
    sometimes see duplicate entries. One example:

    # hexdump -C dtl.out

    00000000  07 04 00 0c 00 00 48 44  00 00 00 00 00 00 00 00
    00000010  00 0c a0 b4 16 83 6d 68  00 00 00 00 00 00 00 00
    00000020  00 00 00 00 10 00 13 50  80 00 00 00 00 00 d0 32

    00000030  07 04 00 0c 00 00 48 44  00 00 00 00 00 00 00 00
    00000040  00 0c a0 b4 16 83 6d 68  00 00 00 00 00 00 00 00
    00000050  00 00 00 00 10 00 13 50  80 00 00 00 00 00 d0 32

    The problem is in scan_dispatch_log() where we call dtl_consumer()
    but bail out before incrementing the index.

    To fix this I moved dtl_consumer() after the timebase comparison.

    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1ca0f8ee2e5874e309f2a9956e74edfdf541ce4
Author: Chen Gang <gang.chen@asianux.com>
Date:   Mon Apr 22 17:12:54 2013 +0000

    powerpc/pseries/lparcfg: Fix possible overflow are more than 1026

    commit 5676005acf26ab7e924a8438ea4746e47d405762 upstream.

    need set '\0' for 'local_buffer'.

    SPLPAR_MAXLENGTH is 1026, RTAS_DATA_BUF_SIZE is 4096. so the contents of
    rtas_data_buf may truncated in memcpy.

    if contents are really truncated.
      the splpar_strlen is more than 1026. the next while loop checking will
      not find the end of buffer. that will cause memory access violation.

    Signed-off-by: Chen Gang <gang.chen@asianux.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b36b7f617524596dc8900c1f8c3ab051c6b9dc5
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Tue Oct 1 17:11:35 2013 +1000

    powerpc: Restore registers on error exit from csum_partial_copy_generic()

    commit 8f21bd0090052e740944f9397e2be5ac7957ded7 upstream.

    The csum_partial_copy_generic() function saves the PowerPC non-volatile
    r14, r15, and r16 registers for the main checksum-and-copy loop.
    Unfortunately, it fails to restore them upon error exit from this loop,
    which results in silent corruption of these registers in the presumably
    rare event of an access exception within that loop.

    This commit therefore restores these register on error exit from the loop.

    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    [bwh: Backported to 3.2: register name macros use lower-case 'r']
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 58b9385170d93957a0518d4ee9c4b1c5068bc7ef
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Tue Aug 27 16:38:33 2013 +1000

    powerpc: Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor

    commit f5f6cbb61610b7bf9d9d96db9c3979d62a424bab upstream.

    /proc/powerpc/lparcfg is an ancient facility (though still actively used)
    which allows access to some informations relative to the partition when
    running underneath a PAPR compliant hypervisor.

    It makes no sense on non-pseries machines. However, currently, not only
    can it be created on these if the kernel has pseries support, but accessing
    it on such a machine will crash due to trying to do hypervisor calls.

    In fact, it should also not do HV calls on older pseries that didn't have
    an hypervisor either.

    Finally, it has the plumbing to be a module but is a "bool" Kconfig option.

    This fixes the whole lot by turning it into a machine_device_initcall
    that is only created on pseries, and adding the necessary hypervisor
    check before calling the H_GET_EM_PARMS hypercall

    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    [bwh: Backported to 3.2: lparcfg_cleanup() was a bit different]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1902a25fe0413d9ffc9565f243ef3d07170e9f61
Author: Chen Gang <gang.chen@asianux.com>
Date:   Wed Mar 20 14:30:12 2013 +0800

    powerpc/smp: Section mismatch from smp_release_cpus to __initdata spinning_secondaries

    commit 8246aca7058f3f2c2ae503081777965cd8df7b90 upstream.

    the smp_release_cpus is a normal funciton and called in normal environments,
      but it calls the __initdata spinning_secondaries.
      need modify spinning_secondaries to match smp_release_cpus.

    the related warning:
      (the linker report boot_paca.33377, but it should be spinning_secondaries)

    -----------------------------------------------------------------------------

    WARNING: arch/powerpc/kernel/built-in.o(.text+0x23176): Section mismatch in reference from the function .smp_release_cpus() to the variable .init.data:boot_paca.33377
    The function .smp_release_cpus() references
    the variable __initdata boot_paca.33377.
    This is often because .smp_release_cpus lacks a __initdata
    annotation or the annotation of boot_paca.33377 is wrong.

    WARNING: arch/powerpc/kernel/built-in.o(.text+0x231fe): Section mismatch in reference from the function .smp_release_cpus() to the variable .init.data:boot_paca.33377
    The function .smp_release_cpus() references
    the variable __initdata boot_paca.33377.
    This is often because .smp_release_cpus lacks a __initdata
    annotation or the annotation of boot_paca.33377 is wrong.

    -----------------------------------------------------------------------------

    Signed-off-by: Chen Gang <gang.chen@asianux.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ee65967c7b587174a32f0d28e0ceff230650d43
Author: Paul Mackerras <paulus@samba.org>
Date:   Fri Jun 14 20:07:41 2013 +1000

    powerpc: Fix emulation of illegal instructions on PowerNV platform

    commit bf593907f7236e95698a76b7c7a2bbf8b1165327 upstream.

    Normally, the kernel emulates a few instructions that are unimplemented
    on some processors (e.g. the old dcba instruction), or privileged (e.g.
    mfpvr).  The emulation of unimplemented instructions is currently not
    working on the PowerNV platform.  The reason is that on these machines,
    unimplemented and illegal instructions cause a hypervisor emulation
    assist interrupt, rather than a program interrupt as on older CPUs.
    Our vector for the emulation assist interrupt just calls
    program_check_exception() directly, without setting the bit in SRR1
    that indicates an illegal instruction interrupt.  This fixes it by
    making the emulation assist interrupt set that bit before calling
    program_check_interrupt().  With this, old programs that use no-longer
    implemented instructions such as dcba now work again.

    Signed-off-by: Paul Mackerras <paulus@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit edc9d9afcedef8e1cdf43b8f95baa86a2daf0ad1
Author: Kevin McKinney <klmckinney1@gmail.com>
Date:   Mon Nov 12 22:20:30 2012 -0500

    Staging: bcm: Add two products and remove an existing product.

    commit 4f29ef050848245f7c180b95ccf67dfcd76b1fd8 upstream.

    This patch adds two new products and modifies
    the device id table to include them. In addition,
    product of 0xbccd - BCM_USB_PRODUCT_ID_SM250 is
    removed because Beceem, ZTE, Sprint use this id
    for block devices.

    Reported-by: Muhammad Minhazul Haque <mdminhazulhaque@gmail.com>
    Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3e786c7aac5c4ddd5fd3faf53f47f63d5377db4
Author: Kevin McKinney <klmckinney1@gmail.com>
Date:   Tue Sep 11 22:19:06 2012 -0400

    Staging: bcm: Create and initialize new device id in InterfaceInit

    commit e66fc1fba248738d32f3b64508f9ef1176d9e767 upstream.

    This patch create and initalizes a new device
    id of 0x172 as reported by Rinat Camalov
    <richman1000000d@gmail.com>. In addition, a
    comment is added to the potential invalid
    existing device id.

    Reported-by: Rinat Camalov <richman1000000d@gmail.com>
    Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f668a072fbac9357815ef8af5a3b468267929b3
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Oct 29 23:00:15 2013 +0300

    staging: wlags49_h2: buffer overflow setting station name

    commit b5e2f339865fb443107e5b10603e53bbc92dc054 upstream.

    We need to check the length parameter before doing the memcpy().  I've
    actually changed it to strlcpy() as well so that it's NUL terminated.

    You need CAP_NET_ADMIN to trigger these so it's not the end of the
    world.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d4a64a9257d84e326e36fb793f0541fa0595ac83
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Fri Jul 5 16:49:34 2013 +0100

    staging: comedi: fix a race between do_cmd_ioctl() and read/write

    commit 4b18f08be01a7b3c7b6df497137b6e3cb28adaa3 upstream.

    `do_cmd_ioctl()` is called with the comedi device's mutex locked to
    process the `COMEDI_CMD` ioctl to set up comedi's asynchronous command
    handling on a comedi subdevice.  `comedi_read()` and `comedi_write()`
    are the `read` and `write` handlers for the comedi device, but do not
    lock the mutex (for performance reasons, as some things can hold the
    mutex for quite a long time).

    There is a race condition if `comedi_read()` or `comedi_write()` is
    running at the same time and for the same file object and comedi
    subdevice as `do_cmd_ioctl()`.  `do_cmd_ioctl()` sets the subdevice's
    `busy` pointer to the file object way before it sets the `SRF_RUNNING` flag
    in the subdevice's `runflags` member.  `comedi_read() and
    `comedi_write()` check the subdevice's `busy` pointer is pointing to the
    current file object, then if the `SRF_RUNNING` flag is not set, will call
    `do_become_nonbusy()` to shut down the asyncronous command.  Bad things
    can happen if the asynchronous command is being shutdown and set up at
    the same time.

    To prevent the race, don't set the `busy` pointer until
    after the `SRF_RUNNING` flag has been set.  Also, make sure the mutex is
    held in `comedi_read()` and `comedi_write()` while calling
    `do_become_nonbusy()` in order to avoid moving the race condition to a
    point within that function.

    Change some error handling `goto cleanup` statements in `do_cmd_ioctl()`
    to simple `return -ERRFOO` statements as a result of changing when the
    `busy` pointer is set.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2a6ae027c17987eeed85633ed9c3e84d957da70e
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Fri Aug 31 20:41:29 2012 +0100

    staging: comedi: das08: Correct AI encoding for das08jr-16-ao

    commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.

    The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
    `ai_encoding` member set to `das08_encode12`.  It should be set to
    `das08_encode16` same as the 'das08jr/16' board.  After all, this board
    has 16-bit AI resolution.

    The description of the A/D LSB register at offset 0 seems incorrect in
    the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
    resolution is only 12 bits.  The diagrams of the A/D LSB and MSB
    registers show 15 data bits and a sign bit, which matches what the
    software expects for the `das08_encode16` AI encoding method.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e4337b79778174128fcd785f353047384499d3e
Author: Alex Hung <alex.hung@canonical.com>
Date:   Mon May 6 08:23:43 2013 +0000

    ACPI video: ignore BIOS initial backlight value for HP 1000

    commit 4ef366c583d6180b1c951147869ee5a3038834f2 upstream.

    On HP 1000 lapops, BIOS reports minimum backlight on boot and
    causes backlight to dim completely. This ignores the initial backlight
    values and set to max brightness.

    References:: https://bugs.launchpad.net/bugs/1167760
    Signed-off-by: Alex Hung <alex.hung@canonical.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 047cce410d083cf08de91bf76aa9bbdae989a285
Author: Bastian Triller <bastian.triller@gmail.com>
Date:   Sun May 19 11:52:33 2013 +0000

    ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist

    commit c8f6d8351ba8c89d5cd4c562552ec7ec29274e31 upstream.

    Like on UL30VT, the ACPI video driver can't control backlight correctly on
    Asus UL30A.  Vendor driver (asus-laptop) can work.  This patch is to
    add "Asus UL30A" to ACPI video detect blacklist in order to use
    asus-laptop for video control on the "Asus UL30A" rather than ACPI
    video driver.

    Signed-off-by: Bastian Triller <bastian.triller@gmail.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 622c5c1435caee7f023de2e422f8e33d3996b9de
Author: Lan Tianyu <tianyu.lan@intel.com>
Date:   Fri Nov 30 13:02:50 2012 +0100

    ACPI / video: Add "Asus UL30VT" to ACPI video detect blacklist

    commit d0c2ce16bec0afa6013b4c5220ca4c9c67210215 upstream.

    The ACPI video driver can't control backlight correctly on
    Asus UL30VT.  Vendor driver (asus-laptop) can work.  This patch is to
    add "Asus UL30VT" to ACPI video detect blacklist in order to use
    asus-laptop for video control on the "Asus UL30VT" rather than ACPI
    video driver.

    References: https://bugzilla.kernel.org/show_bug.cgi?id=32592
    Reported-by: Alex Williamson <alex.williamson@redhat.com>
    Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 89c9afdbdcfdc720fa6ce5acf3745dda6e81a7db
Author: Corentin Chary <corentin.chary@gmail.com>
Date:   Wed Jun 13 09:32:04 2012 +0200

    acpi/video_detect: blacklist samsung x360

    commit 084940d5b101e9ca91a689eb5048151b14076839 upstream.

    On Samsung X360, the BIOS will set a flag (VDRV) if the generic
    ACPI backlight device is used. This flag will definitively break
    the backlight interface (even the vendor interface) untill next
    reboot. It's why we should prevent video.ko from being used here
    and we can't rely on a later call to acpi_video_unregister().

    Signed-off-by: Corentin Chary <corentin.chary@gmail.com>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e51d5ac0181d0b7229536fc7fd4c790865f2cdb
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Tue Apr 8 21:52:05 2014 -0400

    sym53c8xx_2: Set DID_REQUEUE return code when aborting squeue

    commit fd1232b214af43a973443aec6a2808f16ee5bf70 upstream.

    This patch fixes I/O errors with the sym53c8xx_2 driver when the disk
    returns QUEUE FULL status.

    When the controller encounters an error (including QUEUE FULL or BUSY
    status), it aborts all not yet submitted requests in the function
    sym_dequeue_from_squeue.

    This function aborts them with DID_SOFT_ERROR.

    If the disk has full tag queue, the request that caused the overflow is
    aborted with QUEUE FULL status (and the scsi midlayer properly retries
    it until it is accepted by the disk), but the sym53c8xx_2 driver aborts
    the following requests with DID_SOFT_ERROR --- for them, the midlayer
    does just a few retries and then signals the error up to sd.

    The result is that disk returning QUEUE FULL causes request failures.

    The error was reproduced on 53c895 with COMPAQ BD03685A24 disk
    (rebranded ST336607LC) with command queue 48 or 64 tags.  The disk has
    64 tags, but under some access patterns it return QUEUE FULL when there
    are less than 64 pending tags.  The SCSI specification allows returning
    QUEUE FULL anytime and it is up to the host to retry.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Cc: Matthew Wilcox <matthew@wil.cx>
    Cc: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d3ef6557f0130b07ff09c962593b9cf51f9f6346
Author: NeilBrown <neilb@suse.de>
Date:   Wed Jul 2 12:04:14 2014 +1000

    md: flush writes before starting a recovery.

    commit 133d4527eab8d199a62eee6bd433f0776842df2e upstream.

    When we write to a degraded array which has a bitmap, we
    make sure the relevant bit in the bitmap remains set when
    the write completes (so a 're-add' can quickly rebuilt a
    temporarily-missing device).

    If, immediately after such a write starts, we incorporate a spare,
    commence recovery, and skip over the region where the write is
    happening (because the 'needs recovery' flag isn't set yet),
    then that write will not get to the new device.

    Once the recovery finishes the new device will be trusted, but will
    have incorrect data, leading to possible corruption.

    We cannot set the 'needs recovery' flag when we start the write as we
    do not know easily if the write will be "degraded" or not.  That
    depends on details of the particular raid level and particular write
    request.

    This patch fixes a corruption issue of long standing and so it
    suitable for any -stable kernel.  It applied correctly to 3.0 at
    least and will minor editing to earlier kernels.

    Reported-by: Bill <billstuff2001@sbcglobal.net>
    Tested-by: Bill <billstuff2001@sbcglobal.net>
    Link: http://lkml.kernel.org/r/53A518BB.60709@sbcglobal.net
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21057e4a4d6155e0594573e7d5d8dd7dcf537774
Author: Michal Nazarewicz <mina86@mina86.com>
Date:   Fri Jun 13 15:38:05 2014 +0200

    tools: ffs-test: fix header values endianess

    commit f35f71244da6e51db4e1f2c7e318581f498ececf upstream.

    It appears that no one ever run ffs-test on a big-endian machine,
    since it used cpu-endianess for fs_count and hs_count fields which
    should be in little-endian format.  Fix by wrapping the numbers in
    cpu_to_le32.

    Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a22a7e7ba7d3b7f4288bfde1f9ab552905366f32
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Thu Jun 19 16:44:48 2014 -0400

    nfsd: fix rare symlink decoding bug

    commit 76f47128f9b33af1e96819746550d789054c9664 upstream.

    An NFS operation that creates a new symlink includes the symlink data,
    which is xdr-encoded as a length followed by the data plus 0 to 3 bytes
    of zero-padding as required to reach a 4-byte boundary.

    The vfs, on the other hand, wants null-terminated data.

    The simple way to handle this would be by copying the data into a newly
    allocated buffer with space for the final null.

    The current nfsd_symlink code tries to be more clever by skipping that
    step in the (likely) case where the byte following the string is already
    0.

    But that assumes that the byte following the string is ours to look at.
    In fact, it might be the first byte of a page that we can't read, or of
    some object that another task might modify.

    Worse, the NFSv4 code tries to fix the problem by actually writing to
    that byte.

    In the NFSv2/v3 cases this actually appears to be safe:

    	- nfs3svc_decode_symlinkargs explicitly null-terminates the data
    	  (after first checking its length and copying it to a new
    	  page).
    	- NFSv2 limits symlinks to 1k.  The buffer holding the rpc
    	  request is always at least a page, and the link data (and
    	  previous fields) have maximum lengths that prevent the request
    	  from reaching the end of a page.

    In the NFSv4 case the CREATE op is potentially just one part of a long
    compound so can end up on the end of a page if you're unlucky.

    The minimal fix here is to copy and null-terminate in the NFSv4 case.
    The nfsd_symlink() interface here seems too fragile, though.  It should
    really either do the copy itself every time or just require a
    null-terminated string.

    Reported-by: Jeff Layton <jlayton@primarydata.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a96a557e2573a81ca6d62e6c5a0cee119f25ef78
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Thu Jun 19 11:40:18 2014 +0200

    KVM: x86: preserve the high 32-bits of the PAT register

    commit 7cb060a91c0efc5ff94f83c6df3ed705e143cdb9 upstream.

    KVM does not really do much with the PAT, so this went unnoticed for a
    long time.  It is exposed however if you try to do rdmsr on the PAT
    register.

    Reported-by: Valentine Sinitsyn <valentine.sinitsyn@gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80bbfbaa050a92ce9937904f5d937e7a9ca2b584
Author: Nadav Amit <namit@cs.technion.ac.il>
Date:   Wed Jun 18 17:21:19 2014 +0300

    KVM: x86: Increase the number of fixed MTRR regs to 10

    commit 682367c494869008eb89ef733f196e99415ae862 upstream.

    Recent Intel CPUs have 10 variable range MTRRs. Since operating systems
    sometime make assumptions on CPUs while they ignore capability MSRs, it is
    better for KVM to be consistent with recent CPUs. Reporting more MTRRs than
    actually supported has no functional implications.

    Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6e44d311e993f364bbf4d99e2b6beac25f03bdbe
Author: Steve French <smfrench@gmail.com>
Date:   Sun Jun 22 20:38:49 2014 -0500

    CIFS: fix mount failure with broken pathnames when smb3 mount with mapchars option

    commit ce36d9ab3bab06b7b5522f5c8b68fac231b76ffb upstream.

    When we SMB3 mounted with mapchars (to allow reserved characters : \ / > < * ?
    via the Unicode Windows to POSIX remap range) empty paths
    (eg when we open "" to query the root of the SMB3 directory on mount) were not
    null terminated so we sent garbarge as a path name on empty paths which caused
    SMB2/SMB2.1/SMB3 mounts to fail when mapchars was specified.  mapchars is
    particularly important since Unix Extensions for SMB3 are not supported (yet)

    Signed-off-by: Steve French <smfrench@gmail.com>
    Reviewed-by: David Disseldorp <ddiss@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74be85d10748a196626d8c0e531c75c11d26ad95
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Thu Jun 12 22:28:22 2014 +0200

    b43: fix frequency reported on G-PHY with /new/ firmware

    commit 2fc68eb122c7ea6cd5be1fe7d6650c0beb2f4f40 upstream.

    Support for firmware rev 508+ was added years ago, but we never noticed
    it reports channel in a different way for G-PHY devices. Instead of
    offset from 2400 MHz it simply passes channel id (AKA hw_value).

    So far it was (most probably) affecting monitor mode users only, but
    the following recent commit made it noticeable for quite everybody:

    commit 3afc2167f60a327a2c1e1e2600ef209a3c2b75b7
    Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Date:   Tue Mar 4 16:50:13 2014 +0200

        cfg80211/mac80211: ignore signal if the frame was heard on wrong channel

    Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ba8f03aa4a5aced02df87e69737922eeb14a7350
Author: David R. Piegdon <lkml@p23q.org>
Date:   Mon Jun 16 23:42:51 2014 +0000

    ARM: OMAP2+: Fix parser-bug in platform muxing code

    commit c021f241f4fab2bb4fc4120a38a828a03dd3f970 upstream.

    Fix a parser-bug in the omap2 muxing code where muxtable-entries will be
    wrongly selected if the requested muxname is a *prefix* of their
    m0-entry and they have a matching mN-entry. Fix by additionally checking
    that the length of the m0_entry is equal.

    For example muxing of "dss_data2.dss_data2" on omap32xx will fail
    because the prefix "dss_data2" will match the mux-entries "dss_data2" as
    well as "dss_data20", with the suffix "dss_data2" matching m0 (for
    dss_data2) and m4 (for dss_data20). Thus both are recognized as signal
    path candidates:

    Relevant muxentries from mux34xx.c:
            _OMAP3_MUXENTRY(DSS_DATA20, 90,
                    "dss_data20", NULL, "mcspi3_somi", "dss_data2",
                    "gpio_90", NULL, NULL, "safe_mode"),
            _OMAP3_MUXENTRY(DSS_DATA2, 72,
                    "dss_data2", NULL, NULL, NULL,
                    "gpio_72", NULL, NULL, "safe_mode"),

    This will result in a failure to mux the pin at all:

     _omap_mux_get_by_name: Multiple signal paths (2) for dss_data2.dss_data2

    Patch should apply to linus' latest master down to rather old linux-2.6
    trees.

    Signed-off-by: David R. Piegdon <lkml@p23q.org>
    Cc: stable@vger.kernel.org
    [tony@atomide.com: updated description to include full description]
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc0bfd69158e4eb64d8ca75ed382b5215f3461c1
Author: Arik Nemtsov <arik@wizery.com>
Date:   Mon May 26 14:40:51 2014 +0300

    mac80211: don't check netdev state for debugfs read/write

    commit 923eaf367206e01f22c97aee22300e332d071916 upstream.

    Doing so will lead to an oops for a p2p-dev interface, since it has
    no netdev.

    Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb688f6a4b6090dbcdccc935cf074618c0f421c1
Author: Syam Sidhardhan <s.syam@samsung.com>
Date:   Thu Apr 12 20:33:17 2012 +0530

    Bluetooth: Remove unused hci_le_ltk_reply()

    commit e10b9969f217c948c5523045f44eba4d3a758ff0 upstream.

    In this API, we were using sizeof operator for an array
    given as function argument, which is invalid.
    However this API is not used anywhere.

    Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
    Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bc96ff59b2f19e924d9e15e24cee19723d674b92
Author: Johan Hedberg <johan.hedberg@intel.com>
Date:   Mon Jun 9 13:58:14 2014 +0300

    Bluetooth: Fix SSP acceptor just-works confirmation without MITM

    commit ba15a58b179ed76a7e887177f2b06de12c58ec8f upstream.

    From the Bluetooth Core Specification 4.1 page 1958:

    "if both devices have set the Authentication_Requirements parameter to
    one of the MITM Protection Not Required options, authentication stage 1
    shall function as if both devices set their IO capabilities to
    DisplayOnly (e.g., Numeric comparison with automatic confirmation on
    both devices)"

    So far our implementation has done user confirmation for all just-works
    cases regardless of the MITM requirements, however following the
    specification to the word means that we should not be doing confirmation
    when neither side has the MITM flag set.

    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Tested-by: Szymon Janc <szymon.janc@tieto.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1dbae5d755c36ab7932f9282ff146cf1fe698ade
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Wed Jul 2 15:47:04 2014 +0200

    drm/vmwgfx: Fix incorrect write to read-only register v2:

    commit 4e578080ed3262ed2c3985868539bc66218d25c0 upstream.

    Commit "drm/vmwgfx: correct fb_fix_screeninfo.line_length", while fixing a
    vmwgfx fbdev bug, also writes the pitch to a supposedly read-only register:
    SVGA_REG_BYTES_PER_LINE, while it should be (and also in fact is) written to
    SVGA_REG_PITCHLOCK.

    This patch is Cc'd stable because of the unknown effects writing to this
    register might have, particularly on older device versions.

    v2: Updated log message.

    Cc: Christopher Friedt <chrisfriedt@gmail.com>
    Tested-by: Christopher Friedt <chrisfriedt@gmail.com>
    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 822780ca251deec5c3d61da9568f9f64a79233e4
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue May 27 16:40:51 2014 -0400

    drm/radeon/atom: fix dithering on certain panels

    commit 642528355c694f5ed68f6bff9ff520326a249f99 upstream.

    We need to specify the encoder mode as LVDS for eDP
    when using the Crtc_Source atom table in order to properly
    set up the FMT hardware.

    bug:
    https://bugs.freedesktop.org/show_bug.cgi?id=73911

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 91b75cbadcefa1a3c5d0da57c442b23b61507aae
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue May 27 13:11:36 2014 -0400

    drm/radeon: fix typo in radeon_connector_is_dp12_capable()

    commit af5d36539dfe043f1cf0f8b7334d6bb12cd14e75 upstream.

    We were checking the ext clock rather than the display clock.

    Noticed by ArtForz on IRC.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b04837090f3e97facdc59104a5aee1873769ae13
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Apr 21 21:45:09 2014 -0400

    drm/radeon: only apply hdmi bpc pll flags when encoder mode is hdmi

    commit 7d5ab3009a8ca777174f6f469277b3922d56fd4b upstream.

    May fix display issues with non-HDMI displays.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c27517de002506599c8eeb75ad4d1fa5f9204496
Author: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date:   Thu May 22 14:56:52 2014 +0200

    mtd: pxa3xx_nand: make the driver work on big-endian systems

    commit b7e460624f0f3c31150f3b09e75b0d009e22ba5f upstream.

    The pxa3xx_nand driver currently uses __raw_writel() and __raw_readl()
    to access I/O registers. However, those functions do not do any
    endianness swapping, which means that they won't work when the CPU
    runs in big-endian but the I/O registers are little endian, which is
    the common situation for ARM systems running big endian.

    Since __raw_writel() and __raw_readl() do not include any memory
    barriers and the pxa3xx_nand driver can only be compiled for ARM
    platforms, the closest I/o accessors functions that do endianess
    swapping are writel_relaxed() and readl_relaxed().

    This patch has been verified to work on Armada XP GP: without the
    patch, the NAND is not detected when the kernel runs big endian while
    it is properly detected when the kernel runs little endian. With the
    patch applied, the NAND is properly detected in both situations
    (little and big endian).

    Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53a7d50b755b1a71b0cfcebe22fa9175149d9d52
Author: Stanislaw Gruszka <stf_xl@wp.pl>
Date:   Mon Jun 16 18:45:15 2014 +0200

    rt2x00: fix rfkill regression on rt2500pci

    commit 616a8394b5df8c88f4dd416f4527439a4e365034 upstream.

    As reported by Niels, starting rfkill polling during device probe
    (commit e2bc7c5, generally sane change) broke rfkill on rt2500pci
    device. I considered that bug as some initalization issue, which
    should be fixed on rt2500pci specific code. But after several
    attempts (see bug report for details) we fail to find working solution.
    Hence I decided to revert to old behaviour on rt2500pci to fix
    regression.

    Additionally patch also unregister rfkill on device remove instead
    of ifconfig down, what was another issue introduced by bad commit.

    Bug report:
    https://bugzilla.kernel.org/show_bug.cgi?id=73821

    Fixes: e2bc7c5f3cb8 ("rt2x00: Fix rfkill_polling register function.")
    Bisected-by: Niels <nille0386@googlemail.com>
    Reported-and-tested-by: Niels <nille0386@googlemail.com>
    Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2160caddb9166f02b0ea73b220aaa5df0a51db91
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Tue Jun 10 12:51:06 2014 +0200

    rt2x00: disable TKIP on USB

    commit 8edcb0ba0d56f5914eef11eda6db8bfe74eb9ca8 upstream.

    On USB we can not get atomically TKIP key. We have to disable support
    for TKIP acceleration on USB hardware to avoid bug as showed bellow.

    [  860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
    <snip>
    [  860.827280] Call Trace:
    [  860.827282]  [<ffffffff81682ea6>] dump_stack+0x4d/0x66
    [  860.827284]  [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
    [  860.827285]  [<ffffffff81685bb3>] __schedule+0x733/0x7b0
    [  860.827287]  [<ffffffff81685c59>] schedule+0x29/0x70
    [  860.827289]  [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
    [  860.827291]  [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
    [  860.827294]  [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
    [  860.827296]  [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
    [  860.827298]  [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
    [  860.827301]  [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
    [  860.827303]  [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
    [  860.827305]  [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160  [rt2x00usb]
    [  860.827307]  [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
    [  860.827309]  [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
    [  860.827311]  [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
    [  860.827314]  [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50  [rt2800lib]
    [  860.827321]  [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0  [mac80211]
    [  860.827322]  [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
    [  860.827329]  [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]

    Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
    Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 005564fb1a1d98ae98e720f283e15275e5734562
Author: Michal Nazarewicz <mina86@mina86.com>
Date:   Tue Jun 17 17:47:41 2014 +0200

    usb: gadget: f_fs: fix NULL pointer dereference when there are no strings

    commit f0688c8b81d2ea239c3fb0b848f623b579238d99 upstream.

    If the descriptors do not need any strings and user space sends empty
    set of strings, the ffs->stringtabs field remains NULL.  Thus
    *ffs->stringtabs in functionfs_bind leads to a NULL pointer
    dereferenece.

    The bug was introduced by commit [fd7c9a007f: “use usb_string_ids_n()”].

    While at it, remove double initialisation of lang local variable in
    that function.

    ffs->strings_count does not need to be checked in any way since in
    the above scenario it will remain zero and usb_string_ids_n() is
    a no-operation when colled with 0 argument.

    Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d539a0515798a3790eaa4a898746fc105be237b0
Author: Johan Hovold <johan@kernel.org>
Date:   Thu Jun 5 16:05:52 2014 +0200

    USB: ftdi_sio: fix null deref at port probe

    commit aea1ae8760314e072bf1b773521e9de5d5dda10d upstream.

    Fix NULL-pointer dereference when probing an interface with no
    endpoints.

    These devices have two bulk endpoints per interface, but this avoids
    crashing the kernel if a user forces a non-FTDI device to be probed.

    Note that the iterator variable was made unsigned in order to avoid
    a maybe-uninitialized compiler warning for ep_desc after the loop.

    Fixes: 895f28badce9 ("USB: ftdi_sio: fix hi-speed device packet size
    calculation")

    Reported-by: Mike Remski <mremski@mutualink.net>
    Tested-by: Mike Remski <mremski@mutualink.net>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d4cd89665c5a7e594cd1bbd5fac776c039ad62d
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Jun 6 17:25:56 2014 +0200

    usb: option: add/modify Olivetti Olicard modems

    commit b0ebef36e93703e59003ad6a1a20227e47714417 upstream.

    Adding a couple of Olivetti modems and blacklisting the net
    function on a couple which are already supported.

    Reported-by: Lars Melin <larsm17@gmail.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bd617ea5c556d7cb0fd619abd5a742cf15ba197
Author: Oliver Neukum <oneukum@suse.de>
Date:   Tue May 20 16:27:40 2014 +0200

    USB: option: add device ID for SpeedUp SU9800 usb 3g modem

    commit 1cab4c68e339086cdaff7535848e878e8f261fca upstream.

    Reported by Alif Mubarak Ahmad:

    This device vendor and product id is 1c9e:9800
    It is working as serial interface with generic usbserial driver.
    I thought it is more suitable to use usbserial option driver, which has
    better capability distinguishing between modem serial interface and
    micro sd storage interface.

    [ johan: style changes ]

    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Tested-by: Alif Mubarak Ahmad <alive4ever@live.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3943a08b97f2e36e01172d1f321e43c8067c9094
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Oct 31 06:08:39 2012 +0100

    USB: add USB_DEVICE_INTERFACE_CLASS macro

    commit 17b72feb2be14e6d37023267dc0e199e8e0e3fdc upstream.

    Matching on device and interface class with with unspecified
    subclass and protocol is sometimes useful.  This is slightly
    different from USB_DEVICE_AND_INTERFACE_INFO which requires
    the full interface class/subclass/protocol triplet.

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 939a3a4989f3210a20f5e68734896c43d9b6ae6c
Author: Wang, Yu <yu.y.wang@intel.com>
Date:   Tue Jun 24 17:14:44 2014 +0300

    xhci: Fix runtime suspended xhci from blocking system suspend.

    commit d6236f6d1d885aa19d1cd7317346fe795227a3cc upstream.

    The system suspend flow as following:
    1, Freeze all user processes and kenrel threads.

    2, Try to suspend all devices.

    2.1, If pci device is in RPM suspended state, then pci driver will try
    to resume it to RPM active state in the prepare stage.

    2.2, xhci_resume function calls usb_hcd_resume_root_hub to queue two
    workqueue items to resume usb2&usb3 roothub devices.

    2.3, Call suspend callbacks of devices.

    2.3.1, All suspend callbacks of all hcd's children, including
    roothub devices are called.

    2.3.2, Finally, hcd_pci_suspend callback is called.

    Due to workqueue threads were already frozen in step 1, the workqueue
    items can't be scheduled, and the roothub devices can't be resumed in
    this flow. The HCD_FLAG_WAKEUP_PENDING flag which is set in
    usb_hcd_resume_root_hub won't be cleared. Finally,
    hcd_pci_suspend will return -EBUSY, and system suspend fails.

    The reason why this issue doesn't show up very often is due to that
    choose_wakeup will be called in step 2.3.1. In step 2.3.1, if
    udev->do_remote_wakeup is not equal to device_may_wakeup(&udev->dev), then
    udev will resume to RPM active for changing the wakeup settings. This
    has been a lucky hit which hides this issue.

    For some special xHCI controllers which have no USB2 port, then roothub
    will not match hub driver due to probe failed. Then its
    do_remote_wakeup will be set to zero, and we won't be as lucky.

    xhci driver doesn't need to resume roothub devices everytime like in
    the above case. It's only needed when there are pending event TRBs.

    This patch should be back-ported to kernels as old as 3.2, that
    contains the commit f69e3120df82391a0ee8118e0a156239a06b2afb
    "USB: XHCI: resume root hubs when the controller resumes"

    Signed-off-by: Wang, Yu <yu.y.wang@intel.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    [use readl() instead of removed xhci_readl(), reword commit message -Mathias]
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4d7311944326ccf5977b059df7e90527a1e4ec42
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date:   Tue Jun 24 17:14:41 2014 +0300

    xhci: correct burst count field for isoc transfers on 1.0 xhci hosts

    commit 3213b151387df0b95f4eada104f68eb1c1409cb3 upstream.

    The transfer burst count (TBC) field in xhci 1.0 hosts should be set
    to the number of bursts needed to transfer all packets in a isoc TD.
    Supported values are 0-2 (1 to 3 bursts per service interval).

    Formula for TBC calculation is given in xhci spec section 4.11.2.3:
    TBC = roundup( Transfer Descriptor Packet Count / Max Burst Size +1 ) - 1

    This patch should be applied to stable kernels since 3.0 that contain
    the commit 5cd43e33b9519143f06f507dd7cbee6b7a621885
    "xhci 1.0: Set transfer burst count field."

    Suggested-by: ShiChun Ma <masc2008@qq.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c4b5ebdfde09bfa83f0b46802fc8c846f072e0f
Author: Brian King <brking@linux.vnet.ibm.com>
Date:   Fri May 23 10:52:10 2014 -0500

    ibmvscsi: Abort init sequence during error recovery

    commit 9ee755974bea2f9880e517ec985dc9dede1b3a36 upstream.

    If a CRQ reset is triggered for some reason while in the middle
    of performing VSCSI adapter initialization, we don't want to
    call the done function for the initialization MAD commands as
    this will only result in two threads attempting initialization
    at the same time, resulting in failures.

    Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
    Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75b38de5e10c02adc31562a6ef3606598fde40bc
Merge: 110c783 8a8b012
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 9 08:21:08 2014 -0700

    Merge "Merge "msm: kgsl: Don't hold the refernce to the process private in kgsl create context""

commit 9f3ee8afe87570fca84a54335e681df851afee6f
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Jul 9 00:55:53 2014 -0500

    GammaControl: Fix userspace/kernelspace default mismatch

    Change-Id: I8ecd6a0cdab2c4dbb1dc90b632478fbbbf05e18c
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 8a8b01263b950d6c777275123f7f8e0c3344644a
Merge: 287ea41 407ebcc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jul 9 04:06:31 2014 -0700

    Merge "msm: kgsl: Don't hold the refernce to the process private in kgsl create context"

commit 407ebcc000bec3a9aa26f65707ae314b15e8e23e
Author: Gaurav Gagrani <ggagrani@codeaurora.org>
Date:   Tue Jul 8 13:45:58 2014 +0530

    msm: kgsl: Don't hold the refernce to the process private in kgsl create context

    There is a possible race condition for dev_priv where the kgsl_release
    is called, while adreno_ft_detect has reference for the same context.
    This change will avoid to use dev_priv in context destroy, which is
    already freed in kgsl_release.

    CRs-Fixed: 688521
    Change-Id: I0411873b605c4e264057eaa3f79c6439004c427c
    Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

commit e44012d82e2d96f45ea7d30512b52b81312efa69
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Tue Jul 8 14:48:07 2014 -0500

    GammaControl: Only apply tuner params that are modified

    Lighten up on the number of rgb shift calculations & only apply
    modified tuner params.

    Change-Id: Ie6e0d1957f64fc4fa69fbb7af2447c02e85dcbde
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit c085123b8bc6b807858c0197ac208b9ff8e5c51f
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Jul 8 20:58:32 2014 -0400

    Gamma Control: change range

    The current userspace implementation really hates negative numbers on
    the slider bars. Let's accept 0 to 120, with nominal values achieved as
    echo "60 60 60" > /sys/class/misc/gammacontrol/tuner and trinity blue as
    "60 60 80"

    Change-Id: Ic6768baf53997a5984e9470e423d080e64b217b5

commit 110c783372c3f35bac04ee3b629322b125be2b66
Merge: 60bd595 287ea41
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 8 11:52:26 2014 -0700

    Merge "Merge "msm: kgsl: Increase the timeout value for fault detection""

commit 287ea41b9e0be394f5d7d0eba9869fc4365fec44
Merge: a6e4893 b31e726
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 8 08:45:39 2014 -0700

    Merge "msm: kgsl: Increase the timeout value for fault detection"

commit a6e4893b0fae844bc5ff286eae5740fa9fbe7bf0
Merge: 407525a ad4eb6e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jul 8 08:45:37 2014 -0700

    Merge "msm: kgsl: Force the ME off before reading the microcode"

commit d21fa7b2c97dd355366abe7f648b80bad8672e60
Author: Wang, Xiaoming <xiaoming.wang@intel.com>
Date:   Mon Apr 14 12:30:45 2014 -0400

    net: ipv4: current group_info should be put after using.

    Plug a group_info refcount leak in ping_init.
    group_info is only needed during initialization and
    the code failed to release the reference on exit.
    While here move grabbing the reference to a place
    where it is actually needed.

    Change-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca
    Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
    Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
    Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Git-commit:b04c46190219a4f845e46a459e3102137b7f6cac
    Git-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
    Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
    [rsiddoji@codeaurora.org: resolve trivial merge conflicts]
    Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>

commit ecab17be93f5c130f7ea19e860dce7472d297b0d
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

    If uaddr == uaddr2, then we have broken the rule of only requeueing from
    a non-pi futex to a pi futex with this call.  If we attempt this, then
    dangling pointers may be left for rt_waiter resulting in an exploitable
    condition.

    This change brings futex_requeue() in line with futex_wait_requeue_pi()
    which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
    uaddr == uaddr2 in futex_wait_requeue_pi()")

    [ tglx: Compare the resulting keys as well, as uaddrs might be
      	different depending on the mapping ]

    Fixes CVE-2014-3153.

    Reported-by: Pinkie Pie
    Signed-off-by: Will Drewry <wad@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reviewed-by: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
    Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Divya Sharma <c_shard@codeaurora.org>

commit 23b9482adc3165b017b7d398f5dee3b7a4556ca0
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Mon Jul 7 21:17:40 2014 -0500

    GammaControl: Print when tuner is out of bounds

    Allow the kernel to print err when the tuner is set out of bounds
    and resets to 0.

    Change-Id: I7561a93d95f5b673ba5c587e80a7540532591487
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit f9c1196e637e192c5d91fd296c6d50eb3feebe81
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Mon Jul 7 02:59:59 2014 -0500

    GammaControl: Ditch color mods table

    Derived from:
      https://github.com/DecimalMan/dkp/commit/dc5e59ed2bddfd2692b4c7d

    But instead of 40 settings... why not 120?!!
    Create default tints for red, green & blue, and allow them to be
    modified by tuner using a curve; replacing the previous color mods
    table used.

    Note: trinity color profile can be achieved by:
      echo "0 0 10" > /sys/class/misc/gammacontrol/tuner
      echo "-18 -16 -10" > /sys/class/misc/gammacontrol/v1rgb

    Change-Id: I08f13077e82afe454734f1a3e2453633cdaffeee
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit e40eaf8754b1e07fd9f56c00cfa9b5967f236d98
Merge: bb8da9a 7913639
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Mon Jul 7 07:36:04 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit bb8da9ae8e1279985cc3cceaa17e63cd8d811ca1
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jul 7 00:34:30 2014 -0400

    Gammacontrol: Lucky number 13

    Let's ditch the table

    Change-Id: I4f208fda16889965fecab76d90de11d32db7f54d

commit e1c51957ffb40cfc5500684e0621e020293bce27
Merge: d68cae8 f0d9725
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jul 7 04:18:40 2014 +0000

    Merge changes I1589728d,I021f810d,I484a435b,I5a5500c9 into cm-11.0

    * changes:
      oled: d2, etc: Clean up some logspam
      mipi_samsung_oled: Set gammas without need for a screen reset
      GammaControl: Color mods fixup
      GammaControl: Fix tuner being set

commit f0d972500357e43b3d8399cb5a7a431259d64601
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Sun Jul 6 22:18:45 2014 -0500

    oled: d2, etc: Clean up some logspam

    when utilizing userspace controls

    Change-Id: I1589728d6012afafca53fb549cc032157d126af6
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 274344812683d4c2820ca481cbea17a644d2a4dc
Author: Ryan Pennucci <decimalman@gmail.com>
Date:   Sun Jul 6 21:10:55 2014 -0500

    mipi_samsung_oled: Set gammas without need for a screen reset

    Split from df3f71a & dc5e59e of https://github.com/DecimalMan/dkp
    [ljc: Rework with shipped APIs]

    Change-Id: I021f810d4c413ebff6660ae0dda70b31ea97be00
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit bf64c3adc1cb58aec7bb919959534bef6ccd38e4
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Sun Jul 6 20:48:42 2014 -0500

    GammaControl: Color mods fixup

    Re-order & tweak so that the table goes with the sliders in display
    settings. We'll lose support for trinity colors on-the-fly, but that
    can be easily redone by increasing the 'blue' slider in userspace
    and modifying v1rgb
      echo "-9 -8 -5" > /sys/class/misc/gammacontrol/v1rgb
      (double the value for more blue)

    Change-Id: I484a435b550d630968647add4013f04e2fb0eeb8
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 79136399eda8e0debfefa783185c380008684faf
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Jul 6 18:50:29 2014 -0700

    Linux 3.4.97

commit 0c3351a0a4815ea566d3febf82033b6c55ed4a2d
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Sun Apr 13 20:58:54 2014 +0200

    tracing: Fix syscall_*regfunc() vs copy_process() race

    commit 4af4206be2bd1933cae20c2b6fb2058dbc887f7c upstream.

    syscall_regfunc() and syscall_unregfunc() should set/clear
    TIF_SYSCALL_TRACEPOINT system-wide, but do_each_thread() can race
    with copy_process() and miss the new child which was not added to
    the process/thread lists yet.

    Change copy_process() to update the child's TIF_SYSCALL_TRACEPOINT
    under tasklist.

    Link: http://lkml.kernel.org/p/20140413185854.GB20668@redhat.com

    Fixes: a871bd33a6c0 "tracing: Add syscall tracepoints"
    Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
    Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e3293b8639a90b7227be9c273af0a45015c499bb
Author: Tejun Heo <tj@kernel.org>
Date:   Thu Jul 3 15:43:15 2014 -0400

    ptrace,x86: force IRET path after a ptrace_stop()

    commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a upstream.

    The 'sysret' fastpath does not correctly restore even all regular
    registers, much less any segment registers or reflags values.  That is
    very much part of why it's faster than 'iret'.

    Normally that isn't a problem, because the normal ptrace() interface
    catches the process using the signal handler infrastructure, which
    always returns with an iret.

    However, some paths can get caught using ptrace_event() instead of the
    signal path, and for those we need to make sure that we aren't going to
    return to user space using 'sysret'.  Otherwise the modifications that
    may have been done to the register set by the tracer wouldn't
    necessarily take effect.

    Fix it by forcing IRET path by setting TIF_NOTIFY_RESUME from
    arch_ptrace_stop_needed() which is invoked from ptrace_stop().

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Andy Lutomirski <luto@amacapital.net>
    Acked-by: Oleg Nesterov <oleg@redhat.com>
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60db34152db66ac6e6b6e12c1d7229179ff4711a
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Tue May 20 21:59:42 2014 +0200

    powerpc: fix typo 'CONFIG_PPC_CPU'

    commit b69a1da94f3d1589d1942b5d1b384d8cfaac4500 upstream.

    Commit cd64d1697cf0 ("powerpc: mtmsrd not defined") added a check for
    CONFIG_PPC_CPU were a check for CONFIG_PPC_FPU was clearly intended.

    Fixes: cd64d1697cf0 ("powerpc: mtmsrd not defined")
    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 52cbee9d056662d013935f3a9857358f9e67b3d5
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Tue May 20 22:24:58 2014 +0200

    powerpc: fix typo 'CONFIG_PMAC'

    commit 6e0fdf9af216887e0032c19d276889aad41cad00 upstream.

    Commit b0d278b7d3ae ("powerpc/perf_event: Reduce latency of calling
    perf_event_do_pending") added a check for CONFIG_PMAC were a check for
    CONFIG_PPC_PMAC was clearly intended.

    Fixes: b0d278b7d3ae ("powerpc/perf_event: Reduce latency of calling perf_event_do_pending")
    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d5110f6e1110af13b621da160d59887f35e291ea
Author: Gavin Shan <gwshan@linux.vnet.ibm.com>
Date:   Thu Apr 24 18:00:21 2014 +1000

    powerpc/pseries: Fix overwritten PE state

    commit 54f112a3837d4e7532bbedbbbf27c0de277be510 upstream.

    In pseries_eeh_get_state(), EEH_STATE_UNAVAILABLE is always
    overwritten by EEH_STATE_NOT_SUPPORT because of the missed
    "break" there. The patch fixes the issue.

    Reported-by: Joe Perches <joe@perches.com>
    Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bdef8307cc822a0121698ad619d1fdb3191795ba
Author: Christoph Hellwig <hch@lst.de>
Date:   Wed May 28 10:46:13 2014 +0200

    nfsd: getattr for FATTR4_WORD0_FILES_AVAIL needs the statfs buffer

    commit 12337901d654415d9f764b5f5ba50052e9700f37 upstream.

    Note nobody's ever noticed because the typical client probably never
    requests FILES_AVAIL without also requesting something else on the list.

    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb55ed0cdd1bcb9bfba644c1d577b8b008de92b5
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue May 27 11:14:26 2014 -0400

    nfsd4: fix FREE_STATEID lockowner leak

    commit 48385408b45523d9a432c66292d47ef43efcbb94 upstream.

    27b11428b7de ("nfsd4: remove lockowner when removing lock stateid")
    introduced a memory leak.

    Reported-by: Jeff Layton <jeff.layton@primarydata.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0d9888d713c1cc3737d5c4e90dd705e633df55a
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Jun 6 18:25:04 2014 +0200

    IB/umad: Fix use-after-free on close

    commit 60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f upstream.

    Avoid that closing /dev/infiniband/umad<n> or /dev/infiniband/issm<n>
    triggers a use-after-free.  __fput() invokes f_op->release() before it
    invokes cdev_put().  Make sure that the ib_umad_device structure is
    freed by the cdev_put() call instead of f_op->release().  This avoids
    that changing the port mode from IB into Ethernet and back to IB
    followed by restarting opensmd triggers the following kernel oops:

        general protection fault: 0000 [#1] PREEMPT SMP
        RIP: 0010:[<ffffffff810cc65c>]  [<ffffffff810cc65c>] module_put+0x2c/0x170
        Call Trace:
         [<ffffffff81190f20>] cdev_put+0x20/0x30
         [<ffffffff8118e2ce>] __fput+0x1ae/0x1f0
         [<ffffffff8118e35e>] ____fput+0xe/0x10
         [<ffffffff810723bc>] task_work_run+0xac/0xe0
         [<ffffffff81002a9f>] do_notify_resume+0x9f/0xc0
         [<ffffffff814b8398>] int_signal+0x12/0x17

    Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Yann Droneaud <ydroneaud@opteya.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b6b405ba1650d663665b693ddff520ade3d1cbaa
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Tue May 20 10:33:41 2014 +0200

    IB/umad: Fix error handling

    commit 8ec0a0e6b58218bdc1db91dd70ebfcd6ad8dd6cd upstream.

    Avoid leaking a kref count in ib_umad_open() if port->ib_dev == NULL
    or if nonseekable_open() fails.

    Avoid leaking a kref count, that sm_sem is kept down and also that the
    IB_PORT_SM capability mask is not cleared in ib_umad_sm_open() if
    nonseekable_open() fails.

    Since container_of() never returns NULL, remove the code that tests
    whether container_of() returns NULL.

    Moving the kref_get() call from the start of ib_umad_*open() to the
    end is safe since it is the responsibility of the caller of these
    functions to ensure that the cdev pointer remains valid until at least
    when these functions return.

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>

    [ydroneaud@opteya.com: rework a bit to reduce the amount of code changed]

    Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>

    [ nonseekable_open() can't actually fail, but....  - Roland ]

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c52be4c8594b7e0fbbfaaab2cb77056bc0b0f5b1
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Tue May 20 15:03:49 2014 +0200

    IB/srp: Fix a sporadic crash triggered by cable pulling

    commit 024ca90151f5e4296d30f72c13ff9a075e23c9ec upstream.

    Avoid that the loops that iterate over the request ring can encounter
    a pointer to a SCSI command in req->scmnd that is no longer associated
    with that request. If the function srp_unmap_data() is invoked twice
    for a SCSI command that is not in flight then that would cause
    ib_fmr_pool_unmap() to be invoked with an invalid pointer as argument,
    resulting in a kernel oops.

    Reported-by: Sagi Grimberg <sagig@mellanox.com>
    Reference: http://thread.gmane.org/gmane.linux.drivers.rdma/19068/focus=19069
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 751701062261458856bdc35b3cbccfd64a5ade1b
Author: Dennis Dalessandro <dennis.dalessandro@intel.com>
Date:   Fri May 2 11:40:17 2014 -0400

    IB/ipath: Translate legacy diagpkt into newer extended diagpkt

    commit 7e6d3e5c70f13874fb06e6b67696ed90ce79bd48 upstream.

    This patch addresses an issue where the legacy diagpacket is sent in
    from the user, but the driver operates on only the extended
    diagpkt. This patch specifically initializes the extended diagpkt
    based on the legacy packet.

    Reported-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
    Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dd823fd8ae22b56e277a5e603098787417cbf32c
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Fri May 2 11:28:04 2014 -0400

    IB/qib: Fix port in pkey change event

    commit 911eccd284d13d78c92ec4f1f1092c03457d732a upstream.

    The code used a literal 1 in dispatching an IB_EVENT_PKEY_CHANGE.

    As of the dual port qib QDR card, this is not necessarily correct.

    Change to use the port as specified in the call.

    Reported-by: Alex Estrin <alex.estrin@intel.com>
    Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e8b64337e32166c7cd578fcda3dea1f770b47de3
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Thu May 15 10:01:59 2014 +0530

    watchdog: sp805: Set watchdog_device->timeout from ->set_timeout()

    commit 938626d96a3ffb9eb54552bb0d3a4f2b30ffdeb0 upstream.

    Implementation of ->set_timeout() is supposed to set 'timeout' field of 'struct
    watchdog_device' passed to it. sp805 was rather setting this in a local
    variable. Fix it.

    Reported-by: Arun Ramamurthy <arun.ramamurthy@broadcom.com>
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Reviewed-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0834497455a06f7772e82a812e05dff446472b21
Author: hujianyang <hujianyang@huawei.com>
Date:   Sat May 31 11:39:32 2014 +0800

    UBIFS: Remove incorrect assertion in shrink_tnc()

    commit 72abc8f4b4e8574318189886de627a2bfe6cd0da upstream.

    I hit the same assert failed as Dolev Raviv reported in Kernel v3.10
    shows like this:

    [ 9641.164028] UBIFS assert failed in shrink_tnc at 131 (pid 13297)
    [ 9641.234078] CPU: 1 PID: 13297 Comm: mmap.test Tainted: G           O 3.10.40 #1
    [ 9641.234116] [<c0011a6c>] (unwind_backtrace+0x0/0x12c) from [<c000d0b0>] (show_stack+0x20/0x24)
    [ 9641.234137] [<c000d0b0>] (show_stack+0x20/0x24) from [<c0311134>] (dump_stack+0x20/0x28)
    [ 9641.234188] [<c0311134>] (dump_stack+0x20/0x28) from [<bf22425c>] (shrink_tnc_trees+0x25c/0x350 [ubifs])
    [ 9641.234265] [<bf22425c>] (shrink_tnc_trees+0x25c/0x350 [ubifs]) from [<bf2245ac>] (ubifs_shrinker+0x25c/0x310 [ubifs])
    [ 9641.234307] [<bf2245ac>] (ubifs_shrinker+0x25c/0x310 [ubifs]) from [<c00cdad8>] (shrink_slab+0x1d4/0x2f8)
    [ 9641.234327] [<c00cdad8>] (shrink_slab+0x1d4/0x2f8) from [<c00d03d0>] (do_try_to_free_pages+0x300/0x544)
    [ 9641.234344] [<c00d03d0>] (do_try_to_free_pages+0x300/0x544) from [<c00d0a44>] (try_to_free_pages+0x2d0/0x398)
    [ 9641.234363] [<c00d0a44>] (try_to_free_pages+0x2d0/0x398) from [<c00c6a60>] (__alloc_pages_nodemask+0x494/0x7e8)
    [ 9641.234382] [<c00c6a60>] (__alloc_pages_nodemask+0x494/0x7e8) from [<c00f62d8>] (new_slab+0x78/0x238)
    [ 9641.234400] [<c00f62d8>] (new_slab+0x78/0x238) from [<c031081c>] (__slab_alloc.constprop.42+0x1a4/0x50c)
    [ 9641.234419] [<c031081c>] (__slab_alloc.constprop.42+0x1a4/0x50c) from [<c00f80e8>] (kmem_cache_alloc_trace+0x54/0x188)
    [ 9641.234459] [<c00f80e8>] (kmem_cache_alloc_trace+0x54/0x188) from [<bf227908>] (do_readpage+0x168/0x468 [ubifs])
    [ 9641.234553] [<bf227908>] (do_readpage+0x168/0x468 [ubifs]) from [<bf2296a0>] (ubifs_readpage+0x424/0x464 [ubifs])
    [ 9641.234606] [<bf2296a0>] (ubifs_readpage+0x424/0x464 [ubifs]) from [<c00c17c0>] (filemap_fault+0x304/0x418)
    [ 9641.234638] [<c00c17c0>] (filemap_fault+0x304/0x418) from [<c00de694>] (__do_fault+0xd4/0x530)
    [ 9641.234665] [<c00de694>] (__do_fault+0xd4/0x530) from [<c00e10c0>] (handle_pte_fault+0x480/0xf54)
    [ 9641.234690] [<c00e10c0>] (handle_pte_fault+0x480/0xf54) from [<c00e2bf8>] (handle_mm_fault+0x140/0x184)
    [ 9641.234716] [<c00e2bf8>] (handle_mm_fault+0x140/0x184) from [<c0316688>] (do_page_fault+0x150/0x3ac)
    [ 9641.234737] [<c0316688>] (do_page_fault+0x150/0x3ac) from [<c000842c>] (do_DataAbort+0x3c/0xa0)
    [ 9641.234759] [<c000842c>] (do_DataAbort+0x3c/0xa0) from [<c0314e38>] (__dabt_usr+0x38/0x40)

    After analyzing the code, I found a condition that may cause this failed
    in correct operations. Thus, I think this assertion is wrong and should be
    removed.

    Suppose there are two clean znodes and one dirty znode in TNC. So the
    per-filesystem atomic_t @clean_zn_cnt is (2). If commit start, dirty_znode
    is set to COW_ZNODE in get_znodes_to_commit() in case of potentially ops
    on this znode. We clear COW bit and DIRTY bit in write_index() without
    @tnc_mutex locked. We don't increase @clean_zn_cnt in this place. As the
    comments in write_index() shows, if another process hold @tnc_mutex and
    dirty this znode after we clean it, @clean_zn_cnt would be decreased to (1).
    We will increase @clean_zn_cnt to (2) with @tnc_mutex locked in
    free_obsolete_znodes() to keep it right.

    If shrink_tnc() performs between decrease and increase, it will release
    other 2 clean znodes it holds and found @clean_zn_cnt is less than zero
    (1 - 2 = -1), then hit the assertion. Because free_obsolete_znodes() will
    soon correct @clean_zn_cnt and no harm to fs in this case, I think this
    assertion could be removed.

    2 clean zondes and 1 dirty znode, @clean_zn_cnt == 2

    Thread A (commit)         Thread B (write or others)       Thread C (shrinker)
    ->write_index
       ->clear_bit(DIRTY_NODE)
       ->clear_bit(COW_ZNODE)

                @clean_zn_cnt == 2
                              ->mutex_locked(&tnc_mutex)
                              ->dirty_cow_znode
                                  ->!ubifs_zn_cow(znode)
                                  ->!test_and_set_bit(DIRTY_NODE)
                                  ->atomic_dec(&clean_zn_cnt)
                              ->mutex_unlocked(&tnc_mutex)

                @clean_zn_cnt == 1
                                                               ->mutex_locked(&tnc_mutex)
                                                               ->shrink_tnc
                                                                 ->destroy_tnc_subtree
                                                                 ->atomic_sub(&clean_zn_cnt, 2)
                                                                 ->ubifs_assert  <- hit
                                                               ->mutex_unlocked(&tnc_mutex)

                @clean_zn_cnt == -1
    ->mutex_lock(&tnc_mutex)
    ->free_obsolete_znodes
       ->atomic_inc(&clean_zn_cnt)
    ->mutux_unlock(&tnc_mutex)

                @clean_zn_cnt == 0 (correct after shrink)

    Signed-off-by: hujianyang <hujianyang@huawei.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit df5c07b84d2744b8b4e3f8a240b21698405feeb3
Author: Markos Chandras <markos.chandras@imgtec.com>
Date:   Mon Jun 23 09:48:51 2014 +0100

    MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region

    commit ab6c15bc6620ebe220970cc040b29bcb2757f373 upstream.

    Previously, the lower limit for the MIPS SC initialization loop was
    set incorrectly allowing one extra loop leading to writes
    beyond the MSC ioremap'd space. More precisely, the value of the 'imp'
    in the last loop increased beyond the msc_irqmap_t boundaries and
    as a result of which, the 'n' variable was loaded with an incorrect
    value. This value was used later on to calculate the offset in the
    MSC01_IC_SUP which led to random crashes like the following one:

    CPU 0 Unable to handle kernel paging request at virtual address e75c0200,
    epc == 8058dba4, ra == 8058db90
    [...]
    Call Trace:
    [<8058dba4>] init_msc_irqs+0x104/0x154
    [<8058b5bc>] arch_init_irq+0xd8/0x154
    [<805897b0>] start_kernel+0x220/0x36c

    Kernel panic - not syncing: Attempted to kill the idle task!

    This patch fixes the problem

    Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
    Reviewed-by: James Hogan <james.hogan@imgtec.com>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/7118/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e4c57c863f3931de2de920428a2dc6ddf24cb38
Author: Alex Smith <alex.smith@imgtec.com>
Date:   Tue Jun 17 10:39:53 2014 +0100

    recordmcount/MIPS: Fix possible incorrect mcount_loc table entries in modules

    commit 91ad11d7cc6f4472ebf177a6252fbf0fd100d798 upstream.

    On MIPS calls to _mcount in modules generate 2 instructions to load
    the _mcount address (and therefore 2 relocations). The mcount_loc
    table should only reference the first of these, so the second is
    filtered out by checking the relocation offset and ignoring ones that
    immediately follow the previous one seen.

    However if a module has an _mcount call at offset 0, the second
    relocation would not be filtered out due to old_r_offset == 0
    being taken to mean that the current relocation is the first one
    seen, and both would end up in the mcount_loc table.

    This results in ftrace_make_nop() patching both (adjacent)
    instructions to branches over the _mcount call sequence like so:

      0xffffffffc08a8000:  04 00 00 10     b       0xffffffffc08a8014
      0xffffffffc08a8004:  04 00 00 10     b       0xffffffffc08a8018
      0xffffffffc08a8008:  2d 08 e0 03     move    at,ra
      ...

    The second branch is in the delay slot of the first, which is
    defined to be unpredictable - on the platform on which this bug was
    encountered, it triggers a reserved instruction exception.

    Fix by initializing old_r_offset to ~0 and using that instead of 0
    to determine whether the current relocation is the first seen.

    Signed-off-by: Alex Smith <alex.smith@imgtec.com>
    Cc: linux-kernel@vger.kernel.org
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/7098/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5564b79b5e7c10fbbca517d74f7f0d77877c4270
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Sat Apr 5 15:14:22 2014 -0600

    PCI: Fix incorrect vgaarb conditional in WARN_ON()

    commit 67ebd8140dc8923c65451fa0f6a8eee003c4dcd3 upstream.

    3448a19da479 "vgaarb: use bridges to control VGA routing where possible"
    added the "flags & PCI_VGA_STATE_CHANGE_DECODES" condition to an existing
    WARN_ON(), but used bitwise AND (&) instead of logical AND (&&), so the
    condition is never true.  Replace with logical AND.

    Found by Coverity (CID 142811).

    Fixes: 3448a19da479 "vgaarb: use bridges to control VGA routing where possible"
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Yinghai Lu <yinghai@kernel.org>
    Acked-by: David Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ade14072dca4bafc463c63a1788d3792af7fed54
Author: Thomas Jarosch <thomas.jarosch@intra2net.com>
Date:   Mon Apr 7 15:10:32 2014 +0200

    PCI: Add new ID for Intel GPU "spurious interrupt" quirk

    commit 7c82126a94e69bbbac586f0249e7ef11e681246c upstream.

    After a CPU upgrade while keeping the same mainboard, we faced "spurious
    interrupt" problems again.

    It turned out that the new CPU also featured a new GPU with a different PCI
    ID.

    Add this PCI ID to the quirk table.  Probably all other Intel GPU PCI IDs
    are affected, too, but I don't want to add them without a test system.

    See f67fd55fa96f ("PCI: Add quirk for still enabled interrupts on Intel
    Sandy Bridge GPUs") for some history.

    [bhelgaas: add f67fd55fa96f reference, stable tag]
    Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c80dcb8fad169cda3bdab9586667b2369bd7a478
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Sat Jun 7 22:35:07 2014 -0700

    Input: elantech - deal with clickpads reporting right button events

    commit cd9e83e2754465856097f31c7ab933ce74c473f8 upstream.

    At least the Dell Vostro 5470 elantech *clickpad* reports right button
    clicks when clicked in the right bottom area:

    https://bugzilla.redhat.com/show_bug.cgi?id=1103528

    This is different from how (elantech) clickpads normally operate, normally
    no matter where the user clicks on the pad the pad always reports a left
    button event, since there is only 1 hardware button beneath the path.

    It looks like Dell has put 2 buttons under the pad, one under each bottom
    corner, causing this.

    Since this however still clearly is a real clickpad hardware-wise, we still
    want to report it as such to userspace, so that things like finger movement
    in the bottom area can be properly ignored as it should be on clickpads.

    So deal with this weirdness by simply mapping a right click to a left click
    on elantech clickpads. As an added advantage this is something which we can
    simply do on all elantech clickpads, so no need to add special quirks for
    this weird model.

    Reported-and-tested-by: Elder Marco <eldermarco@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d68cae8f0899500eb815748a358ea25eb0e773cf
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jul 6 13:17:41 2014 -0400

    m2: increase volume key debounce to 8

    To better differentiate long-press and short press

    Change-Id: Ib2470790a95baba2b1e31baefdbd4bc5fbb0ef91

commit b6d209e84554fa4865758001c7580096e9f25ca5
Author: Ryan Pennucci <decimalman@gmail.com>
Date:   Wed Jun 25 20:45:27 2014 -0400

    dhd: apply old changes to updated driver

    - Condense wakelock handling
    - Remove oodles of debuggery
    - Assorted small changes

    Change-Id: I241492557614e7c20e809edd7f0646aafe388216

commit c5891615405596cf6b64cc4d69b205155dc97e72
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Sun Jul 6 09:20:37 2014 -0500

    GammaControl: Fix tuner being set

    Set the whole color_mods array.

    Also, fix expressatt; FB_MSM_MIPI_MAGNA_OLED_VIDEO_WVGA_PT uses
    smart mtp ea8868, which supports the gamma voltages V59..V15

    Change-Id: I5a5500c9b1cea5415a29c2a7909147e8f9d03ed9
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 1135b61cd8b7875cfcfe4af4c59721f431dedc68
Author: Colin Cross <ccross@android.com>
Date:   Wed Oct 30 13:14:12 2013 -0700

    mm: fix anon vma naming

    Fix two bugs caused by merging anon vma_naming, a typo in
    mempolicy.c and a bad merge in sys.c.

    Change-Id: Ia4ced447d50573e68195e95ea2f2b4d9456b8a90
    Signed-off-by: Colin Cross <ccross@android.com>

commit 9f5a89b2e6668da90ad6d2c6435be602a6e6cf3b
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Jun 18 14:36:12 2014 -0500

    motor: tspdrv: return on invalid buffer index

    Update from VPUDND8

    Change-Id: I941042c68d89ed636d8be9f2f54bcc1c20f930a8
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 3ab9f468755898c79d7648264580419076fbe70d
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Jun 18 10:42:36 2014 -0500

    motor: tspdrv: Check buffer size before copying

    Update from VPUDND8

    Change-Id: If7a57f15151074b1d984b51255257116121e5682
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 7149637a5fc74a07eb2dbea1fb464bcd2b74fbe9
Merge: 2eb0707 e733765
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jul 6 12:48:31 2014 +0000

    Merge changes I49a7f5d0,I81d6ff7b,I33dc38b9,I242cd870 into cm-11.0

    * changes:
      GammaControl: create a single tunable knob using previous presets
      GammaControl: Rework for the d2 family
      Add Gamma Control v1
      Squashed revert of panel color shifting sysfs interface

commit e733765de64f7df46be0b9ea9e331666b0dbb5a1
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Jul 5 18:28:23 2014 -0400

    GammaControl: create a single tunable knob using previous presets

    Change-Id: I49a7f5d009f9a8f51b4a73fae65ba07cdc14b38f

commit 2a71381ca4754c0d0a5f77cf8cdfc170efe98a51
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Fri Jul 4 17:42:38 2014 -0500

    GammaControl: Rework for the d2 family

    Rework to gamma control to go along with our panels, bump version
    & add make parts.

    RGB gamma curve can be shifted by modifying files in:
    "/sys/class/misc/gamma_control"

    Each gamma value requires 3 values for shifting (red, green, & blue),
    i.e:
      echo "25 6 -10" > /sys/class/misc/gamma_control/v255rgb

    Includes changes to color offset application from d97dcfb & 90459ce

    Change-Id: I81d6ff7bfd261d9c52491da157a4e696168dc8f8
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 412a26c13761b366ceb4d70baa30ee8bb6a24c12
Author: franciscofranco <franciscofranco.1990@gmail.com>
Date:   Sat Feb 9 12:37:17 2013 -0800

    Add Gamma Control v1

    Import gamma_control.c at 5647088 from
    https://bitbucket.org/morfic/trinity_four

    Change-Id: I33dc38b9148c856cc2d27e8a1b1829609b31646b
    Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
    Signed-off-by: morfic <morfic@gmail.com>

commit ac7882edc27a18c51fb9a73d74ff6da1a6f70290
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Sat Jul 5 16:09:11 2014 -0500

    Squashed revert of panel color shifting sysfs interface

    Squashed revert for the whole d2 family in preparation for
    gamma control shifting.

    This reverts commits 62eda51c6195cd0b08d7a4d34d29f7be077f9bf6,
                         41db8f4436b2c55bf9fe1932136e8cae3b04821f,
                         90459ce34ecd1c31591feddfea4b3a1d88ca314e,
                         d97dcfbaf1656c4fcc1e1d0b8a694e8edaba5b6c.

    Change-Id: I242cd87025c7075ff36c03632e8fbad33ac8b230

commit 2eb0707090378fed26865520284c630db80cf905
Merge: 5a32034 3e3d5f6
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Sat Jul 5 10:53:51 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	drivers/usb/serial/usb_wwan.c

    Change-Id: Id70a3edb0e4c4494a60af9b9927f0ae12b8b1485

commit b31e7264d1a89699ee2eef53c1c0fa31fd41384b
Author: Shubhraprakash Das <sadas@codeaurora.org>
Date:   Wed Mar 26 16:06:29 2014 -0700

    msm: kgsl: Increase the timeout value for fault detection

    Increment the timeout value for detecting faults from 50ms to
    200ms. The fault detection mechanism is a backup to hardware
    fault detection. 50ms is small since it has been observed that
    this mechanism triggers false positives with 50ms.

    CRs-Fixed: 672164
    Change-Id: I8f382051e06bdc47f152309a2868092e1980604e
    Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
    Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit 8880d5bb53b74a4549c295dfbfe8fd10e8474cfb
Author: Arve Hjønnevåg <arve@android.com>
Date:   Thu Feb 13 20:25:06 2014 -0800

    Staging: android: binder: More offset validation.

    Make sure offsets don't point to overlapping flat_binder_object
    structs.

    Conflicts:
    	drivers/staging/android/binder.c

    Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    Git-commit: 457c3cd05958b8397211ae1f6dd3c3d325f4c0ea
    Git-repo: https://android.googlesource.com/kernel/common/
    Signed-off-by: Neeti Desai <neetid@codeaurora.org>
    Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit ad4eb6ea8f19edabbd114a1b4a2b0002d9418c17
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Tue Jan 14 10:02:01 2014 -0700

    msm: kgsl: Force the ME off before reading the microcode

    On A3XX reading the microcode while the CP is running is dangerous
    beyond words.  By setting the offset address for the read, we are
    essentially changing the instruction pointer for the ME while it
    is running causing opcode errors, gpu faults and/or system errors.

    We do not want to stop the CP at the beginning of the snapshot
    process beacuse doing so changes the RBBM status and the state of
    the CP registers which may damage the debug effort.  But by the
    time we get to the microcode read we no longer care about the state
    of the registers so we can freely halt the ME just before starting
    the read.

    Conflicts:
    	drivers/gpu/msm/adreno_a3xx_snapshot.c

    Change-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit 3e3d5f6146c3f684f4b7bd71feffc31e1c668754
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Jun 30 20:05:38 2014 -0700

    Linux 3.4.96

commit d3007333170435135f0620fb52386aad3fb2a14f
Author: Andy Lutomirski <luto@amacapital.net>
Date:   Mon Jun 23 14:22:15 2014 -0700

    x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)

    commit 554086d85e71f30abe46fc014fea31929a7c6a8a upstream.

    The bad syscall nr paths are their own incomprehensible route
    through the entry control flow.  Rearrange them to work just like
    syscalls that return -ENOSYS.

    This fixes an OOPS in the audit code when fast-path auditing is
    enabled and sysenter gets a bad syscall nr (CVE-2014-4508).

    This has probably been broken since Linux 2.6.27:
    af0575bba0 i386 syscall audit fast-path

    Cc: Roland McGrath <roland@redhat.com>
    Reported-by: Toralf Förster <toralf.foerster@gmx.de>
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Link: http://lkml.kernel.org/r/e09c499eade6fc321266dd6b54da7beb28d6991c.1403558229.git.luto@amacapital.net
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b0d0894ebaede13481207275e075f2975fb30a3
Author: Roger Quadros <rogerq@ti.com>
Date:   Wed Dec 18 15:40:10 2013 +0530

    usb: usbtest: Add timetout to simple_io()

    commit e5e4746510d140261918aecce2e5e3aa4456f7e9 upstream.

    Without a timetout some tests e.g. test_halt() can remain stuck forever.

    Signed-off-by: Roger Quadros <rogerq@ti.com>
    Reviewed-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e18bac2cae5d6efa474611a2dc825b7749760af4
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Thu Jun 12 00:39:58 2014 -0500

    btrfs: fix use of uninit "ret" in end_extent_writepage()

    commit 3e2426bd0eb980648449e7a2f5a23e3cd3c7725c upstream.

    If this condition in end_extent_writepage() is false:

    	if (tree->ops && tree->ops->writepage_end_io_hook)

    we will then test an uninitialized "ret" at:

    	ret = ret < 0 ? ret : -EIO;

    The test for ret is for the case where ->writepage_end_io_hook
    failed, and we'd choose that ret as the error; but if
    there is no ->writepage_end_io_hook, nothing sets ret.

    Initializing ret to 0 should be sufficient; if
    writepage_end_io_hook wasn't set, (!uptodate) means
    non-zero err was passed in, so we choose -EIO in that case.

    Signed-of-by: Eric Sandeen <sandeen@redhat.com>

    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64b84ef0258d03d80d2581b7f44b7630e945e612
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Sun Jun 8 19:04:13 2014 +0800

    Btrfs: use right type to get real comparison

    commit cd857dd6bc2ae9ecea14e75a34e8a8fdc158e307 upstream.

    We want to make sure the point is still within the extent item, not to verify
    the memory it's pointing to.

    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f1dd63b01d0ab74032c77cad7a664da8a59dc2c
Author: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Date:   Thu May 22 22:43:43 2014 +0200

    fs: btrfs: volumes.c: Fix for possible null pointer dereference

    commit 8321cf2596d283821acc466377c2b85bcd3422b7 upstream.

    There is otherwise a risk of a possible null pointer dereference.

    Was largely found by using a static code analysis program called cppcheck.

    Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a25ebe211246ea835f165c371d744f2d65260d64
Author: Chris Mason <clm@fb.com>
Date:   Wed May 21 05:49:54 2014 -0700

    Btrfs: fix double free in find_lock_delalloc_range

    commit 7d78874273463a784759916fc3e0b4e2eb141c70 upstream.

    We need to NULL the cached_state after freeing it, otherwise
    we might free it again if find_delalloc_range doesn't find anything.

    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2edae61bce495df81c58eb0b93faac301de849c7
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Mon Mar 10 19:28:08 2014 +0200

    skbuff: skb_segment: orphan frags before copying

    commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f upstream.

    skb_segment copies frags around, so we need
    to copy them carefully to avoid accessing
    user memory after reporting completion to userspace
    through a callback.

    skb_segment doesn't normally happen on datapath:
    TSO needs to be disabled - so disabling zero copy
    in this case does not look like a big deal.

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2.  As skb_segment() only supports page-frags *or* a
     frag list, there is no need for the additional frag_skb pointer or the
     preparatory renaming.]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f3ca8e5606f49ff02a0133fdbe2e6b852cb1e64
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Fri Jul 20 09:23:20 2012 +0000

    skbuff: export skb_copy_ubufs

    commit dcc0fb782b3a6e2abfeaaeb45dd88ed09596be0f upstream.

    Export skb_copy_ubufs so that modules can orphan frags.

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1f29351617ffe827edf80ffdfdef2da3a2494f96
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Fri Jul 20 09:23:07 2012 +0000

    skbuff: add an api to orphan frags

    commit a353e0ce0fd42d8859260666d1e9b10f2abd4698 upstream.

    Many places do
           if ((skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY))
    		skb_copy_ubufs(skb, gfp_mask);
    to copy and invoke frag destructors if necessary.
    Add an inline helper for this.

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a97df3f22b83742deb9191d53928641ec3befb6e
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Thu Mar 7 14:53:45 2013 +0100

    genirq: Sanitize spurious interrupt detection of threaded irqs

    commit 1e77d0a1ed7417d2a5a52a7b8d32aea1833faa6c upstream.

    Till reported that the spurious interrupt detection of threaded
    interrupts is broken in two ways:

    - note_interrupt() is called for each action thread of a shared
      interrupt line. That's wrong as we are only interested whether none
      of the device drivers felt responsible for the interrupt, but by
      calling multiple times for a single interrupt line we account
      IRQ_NONE even if one of the drivers felt responsible.

    - note_interrupt() when called from the thread handler is not
      serialized. That leaves the members of irq_desc which are used for
      the spurious detection unprotected.

    To solve this we need to defer the spurious detection of a threaded
    interrupt to the next hardware interrupt context where we have
    implicit serialization.

    If note_interrupt is called with action_ret == IRQ_WAKE_THREAD, we
    check whether the previous interrupt requested a deferred check. If
    not, we request a deferred check for the next hardware interrupt and
    return.

    If set, we check whether one of the interrupt threads signaled
    success. Depending on this information we feed the result into the
    spurious detector.

    If one primary handler of a shared interrupt returns IRQ_HANDLED we
    disable the deferred check of irq threads on the same line, as we have
    found at least one device driver who cared.

    Reported-by: Till Straumann <strauman@slac.stanford.edu>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Austin Schuh <austin@peloton-tech.com>
    Cc: Oliver Hartkopp <socketcan@hartkopp.net>
    Cc: Wolfgang Grandegger <wg@grandegger.com>
    Cc: Pavel Pisa <pisa@cmp.felk.cvut.cz>
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Cc: linux-can@vger.kernel.org
    Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1303071450130.22263@ionos
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d48df4863c4a4d40809575efa1f101b1e8090b5
Author: Mike Frysinger <vapier@gentoo.org>
Date:   Sun May 4 20:43:15 2014 -0400

    x86, x32: Use compat shims for io_{setup,submit}

    commit 7fd44dacdd803c0bbf38bf478d51d280902bb0f1 upstream.

    The io_setup takes a pointer to a context id of type aio_context_t.
    This in turn is typed to a __kernel_ulong_t.  We could tweak the
    exported headers to define this as a 64bit quantity for specific
    ABIs, but since we already have a 32bit compat shim for the x86 ABI,
    let's just re-use that logic.  The libaio package is also written to
    expect this as a pointer type, so a compat shim would simplify that.

    The io_submit func operates on an array of pointers to iocb structs.
    Padding out the array to be 64bit aligned is a huge pain, so convert
    it over to the existing compat shim too.

    We don't convert io_getevents to the compat func as its only purpose
    is to handle the timespec struct, and the x32 ABI uses 64bit times.

    With this change, the libaio package can now pass its testsuite when
    built for the x32 ABI.

    Signed-off-by: Mike Frysinger <vapier@gentoo.org>
    Link: http://lkml.kernel.org/r/1399250595-5005-1-git-send-email-vapier@gentoo.org
    Cc: H.J. Lu <hjl.tools@gmail.com>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 69d66150cb4ea64bf31a0db61302777ad68ddb9a
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Wed Apr 30 14:03:25 2014 -0700

    x86-32, espfix: Remove filter for espfix32 due to race

    commit 246f2d2ee1d715e1077fc47d61c394569c8ee692 upstream.

    It is not safe to use LAR to filter when to go down the espfix path,
    because the LDT is per-process (rather than per-thread) and another
    thread might change the descriptors behind our back.  Fortunately it
    is always *safe* (if a bit slow) to go down the espfix path, and a
    32-bit LDT stack segment is extremely rare.

    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e802a11d29bed1e9ea4dad092d745baae3290947
Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
Date:   Mon Jun 16 20:59:52 2014 +0000

    target: Explicitly clear ramdisk_mcp backend pages

    [Note that a different patch to address the same issue went in during
    v3.15-rc1 (commit 4442dc8a), but includes a bunch of other changes that
    don't strictly apply to fixing the bug]

    This patch changes rd_allocate_sgl_table() to explicitly clear
    ramdisk_mcp backend memory pages by passing __GFP_ZERO into
    alloc_pages().

    This addresses a potential security issue where reading from a
    ramdisk_mcp could return sensitive information, and follows what
    >= v3.15 does to explicitly clear ramdisk_mcp memory at backend
    device initialization time.

    Reported-by: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt>
    Cc: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b2ff2f48d169e743dd074ca53a6fb1c295771254
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Sat May 3 11:03:28 2014 +0100

    ARM: stacktrace: avoid listing stacktrace functions in stacktrace

    commit 3683f44c42e991d313dc301504ee0fca1aeb8580 upstream.

    While debugging the FEC ethernet driver using stacktrace, it was noticed
    that the stacktraces always begin as follows:

     [<c00117b4>] save_stack_trace_tsk+0x0/0x98
     [<c0011870>] save_stack_trace+0x24/0x28
     ...

    This is because the stack trace code includes the stack frames for itself.
    This is incorrect behaviour, and also leads to "skip" doing the wrong
    thing (which is the number of stack frames to avoid recording.)

    Perversely, it does the right thing when passed a non-current thread.  Fix
    this by ensuring that we have a known constant number of frames above the
    main stack trace function, and always skip these.

    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0992ba402355b4aca62a74c915f5d787210ef1b5
Author: Lv Zheng <lv.zheng@intel.com>
Date:   Mon May 12 15:50:16 2014 +0800

    ACPI: Fix conflict between customized DSDT and DSDT local copy

    commit 73577d1df8e1f31f6b1a5eebcdbc334eb0330e47 upstream.

    This patch fixes the following issue:
    If DSDT is customized, no local DSDT copy is needed.

    References: https://bugzilla.kernel.org/show_bug.cgi?id=69711
    Signed-off-by: Enrico Etxe Arte <goitizena.generoa@gmail.com>
    Signed-off-by: Lv Zheng <lv.zheng@intel.com>
    [rjw: Subject]
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d228aeaff57cb42b134b499fd1cd6111724b9340
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:22:54 2014 +0200

    USB: sierra: fix remote wakeup

    commit 80cc0fcbdaeaf10d04ba27779a2d7ceb73d2717a upstream.

    Make sure that needs_remote_wake up is always set when there are open
    ports.

    Currently close() would unconditionally set needs_remote_wakeup to 0
    even though there might still be open ports. This could lead to blocked
    input and possibly dropped data on devices that do not support remote
    wakeup (and which must therefore not be runtime suspended while open).

    Add an open_ports counter (protected by the susp_lock) and only clear
    needs_remote_wakeup when the last port is closed.

    Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while
    online")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit edc71a5ebfed93d04c5648a6e9f94a5358d46aa0
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:22:53 2014 +0200

    USB: sierra: fix urb and memory leak on disconnect

    commit 014333f77c0b71123d6ef7d31a9724e0699c9548 upstream.

    The delayed-write queue was never emptied on disconnect, something which
    would lead to leaked urbs and transfer buffers if the device is
    disconnected before being runtime resumed due to a write.

    Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while
    online")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe8dec3ea2a9e1105ca5ae46f2baa1c9935923b3
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:22:52 2014 +0200

    USB: sierra: fix urb and memory leak in resume error path

    commit 7fdd26a01eb7b6cb6855ff8f69ef4a720720dfcb upstream.

    Neither the transfer buffer or the urb itself were released in the
    resume error path for delayed writes. Also on errors, the remainder of
    the queue was not even processed, which leads to further urb and buffer
    leaks.

    The same error path also failed to balance the outstanding-urb counter,
    something which results in degraded throughput or completely blocked
    writes.

    Fix this by releasing urb and buffer and balancing counters on errors,
    and by always processing the whole queue even when submission of one urb
    fails.

    Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while
    online")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 05bec811d722b1e98885875a59c2dbc42cec4145
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:22:51 2014 +0200

    USB: sierra: fix use after free at suspend/resume

    commit 8452727de70f6ad850cd6d0aaa18b5d9050aa63b upstream.

    Fix use after free or NULL-pointer dereference during suspend and
    resume.

    The port data may never have been allocated (port probe failed)
    or may already have been released by port_remove (e.g. driver is
    unloaded) when suspend and resume are called.

    Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while
    online")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c3d7a87ae8efae4491d15e9de2735f803b9c30a
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:22:50 2014 +0200

    USB: sierra: fix AA deadlock in open error path

    commit 353fe198602e8b4d1c7bdcceb8e60955087201b1 upstream.

    Fix AA deadlock in open error path that would call close() and try to
    grab the already held disc_mutex.

    Fixes: b9a44bc19f48 ("sierra: driver urb handling improvements")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e91351f9626fe1822c5d6e8c10cece4d5e92d1d
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:18 2014 +0200

    USB: usb_wwan: fix potential blocked I/O after resume

    commit fb7ad4f93d9f0f7d49beda32f5e7becb94b29a4d upstream.

    Keep trying to submit urbs rather than bail out on first read-urb
    submission error, which would also prevent I/O for any further ports
    from being resumed.

    Instead keep an error count, for all types of failed submissions, and
    let USB core know that something went wrong.

    Also make sure to always clear the suspended flag. Currently a failed
    read-urb submission would prevent cached writes as well as any
    subsequent writes from being submitted until next suspend-resume cycle,
    something which may not even necessarily happen.

    Note that USB core currently only logs an error if an interface resume
    failed.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0886f4e9008835a02210f30a0850ddb7297a9ece
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:17 2014 +0200

    USB: usb_wwan: fix potential NULL-deref at resume

    commit 9096f1fbba916c2e052651e9de82fcfb98d4bea7 upstream.

    The interrupt urb was submitted unconditionally at resume, something
    which could lead to a NULL-pointer dereference in the urb completion
    handler as resume may be called after the port and port data is gone.

    Fix this by making sure the interrupt urb is only submitted and active
    when the port is open.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ca91395e1b1aa0802307dbf493347d4dea0b2063
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:16 2014 +0200

    USB: usb_wwan: fix urb leak at shutdown

    commit 79eed03e77d481b55d85d1cfe5a1636a0d3897fd upstream.

    The delayed-write queue was never emptied at shutdown (close), something
    which could lead to leaked urbs if the port is closed before being
    runtime resumed due to a write.

    When this happens the output buffer would not drain on close
    (closing_wait timeout), and after consecutive opens, writes could be
    corrupted with previously buffered data, transfered with reduced
    throughput or completely blocked.

    Note that unbusy_queued_urb() was simply moved out of CONFIG_PM.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 887b3c368f744e95538a6ab0f9d91d21d933c5c4
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:15 2014 +0200

    USB: usb_wwan: fix write and suspend race

    commit 170fad9e22df0063eba0701adb966786d7a4ec5a upstream.

    Fix race between write() and suspend() which could lead to writes being
    dropped (or I/O while suspended) if the device is runtime suspended
    while a write request is being processed.

    Specifically, suspend() releases the susp_lock after determining the
    device is idle but before setting the suspended flag, thus leaving a
    window where a concurrent write() can submit an urb.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 50476eeb49caef5d03baec2ca9ca1187bb87b738
Author: xiao jin <jin.xiao@intel.com>
Date:   Mon May 26 19:23:14 2014 +0200

    USB: usb_wwan: fix race between write and resume

    commit d9e93c08d8d985e5ef89436ebc9f4aad7e31559f upstream.

    We find a race between write and resume. usb_wwan_resume run play_delayed()
    and spin_unlock, but intfdata->suspended still is not set to zero.
    At this time usb_wwan_write is called and anchor the urb to delay
    list. Then resume keep running but the delayed urb have no chance
    to be commit until next resume. If the time of next resume is far
    away, tty will be blocked in tty_wait_until_sent during time. The
    race also can lead to writes being reordered.

    This patch put play_Delayed and intfdata->suspended together in the
    spinlock, it's to avoid the write race during resume.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: xiao jin <jin.xiao@intel.com>
    Signed-off-by: Zhang, Qi1 <qi1.zhang@intel.com>
    Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 640768af2f78c8c1b2a301d5e52f658765738ce5
Author: xiao jin <jin.xiao@intel.com>
Date:   Mon May 26 19:23:13 2014 +0200

    USB: usb_wwan: fix urb leak in write error path

    commit db0904737947d509844e171c9863ecc5b4534005 upstream.

    When enable usb serial for modem data, sometimes the tty is blocked
    in tty_wait_until_sent because portdata->out_busy always is set and
    have no chance to be cleared.

    We find a bug in write error path. usb_wwan_write set portdata->out_busy
    firstly, then try autopm async with error. No out urb submit and no
    usb_wwan_outdat_callback to this write, portdata->out_busy can't be
    cleared.

    This patch clear portdata->out_busy if usb_wwan_write try autopm async
    with error.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: xiao jin <jin.xiao@intel.com>
    Signed-off-by: Zhang, Qi1 <qi1.zhang@intel.com>
    Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4aff6991e35c738d21a2d864aea4d63eea4e39d2
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu May 15 06:58:24 2014 -0400

    matroxfb: perform a dummy read of M_STATUS

    commit 972754cfaee94d6e25acf94a497bc0a864d91b7e upstream.

    I had occasional screen corruption with the matrox framebuffer driver and
    I found out that the reason for the corruption is that the hardware
    blitter accesses the videoram while it is being written to.

    The matrox driver has a macro WaitTillIdle() that should wait until the
    blitter is idle, but it sometimes doesn't work. I added a dummy read
    mga_inl(M_STATUS) to WaitTillIdle() to fix the problem. The dummy read
    will flush the write buffer in the PCI chipset, and the next read of
    M_STATUS will return the hardware status.

    Since applying this patch, I had no screen corruption at all.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2dbc65d60c2ac4c77d775cd2a449738c1356baf3
Author: Maurizio Lombardi <mlombard@redhat.com>
Date:   Tue May 27 12:48:56 2014 -0400

    ext4: fix wrong assert in ext4_mb_normalize_request()

    commit b5b60778558cafad17bbcbf63e0310bd3c68eb17 upstream.

    The variable "size" is expressed as number of blocks and not as
    number of clusters, this could trigger a kernel panic when using
    ext4 with the size of a cluster different from the size of a block.

    Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 029784e8b394634c30654d090fb53dfcefd9f91f
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Mon May 26 21:55:08 2014 +0200

    s390/lowcore: reserve 96 bytes for IRB in lowcore

    commit 993072ee67aa179c48c85eb19869804e68887d86 upstream.

    The IRB might be 96 bytes if the extended-I/O-measurement facility is
    used. This feature is currently not used by Linux, but struct irb
    already has the emw defined. So let's make the irb in lowcore match the
    size of the internal data structure to be future proof.
    We also have to add a pad, to correctly align the paste.

    The bigger irb field also circumvents a bug in some QEMU versions that
    always write the emw field on test subchannel and therefore destroy the
    paste definitions of this CPU. Running under these QEMU version broke
    some timing functions in the VDSO and all users of these functions,
    e.g. some JREs.

    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
    Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 162692c2f829d4336609e55dec7c2451073ef519
Author: Johannes Weiner <hannes@cmpxchg.org>
Date:   Fri Jun 6 14:35:35 2014 -0700

    mm: vmscan: clear kswapd's special reclaim powers before exiting

    commit 71abdc15adf8c702a1dd535f8e30df50758848d2 upstream.

    When kswapd exits, it can end up taking locks that were previously held
    by allocating tasks while they waited for reclaim.  Lockdep currently
    warns about this:

    On Wed, May 28, 2014 at 06:06:34PM +0800, Gu Zheng wrote:
    >  inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-R} usage.
    >  kswapd2/1151 [HC0[0]:SC0[0]:HE1:SE1] takes:
    >   (&sig->group_rwsem){+++++?}, at: exit_signals+0x24/0x130
    >  {RECLAIM_FS-ON-W} state was registered at:
    >     mark_held_locks+0xb9/0x140
    >     lockdep_trace_alloc+0x7a/0xe0
    >     kmem_cache_alloc_trace+0x37/0x240
    >     flex_array_alloc+0x99/0x1a0
    >     cgroup_attach_task+0x63/0x430
    >     attach_task_by_pid+0x210/0x280
    >     cgroup_procs_write+0x16/0x20
    >     cgroup_file_write+0x120/0x2c0
    >     vfs_write+0xc0/0x1f0
    >     SyS_write+0x4c/0xa0
    >     tracesys+0xdd/0xe2
    >  irq event stamp: 49
    >  hardirqs last  enabled at (49):  _raw_spin_unlock_irqrestore+0x36/0x70
    >  hardirqs last disabled at (48):  _raw_spin_lock_irqsave+0x2b/0xa0
    >  softirqs last  enabled at (0):  copy_process.part.24+0x627/0x15f0
    >  softirqs last disabled at (0):            (null)
    >
    >  other info that might help us debug this:
    >   Possible unsafe locking scenario:
    >
    >         CPU0
    >         ----
    >    lock(&sig->group_rwsem);
    >    <Interrupt>
    >      lock(&sig->group_rwsem);
    >
    >   *** DEADLOCK ***
    >
    >  no locks held by kswapd2/1151.
    >
    >  stack backtrace:
    >  CPU: 30 PID: 1151 Comm: kswapd2 Not tainted 3.10.39+ #4
    >  Call Trace:
    >    dump_stack+0x19/0x1b
    >    print_usage_bug+0x1f7/0x208
    >    mark_lock+0x21d/0x2a0
    >    __lock_acquire+0x52a/0xb60
    >    lock_acquire+0xa2/0x140
    >    down_read+0x51/0xa0
    >    exit_signals+0x24/0x130
    >    do_exit+0xb5/0xa50
    >    kthread+0xdb/0x100
    >    ret_from_fork+0x7c/0xb0

    This is because the kswapd thread is still marked as a reclaimer at the
    time of exit.  But because it is exiting, nobody is actually waiting on
    it to make reclaim progress anymore, and it's nothing but a regular
    thread at this point.  Be tidy and strip it of all its powers
    (PF_MEMALLOC, PF_SWAPWRITE, PF_KSWAPD, and the lockdep reclaim state)
    before returning from the thread function.

    Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
    Reported-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Cc: Tang Chen <tangchen@cn.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 41772cf6bd35f4ece7a288f186d48aea07bd1d89
Author: Kees Cook <keescook@chromium.org>
Date:   Thu Apr 17 13:22:09 2014 -0700

    HID: core: fix validation of report id 0

    commit 1b15d2e5b8077670b1e6a33250a0d9577efff4a5 upstream.

    Some drivers use the first HID report in the list instead of using an
    index. In these cases, validation uses ID 0, which was supposed to mean
    "first known report". This fixes the problem, which was causing at least
    the lgff family of devices to stop working since hid_validate_values
    was being called with ID 0, but the devices used single numbered IDs
    for their reports:

    0x05, 0x01,         /*  Usage Page (Desktop),                   */
    0x09, 0x05,         /*  Usage (Gamepad),                        */
    0xA1, 0x01,         /*  Collection (Application),               */
    0xA1, 0x02,         /*      Collection (Logical),               */
    0x85, 0x01,         /*          Report ID (1),                  */
    ...

    Reported-by: Simon Wood <simon@mungewell.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9f10ce4b065156a574a2110fc1edfbc012a95d1
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Jun 4 16:05:33 2014 -0700

    mm: fix sleeping function warning from __put_anon_vma

    commit 7f39dda9d86fb4f4f17af0de170decf125726f8c upstream.

    Trinity reports BUG:

      sleeping function called from invalid context at kernel/locking/rwsem.c:47
      in_atomic(): 0, irqs_disabled(): 0, pid: 5787, name: trinity-c27

    __might_sleep < down_write < __put_anon_vma < page_get_anon_vma <
    migrate_pages < compact_zone < compact_zone_order < try_to_compact_pages ..

    Right, since conversion to mutex then rwsem, we should not put_anon_vma()
    from inside an rcu_read_lock()ed section: fix the two places that did so.
    And add might_sleep() to anon_vma_free(), as suggested by Peter Zijlstra.

    Fixes: 88c22088bf23 ("mm: optimize page_lock_anon_vma() fast-path")
    Reported-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e040c1b2f0f5367753f68d3b0712e396b4b156d
Author: Tony Luck <tony.luck@intel.com>
Date:   Wed Jun 4 16:11:01 2014 -0700

    mm/memory-failure.c: don't let collect_procs() skip over processes for MF_ACTION_REQUIRED

    commit 74614de17db6fb472370c426d4f934d8d616edf2 upstream.

    When Linux sees an "action optional" machine check (where h/w has reported
    an error that is not in the current execution path) we generally do not
    want to signal a process, since most processes do not have a SIGBUS
    handler - we'd just prematurely terminate the process for a problem that
    they might never actually see.

    task_early_kill() decides whether to consider a process - and it checks
    whether this specific process has been marked for early signals with
    "prctl", or if the system administrator has requested early signals for
    all processes using /proc/sys/vm/memory_failure_early_kill.

    But for MF_ACTION_REQUIRED case we must not defer.  The error is in the
    execution path of the current thread so we must send the SIGBUS
    immediatley.

    Fix by passing a flag argument through collect_procs*() to
    task_early_kill() so it knows whether we can defer or must take action.

    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Chen Gong <gong.chen@linux.jf.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bbc55195dc188b1253f794efa97c060369707d51
Author: Tony Luck <tony.luck@intel.com>
Date:   Wed Jun 4 16:10:59 2014 -0700

    mm/memory-failure.c-failure: send right signal code to correct thread

    commit a70ffcac741d31a406c1d2b832ae43d658e7e1cf upstream.

    When a thread in a multi-threaded application hits a machine check because
    of an uncorrectable error in memory - we want to send the SIGBUS with
    si.si_code = BUS_MCEERR_AR to that thread.  Currently we fail to do that
    if the active thread is not the primary thread in the process.
    collect_procs() just finds primary threads and this test:

    	if ((flags & MF_ACTION_REQUIRED) && t == current) {

    will see that the thread we found isn't the current thread and so send a
    si.si_code = BUS_MCEERR_AO to the primary (and nothing to the active
    thread at this time).

    We can fix this by checking whether "current" shares the same mm with the
    process that collect_procs() said owned the page.  If so, we send the
    SIGBUS to current (with code BUS_MCEERR_AR).

    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Reported-by: Otto Bruggeman <otto.g.bruggeman@intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Chen Gong <gong.chen@linux.jf.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3dc4a23faeecedad2f9195eaa355755a8a986526
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:10 2014 +0200

    USB: option: fix runtime PM handling

    commit acf47d4f9c39b1cba467aa9442fc2efe0b1da741 upstream.

    Fix potential I/O while runtime suspended due to missing PM operations
    in send_setup.

    Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
    option driver")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1038502e6381461ecc253032a2e829277649dc85
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Jun 3 11:00:27 2014 -0400

    USB: EHCI: avoid BIOS handover on the HASEE E200

    commit b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b upstream.

    Leandro Liptak reports that his HASEE E200 computer hangs when we ask
    the BIOS to hand over control of the EHCI host controller.  This
    definitely sounds like a bug in the BIOS, but at the moment there is
    no way to fix it.

    This patch works around the problem by avoiding the handoff whenever
    the motherboard and BIOS version match those of Leandro's computer.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Leandro Liptak <leandroliptak@gmail.com>
    Tested-by: Leandro Liptak <leandroliptak@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4cbd8a25f93283765cc12dc7f8914ca33cb49567
Author: Felipe Balbi <balbi@ti.com>
Date:   Wed Apr 16 10:30:33 2014 -0500

    usb: dwc3: gadget: clear stall when disabling endpoint

    commit 687ef9817df7ed960d14575b9033dde3d04631fe upstream.

    so it seems like DWC3 IP doesn't clear stalls
    automatically when we disable an endpoint, because
    of that, we _must_ make sure stalls are cleared
    before clearing the proper bit in DALEPENA register.

    Reported-by: Johannes Stezenbach <js@sig21.net>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a7f0226e50ed22a2a62f875f6b3766e0f108a7a9
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Mon May 26 23:37:09 2014 +0200

    usb: gadget: rename CONFIG_USB_GADGET_PXA25X

    commit d30f2065d6da377cc76771aca5a9850cfca8723b upstream.

    Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
    basically renamed the Kconfig symbol USB_GADGET_PXA25X to USB_PXA25X. It
    did not rename the related macros in use at that time. Commit
    c0a39151a405 ("ARM: pxa: fix inconsistent CONFIG_USB_PXA27X") did so for
    all but one macro. Rename that last macro too now.

    Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 35a58e89b97b037978ba768bb7b055d1ed61078b
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Jun 3 11:11:34 2014 -0400

    USB: usbtest: add a timeout for scatter-gather tests

    commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream.

    In usbtest, tests 5 - 8 use the scatter-gather library in usbcore
    without any sort of timeout.  If there's a problem in the gadget or
    host controller being tested, the test can hang.

    This patch adds a 10-second timeout to the tests, so that they will
    fail gracefully with an ETIMEDOUT error instead of hanging.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Huang Rui <ray.huang@amd.com>
    Tested-by: Huang Rui <ray.huang@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43e5e63ffac81183717c0bde818c18d3466fee17
Author: Huang Rui <ray.huang@amd.com>
Date:   Mon May 26 10:55:36 2014 +0800

    usb: usbtest: fix unlink write error with pattern 1

    commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream.

    TEST 12 and TEST 24 unlinks the URB write request for N times. When
    host and gadget both initialize pattern 1 (mod 63) data series to
    transfer, the gadget side will complain the wrong data which is not
    expected.  Because in host side, usbtest doesn't fill the data buffer
    as mod 63 and this patch fixed it.

    [20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
    [20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
    [20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last
    [20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
    [20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0
    [20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
    [20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active
    [20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy
    [20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete
    [20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0
    [20285.491431] zero gadget: bad OUT byte, buf[1] = 0
    [20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000
    [20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0
    [20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512
    [20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
    [20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
    [20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last
    [20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
    [20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0

    Signed-off-by: Huang Rui <ray.huang@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b60ba82395e3f3dad5aabccc9f71cf2416e57fdc
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri May 9 14:59:16 2014 +0300

    applicom: dereferencing NULL on error path

    commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream.

    This is a static checker fix.  The "dev" variable is always NULL after
    the while statement so we would be dereferencing a NULL pointer here.

    Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c96691fa95d62355be752d61375d2350cf1f29a
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Mon May 26 21:47:11 2014 +0200

    staging: tidspbridge: check for CONFIG_SND_OMAP_SOC_MCBSP

    commit d3921a03a89acb1b9ca599590c0131c89f8737d8 upstream.

    Commit d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
    removed the Kconfig symbol OMAP_MCBSP. It left two checks for
    CONFIG_OMAP_MCBSP untouched.

    Convert these to checks for CONFIG_SND_OMAP_SOC_MCBSP. That must be
    correct, since that re-enables calls to functions that are all found in
    sound/soc/omap/mcbsp.c. And that file is built only if
    CONFIG_SND_OMAP_SOC_MCBSP is defined.

    Fixes: d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 84716cf319a08667be6992a20920d2bb84f200b3
Author: Stephane Grosjean <s.grosjean@peak-system.com>
Date:   Tue May 20 11:38:56 2014 +0200

    can: peak_pci: prevent use after free at netdev removal

    commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream.

    As remarked by Christopher R. Baker in his post at

    http://marc.info/?l=linux-can&m=139707295706465&w=2

    there's a possibility for an use after free condition at device removal.

    This simplified patch introduces an additional variable to prevent the issue.
    Thanks for catching this.

    Reported-by: Christopher R. Baker <cbaker@rec.ri.cmu.edu>
    Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5bfc8718998bedfeea1997d83838ffd1981cbf12
Merge: 7bbff52 e800ecd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jun 30 07:21:34 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.03.007.063 on remote branch"

commit 7bbff5229678d8fde7a18a5c8e446dfec6cb604d
Merge: 60bd595 e800ecd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jun 30 04:01:50 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.03.007.063 on remote branch"

commit e800ecd04639f5ab8a5ac943a9b2a4ed4525ae2a
Merge: 60bd595 c4f1f8c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Jun 30 03:40:25 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.03.007.063 on remote branch

    Change-Id: I02b9005a885b11439737f0126189ac11f167a82c

commit 5a32034fd6efe592abbc5903788e7495784deefd
Author: Minsung Kim <ms925.kim@samsung.com>
Date:   Wed Jun 25 19:44:50 2014 +0900

    cpufreq: fix sleeping in atomic context when realloc freq_table for all_time_in_state

    Commit 40cf2f8 (cpufreq: Persist cpufreq time in state data across hotplug)
    causes the following call trace to be spit on boot:

    BUG: sleeping function called from invalid context at mm/slub.c:936
    in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: swapper/0
    CPU: 6 PID: 1 Comm: swapper/0 Not tainted 3.10.9-20140624.172707-eng-gd6c0f69-dirty #50
    Backtrace:
    [<c0012270>] (dump_backtrace+0x0/0x10c) from [<c001256c>] (show_stack+0x18/0x1c)
     r6:ffff1788 r5:c0c020c0 r4:e609c000 r3:00000000
    [<c0012554>] (show_stack+0x0/0x1c) from [<c07a2970>] (dump_stack+0x20/0x28)
    [<c07a2950>] (dump_stack+0x0/0x28) from [<c0057678>] (__might_sleep+0x104/0x120)
    [<c0057574>] (__might_sleep+0x0/0x120) from [<c00ff000>] (__kmalloc_track_caller+0x144/0x274)
     r6:00000000 r5:e609c000 r4:e6802140
    [<c00feebc>] (__kmalloc_track_caller+0x0/0x274) from [<c00da098>] (krealloc+0x58/0xb0)
    [<c00da040>] (krealloc+0x0/0xb0) from [<c050266c>] (cpufreq_allstats_create+0x120/0x204)
     r8:e4c4ff00 r7:c0d266b8 r6:0013d620 r5:e4c4e600 r4:00000001
    r3:e535d6d0
    [<c050254c>] (cpufreq_allstats_create+0x0/0x204) from [<c0502e38>] (cpufreq_stat_notifier_policy+0xb8/0xd0)
    [<c0502d80>] (cpufreq_stat_notifier_policy+0x0/0xd0) from [<c00517cc>] (notifier_call_chain+0x4c/0x8c)
     r5:00000000 r4:fffffffe
    [<c0051780>] (notifier_call_chain+0x0/0x8c) from [<c00519fc>] (__blocking_notifier_call_chain+0x50/0x68)
     r8:c0cd4d00 r7:00000002 r6:e609dd7c r5:ffffffff r4:c0d25a4c
    r3:ffffffff
    [<c00519ac>] (__blocking_notifier_call_chain+0x0/0x68) from [<c0051a34>] (blocking_notifier_call_chain+0x20/0x28)
     r7:c0e24f30 r6:00000000 r5:e53e1e00 r4:e609dd7c
    [<c0051a14>] (blocking_notifier_call_chain+0x0/0x28) from [<c0500fec>] (__cpufreq_set_policy+0xc0/0x1d0)
    [<c0500f2c>] (__cpufreq_set_policy+0x0/0x1d0) from [<c0501308>] (cpufreq_add_dev_interface+0x20c/0x270)
     r7:00000008 r6:00000000 r5:e53e1e00 r4:e53e1e58
    [<c05010fc>] (cpufreq_add_dev_interface+0x0/0x270) from [<c05016a8>] (cpufreq_add_dev+0x33c/0x420)
    [<c050136c>] (cpufreq_add_dev+0x0/0x420) from [<c03604a4>] (subsys_interface_register+0x80/0xbc)
    [<c0360424>] (subsys_interface_register+0x0/0xbc) from [<c050035c>] (cpufreq_register_driver+0x8c/0x194)

    Change-Id: If77a656d0ea60a8fc4083283d104509fa6c07f8f
    Signed-off-by: Minsung Kim <ms925.kim@samsung.com>

commit 87cc8e6889b8d899f0acf0bcf8a4e0f2ad5f3a2f
Author: Javi Merino <javi.merino@arm.com>
Date:   Wed Jun 13 15:07:00 2012 +0100

    DMA: PL330: Fix racy mutex unlock

    pl330_update() stores a pointer to the thrd->req that finished, which
    contains a pointer to the corresponding pl330_req.  This is done with
    the pl330_lock held.  Then, it iterates through the req_done list,
    calling the callback for each of the requests that are done.  The
    problem is that the driver releases the lock before calling the
    callback for each of the callbacks.  pl330_submit_req() running in
    another processor can then acquire the lock and insert another request
    in one of the thrd->req that hasn't been processed yet, replacing the
    pointer to pl330_req there.  When the callback returns in
    pl330_update() and the next rqdone is popped from the list, it
    dereferences the pl330_req pointer to the just scheduled pl330_req,
    instead of the one that has finished, calling pl330 with the wrong r.

    This patch fixes this by storing the pointer to pl330_req directly in
    the list.

    (cherry picked from commit fdec53d5203ee3d44be7c09d1524e3a6287d46a7 from android-3.10)

    Bug: 15828462
    Bug: 15859101
    Change-Id: Icb6f7bc08fd372c8688fd157eda6add721d43c29
    Signed-off-by: Javi Merino <javi.merino@arm.com>
    Cc: Jassi Brar <jaswinder.singh@linaro.org>
    Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>

commit 8f5868bfa8ee8fd4f9a2b72d8cc7311ec451024b
Author: Dmitry Shmidt <dimitrysh@google.com>
Date:   Tue Jun 24 09:36:50 2014 -0700

    net: wireless: Increase scan entry expiration to fit new scan time

    Change-Id: I0e23ce45d78d7c17633670973f49943a5ed6032d
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

commit 8ba944ed5db7a8df463ba5688482178c9c8f9ffe
Author: Charndeep Grewal <csgrewa@tycho.ncsc.mil>
Date:   Tue Oct 23 16:18:50 2012 -0400

    android: logger: enforce GID and CAP check on log flush

    Restrict log flushing to those in the logs group, or
    anyone with CAP_SYSLOG.

    Change-Id: I5d6977d1c0d60ffe8487771cc195789e5db95454
    Signed-off-by: Charndeep Grewal <csgrewa@tycho.ncsc.mil>

commit fba5a8bf06105abace3cc549590af017946e80d1
Author: Benoit Goby <benoit@android.com>
Date:   Wed Sep 19 17:03:34 2012 -0700

    usb: gadget: f_fs: Fix enumeration in fullspeed mode

    ffs_func_eps_enable always take the highspeed usb_endpoint_descriptor
    if it is available. Choose the correct usb_endpoint_descriptor
    depending on the gadget speed instead.

    Change-Id: I5b8444cfdf1b6fe1eef25525fb7a0a0f617a353e
    Signed-off-by: Benoit Goby <benoit@android.com>

commit 889e63f4f7dbedba1ed358da007853dedeab4221
Author: Peter Korsgaard <peter.korsgaard@barco.com>
Date:   Thu May 3 12:58:49 2012 +0200

    f_fs: ffs_func_free: cleanup requests allocated by autoconfig

    functionfs was leaking request objects created by autoconfig.

    Bug: 8659094

    Change-Id: I641326cb5cb26e0a2ffa082cd2be2c21c66c38e5
    Signed-off-by: Peter Korsgaard <peter.korsgaard@barco.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Benoit Goby <benoit@android.com>

commit a4997f55c441d735e218a59611801e51f81f8071
Author: JP Abgrall <jpa@google.com>
Date:   Fri Mar 1 18:28:21 2013 -0800

    serial: samsung: fix leaked requested irq

    The s3c64xx_serial_startup() requests an IRQ, but the common
    s3c24xx_serial_shutdown() would not free it.

    s3c64xx_serial_startup() is used when
    s3c24xx_serial_has_interrupt_mask(port) is true, at which point
      ourport->rx_claimed = ourport->tx_claimed = 1
    so we only need to free in one of the claimed cases.

    Change-Id: I8e17ce52cf48dbf3faa26ac24c8a71f016771f32
    Signed-off-by: JP Abgrall <jpa@google.com>

commit e2b7d1dce8e9b6ae18322b2669568b74f2cfb7a5
Author: Mathias Krause <minipli@googlemail.com>
Date:   Sun Apr 7 01:51:49 2013 +0000

    Bluetooth: fix possible info leak in bt_sock_recvmsg()

    [ Upstream commit 4683f42fde3977bdb4e8a09622788cc8b5313778 ]

    In case the socket is already shutting down, bt_sock_recvmsg() returns
    with 0 without updating msg_namelen leading to net/socket.c leaking the
    local, uninitialized sockaddr_storage variable to userland -- 128 bytes
    of kernel stack memory.

    Fix this by moving the msg_namelen assignment in front of the shutdown
    test.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Cc: Gustavo Padovan <gustavo@padovan.org>
    Cc: Johan Hedberg <johan.hedberg@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab2f8546549bda5603c08078d7fe034380e618f2
Author: Arve Hjønnevåg <arve@android.com>
Date:   Sun Apr 29 22:53:02 2012 +0200

    PM / Sleep: Add wakeup_source_activate and wakeup_source_deactivate tracepoints

    Add tracepoints to wakeup_source_activate and wakeup_source_deactivate.
    Useful for checking that specific wakeup sources overlap as expected.

    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit aadfbef3fb50ef7e136c50658ed029122906def4
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:52:52 2012 +0200

    PM / Sleep: Change wakeup source statistics to follow Android

    Wakeup statistics used by Android are slightly different from what we
    have in wakeup sources at the moment and there aren't any known
    users of those statistics other than Android, so modify them to make
    it easier for Android to switch to wakeup sources.

    This removes the struct wakeup_source's hit_cout field, which is very
    rough and therefore not very useful, and adds two new fields,
    wakeup_count and expire_count.  The first one tracks how many times
    the wakeup source is activated with events_check_enabled set (which
    roughly corresponds to the situations when a system power transition
    to a sleep state is in progress and would be aborted by this wakeup
    source if it were the only active one at that time) and the second
    one is the number of times the wakeup source has been activated with
    a timeout that expired.

    Additionally, the last_time field is now updated when the wakeup
    source is deactivated too (previously it was only updated during
    the wakeup source's activation), which seems to be what Android does
    with the analogous counter for wakelocks.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8a3b31a303a3a28e1babd3535a49bc054f20bb0
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:52:34 2012 +0200

    PM / Sleep: Use wait queue to signal "no wakeup events in progress"

    The current wakeup source deactivation code doesn't do anything when
    the counter of wakeup events in progress goes down to zero, which
    requires pm_get_wakeup_count() to poll that counter periodically.
    Although this reduces the average time it takes to deactivate a
    wakeup source, it also may lead to a substantial amount of unnecessary
    polling if there are extended periods of wakeup activity.  Thus it
    seems reasonable to use a wait queue for signaling the "no wakeup
    events in progress" condition and remove the polling.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Acked-by: mark gross <markgross@thegnar.org>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 324c154d33f9367cf1fad4681904a31e37a4403d
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:54:47 2012 +0200

    PM / QoS: Create device constraints objects on notifier registration

    The current behavior of dev_pm_qos_add_notifier() makes device PM QoS
    notifiers less than useful.  Namely, it silently returns success when
    called before any PM QoS constraints are added for the device, so the
    caller will assume that the notifier has been registered, but when
    someone actually adds some nontrivial constraints for the device
    eventually, the previous callers of dev_pm_qos_add_notifier()
    will not know about that and their notifier routines will not be
    executed (contrary to their expectations).

    To address this problem make dev_pm_qos_add_notifier() create the
    constraints object for the device if it is not present when the
    routine is called.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Acked-by : markgross <markgross@thegnar.org>

commit 1dbf9f8642a9df48d64738272d6c6306750d98a7
Author: Colin Cross <ccross@android.com>
Date:   Mon Jul 16 18:24:33 2012 -0700

    ARM: ftrace: Trace function entry before updating index

    Commit 722b3c74695377d11d18a52f3da08114d37f3f37 modified x86 ftrace to
    avoid tracing all functions called from irqs when function graph was
    used with a filter.  Port the same fix to ARM.

    Change-Id: I3facbb85447effe54ff92db206068087c892fc28
    Signed-off-by: Colin Cross <ccross@android.com>

commit 52dfdbd1ef158f039343d8da59f47788a50b6822
Author: JP Abgrall <jpa@google.com>
Date:   Thu May 30 15:31:17 2013 -0700

    misc: uidstat: avoid create_stat() race and blockage.

    * create_stat() race would lead to:
      [   58.132324] proc_dir_entry 'uid_stat/10061' already registered

    * blocking kmalloc reported by sbranden
     tcp_read_sock()
      uid_stat_tcp_rcv()
        create_stat()
          kmalloc(GFP_KERNEL)

    Signed-off-by: JP Abgrall <jpa@google.com>

commit bdf5d686e85be99fd4322bdd8176c6d8425e7959
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Mon May 7 22:00:59 2012 +0200

    PM / Domains: Fix computation of maximum domain off time

    The default domain power off governor function for generic PM
    domains, default_power_down_ok(), may violate subdomain maximum
    off time limit by allowing the master domain to be off for too
    long.  Namely, it only finds the minium of all device maximum
    off times over the domain's devices and uses that to compute the
    domain's maximum off time, but it should do the same for the
    subdomains.

    Fix this problem by modifying default_power_down_ok() to compute
    the given domain's maximum off time as the difference between the
    minimum off time over all devices and subdomains in the domain and
    its power on latency.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit 5ef758a886a68d3c5eca424bb26124deb63b8e37
Author: Huang Ying <ying.huang@intel.com>
Date:   Mon May 7 21:35:45 2012 +0200

    PM / Domains: Fix link checking when add subdomain

    Current pm_genpd_add_subdomain() will allow duplicated link between
    master and slave domain.  This patch fixed it.

    Because when current pm_genpd_add_subdomain() checks whether the link
    between the master and slave generic PM domain already exists,
    slave_links instead of master_links of master domain is used.

    Signed-off-by: Huang Ying <ying.huang@intel.com>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit 4827a6a29797bc9da64edfcddacd144d7f628654
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Mon May 14 21:45:52 2012 +0200

    PM / Domains: Make it possible to add devices to inactive domains

    The generic PM domains core code currently requires domains to be in
    the "power on" state for adding devices to them, but this limitation
    turns out to be inconvenient in some situations, so remove it.

    For this purpose, make __pm_genpd_add_device() set the device's
    need_restore flag if the domain is in the "power off" state, so that
    the device's "restore state" (usually .runtime_resume()) callback
    is executed when it is resumed after the domain has been turned on.
    If the domain is in the "power on" state, the device's need_restore
    flag will be cleared by __pm_genpd_add_device(), so that its "save
    state" (usually .runtime_suspend()) callback is executed when the
    domain is about to be turned off.  However, since that default
    behavior need not be always desirable, add a helper function
    pm_genpd_dev_need_restore() allowing a device's need_restore flag
    to be set/unset at any time.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit e95da15a7d6ad8c335677c34cdc5d1db620a94c3
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:54:36 2012 +0200

    PM / Runtime: Remove device fields related to suspend time, v2

    After the previous changes in default_stop_ok() and
    default_power_down_ok() for PM domains, there are two fields in
    struct dev_pm_info that aren't necessary any more,  suspend_time
    and max_time_suspended_ns.

    Remove those fields along with all of the code that accesses them,
    which simplifies the runtime PM framework quite a bit.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit d5a4185fed6018df31dec039fbb5705e101415b4
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Tue May 1 21:34:07 2012 +0200

    PM / Domains: Cache device stop and domain power off governor results, v3

    The results of the default device stop and domain power off governor
    functions for generic PM domains, default_stop_ok() and
    default_power_down_ok(), depend only on the timing data of devices,
    which are static, and on their PM QoS constraints.  Thus, in theory,
    these functions only need to carry out their computations, which may
    be time consuming in general, when it is known that the PM QoS
    constraint of at least one of the devices in question has changed.

    Use the PM QoS notifiers of devices to implement that.  First,
    introduce new fields, constraint_changed and max_off_time_changed,
    into struct gpd_timing_data and struct generic_pm_domain,
    respectively, and register a PM QoS notifier function when adding
    a device into a domain that will set those fields to 'true' whenever
    the device's PM QoS constraint is modified.  Second, make
    default_stop_ok() and default_power_down_ok() use those fields to
    decide whether or not to carry out their computations from scratch.

    The device and PM domain hierarchies are taken into account in that
    and the expense is that the changes of PM QoS constraints of
    suspended devices will not be taken into account immediately, which
    isn't guaranteed anyway in general.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit 97436e66cc8d2674618d99f539e07a362ff15c70
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:54:17 2012 +0200

    PM / Domains: Rework default device stop governor function, v2

    The existing default device stop governor function for PM domains,
    default_stop_ok(), is supposed to check whether or not the device's
    PM QoS latency constraint will be violated if the device is stopped
    by pm_genpd_runtime_suspend().  However, the computations carried out
    by it don't reflect the definition of the PM QoS latency constrait in
    Documentation/ABI/testing/sysfs-devices-power.

    Make default_stop_ok() follow the definition of the PM QoS latency
    constrait.  In particular, make it take the device's start and stop
    latencies correctly.

    Add a new field, effective_constraint_ns, to struct gpd_timing_data
    and use it to store the difference between the device's PM QoS
    constraint and its resume latency for use by the device's parent
    (the effective_constraint_ns values for the children are used for
    computing the parent's one along with its PM QoS constraint).

    Remove the break_even_ns field from struct gpd_timing_data, because
    it's not used any more.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit e9d026df409fcabf81071c2fdee8d478bc916c9a
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Sun Apr 29 22:54:30 2012 +0200

    PM / Domains: Rework default domain power off governor function, v2

    The existing default domain power down governor function for PM
    domains, default_power_down_ok(), is supposed to check whether or not
    the PM QoS latency constraints of the devices in the domain will be
    violated if the domain is turned off by pm_genpd_poweroff().
    However, the computations carried out by it don't reflect the
    definition of the PM QoS latency constrait in
    Documentation/ABI/testing/sysfs-devices-power.

    Make default_power_down_ok() follow the definition of the PM QoS
    latency constrait.  In particular, make it only take latencies into
    account, because it doesn't matter how much time has elapsed since
    the domain's devices were suspended for the computation.

    Remove the break_even_ns and power_off_time fields from
    struct generic_pm_domain, because they are not necessary any more.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit d2b66b60bea6644d904903fcf72ec24ca440bb86
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Tue May 1 21:33:53 2012 +0200

    PM / Domains: Make device removal more straightforward

    The removal of a device from a PM domain doesn't have to browse
    the domain's device list, because it can check directly if the
    device belongs to the given domain.  Moreover, it should clear
    the domain_data pointer in dev->power.subsys_data, because
    dev_pm_put_subsys_data(dev) may not remove dev->power.subsys_data
    and the stale domain data pointer may cause problems to happen.

    Rework pm_genpd_remove_device() taking the above observations into
    account.

    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

commit ff67b32ebd8352838a0b0f5515226081d67128d8
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Apr 7 11:18:34 2014 +0800

    f2fs: fix wrong statistics of inline data

    If we remove a file that has inline data after mount, our statistics turns to
    inaccurate.

    cat /sys/kernel/debug/f2fs/status
      - Inline_data Inode: 4294967295

    Let's add stat_inc_inline_inode() to stat inline info of the file when lookup.

    Change log from v1:
     o stat in f2fs_lookup() instead of in do_read_inode() for excluding wrong stat.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 12fabe3202306816c426731ef56afcb952e3f323
Author: Huajun Li <huajun.li@intel.com>
Date:   Sun Nov 10 23:13:21 2013 +0800

    f2fs: update f2fs Documentation

    This patch describes the inline_data support in f2fs document.

    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 87712c8e263bcfad5703d90e20058fe9bc9c1788
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Sat Mar 29 15:30:40 2014 +0800

    f2fs: fix error path when fail to read inline data

    We should unlock page in ->readpage() path and also should unlock & release page
    in error path of ->write_begin() to avoid deadlock or memory leak.
    So let's add release code to fix the problem when we fail to read inline data.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f60132e04e4dbc9fb7a38fdf0c2b4fdd88023410
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Sat Mar 29 11:33:17 2014 +0800

    f2fs: use list_for_each_entry{_safe} for simplyfying code

    This patch use list_for_each_entry{_safe} instead of list_for_each{_safe} for
    simplfying code.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 6d90ba635c3504760c05e98be1e486c2fa2ec9c6
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Wed Apr 2 08:55:00 2014 +0800

    f2fs: avoid free slab cache under spinlock

    Move kmem_cache_free out of spinlock protection region for better performance.

    Change log from v1:
     o remove spinlock protection for kmem_cache_free in destroy_node_manager
    suggested by Jaegeuk Kim.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 5568f48999e5076b12601c0a079c13c77587a7df
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Sat Mar 22 14:59:45 2014 +0800

    f2fs: avoid unneeded lookup when xattr name length is too long

    In f2fs_setxattr we have limit this attribute name length, so we should also
    check it in f2fs_getxattr to avoid useless lookup caused by invalid name length.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit c7906565c482416fd0c00084be62725543bcd818
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Apr 1 17:38:26 2014 +0900

    f2fs: return -EIO when node id is not matched

    During the cleaing of node segments, F2FS can get errored node blocks due to
    data race between node page lock and its valid bitmap operations.
    In that case, it needs to return an error to skip such the obsolete block copy.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 7c12a4f393986c16c74fa92ead4c5fe3d8acdcf8
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Mar 20 22:21:08 2014 +0900

    f2fs: avoid RECLAIM_FS-ON-W warning

    This patch should resolve the following possible bug.

    RECLAIM_FS-ON-W at:
     mark_held_locks+0xb9/0x140
     lockdep_trace_alloc+0x85/0xf0
     __kmalloc+0x53/0x1d0
     read_all_xattrs+0x3d1/0x3f0 [f2fs]
     f2fs_getxattr+0x4f/0x100 [f2fs]
     f2fs_get_acl+0x4c/0x290 [f2fs]
     get_acl+0x4f/0x80
     posix_acl_create+0x72/0x180
     f2fs_init_acl+0x29/0xcc [f2fs]
     __f2fs_add_link+0x259/0x710 [f2fs]
     f2fs_create+0xad/0x1c0 [f2fs]
     vfs_create+0xed/0x150
     do_last+0xd36/0xed0
     path_openat+0xc5/0x680
     do_filp_open+0x43/0xa0
     do_sys_open+0x13c/0x230
     SyS_creat+0x1e/0x20
     system_call_fastpath+0x16/0x1b

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit fef165f9be8f2264ac5d5fdb35976665ce58207e
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Mar 20 21:52:53 2014 +0900

    f2fs: skip unnecessary node writes during fsync

    If multiple redundant fsync calls are triggered, we don't need to write its
    node pages with fsync mark continuously.

    So, this patch adds FI_NEED_FSYNC to track whether the latest node block is
    written with the fsync mark or not.
    If the mark was set, a new fsync doesn't need to write a node block.
    Otherwise, we should do a new node block with the mark for roll-forward
    recovery.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 745e1b418ea96ce335a6d32dfcc5ef2f10d8f693
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Mar 20 19:10:08 2014 +0900

    f2fs: introduce fi->i_sem to protect fi's info

    This patch introduces fi->i_sem to protect fi's info that includes xattr_ver,
    pino, i_nlink.
    This enables to remove i_mutex during f2fs_sync_file, resulting in performance
    improvement when a number of fsync calls are triggered from many concurrent
    threads.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 745ca7cfbfbde46df769118b519d41e37f92c51d
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Mar 19 14:17:21 2014 +0900

    f2fs: change reclaim rate in percentage

    It is more reasonable to determine the reclaiming rate of prefree segments
    according to the volume size, which is set to 5% by default.
    For example, if the volume is 128GB, the prefree segments are reclaimed
    when the number reaches to 6.4GB.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit bb2666641fc4f4f5aa1dfadc91940cb41ac7e4e7
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Mar 19 13:45:52 2014 +0900

    f2fs: remove unnecessary threshold

    The NM_WOUT_THRESHOLD is now obsolete since f2fs starts to control on a basis
    of the memory footprint.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 1694f79e8ff3e17d9bb5eb3d3cb14bcccc726c50
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Mar 19 13:31:37 2014 +0900

    f2fs: throttle the memory footprint with a sysfs entry

    This patch introduces ram_thresh, a sysfs entry, which controls the memory
    footprint used by the free nid list and the nat cache.

    Previously, the free nid list was controlled by MAX_FREE_NIDS, while the nat
    cache was managed by NM_WOUT_THRESHOLD.
    However, this approach cannot be applied dynamically according to the system.

    So, this patch adds ram_thresh that users can specify the threshold, which is
    in order of 1 / 1024.
    For example, if the total ram size is 4GB and the value is set to 10 by default,
    f2fs tries to control the number of free nids and nat caches not to consume over
    10 * (4GB / 1024) = 10MB.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ae4ea1ab89832bc7a24816c47e511466491ee401
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Mar 19 10:43:59 2014 +0900

    f2fs: avoid to drop nat entries due to the negative nr_shrink

    The try_to_free_nats should not receive the negative nr_shrink.
    Otherwise, it can drop all the nat entries by the while loop.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 3a1cc36a0e652be1f1d8f26ed10ea4bafb2ed388
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Mar 18 13:29:07 2014 +0900

    f2fs: call f2fs_wait_on_page_writeback instead of native function

    If a page is on writeback, f2fs can face with deadlock due to under writepages.
    This is caused by merging IOs inside f2fs, so if it comes to detect, let's throw
    merged IOs, which is implemented by f2fs_wait_on_page_writeback.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 58c960543ba44ab43f61912da1c5585d32963988
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Mar 18 13:47:11 2014 +0900

    f2fs: introduce nr_pages_to_write for segment alignment

    This patch introduces nr_pages_to_write to align page writes to the segment
    or other operational unit size, which can be tuned according to the system
    environment.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 3521ddbe007bbde61f791f400c6a09eee1df2e99
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Mar 18 13:43:05 2014 +0900

    f2fs: increase pages_skipped when skipping writepages

    This patch increases pages_skipped when skipping writepages.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 2a62e6b25a0f6246aef9a872d44e9760d3dcfa44
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Mar 18 12:40:49 2014 +0900

    f2fs: avoid small data writes by skipping writepages

    This patch introduces nr_pages_to_skip(sbi, type) to determine writepages can
    be skipped.
    The dentry, node, and meta pages can be conrolled by F2FS without breaking the
    FS consistency.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit a294aef76b99dfd13860b01fa8ac4134bd9eb68e
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Mar 18 12:33:06 2014 +0900

    f2fs: introduce get_dirty_dents for readability

    The get_dirty_dents gives us the number of dirty dentry pages.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit daf5ed06fcb2f924018ae3011cd0929c90ccb1f7
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Mar 18 09:07:59 2014 +0800

    f2fs: fix incorrect parsing with option string

    Previously 'background_gc={on***,off***}' is being parsed as correct option,
    with this patch we cloud fix the trivial bug in mount process.

    Change log from v1:
     o need to check length of parameter suggested by Jaegeuk Kim.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 9a851f434dec387d30d73cb678413d3fea2e2b80
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Mar 17 16:36:24 2014 +0800

    f2fs: avoid to return incorrect errno of read_normal_summaries

    We should return error number of read_normal_summaries instead of -EINVAL when
    read_normal_summaries failed.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit d08ae424ac93c78b42dba666870096aee44918c6
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Mar 17 16:35:06 2014 +0800

    f2fs: introduce f2fs_has_xattr_block for better readability

    This patch introduces a help function f2fs_has_xattr_block for better
    readability.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 522e5c2c98be4e3812749ac41c4499a046fd29a8
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Mon Mar 17 10:31:06 2014 +0800

    f2fs: print type for each segment in segment_info's show

    The original segment_info's show looks out-of-format:
    cat /proc/fs/f2fs/loop0/segment_info
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 512
    512 512 512 512 512 512 512 0 0 512
    348 0 263 0 0 512 0 0 512 512
    512 512 0 512 512 512 512 512 512 512
    512 512 511 328 512 512 512 512 512 512
    512 512 512 512 512 512 512 0 0 175

    Let's fix this and show type for each segment.
    cat /proc/fs/f2fs/loop0/segment_info
    format: segment_type|valid_blocks
    segment_type(0:HD, 1:WD, 2:CD, 3:HN, 4:WN, 5:CN)
    0    2|0   1|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0
    10   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0
    20   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0
    30   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0
    40   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0   0|0
    50   3|0   3|0   3|0   3|0   3|0   3|0   3|0   0|0   3|0   3|0
    60   3|0   3|0   3|0   3|0   3|0   3|0   3|0   3|0   3|0   3|512
    70   3|512 3|512 3|512 3|512 3|512 3|512 3|512 3|0   3|0   3|512
    80   3|0   3|0   3|0   3|0   3|0   3|512 3|0   3|0   3|512 3|512
    90   3|512 0|512 3|274 0|512 0|512 0|512 0|512 0|512 0|512 3|512
    100  3|512 0|512 3|511 0|328 3|512 0|512 0|512 3|512 0|512 0|512
    110  0|512 0|512 0|512 0|512 0|512 0|512 0|512 5|0   4|0   3|512

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 2eb230cdc1a37eec76f27c38139d230d3da9432a
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Wed Mar 12 17:08:36 2014 +0800

    f2fs: check upper bound of ino value in f2fs_nfs_get_inode

    Upper bound checking of ino should be added to f2fs_nfs_get_inode, so unneeded
    process before do_read_inode in f2fs_iget could be avoided when ino is invalid.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ccf255444c12d6033d24531cc0e412d2fa41a8a2
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Wed Mar 12 15:59:03 2014 +0800

    f2fs: introduce f2fs_has_inline_xattr for better readability

    This patch introduces a help function f2fs_has_inline_xattr for better
    readability.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f258ad44fd6bda02934d350c801a3a480edaf3e1
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Mar 11 13:37:38 2014 +0800

    f2fs: recover inline xattr data in roll-forward process

    Previously we do not recover inline xattr data of inode after power-cut, so
    inline xattr data may be lost.
    We should recover the data during the roll-forward process.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit be3a3bfbd7b61b38c46051c9e21f3e62751d043a
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Fri Mar 7 18:43:36 2014 +0800

    f2fs: optimize restore_node_summary slightly

    Previously, we ra_sum_pages to pre-read contiguous pages as more
    as possible, and if we fail to alloc more pages, an ENOMEM error
    will be reported upstream, even though we have alloced some pages
    yet. In fact, we can use the available pages to do the job partly,
    and continue the rest in the following circle. Only reporting ENOMEM
    upstream if we really can not alloc any available page.

    And another fix is ignoring dealing with the following pages if an
    EIO occurs when reading page from page_list.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: modify the flow for better neat code]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 4b67546f43b1b08099a5e5449db185f8a13c6441
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Fri Mar 7 18:43:33 2014 +0800

    f2fs: format segment_info's show for better legibility

    The original segment_info's show is a bit out-of-format:

    [root@guz Demoes]# cat /proc/fs/f2fs/loop0/segment_info
    0 0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    ......
    0 0 0 0 0 0 0 0 0 0
    0 0 1 0 0 1 [root@guz Demoes]#

    so we fix it here for better legibility.
    [root@guz Demoes]# cat /proc/fs/f2fs/loop0/segment_info
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    0 0 0 0 0 0 0 0 0 0
    ......
    0 0 0 0 0 0 0 0 0 0
    0 0 1 0 0 1
    [root@guz Demoes]#

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit e10d8f4163e62a0e3a2f4566862214b4f06bd8ef
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Fri Mar 7 18:43:28 2014 +0800

    f2fs: remove the unused ctor argument of f2fs_kmem_cache_create()

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit d0d349b56a480e298ac4bd4d6e74faddf2667c45
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Fri Mar 7 18:43:24 2014 +0800

    f2fs: update start nid only once each circle

    Integrated a couple of minor changes for better readability suggested by
    Chao Yu.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f8973b6c72d65fe6eafe5d3be65492612475041d
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Mar 5 10:48:25 2014 +0900

    f2fs: fix wrong kernel coding style

    This patch includes a simple fix to adjust coding style.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 149e1cb7483dd3236e703c8e86c3a89f043be763
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Mar 3 11:28:40 2014 +0900

    f2fs: fix to write node pages with WRITE_SYNC

    This patch fixes performance regression of dbench reported by
    Alex <hbx7d@yandex.com>.

    This issue was revealed by Phoronix tests results:
    http://www.phoronix.com/scan.php?page=article&item=linux_314_ssdfs&num=2

    It turns out that we need to assign WRITE_SYNC to the node writes, if
    fsync is triggered.

    The performance numbers are like below, which is measured by Alex.
    1. 355MB/s       ext4
    2. 225MB/s       f2fs : WRITE for node writes
    3. 525MB/s       f2fs : WRITE_SYNC for node writes

    Reported-And-Tested-by: Alex <hbx7d@yandex.com>.
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 67fbfac3bcd292340c63ac6088be73a47bb81548
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Fri Feb 28 10:12:05 2014 +0800

    f2fs: fix dirty page accounting when redirty

    We should de-account dirty counters for page when redirty in ->writepage().

    Wu Fengguang described in 'commit 971767caf632190f77a40b4011c19948232eed75':
    "writeback: fix dirtied pages accounting on redirty
    De-account the accumulative dirty counters on page redirty.

    Page redirties (very common in ext4) will introduce mismatch between
    counters (a) and (b)

    a) NR_DIRTIED, BDI_DIRTIED, tsk->nr_dirtied
    b) NR_WRITTEN, BDI_WRITTEN

    This will introduce systematic errors in balanced_rate and result in
    dirty page position errors (ie. the dirty pages are no longer balanced
    around the global/bdi setpoints)."

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit d6e8bd60b494fdc8c5d42642ce043999ecdf42be
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Feb 27 19:52:21 2014 +0800

    f2fs: use existing macro to clean up some codes

    This patch use existing macro F2FS_INODE/NEXT_FREE_BLKADDR to clean up some
    codes.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit c0ca66a3c82a0f9f60dd6301beceaef29cfa398c
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Thu Feb 27 19:12:24 2014 +0800

    f2fs: readahead contiguous SSA blocks for f2fs_gc

    If there are multi segments in one section, we will read those SSA blocks which
    have contiguous address one by one in f2fs_gc. It may lost performance, let's
    read ahead SSA blocks by merge multi read request.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 9d728b607d69e2cda0888061c1a14972f888f747
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Feb 27 20:09:05 2014 +0900

    f2fs: add an sysfs entry to control the directory level

    This patch adds an sysfs entry to control dir_level used by the large directory.

    The description of this entry is:

     dir_level                    This parameter controls the directory level to
    			      support large directory. If a directory has a
    			      number of files, it can reduce the file lookup
    			      latency by increasing this dir_level value.
    			      Otherwise, it needs to decrease this value to
    			      reduce the space overhead. The default value is 0.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 7d850ca9cc473e091753350ad0d26e479bf326c9
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Jan 9 21:00:06 2014 +0900

    f2fs: update documents and a MAINTAINERS entry

    This patch adds missing some description of sysfs entries in
     - Documentation/ABI/testing/sysfs-fs-f2fs
     - Documentation/filesystems/f2fs.txt.

    And it adds a maintained document entry of F2FS in MAINTAINERS.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f18dec23fa00d908806cfa2e28fb0873cfe0ab57
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Feb 27 18:20:00 2014 +0900

    f2fs: introduce large directory support

    This patch introduces an i_dir_level field to support large directory.

    Previously, f2fs maintains multi-level hash tables to find a dentry quickly
    from a bunch of chiild dentries in a directory, and the hash tables consist of
    the following tree structure as below.

    In Documentation/filesystems/f2fs.txt,

    ----------------------
    A : bucket
    B : block
    N : MAX_DIR_HASH_DEPTH
    ----------------------

    level #0   | A(2B)
               |
    level #1   | A(2B) - A(2B)
               |
    level #2   | A(2B) - A(2B) - A(2B) - A(2B)
         .     |   .       .       .       .
    level #N/2 | A(2B) - A(2B) - A(2B) - A(2B) - A(2B) - ... - A(2B)
         .     |   .       .       .       .
    level #N   | A(4B) - A(4B) - A(4B) - A(4B) - A(4B) - ... - A(4B)

    But, if we can guess that a directory will handle a number of child files,
    we don't need to traverse the tree from level #0 to #N all the time.
    Since the lower level tables contain relatively small number of dentries,
    the miss ratio of the target dentry is likely to be high.

    In order to avoid that, we can configure the hash tables sparsely from level #0
    like this.

    level #0   | A(2B) - A(2B) - A(2B) - A(2B)

    level #1   | A(2B) - A(2B) - A(2B) - A(2B) - A(2B) - ... - A(2B)
         .     |   .       .       .       .
    level #N/2 | A(2B) - A(2B) - A(2B) - A(2B) - A(2B) - ... - A(2B)
         .     |   .       .       .       .
    level #N   | A(4B) - A(4B) - A(4B) - A(4B) - A(4B) - ... - A(4B)

    With this structure, we can skip the ineffective tree searches in lower level
    hash tables.

    This patch adds just a facility for this by introducing i_dir_level in
    f2fs_inode.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit da4134c77a15242356729c58e1e60288c248388c
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Thu Feb 27 13:57:53 2014 +0900

    f2fs: remove costly bit operations for f2fs_find_entry

    It turns out that a bit operation like find_next_bit is not always fast enough
    for f2fs_find_entry.
    Instead, it is pretty much simple and fast to traverse each dentries.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit b27fd78265f2d19a587421c81bd8220332d4c7d0
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Feb 24 13:00:13 2014 +0900

    f2fs: implement a lock-free stat_show

    The stat_show is just to show the current status of f2fs.
    So, we can remove all the there-in locks.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 2e36978e47e9e94703278468d09e925ac7ee1e34
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Feb 21 14:29:35 2014 +0900

    f2fs: introduce a radix_tree for the free_nid list

    This patch introduces a radix tree for the list of free_nids, which enhances
    the performance on free nid management.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit bb0ba68e5ec98617dffceb24651bebb36370229b
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Fri Feb 21 18:08:29 2014 +0800

    f2fs: introduce help macro on_build_free_nids()

    Introduce help macro on_build_free_nids() which just uses build_lock
    to judge whether the building free nid is going, so that we can remove
    the on_build_free_nids field from f2fs_sb_info.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    [Jaegeuk Kim: remove an unnecessary white line removal]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit c4a17f6f9701ad3a829c68bced866321b4a24109
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Feb 21 13:17:22 2014 +0900

    f2fs: fix to mark the checkpointed nat entry correctly

    The nat cache entry maintains a status whether it is checkpointed or not.
    So, if a new cache entry is loaded from the last checkpoint,
    nat_entry->checkpointed should be true.
    If the cache entry is modified as being dirty, nat_entry->checkpoint should
    be false.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ac61cbf4d5658dadb52f651aa430e59affc3a5fb
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Feb 19 18:23:32 2014 +0900

    f2fs: fix to do build_stat prior to the recovery procedure

    At the end of the recovery procedure, write_checkpoint is called and updates
    the cp count which is managed by f2fs stat.
    But, previously build_stat() is called after the recovery procedure, which
    results in:

    BUG: unable to handle kernel NULL pointer dereference at 000000000000012c
    IP: [<ffffffffa03b1030>] write_checkpoint+0x720/0xbc0 [f2fs]
    Call Trace:
     [<ffffffff810a6b44>] ? mark_held_locks+0x74/0x140
     [<ffffffff8109a3e0>] ? __init_waitqueue_head+0x60/0x60
     [<ffffffffa03bf036>] recover_fsync_data+0x656/0xf20 [f2fs]
     [<ffffffff812ee3eb>] ? security_d_instantiate+0x1b/0x30
     [<ffffffffa03aeb4d>] f2fs_fill_super+0x94d/0xa00 [f2fs]
     [<ffffffff811a9825>] mount_bdev+0x1a5/0x1f0
     [<ffffffff8114915e>] ? __get_free_pages+0xe/0x40
     [<ffffffffa03ae200>] ? f2fs_remount+0x130/0x130 [f2fs]
     [<ffffffffa03aa575>] f2fs_mount+0x15/0x20 [f2fs]
     [<ffffffff811aa713>] mount_fs+0x43/0x1b0
     [<ffffffff811c7124>] vfs_kern_mount+0x74/0x160
     [<ffffffff811c5cb1>] ? __get_fs_type+0x51/0x60
     [<ffffffff811c9727>] do_mount+0x237/0xb50
     [<ffffffff811c936a>] ? copy_mount_options+0x3a/0x170

    So, this patche changes the order of recovery_fsync_data() and
    f2fs_build_stats().

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 5b78f390bb508d8e64a53dd97015d0874b4fcaa1
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Feb 17 19:29:27 2014 +0900

    f2fs: fix not to write data pages on the page reclaiming path

    Even if f2fs_write_data_page is called by the page reclaiming path, we should
    not write the page to provide enough free segments for the worst case scenario.
    Otherwise, f2fs can face with no free segment while gc is conducted, resulting
    in:

     ------------[ cut here ]------------
     kernel BUG at /home/zeus/f2fs_test/src/fs/f2fs/segment.c:565!
     RIP: 0010:[<ffffffffa02c3b11>]  [<ffffffffa02c3b11>] new_curseg+0x331/0x340 [f2fs]
     Call Trace:
      allocate_segment_by_default+0x204/0x280 [f2fs]
      allocate_data_block+0x108/0x210 [f2fs]
      write_data_page+0x8a/0xc0 [f2fs]
      do_write_data_page+0xe1/0x2a0 [f2fs]
      move_data_page+0x8a/0xf0 [f2fs]
      f2fs_gc+0x446/0x970 [f2fs]
      f2fs_balance_fs+0xb6/0xd0 [f2fs]
      f2fs_write_begin+0x50/0x350 [f2fs]
      ? unlock_page+0x27/0x30
      ? unlock_page+0x27/0x30
      generic_file_buffered_write+0x10a/0x280
      ? file_update_time+0xa3/0xf0
      __generic_file_aio_write+0x1c8/0x3d0
      ? generic_file_aio_write+0x52/0xb0
      ? generic_file_aio_write+0x52/0xb0
      generic_file_aio_write+0x65/0xb0
      do_sync_write+0x5a/0x90
      vfs_write+0xc5/0x1f0
      SyS_write+0x55/0xa0
      system_call_fastpath+0x16/0x1b

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 30d226b2949a80dc1abbf6811fea4fadc8390a4a
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Feb 17 12:44:20 2014 +0900

    f2fs: fix the calculation of max_nids

    Total nids that f2fs can use should not include 0, nid for node inode, and nid
    for meta inode.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 150234ad2290d27391691945d9e80174fb424faa
Author: Changman Lee <cm224.lee@samsung.com>
Date:   Thu Feb 13 15:12:29 2014 +0900

    f2fs: show counts of checkpoint in status

    This patch shows the counts of checkpoint in f2fs' status.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 17ce2ce2d1a4f7dbc0c11cf2a777ebfc94ac4048
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Fri Feb 7 16:11:53 2014 +0800

    f2fs: introduce ra_meta_pages to readahead CP/NAT/SIT pages

    This patch help us to cleanup the readahead code by merging ra_{sit,nat}_pages
    function into ra_meta_pages.
    Additionally the new function is used to readahead cp block in
    recover_orphan_inodes.

    Change log from v1:
     o fix a deadloop bug pointed by Jaegeuk Kim.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit d24a59faea32d68d77c79a1112bc399175e34ed0
Author: Chao Yu <chao2.yu@samsung.com>
Date:   Tue Jan 28 10:29:26 2014 +0800

    f2fs: use inode mutex to keep atomicity of f2fs_falloc

    Previously without protection of inode mutex, f2fs_falloc and other data
    correlated operations will interfere with each other.
    So let's use inode mutex to keep atomicity of f2fs_falloc.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit ca703dc2ac70107f99f1d394c119a0d26f27d472
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Feb 7 10:00:06 2014 +0900

    f2fs: clean up redundant function call

    This patch integrates inode_[inc|dec]_dirty_dents with inc_page_count to remove
    redundant calls.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit b5cb5d0e22d5c3256b98ae9cfc56fa590bb8ceaf
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Feb 5 13:03:57 2014 +0900

    f2fs: fix f2fs_write_meta_page at no checkpoint status

    If f2fs entered errorneous checkpoint status, it should skip writing meta
    pages instead of redirtying the pages out.
    Otherwise, it cannot unmount the partition even though f2fs is under read-only
    status.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit dd15fcda1d5e83b8667bc19519d030afb6fff433
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Wed Feb 5 11:16:39 2014 +0900

    f2fs: fix to truncate dentry pages in the error case

    When a new directory is allocated, if an error is occurred, we should truncate
    preallocated dentry pages too.

    This bug was reported by Andrey Tsyvarev after a while as follows.

    mkdir()->
     f2fs_add_link()->
      init_inode_metadata()->
        f2fs_init_acl()->
          f2fs_get_acl()->
            f2fs_getxattr()->
              read_all_xattrs() fails.

    Also there was a BUG_ON triggered after the fault in
    mkdir()->
     f2fs_add_link()->
       init_inode_metadata()->
        remove_inode_page() ->
          f2fs_bug_on(inode->i_blocks != 0 && inode->i_blocks != 1);

    But, previous patch wasn't perfect to resolve that bug, so the following bug
    report was also submitted.

    kernel BUG at fs/f2fs/inode.c:274!
    Call Trace:
     [<ffffffff811fde03>] evict+0xa3/0x1a0
     [<ffffffff811fe615>] iput+0xf5/0x180
     [<ffffffffa01c7f63>] f2fs_mkdir+0xf3/0x150 [f2fs]
     [<ffffffff811f2a77>] vfs_mkdir+0xb7/0x160
     [<ffffffff811f36bf>] SyS_mkdir+0x5f/0xc0
     [<ffffffff81680769>] system_call_fastpath+0x16/0x1b

    Finally, this patch resolves all the issues like below.

    If an error is occurred after make_empty_dir(),
     1. truncate_inode_pages()
       The make_bad_inode() prior to iput() will change i_mode to S_IFREG, which
       means that f2fs will not decrement fi->dirty_dents during f2fs_evict_inode.
       But, by calling it here, we can do that.

     2. truncate_blocks()
       Preallocated dentry pages are trucated here to sync i_blocks.

     3. remove_dirty_dir_inode()
       Remove this directory inode from the list.

    Reported-and-Tested-by: Andrey Tsyvarev <tsyvarev@ispras.ru>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 825644adb2ad233555bae02d0791a5017ddec9d1
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Jan 28 14:54:07 2014 +0900

    f2fs: fix a build warning

    This patch modifies flow a little bit to avoid the following build warnings.

    src/fs/f2fs/recovery.c: In function ‘check_index_in_prev_nodes’:
    src/fs/f2fs/recovery.c:288:51: warning: ‘sum.<U5390>.<U52f8>.ofs_in_node’ may
    	be used uninitialized in this function [-Wmaybe-uninitialized]
    src/fs/f2fs/recovery.c:260:23: warning: ‘sum.nid’ may be used uninitialized
    	in this function [-Wmaybe-uninitialized]

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 7ec18c96f1d2db558dbd8607cc343c8afe7fc969
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Feb 4 13:01:10 2014 +0900

    f2fs: clean up with a macro

    This patch adds GET_BLKOFF_FROM_SEG0 to clean up some codes.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit cba9cd487fdabe35159ff26ebcb5ae878f4922b6
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Feb 3 17:24:51 2014 +0900

    f2fs: fix the potential mismatch between dir's i_size and i_blocks

    This is the erroneous scenario.

                                 i_size    on-disk i_size    i_blocks
    __f2fs_add_link()             4096           4096           2
     get_new_data_page            8192           4096           3
     -ENOSPC = init_inode_metadata
     checkpoint                     -            4096           3
     POR and reboot

    __f2fs_add_link()             4096           4096           3
     page = get_new_data_page (page->index = 1 by NEW_ADDR)
     add a dentry to the page successfully

    f2fs_rmdir()
     f2fs_empty_dir()             4096           4096           3
     f2fs_unlink() goes, since there is no valid dentry due to i_size = 4096.
     But, still there is one dentry in page->index = 1.

    So this patch moves the code to write dir->i_size into on-disk i_size in order
    to sync dir's i_size, on-disk i_size, and its i_blocks.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit 223e63a1a2e3843c28ceeeb2d359af0cccc3ac0e
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Mon Feb 3 10:50:22 2014 +0900

    f2fs: remove the ugly pointer conversion

    This patch modifies the use of bi_private to remove pointer chasing for sbi.
    Previously, we had a bi_private structure, but it needs memory allocation.
    So this patch uses bi_private by the sbi pointer and adds a completion pointer
    into the sbi.
    This can achieve no memory allocation and nice use of the bi_private.

    Change-Id: I1546c1e7f991f8eebe9323d6930a5919d18773cb
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit b5ef2ce160d5a1d878f03d2dd178187177d400cb
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Jan 28 12:25:06 2014 +0900

    f2fs: fix to recover xattr node block

    If a new xattr node page was allocated and its inode is fsynced, we should
    recover the xattr node page during the roll-forward process after power-cut.
    But, previously, f2fs didn't handle that case, resulting in kernel panic as
    follows reported by Tom Li.

    BUG: unable to handle kernel paging request at ffffc9001c861a98
    IP: [<ffffffffa0295236>] check_index_in_prev_nodes+0x86/0x2d0 [f2fs]
    Call Trace:
     [<ffffffff815ece9b>] ? printk+0x48/0x4a
     [<ffffffffa029626a>] recover_fsync_data+0xdca/0xf50 [f2fs]
     [<ffffffffa02873ae>] f2fs_fill_super+0x92e/0x970 [f2fs]
     [<ffffffff8112c9f8>] mount_bdev+0x1b8/0x200
     [<ffffffffa0286a80>] ? f2fs_remount+0x130/0x130 [f2fs]
     [<ffffffffa0285e40>] f2fs_mount+0x10/0x20 [f2fs]
     [<ffffffff8112d4de>] mount_fs+0x3e/0x1b0
     [<ffffffff810ef4eb>] ? __alloc_percpu+0xb/0x10
     [<ffffffff8114761f>] vfs_kern_mount+0x6f/0x120
     [<ffffffff811497b9>] do_mount+0x259/0xa90
     [<ffffffff810ead1d>] ? memdup_user+0x3d/0x80
     [<ffffffff810eadb3>] ? strndup_user+0x53/0x70
     [<ffffffff8114a2c9>] SyS_mount+0x89/0xd0
     [<ffffffff815feae2>] system_call_fastpath+0x16/0x1b

    This patch adds a recovery function of xattr node pages.

    Reported-by: Tom Li <biergaizi@members.fsf.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit c25cfb35011cdc3003e98222350e6ab6edac54eb
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Tue Jan 28 12:22:14 2014 +0900

    f2fs: handle dirty segments inside refresh_sit_entry

    This patch cleans up the refresh_sit_entry to handle locate_dirty_segments.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit a87c3855c7ebf420bb0e7d2e39a86af58844f437
Author: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Date:   Fri Jan 24 09:42:16 2014 +0900

    f2fs: update_inode_page should be done all the time

    In order to make fs consistency, update_inode_page should not be failed all
    the time. Otherwise, it is possible to lose some metadata in the inode like
    a link count.

    Change-Id: Ifd3ed8f10ecfe5d42b994c8d8bad263f453d4afb
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

commit f678e60aa1ca695058debdd516268c1159996d70
Author: Evan McClain <aeroevan@gmail.com>
Date:   Mon Jun 9 23:57:49 2014 -0400

    d2 et al: turn on CONFIG_KERNEL_MODE_NEON.

    Change-Id: Ie3accd4a1fe8a4ed7325ef34f1558d847e1f9168

commit 9658e164d41e3d753a9bea9f1209f3f8022b36ba
Author: myfluxi <linflux@arcor.de>
Date:   Sat Feb 15 19:56:05 2014 -0800

    arm: vfpmodule: Fix warning procfs vfp_bounce reporting failed

    Creation of procfs cpu/vfp_bounce fails because we're initialized too early. Fix
    this by creating it on rootfs_initcall as before the NEON patches.

    <6>[    0.130770] VFP support v0.3: implementor 51 architecture 64 part 6f varia
    nt 2 rev 0
    <4>[    0.130795] ------------[ cut here ]------------
    <4>[    0.130813] WARNING: at fs/proc/generic.c:323 __xlate_proc_name+0xac/0xcc(
    )
    <4>[    0.130822] name 'cpu/vfp_bounce'
    <4>[    0.130855] [<c010e26c>] (unwind_backtrace+0x0/0x144) from [<c0a20f58>] (d
    ump_stack+0x20/0x24)
    <4>[    0.130879] [<c0a20f58>] (dump_stack+0x20/0x24) from [<c019b670>] (warn_sl
    owpath_common+0x58/0x70)
    <4>[    0.130899] [<c019b670>] (warn_slowpath_common+0x58/0x70) from [<c019b704>
    ] (warn_slowpath_fmt+0x40/0x48)
    <4>[    0.130919] [<c019b704>] (warn_slowpath_fmt+0x40/0x48) from [<c02c2ad8>] (
    __xlate_proc_name+0xac/0xcc)
    <4>[    0.130938] [<c02c2ad8>] (__xlate_proc_name+0xac/0xcc) from [<c02c2b50>] (
    __proc_create+0x58/0x100)
    <4>[    0.130956] [<c02c2b50>] (__proc_create+0x58/0x100) from [<c02c2ed0>] (pro
    c_create_data+0x5c/0xc0)
    <4>[    0.130979] [<c02c2ed0>] (proc_create_data+0x5c/0xc0) from [<c0f03484>] (v
    fp_init+0x19c/0x200)
    <4>[    0.131000] [<c0f03484>] (vfp_init+0x19c/0x200) from [<c0f00c98>] (do_one_
    initcall+0x98/0x168)
    <4>[    0.131020] [<c0f00c98>] (do_one_initcall+0x98/0x168) from [<c0f00e60>] (k
    ernel_init+0xf8/0x1b4)
    <4>[    0.131043] [<c0f00e60>] (kernel_init+0xf8/0x1b4) from [<c01081a0>] (kerne
    l_thread_exit+0x0/0x8)
    <4>[    0.131076] ---[ end trace ea6d9a9b5e947151 ]---
    <3>[    0.131086] Failed to create procfs node for VFP bounce reporting

    Change-Id: Ic9bbe46ee026df0af76df70fd95275f284c8dd63
    Signed-off-by: Paul Reioux <reioux@gmail.com>

commit d3bdc65380a9c8e7cfd8bfc6ba519d6bbbade5cf
Author: Fabio Estevam <festevam@gmail.com>
Date:   Tue Jul 9 18:34:01 2013 +0100

    ARM: 7782/1: Kconfig: Let ARM_ERRATA_364296 not depend on CONFIG_SMP

    imx_v6_v7_defconfig handles both multi-core and single-core SoCs, and it has CONFIG_SMP=y selected by default.

    With such config we cannot select ARM_ERRATA_364296, as it depends on !SMP.

    Let ARM_ERRATA_364296 be undependent on CONFIG_SMP, so that we can select this erratum for the ARM1136 SoCs, even if CONFIG_SMP=y is enabled.

    Change-Id: Ia96ea3d8e9468884962793cc4a6b19f62e1adc59
    Reviewed-by: Dave Martin <Dave.Martin@arm.com>
    Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit bc8c21a76a1336f13a19bb2af7b36b335ce22121
Author: Stephen Warren <swarren@nvidia.com>
Date:   Fri Jul 5 22:59:42 2013 +0100

    ARM: 7780/1: add missing linker section markup to head-common.S

    Macro __INIT is used to place various code in head-common.S into the init
    section. This should be matched by a closing __FINIT. Also, add an
    explicit ".text" to ensure subsequent code is placed into the correct
    section; __FINIT is simply a closing marker to match __INIT and doesn't
    guarantee to revert to .text.

    This historically caused no problem, because macro __CPUINIT was used at
    the exact location where __FINIT was missing, which then placed following
    code into the cpuinit section. However, with commit 22f0a2736 "init.h:
    remove __cpuinit sections from the kernel" applied, __CPUINIT becomes a
    no-op, thus leaving all this code in the init section, rather than the
    regular text section. This caused issues such as secondary CPU boot
    failures or crashes.

    Change-Id: I2c346b58c4c4d50a162b19e9967d44ec5e97c7d4
    Signed-off-by: Stephen Warren <swarren@nvidia.com>
    Acked-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 27ab18262f8beb61360287ffef808fe994f7071c
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Fri May 17 18:51:23 2013 +0200

    ARM: crypto: add NEON accelerated XOR implementation

    Add a source file xor-neon.c (which is really just the reference
    C implementation passed through the GCC vectorizer) and hook it
    up to the XOR framework.

    Change-Id: If251e5a16d628ddfdd8d6ce40b78014cd2962d7e
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Nicolas Pitre <nico@linaro.org>

commit ddda0ec6d876edc7fdc10e4fc2e3acd38f9b2fda
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Thu May 16 11:41:48 2013 +0200

    ARM: add support for kernel mode NEON

    In order to safely support the use of NEON instructions in
    kernel mode, some precautions need to be taken:
    - the userland context that may be present in the registers (even
      if the NEON/VFP is currently disabled) must be stored under the
      correct task (which may not be 'current' in the UP case),
    - to avoid having to keep track of additional vfpstates for the
      kernel side, disallow the use of NEON in interrupt context
      and run with preemption disabled,
    - after use, re-enable preemption and re-enable the lazy restore
      machinery by disabling the NEON/VFP unit.

    This patch adds the functions kernel_neon_begin() and
    kernel_neon_end() which take care of the above. It also adds
    the Kconfig symbol KERNEL_MODE_NEON to enable it.

    Change-Id: Iddde22ad8684e92e5f0aa4999962ad743eff8f7c
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Nicolas Pitre <nico@linaro.org>

commit 7cea844bafac2c525203fa0a8de7bfb418899816
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Fri May 24 16:23:28 2013 +0200

    ARM: be strict about FP exceptions in kernel mode

    The support code in vfp_support_entry does not care whether the
    exception that caused it to be invoked occurred in kernel mode or
    in user mode. However, neither condition that could trigger this
    exception (lazy restore and VFP bounce to support code) is
    currently allowable in kernel mode.

    In either case, print a message describing the condition before
    letting the undefined instruction handler run its course and trigger
    an oops.

    Change-Id: I1a9508f3adfb0264cac1984d6080d117bfcb39f6
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Nicolas Pitre <nico@linaro.org>

commit 324064071eb843bf164a3c9862e3289c8ff615a3
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Wed May 22 10:38:53 2013 +0200

    ARM: move VFP init to an earlier boot stage

    In order to use the NEON unit in the kernel, we should
    initialize it a bit earlier in the boot process so NEON users
    that like to do a quick benchmark at load time (like the
    xor_blocks or RAID-6 code) find the NEON/VFP unit already
    enabled.

    Replaced late_initcall() with core_initcall().

    Change-Id: I89b7a5a79dddf6083766a87f9d082c7ee61a54e0
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Nicolas Pitre <nico@linaro.org>

commit d56ed95401bd804b13bb61bcef8f2be1cad985a6
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Thu Jun 26 15:11:27 2014 -0500

    Revert "nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off"

    This reverts commit 3f8f4ae48f4023e1c53722b1dc1a7ab897cbca14.

commit 1f2bdd4eb9e87b423cc7fe24bdb0af4fc95af181
Merge: 2cdba6f 12470e7
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Thu Jun 26 15:11:14 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into korgmerge

    Conflicts:
    	lib/lzo/lzo1x_decompress_safe.c
    	lib/lzo/lzodefs.h

    Change-Id: I4e17254f4eddf949e1c8e3549ff3a3b5dad13d3d

commit 12470e74f393b006a133f7169416f7e1af59e542
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jun 26 15:10:41 2014 -0400

    Linux 3.4.95

commit dc687f5effaf57fe62695468e3db6b50dc49bee1
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jun 20 22:00:53 2014 -0700

    lzo: properly check for overruns

    commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.

    The lzo decompressor can, if given some really crazy data, possibly
    overrun some variable types.  Modify the checking logic to properly
    detect overruns before they happen.

    Reported-by: "Don A. Bailey" <donb@securitymouse.com>
    Tested-by: "Don A. Bailey" <donb@securitymouse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 39085c8966f550d4b39d18683e39e79be7660a72
Author: Markus F.X.J. Oberhumer <markus@oberhumer.com>
Date:   Mon Aug 13 17:25:44 2012 +0200

    lib/lzo: Update LZO compression to current upstream version

    commit 8b975bd3f9089f8ee5d7bbfd798537b992bbc7e7 upstream.

    This commit updates the kernel LZO code to the current upsteam version
    which features a significant speed improvement - benchmarking the Calgary
    and Silesia test corpora typically shows a doubled performance in
    both compression and decompression on modern i386/x86_64/powerpc machines.

    Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit db7d0670393b6febc8967f193c08427bbd6f55d3
Author: Markus F.X.J. Oberhumer <markus@oberhumer.com>
Date:   Mon Aug 13 17:24:24 2012 +0200

    lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c

    commit b6bec26cea948148a9420e7a0ac337f925de49e7 upstream.

    Rename the source file to match the function name and thereby
    also make room for a possible future even slightly faster
    "non-safe" decompressor version.

    Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e5f14a6472167bb91ccf2e4ec1fc6586a99500b
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jun 18 13:32:35 2014 +0200

    ALSA: control: Make sure that id->index does not overflow

    commit 883a1d49f0d77d30012f114b2e19fc141beb3e8e upstream.

    The ALSA control code expects that the range of assigned indices to a control is
    continuous and does not overflow. Currently there are no checks to enforce this.
    If a control with a overflowing index range is created that control becomes
    effectively inaccessible and unremovable since snd_ctl_find_id() will not be
    able to find it. This patch adds a check that makes sure that controls with a
    overflowing index range can not be created.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Jaroslav Kysela <perex@perex.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab59a4b59f1e0aa0b2279be893a39a406c938c21
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jun 18 13:32:34 2014 +0200

    ALSA: control: Handle numid overflow

    commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.

    Each control gets automatically assigned its numids when the control is created.
    The allocation is done by incrementing the numid by the amount of allocated
    numids per allocation. This means that excessive creation and destruction of
    controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
    eventually overflow. Currently when this happens for the control that caused the
    overflow kctl->id.numid + kctl->count will also over flow causing it to be
    smaller than kctl->id.numid. Most of the code assumes that this is something
    that can not happen, so we need to make sure that it won't happen

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Jaroslav Kysela <perex@perex.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 291cd312b3c2826892299a74249fc9a88fb3305f
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jun 18 13:32:33 2014 +0200

    ALSA: control: Don't access controls outside of protected regions

    commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.

    A control that is visible on the card->controls list can be freed at any time.
    This means we must not access any of its memory while not holding the
    controls_rw_lock. Otherwise we risk a use after free access.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Jaroslav Kysela <perex@perex.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e6cbc9765746148dbebd35b2531f31b3ee8dbf8
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jun 18 13:32:32 2014 +0200

    ALSA: control: Fix replacing user controls

    commit 82262a46627bebb0febcc26664746c25cef08563 upstream.

    There are two issues with the current implementation for replacing user
    controls. The first is that the code does not check if the control is actually a
    user control and neither does it check if the control is owned by the process
    that tries to remove it. That allows userspace applications to remove arbitrary
    controls, which can cause a user after free if a for example a driver does not
    expect a control to be removed from under its feed.

    The second issue is that on one hand when a control is replaced the
    user_ctl_count limit is not checked and on the other hand the user_ctl_count is
    increased (even though the number of user controls does not change). This allows
    userspace, once the user_ctl_count limit as been reached, to repeatedly replace
    a control until user_ctl_count overflows. Once that happens new controls can be
    added effectively bypassing the user_ctl_count limit.

    Both issues can be fixed by instead of open-coding the removal of the control
    that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
    proper permission checks as well as decrements user_ctl_count after the control
    has been removed.

    Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
    beginning of the function if the control already exists is removed. This is not
    a problem though since the check is quite useless, because the lock that is
    protecting the control list is released between the check and before adding the
    new control to the list, which means that it is possible that a different
    control with the same settings is added to the list after the check. Luckily
    there is another check that is done while holding the lock in snd_ctl_add(), so
    we'll rely on that to make sure that the same control is not added twice.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Jaroslav Kysela <perex@perex.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4036860a70f956370a18ef06a19fa10a25990d2
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jun 18 13:32:31 2014 +0200

    ALSA: control: Protect user controls against concurrent access

    commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.

    The user-control put and get handlers as well as the tlv do not protect against
    concurrent access from multiple threads. Since the state of the control is not
    updated atomically it is possible that either two write operations or a write
    and a read operation race against each other. Both can lead to arbitrary memory
    disclosure. This patch introduces a new lock that protects user-controls from
    concurrent access. Since applications typically access controls sequentially
    than in parallel a single lock per card should be fine.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Jaroslav Kysela <perex@perex.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 118264918814946dd5ce4c87f1c643f2d20e70f6
Author: Kailang Yang <kailang@realtek.com>
Date:   Thu Jun 5 11:13:44 2014 +0800

    ALSA: hda/realtek - Add support of ALC891 codec

    commit b6c5fbad16aa5026f508093a8d651c25e1cb6179 upstream.

    New codec support for ALC891.

    Signed-off-by: Kailang Yang <kailang@realtek.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f8f4ae48f4023e1c53722b1dc1a7ab897cbca14
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Nov 29 12:18:13 2013 +0100

    nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off

    commit 0e576acbc1d9600cf2d9b4a141a2554639959d50 upstream.

    If CONFIG_NO_HZ=n tick_nohz_get_sleep_length() returns NSEC_PER_SEC/HZ.

    If CONFIG_NO_HZ=y and the nohz functionality is disabled via the
    command line option "nohz=off" or not enabled due to missing hardware
    support, then tick_nohz_get_sleep_length() returns 0. That happens
    because ts->sleep_length is never set in that case.

    Set it to NSEC_PER_SEC/HZ when the NOHZ mode is inactive.

    Reported-by: Michal Hocko <mhocko@suse.cz>
    Reported-by: Borislav Petkov <bp@alien8.de>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7be9d6cd4b57ebd5b344e4a006c0aa6e7a08aba3
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:45 2014 +0200

    USB: cdc-acm: fix runtime PM imbalance at shutdown

    commit 5292afa657d0e790b7479ad8eef9450c1e040b3d upstream.

    Make sure only to decrement the PM counters if they were actually
    incremented.

    Note that the USB PM counter, but not necessarily the driver core PM
    counter, is reset when the interface is unbound.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fd20d5a377f5baa510a804a3b2c9b21d31bb445
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:44 2014 +0200

    USB: cdc-acm: fix I/O after failed open

    commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.

    Make sure to kill any already submitted read urbs on read-urb submission
    failures in open in order to prevent doing I/O for a closed port.

    Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 181614f0f226983c59be4f6e11eecd333bfd933b
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:40 2014 +0200

    USB: cdc-acm: fix shutdown and suspend race

    commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.

    We should stop I/O unconditionally at suspend rather than rely on the
    tty-port initialised flag (which is set prior to stopping I/O during
    shutdown) in order to prevent suspend returning with URBs still active.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9f81ca861395bb48d06493d8b0e8d5e798913074
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:39 2014 +0200

    USB: cdc-acm: fix runtime PM for control messages

    commit bae3f4c53585e9a170da9436e0f06919874bda9a upstream.

    Fix runtime PM handling of control messages by adding the required PM
    counter operations.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21ffba35838100b5d332a75b418f9de43080d406
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:38 2014 +0200

    USB: cdc-acm: fix broken runtime suspend

    commit 140cb81ac8c625942a1d695875932c615767a526 upstream.

    The current ACM runtime-suspend implementation is broken in several
    ways:

    Firstly, it buffers only the first write request being made while
    suspended -- any further writes are silently dropped.

    Secondly, writes being dropped also leak write urbs, which are never
    reclaimed (until the device is unbound).

    Thirdly, even the single buffered write is not cleared at shutdown
    (which may happen before the device is resumed), something which can
    lead to another urb leak as well as a PM usage-counter leak.

    Fix this by implementing a delayed-write queue using urb anchors and
    making sure to discard the queue properly at shutdown.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Reported-by: Xiao Jin <jin.xiao@intel.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 97e72c4aa615b5ed6a7c4b22b9fa766679c749bc
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:37 2014 +0200

    USB: cdc-acm: fix write and resume race

    commit e144ed28bed10684f9aaec6325ed974d53f76110 upstream.

    Fix race between write() and resume() due to improper locking that could
    lead to writes being reordered.

    Resume must be done atomically and susp_count be protected by the
    write_lock in order to prevent racing with write(). This could otherwise
    lead to writes being reordered if write() grabs the write_lock after
    susp_count is decremented, but before the delayed urb is submitted.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit be7978bb5b91ef7168a93cf91acd672dfb65f0d0
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon May 26 19:23:36 2014 +0200

    USB: cdc-acm: fix write and suspend race

    commit 5a345c20c17d87099224a4be12e69e5bd7023dca upstream.

    Fix race between write() and suspend() which could lead to writes being
    dropped (or I/O while suspended) if the device is runtime suspended
    while a write request is being processed.

    Specifically, suspend() releases the write_lock after determining the
    device is idle but before incrementing the susp_count, thus leaving a
    window where a concurrent write() can submit an urb.

    Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
    that support remote wakeup")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6fa2946224569a4f3f975f86193c02c754acc9d8
Author: Michal Schmidt <mschmidt@redhat.com>
Date:   Mon Jun 2 18:25:02 2014 +0200

    netlink: rate-limit leftover bytes warning and print process name

    [ Upstream commit bfc5184b69cf9eeb286137640351c650c27f118a ]

    Any process is able to send netlink messages with leftover bytes.
    Make the warning rate-limited to prevent too much log spam.

    The warning is supposed to help find userspace bugs, so print the
    triggering command name to implicate the buggy program.

    [v2: Use pr_warn_ratelimited instead of printk_ratelimited.]

    Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ddc168fe00751a47139f5e6fd432aea799c654d
Author: Wei Yang <weiyang@linux.vnet.ibm.com>
Date:   Sun Jun 1 15:25:20 2014 +0800

    net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

    [ Upstream commit befdf8978accecac2e0739e6b5075afc62db37fe ]

    This patch wrap up a helper function __mlx4_remove_one() which does the tear
    down function but preserve the drv_data. Functions like
    mlx4_pci_err_detected() and mlx4_restart_one() will call this one with out
    releasing drvdata.

    Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff2005a4a5ba32505030b0bcb3c2a163ea417c53
Author: Wei Yang <weiyang@linux.vnet.ibm.com>
Date:   Sun Jun 1 15:25:19 2014 +0800

    mlx4_core: Stash PCI ID driver_data in mlx4_priv structure

    [ No upstream commit, this is a cherry picked backport enabler. ]

    From: Roland Dreier <roland@purestorage.com>

    That way we can check flags later on, when we've finished with the
    pci_device_id structure.  Also convert the "is VF" flag to an enum:
    "Never do in the preprocessor what can be done in C."

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3309a9750b319afc809caa29b8091e9746ec8ce0
Author: Xufeng Zhang <xufeng.zhang@windriver.com>
Date:   Thu Jun 12 10:53:36 2014 +0800

    sctp: Fix sk_ack_backlog wrap-around problem

    [ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ]

    Consider the scenario:
    For a TCP-style socket, while processing the COOKIE_ECHO chunk in
    sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
    a new association would be created in sctp_unpack_cookie(), but afterwards,
    some processing maybe failed, and sctp_association_free() will be called to
    free the previously allocated association, in sctp_association_free(),
    sk_ack_backlog value is decremented for this socket, since the initial
    value for sk_ack_backlog is 0, after the decrement, it will be 65535,
    a wrap-around problem happens, and if we want to establish new associations
    afterward in the same socket, ABORT would be triggered since sctp deem the
    accept queue as full.
    Fix this issue by only decrementing sk_ack_backlog for associations in
    the endpoint's list.

    Fix-suggested-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
    Acked-by: Daniel Borkmann <dborkman@redhat.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 843c0172bce9a30d77c85f33268b1469ead716ad
Author: Jiri Pirko <jiri@resnulli.us>
Date:   Thu May 29 20:46:17 2014 +0200

    team: fix mtu setting

    [ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

    Now it is not possible to set mtu to team device which has a port
    enslaved to it. The reason is that when team_change_mtu() calls
    dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
    event is called and team_device_event() returns NOTIFY_BAD forbidding
    the change. So fix this by returning NOTIFY_DONE here in case team is
    changing mtu in team_change_mtu().

    Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
    Signed-off-by: Jiri Pirko <jiri@resnulli.us>
    Acked-by: Flavio Leitner <fbl@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0a4474aaad97472efcd10a3e8d897d5798206f0e
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu May 29 08:45:14 2014 -0700

    net: fix inet_getid() and ipv6_select_ident() bugs

    [ Upstream commit 39c36094d78c39e038c1e499b2364e13bce36f54 ]

    I noticed we were sending wrong IPv4 ID in TCP flows when MTU discovery
    is disabled.
    Note how GSO/TSO packets do not have monotonically incrementing ID.

    06:37:41.575531 IP (id 14227, proto: TCP (6), length: 4396)
    06:37:41.575534 IP (id 14272, proto: TCP (6), length: 65212)
    06:37:41.575544 IP (id 14312, proto: TCP (6), length: 57972)
    06:37:41.575678 IP (id 14317, proto: TCP (6), length: 7292)
    06:37:41.575683 IP (id 14361, proto: TCP (6), length: 63764)

    It appears I introduced this bug in linux-3.1.

    inet_getid() must return the old value of peer->ip_id_count,
    not the new one.

    Lets revert this part, and remove the prevention of
    a null identification field in IPv6 Fragment Extension Header,
    which is dubious and not even done properly.

    Fixes: 87c48fa3b463 ("ipv6: make fragment identifications less predictable")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0e49724c557974bb109ffee5cd3eb4864b8cc1d
Author: Tom Gundersen <teg@jklm.no>
Date:   Thu May 15 23:21:30 2014 +0200

    net: tunnels - enable module autoloading

    [ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ]

    Enable the module alias hookup to allow tunnel modules to be autoloaded on demand.

    This is in line with how most other netdev kinds work, and will allow userspace
    to create tunnels without having CAP_SYS_MODULE.

    Signed-off-by: Tom Gundersen <teg@jklm.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12a38b8f1dd7c65d01aa4c759f29a700c194ecec
Author: Mimi Zohar <zohar@linux.vnet.ibm.com>
Date:   Sun May 11 00:05:23 2014 -0400

    evm: prohibit userspace writing 'security.evm' HMAC value

    commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.

    Calculating the 'security.evm' HMAC value requires access to the
    EVM encrypted key.  Only the kernel should have access to it.  This
    patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
    from setting/modifying the 'security.evm' HMAC value directly.

    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f53daea4dd53f43dd10ac24f752f74063abe4fa
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Thu Jun 5 18:08:57 2014 -0700

    iscsi-target: Reject mutual authentication with reflected CHAP_C

    commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.

    This patch adds an explicit check in chap_server_compute_md5() to ensure
    the CHAP_C value received from the initiator during mutual authentication
    does not match the original CHAP_C provided by the target.

    This is in line with RFC-3720, section 8.2.1:

       Originators MUST NOT reuse the CHAP challenge sent by the Responder
       for the other direction of a bidirectional authentication.
       Responders MUST check for this condition and close the iSCSI TCP
       connection if it occurs.

    Reported-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2cdba6f6db3bb3f757b4fb0e46763319fe5810a8
Author: invisiblek <dan.pasanen@gmail.com>
Date:   Sun Jun 22 21:11:25 2014 -0500

    init: fix @nardholio's derp

    Change-Id: I6d8904ab84a766deeea961d8ce0c56c8ca1d566f

commit 6ee824f29a5442a89fe2ad2521b0c2c7991f18ee
Author: Arne Coucheron <arco68@gmail.com>
Date:   Mon Jun 23 00:21:54 2014 +0200

    init: Support power off charging on kitkat bootloader

    Change-Id: I76ecfccb6ac52c422e5dba476bec6128b1292a17

commit cf8e1b571573d3304bb2479d4a4f1e05a267fc2a
Author: Bryan Huntsman <bryanh@codeaurora.org>
Date:   Mon Jun 3 18:48:08 2013 -0700

    msm: fix in-tree compilation for perf_trace_counters

    In-tree compilation for arch/arm/mach-msm/perf_trace_counters.c was
    hitting this error:

        In file included from arch/arm/mach-msm/perf_trace_counters.h:127:0,
                         from arch/arm/mach-msm/perf_trace_counters.c:14:
        include/trace/define_trace.h:79:43: fatal error: ./perf_trace_counters.h: No such file or directory

    Instructions for TRACE_INCLUDE_FILE in include/trace/define_trace.h say
    "the path is relative to define_trace.h, not the file including it".
    Fix in-tree compilation by making the path relative to define_trace.h.

    Change-Id: I566b83faf2714ce5f68ac11e5d63ab7cd0de23ed
    Signed-off-by: Bryan Huntsman <bryanh@codeaurora.org>

commit b4c66b54cfb981497b81f1378b6d556b063fb678
Author: Dave Daynard <nardholio@gmail.com>
Date:   Fri Jun 20 16:16:45 2014 -0400

    drivers: staging: prima: kk_2.7-stable

    Change-Id: Id4d4647c7430e267cd832e389757e0c5bff853ae

commit 36ae39dd184fc12c09cfd51884b459ddddf6812d
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Fri Jun 13 17:03:01 2014 -0700

    prctl: adds the capable(CAP_SYS_NICE) check to PR_SET_TIMERSLACK_PID.

    Adds a capable() check to make sure that arbitary apps do not change the
    timer slack for other apps.

    Bug: 15000427
    Change-Id: I558a2551a0e3579c7f7e7aae54b28aa9d982b209
    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit 2ac47446c3b144064b4ca08629c02e3baed8e952
Author: Jouni Malinen <j@w1.fi>
Date:   Thu May 29 15:42:36 2014 -0700

    cfg80211: Advertise maximum associated STAs in AP mode

    This allows drivers to advertise the maximum number of associated
    stations they support in AP mode (including P2P GO). User space
    applications can use this for cleaner way of handling the limit (e.g.
    hostapd rejecting IEEE 802.11 authentication without manual
    configuration of the limit) or to figure out what type of use cases can
    be executed with multiple devices before trying and failing.

    CRs-Fixed: 605665
    Change-Id: Ie3545c5fc9c82262232ae8dc0373c1a903fbada3
    Signed-off-by: Jouni Malinen <j@w1.fi>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Git-commit: b43504cf75b8b8773ee70c90bcd691282e151b9a
    Git-repo:
    git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
    [ppotte@codeaurora.org: manually solved merge conflicts]
    Signed-off-by: Pradeep Reddy POTTETI <ppotte@codeaurora.org>
    Signed-off-by: Manjunathappa Prakash <prakashpm@codeaurora.org>

commit 025f1330a49b139433d6aee463390c32e57f7f45
Author: Arve Hjønnevåg <arve@android.com>
Date:   Thu Feb 13 20:25:06 2014 -0800

    Staging: android: binder: More offset validation.

    Make sure offsets don't point to overlapping flat_binder_object
    structs.

    Conflicts:
    	drivers/staging/android/binder.c

    Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    Git-commit: 457c3cd05958b8397211ae1f6dd3c3d325f4c0ea
    Git-repo: https://android.googlesource.com/kernel/common/
    Signed-off-by: Neeti Desai <neetid@codeaurora.org>
    Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 277f862ff3a1c51c40c6e68ea8d6f5c2efbcc3b5
Author: Jouni Malinen <jouni@qca.qualcomm.com>
Date:   Mon Jun 16 12:04:17 2014 -0700

    cfg80211: Allow use_mfp to be specified with the connect command

    The NL80211_ATTR_USE_MFP attribute was originally added for
    NL80211_CMD_ASSOCIATE, but it is actually as useful (if not even more
    useful) with NL80211_CMD_CONNECT, so process that attribute with the
    connect command, too.

    Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Git-commit: cee00a959c0a86571e6f99cf42f0261d7e54d2ae
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    CRs-Fixed: 680922
    Change-Id: I63e7e4a2adbf8044372a05fb23951d9be387351d
    Signed-off-by: Manjunathappa Prakash <prakashpm@codeaurora.org>

commit cbd470f084b07cda610b6d2105f719da4a7fed1b
Author: Vinayak Menon <vinayakm.list@gmail.com>
Date:   Mon Jun 2 18:17:59 2014 +0530

    staging: binder: add vm_fault handler

    An issue was observed when a userspace task exits.
    The page which hits error here is the zero page.
    In binder mmap, the whole of vma is not mapped.
    On a task crash, when debuggerd reads the binder regions,
    the unmapped areas fall to do_anonymous_page in handle_pte_fault,
    due to the absence of a vm_fault handler. This results in
    zero page being mapped. Later in zap_pte_range, vm_normal_page
    returns zero page in the case of VM_MIXEDMAP and it results in the
    error.

    BUG: Bad page map in process mediaserver  pte:9dff379f pmd:9bfbd831
    page:c0ed8e60 count:1 mapcount:-1 mapping:  (null) index:0x0
    page flags: 0x404(referenced|reserved)
    addr:40c3f000 vm_flags:10220051 anon_vma:  (null) mapping:d9fe0764 index:fd
    vma->vm_ops->fault:   (null)
    vma->vm_file->f_op->mmap: binder_mmap+0x0/0x274
    CPU: 0 PID: 1463 Comm: mediaserver Tainted: G        W    3.10.17+ #1
    [<c001549c>] (unwind_backtrace+0x0/0x11c) from [<c001200c>] (show_stack+0x10/0x14)
    [<c001200c>] (show_stack+0x10/0x14) from [<c0103d78>] (print_bad_pte+0x158/0x190)
    [<c0103d78>] (print_bad_pte+0x158/0x190) from [<c01055f0>] (unmap_single_vma+0x2e4/0x598)
    [<c01055f0>] (unmap_single_vma+0x2e4/0x598) from [<c010618c>] (unmap_vmas+0x34/0x50)
    [<c010618c>] (unmap_vmas+0x34/0x50) from [<c010a9e4>] (exit_mmap+0xc8/0x1e8)
    [<c010a9e4>] (exit_mmap+0xc8/0x1e8) from [<c00520f0>] (mmput+0x54/0xd0)
    [<c00520f0>] (mmput+0x54/0xd0) from [<c005972c>] (do_exit+0x360/0x990)
    [<c005972c>] (do_exit+0x360/0x990) from [<c0059ef0>] (do_group_exit+0x84/0xc0)
    [<c0059ef0>] (do_group_exit+0x84/0xc0) from [<c0066de0>] (get_signal_to_deliver+0x4d4/0x548)
    [<c0066de0>] (get_signal_to_deliver+0x4d4/0x548) from [<c0011500>] (do_signal+0xa8/0x3b8)

    Add a vm_fault handler which returns VM_FAULT_SIGBUS, and prevents the
    wrong fallback to do_anonymous_page.

    CRs-Fixed: 673147
    Change-Id: I43730a51b6c819538b46c5e4dc5c96c8a384098d
    Signed-off-by: Vinayak Menon <vinayakm.list@gmail.com>
    Patch-mainline: linux-arm-kernel @ 06/02/14, 18:17
    Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
    Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>

commit 083f2a26dbbd3004c19a9405958695f6cddb9b43
Merge: 1f6c618 60bd595
Author: Dave Daynard <nardholio@gmail.com>
Date:   Fri Jun 20 16:10:21 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Conflicts:
    	kernel/events/core.c

    Change-Id: I0acbaf4b232fc32905b85f90853d6877198bc513

commit 1f6c6184293afdf1e131a40d4f3ae305dfe5485f
Author: Jeeja KP <jeeja.kp@intel.com>
Date:   Tue Mar 26 21:22:28 2013 +0530

    ASoC: compress - add support for metadata apis

    Compress core added metadata apis in 9727b4, so add same in ASoC

    Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit e1c122b2e8868eb0e1f66521bdb5015e146f5b56
Author: Eric Laurent <elaurent@google.com>
Date:   Fri May 17 14:40:59 2013 -0700

    ASoc: fix compilation error

    Fix compilation error after merging commit 00642f5
    from master: pop_wait is in struct snd_soc_dai
    not in struct snd_soc_pcm_runtime.

    Signed-off-by: Eric Laurent <elaurent@google.com>

commit 0a724dc82a3d8cadd0b7dcfb46a88abc1306db08
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Wed Mar 27 16:39:01 2013 +0000

    ASoC: compress: Cancel delayed power down if needed

    When a new stream is being opened it is necessary to cancel any delayed
    power down of the audio.

    [Fixed unused variable -- broonie]

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit bae77967373783fbd0acb7609bb731657c728058
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Wed Feb 6 13:52:42 2013 +0000

    ASoC: compress: Only mute playback streams

    Otherwise capture activity on a compressed DAI would mute any playback
    on the same DAI.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

commit 2ca3e0bea6146e6d903141af0739ce34b8963d56
Author: Eric Laurent <elaurent@google.com>
Date:   Mon Apr 8 16:07:19 2013 -0700

    ASoc: fix compilation error

    Fix compilation error after merging commit 1f88eb0
    from master: pop_wait is in struct snd_soc_dai
    not in struct snd_soc_pcm_runtime.

    Signed-off-by: Eric Laurent <elaurent@google.com>

commit f2f1c676f21bd859ed69409e2a91d12ac39bbc19
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Tue Feb 5 10:41:47 2013 +0000

    ASoC: soc-compress: Add support for not memory mapped DSPs

    The ASoC compressed API did not implement the copy callback in its
    compressed ops which is required for DSPs that are not memory mapped.

    This patch creates a local copy of the compress ops for each runtime and
    modifies them with a copy callback as appropriate.

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit 042d11e65de37fbad1b156f24c4e7aff41937244
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Thu Jan 24 09:44:30 2013 +0000

    ASoC: soc-compress: Initialise delayed work to power down audio

    Delayed work was scheduled but not initialised, this patch adds the
    actual work and initialises it.

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Tested-by: Jeeja KP <jeeja.kp@intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit 7a683fb7711453dda2dcf1ddf2fe9ec8eae17037
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Thu Jan 24 09:44:29 2013 +0000

    ASoC: soc-compress: Serialise compressed ops

    Use the pcm_mutex to serialise the compressed ops.

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Tested-by: Jeeja KP <jeeja.kp@intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit 04eb2d55014f12a2d66ffa81fe948f544baa3589
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Thu Jan 24 09:44:28 2013 +0000

    ASoC: soc-compress: Add missing brackets around else

    Conflicts:
    	sound/soc/soc-compress.c

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Tested-by: Jeeja KP <jeeja.kp@intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit b820064c600960a21f7c0548573cdb8b749aa690
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Tue Aug 21 12:15:02 2012 +0530

    ASoC: compress - fix code alignment

    Reported-by: Fengguang Wu <wfg@linux.intel.com>
    Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit d1ba55a0cef68afb420aadc025ff1cfa5bc8cb30
Author: Eric Laurent <elaurent@google.com>
Date:   Mon Apr 8 15:52:05 2013 -0700

    ASoc: fix compilation error

    Fix compilation error after merging commit 1245b700
    from master: snd_soc_dapm_stream_event() protoype has changed.

    Signed-off-by: Eric Laurent <elaurent@google.com>

commit 598aa325abee1cd1104bcf793ba0c01ee87fee96
Author: Eric Laurent <elaurent@google.com>
Date:   Mon Apr 8 15:37:15 2013 -0700

    ALSA: compress: fix compilation error

    Fix compilation error after merging commit 1245b700
    from master: SIZE_MAX is not defined.

    Signed-off-by: Eric Laurent <elaurent@google.com>

commit 438afafa3ce55c121e9d514550ceb4e278d68b0e
Author: Namarta Kohli <namartax.kohli@intel.com>
Date:   Thu Aug 16 17:10:41 2012 +0530

    ASoC: add compress stream support

    This patch adds the support to parse the compress dai's and then also adds the
    soc-compress.c file while handles the compress stream operations, mostly analogus
    to what is done in the soc-pcm.c and aditional handling of the compress
    opertaions

    Conflicts:
    	sound/soc/soc-core.c

    Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
    Signed-off-by: Ramesh Babu K V <ramesh.babu@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit 21ecc7cc4b6be6e7bf64f1240393287b2b198b98
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Thu Aug 16 17:10:40 2012 +0530

    ASoC: add definations for compressed operations

    Here we update the asoc structures to add compress stream definations
    First the struct snd_soc_dai_driver adds a new member to indicate if the dai is
    compressed or pcm. Next we add a new structre the struct snd_soc_compr_ops in
    the struct snd_soc_dai_link. This is to be used for machine driver to perform
    any opertaions required for setting up compressed audio streams

    next is the compressed data operations, they are added using struct
    snd_compr_ops in the struct snd_soc_platform_driver.

    Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
    Signed-off-by: Ramesh Babu K V <ramesh.babu@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit 0b18e195b0e3915c9adc3e41435b9fcba8f81aed
Author: Jeeja KP <jeeja.kp@intel.com>
Date:   Thu Feb 14 16:52:51 2013 +0530

    ALSA: compress: add support for gapless playback

    this add new API for sound compress to support gapless playback.
    As noted in Documentation change, we add API to send metadata of encoder
    and
    padding delay to DSP. Also add API for indicating EOF and switching to
    subsequent track

    Also bump the compress API version

    Conflicts:
    	include/uapi/sound/compress_offload.h

    Change-Id: I298fb3613d00d21b96f39510ed0c2c9c5f656043
    Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 7d28f6763eae83c707f740f3283a48d208139e42
Author: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Date:   Mon Feb 11 13:44:53 2013 +0000

    ALSA: core: don't return uninitialized snd_compr_tstamp

    The snd_compr_update_tstamp() can only fill in the snd_compr_tstamp
    if the codec implements the pointer() function. If that happened
    the code was previously returning uninitialized garbage in the
    tstamp because it wasn't initialized anywhere.

    This change zero-fills the tstamp in the two places it is used
    before calling snd_compr_update_tstamp(), and also has
    snd_compr_update_tstamp() return an error indication if it
    can't provide a tstamp. For the case of snd_compr_calc_avail()
    it ignores this error because we still need to return info on
    the available buffer space even if we can't provide tstamp
    info - when the tstamp is not valid all fields are now
    guaranteed to be zero.

    Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit c4300c8cbd5d85ee46589bc2bdbe253e8821dd03
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Mon Sep 17 11:51:26 2012 +0530

    ALSA: Compress - add codec parameter checks

    Conflicts:
    	include/sound/compress_params.h

    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 03f1dc506e288ddcbffa4c7bc5709deb2087dc21
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Mon Sep 17 11:51:25 2012 +0530

    ALSA: compress - move the buffer check

    Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()
    added a new error check for input params.
    this add new routine for input checks and moves buffer overflow check to this
    new routine. This allows the error value to be propogated to user space

    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 5cb9fcdfcacb433cd2363c278e6a09887ea8b089
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Sep 5 15:32:18 2012 +0300

    ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()

    These are 32 bit values that come from the user, we need to check for
    integer overflows or we could end up allocating a smaller buffer than
    expected.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 5cb7cf368ad529154c07de18700b530be545a124
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Sep 11 14:12:43 2012 +0300

    ALSA: compress_core: fix open flags test in snd_compr_open()

    O_RDONLY is zero so the original test (f->f_flags & O_RDONLY) is always
    false and it will never do compress capture.  The test for O_WRONLY is
    also slightly off.  The original test would consider "->flags =
    (O_WRONLY | O_RDWR)" as write only instead of rejecting it as invalid.

    I've also removed the pr_err() because that could flood dmesg.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 3740f40c69ab6b4ce83448a66b65c21c809b0170
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Tue Jun 12 16:16:18 2012 +0530

    ALSA: compress_core: cleanup pointers on stop

    as the start can be called after stop again, we need to reset state

    Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 673a59fa7a44d6a51cf947bc937334f1d25f9bf9
Author: Vinod Koul <vinod.koul@linux.intel.com>
Date:   Tue Jun 12 16:16:17 2012 +0530

    ALSA: compress_core: don't wake up on pause

    during pause the core should maintain the status-quo on the device and pointers
    and not wake up. If app needs it should call DROP explcitly.

    Signed-off-by: Namarta Kohli <namartax.kohli@intel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 60bd595b19e574e96c9a0ab302a5db9081240006
Merge: 7686c6d 407525a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 18 08:15:31 2014 -0700

    Merge "Merge "msm: kgsl: Fix spinlock recursion in destroy pagetable""

commit 407525a370b9d0b5d27520eaa83a2fd6ae681f48
Merge: 96ca4da 37cb637
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 18 05:33:34 2014 -0700

    Merge "msm: kgsl: Fix spinlock recursion in destroy pagetable"

commit 96ca4dac9eb9a972f6d7096345cfab8e76828d4d
Merge: ac6f9a0 6621aa7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 18 05:33:32 2014 -0700

    Merge "msm: kgsl: prevent kgsl_get_pagetable from returning a destroyed pt"

commit 7686c6d5fcaeb5e5212412fe65d56437b4d01d8b
Merge: 7eee57f5 ac6f9a0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 22:45:43 2014 -0700

    Merge "Merge "msm: kgsl: Look up the process struct in process_mem_open()""

commit 7eee57f5449588ab9eccfc0f78bd52c96577bc32
Merge: 627ba95 2e53ff1
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 09:23:41 2014 -0700

    Merge "Merge "msm: kgsl: hold a process_private refcount in process_mem_print""

commit ac6f9a023006d3e262e93917b9edfbd538b5cdc3
Merge: addd7d5 322a0c9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:51 2014 -0700

    Merge "msm: kgsl: Look up the process struct in process_mem_open()"

commit addd7d5b436e9340b1382365467b4fc1ec2492b5
Merge: 8e67b1f f9a437e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:36 2014 -0700

    Merge "msm: perf: set filter bits for cycle counter on krait"

commit 8e67b1fa2603329ee632ee89a420b837b1a122f9
Merge: 8cce0ab 2101ad2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:35 2014 -0700

    Merge "msm: arm: make nohlt readable"

commit 8cce0abe6526bce61f58530dd448c5248457e7c9
Merge: 661eda9 792fa7c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:34 2014 -0700

    Merge "scripts/kallsyms: filter symbols not in kernel address space"

commit 661eda9c0d33507bd9efc16b8e8188549779c9fd
Merge: 721ee56 9eedbfc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:33 2014 -0700

    Merge "Perf: Reset pmu after hotplug"

commit 721ee5689d78e769fed69cd6f30631d2b3023e76
Merge: 9da9617 455717a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:33 2014 -0700

    Merge "msm: perf: tracectr: Initialize cnts after hotplug"

commit 9da9617b7ec93aac1a1b48c85ebb7fdb26e4b1ca
Merge: 36d745f 4b83d21
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:32 2014 -0700

    Merge "msm: perf: Fix cpu id logic in tracectr notifier"

commit 36d745fc667675e76d15b908f1f547d028203248
Merge: 5ffac82 f0191cc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:31 2014 -0700

    Merge "msm: perf: fix formatting of trace entry"

commit 5ffac823cb84be579dc4fb24760cd6458859f96b
Merge: 0a3029e ea9e11e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:30 2014 -0700

    Merge "Perf: preserve registers across hotplug"

commit 0a3029e5aa96f46e87ae6f93bd9f1f33c8a75378
Merge: 5399557 ebc2b4a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:29 2014 -0700

    Merge "Perf: Fix PID for tracepoints"

commit 53995578ae2341a6a24ae5037fdad60a2457f1da
Merge: 1996c13 653258c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:28 2014 -0700

    Merge "Perf: Make per-process counters cumulative"

commit 1996c132e6e6524d2ecb386b8d96b8c32343ca67
Merge: bae1689 15d8f1e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:27 2014 -0700

    Merge "msm: perf: clean up duplicate constraint events"

commit bae16898d62fa7b608c17ab1f987d319af28b3e7
Merge: f37d83a dc223ce
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:27 2014 -0700

    Merge "msm: perf: initialise krait perf L2 counter enables"

commit f37d83a8a407737a83f5149948ecd3cd557f4193
Merge: 1aea5c9 13f898a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:26 2014 -0700

    Merge "Perf: Support sw events across hotplug"

commit 1aea5c99f4ee468b167b14f55998ee020c7f6b84
Merge: c261a5a 44971e3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:25 2014 -0700

    Merge "Perf: bring CPU online if needed when disabling irq"

commit c261a5ae9e573d6178bee078bca21064aae24d71
Merge: 44796be 8165d84
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:24 2014 -0700

    Merge "Perf: keep events across hotplug"

commit 44796beb5ea98011490905a47d3a9b5a2f2bddee
Merge: 10d99b5 e749cc1
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:23 2014 -0700

    Merge "msm: perf: Fix debug node permissions"

commit 10d99b5cd7184a9662a69bb4b54b7babf22a517e
Merge: 8d0b157 811f4b0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:22 2014 -0700

    Merge "msm: perf: Add L2 support for tracecounters"

commit 8d0b157946f3169adb2f5c4b34718bb8c0fd5364
Merge: 3c02b46 12f2d6e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:22 2014 -0700

    Merge "Perf: Make per-process counters configurable"

commit 3c02b46386b22459c893d9ed19de6804dc89546d
Merge: 6ab41b9 d0080dd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:21 2014 -0700

    Merge "Perf: Fix counts across power collapse"

commit 6ab41b92fe9e7ac93855c5bdf9c08bfbc08c86d4
Merge: 08e6317 dbeaf18
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:20 2014 -0700

    Merge "Perf: Add L1 counters to tracepoints"

commit 08e63171d770bb8adc84c5de0830ba2e0f44303b
Merge: 2e53ff1 4bacd56
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 07:26:19 2014 -0700

    Merge "Perf: Check perf activity on correct CPU"

commit 2e53ff17b29cca66e675aa00fe5d443ec03017ee
Merge: cc0d4b7 5aa3f2c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 17 05:06:38 2014 -0700

    Merge "msm: kgsl: hold a process_private refcount in process_mem_print"

commit 37cb637666389dddc189e63f72dd8b314daae32c
Author: Prakash Kamliya <pkamliya@codeaurora.org>
Date:   Fri Feb 21 16:19:54 2014 +0530

    msm: kgsl: Fix spinlock recursion in destroy pagetable

    pagetable list is protected by ptlock. Few functions
    while iterating over a pagetable list takes same ptlock,
    kgsl_destroy_pagetable() also need same lock. This will
    cause spinlock recursion if kgsl_destroy_pagetable()
    called while iterating over a list. Created two versions
    of same function one is with lock and other is without
    lock.

    CRs-Fixed: 621172
    Change-Id: I61440f99022fce8629a57bb5661e2eef9613187b
    Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
    Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

commit 6621aa7a562a2528d50fe3f5de7f3447988395f5
Author: Jeff Boody <jboody@codeaurora.org>
Date:   Tue Nov 5 09:58:32 2013 -0700

    msm: kgsl: prevent kgsl_get_pagetable from returning a destroyed pt

    A race condition exists between kref_get_pagetable and
    kref_put_pagetable such that is is possible to put the last
    reference to a pagetable slightly before it has been removed
    from the list. By checking kref_get_unless_zero we can determine
    if the last reference has already been released. This is safe
    because the list is protected by a ptlock.

    Change-Id: If6a75e9ca0dec6a12bda5739f835c936a4c3a3b4
    Signed-off-by: Jeff Boody <jboody@codeaurora.org>

commit 322a0c9a493cbfcd457706220724ba1ec51a0745
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon May 12 09:08:58 2014 -0600

    msm: kgsl: Look up the process struct in process_mem_open()

    The pointer to an active process struct stands the risk of going stale
    if process_mem_open() is called just before the debugfs dentry is
    destroyed.  Instead of storing and using the pointer pass the process pid
    to process_mem_open() and do a lookup to ensure that we always get active
    processes.

    Conflicts:
    	drivers/gpu/msm/kgsl.c
    	drivers/gpu/msm/kgsl_debugfs.c

    Change-Id: Ic0dedbad3a3b54dc96251663fdf89c466fef3ca5
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

commit 5aa3f2cf652d35a5505927bcda926593aac695c2
Author: Jeremy Gebben <jgebben@codeaurora.org>
Date:   Mon Mar 10 14:44:43 2014 -0600

    msm: kgsl: hold a process_private refcount in process_mem_print

    There is a possible race condition where the process can be going
    away while its debugfs 'mem' file is being read, which could cause
    memory corruption.

    Conflicts:
    	drivers/gpu/msm/kgsl.c
    	drivers/gpu/msm/kgsl_device.h

    CRs-Fixed: 627780
    Change-Id: I697486faeb3f186fd1220d0acc1e449a4f7b77b0
    Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 5ee5909cd3aca07cc3f529067be353e6ff4113c9
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 16 21:14:13 2014 -0400

    drivers: staging: update prima to kk_2.7-stable

    Change-Id: I6b362e2a4618ed2742a14060509db41ad96b05be

commit 5d460f6aacbd649c50ea157f330faa1c0b83c15c
Author: Sunil Dutt <duttus@codeaurora.org>
Date:   Tue May 27 18:37:04 2014 +0530

    nl80211: Correct the usage of command NL80211_CMD_VENDOR

    Assign/pass the cur_cmd_info parameter correctly. This fixes a
    merge error when open source commit
    ad7e718c9b4f717823fd920a0103f7b0fb06183f was pulled into the tree.

    CRs-Fixed: 672390
    Change-Id: Iaa21a1723709683a6f34b07423b74ef0b6077b68
    Signed-off-by: Sunil Dutt <usdutt@codeaurora.org>

commit 65e0ea4cb5687478acabf0a910eccdb0adb69306
Author: Saket Saurabh <ssaurabh@codeaurora.org>
Date:   Fri May 30 16:48:23 2014 +0530

    usb: ci13xxx_udc: Do not clear ENDPTSETUPSTAT during USB BUS RESET

    When the host sends a setup packet immediately after the bus RESET,
    it is possible that due to interrupt latency the USB software observe
    both USB BUS Reset Interrupt and USB interrupt for SETUP packet(UI) bits
    getting set at the same time. The USB Interrupt SW routine handles the
    reset interrupt as it has more priority than UI interrupt and clear the
    ENDPTSETUPSTAT register. If the software clears this register, it will
    not know that a SETUP packet arrived.

    Fix the issue by not clearing the ENDPTSETUPSTAT during usb bus reset
    processing. When USB HOST sends SETUP Packet, device controller sends ACK
    and sets ENDPTSETUPSTAT bit and asserts USB Interrupt so that SETUP packet
    can be correctly read by the software.

    CRs-Fixed: 669902
    Change-Id: I86656cfcd70d7bc8e1e84604fdbdccc6437c85b6
    Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>

commit cc4200601f35e8c1d6686c93c533804aa09e0530
Author: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Date:   Tue Jun 3 15:31:18 2014 +0530

    usb: android: Skip the work when set_config arrives with same value twice

    Some USB hosts may send SET_CONFIGURATION with same value twice.
    The current code implementation processing the 2nd set_config and
    schedules the work. The android_work() issues disconnect event to
    userspace if SetConfiguration with non-zero value is sent twice.
    The userspace applications may disconnect the USB and the device
    doesn't connect to the host.

    Fix this by avoiding the android_work for the second time SET_CONFIGURATION
    request when it receives SetConfiguration request with same configuration
    value twice from the host.

    CRs-Fixed: 661220
    Change-Id: Ic450315a9067b9b679b4936480d125e4e4b7cdf7
    Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

commit 9fe13e9cd2689ebdb1898f25764e6a00c3d9b377
Author: Tarun Gupta <tarung@codeaurora.org>
Date:   Mon Sep 2 17:00:48 2013 +0530

    USB: android: release spinlock before queuing work in android_setup

    In android_setup we release spinlock after scheduling the work but there
    is no need for holding the spinlock during the schedule_work call
    is executed this can lead to spinlock timeouts in case where schedule
    work takes more time.

    So before scheduling work in android_setup we release spinlock to avoid
    potential spinlock lockup or timeout.

    CRs-Fixed: 661220
    Change-Id: Ibf8ff7f07caf20edf9e646fdcef540fbc6441aec
    Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
    Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
    Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

commit ec08170d11197bbda8ad3244dac83a45ae4127a6
Author: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Date:   Tue Jun 3 14:53:13 2014 +0530

    usb: gadget: Ignore the second set_config from the host

    Some USB hosts may send SET_CONFIGURATION with same value twice.
    The current code implementation of android_work() issues disconnect
    event to userspace if SetConfiguration with non-zero value is sent
    twice. The Userspace application may disconnect USB and it causes
    fail to connect to the USB host.

    Fix this by ignoring the second time SET_CONFIGURATION request
    from the host only for the same configuration value twice.

    CRs-Fixed: 661220
    Change-Id: Iec8dd7824fa9f371ea147784cf9137aa88a7128e
    Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

commit 79760065d5f3ca81cfa0bc0ae7134dc32d641f12
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Fri Mar 14 18:27:20 2014 -0700

    cpufreq: Persist cpufreq time in state data across hotplug

    Cpufreq time_in_state data for all CPUs is made persistent across
    hotplug and exposed to userspace via sysfs file
    /sys/devices/system/cpu/cpufreq/all_time_in_state

    Change-Id: I97cb5de24b6de16189bf8b5df9592d0a6e6ddf32
    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit 71676baab50c70e15029ffcb1ee0051a7ebc0b25
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Jun 17 00:30:11 2014 +0000

    Revert "usb: otg:  Retry putting the OTG PHY in low power mode."

    This reverts commit 39225093680e6a923a646cab9b384b6bbc064548.

    Change-Id: I6354c7b439cb3bc938287e89fb8ab18e47cb182b

commit 954a2029a4a11a883fcbaa54629308be1c4c2ec2
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jun 12 00:08:48 2014 -0400

    d2: enable usb host notify

    Change-Id: I90cb14bfa100ede1bcac0f82922bceda6c7a8656

commit 9c15eee74ae35091786eb361dee0998f717646ef
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Sat Jun 14 21:44:25 2014 -0500

    Revert "Touchscreen optimizations"

    This reverts commit 37343420c2b5855f4c5dfaecde08080031deb7ad.

    See: http://review.cyanogenmod.org/#/c/65727/

    Conflicts:
    	arch/arm/mach-msm/board-m2_spr.c
    	drivers/i2c/busses/i2c-qup.c

    Change-Id: If33ad8628be035e4d8518cbd88979955b72f05f3
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit c84025392105fc0d10d14feb0dc1c824c49710c1
Author: Malcolm Mallardi <mdmallardi@gmail.com>
Date:   Mon Jun 16 18:41:25 2014 -0400

    Revert "cpufreq: interactive: Optimize sync_freq implementation"

    This reverts commit 19d3024b69ab94986de0a1c59ff3a83f0b13d629.

    Change-Id: I7f68fa3b96061c33f19d910c087f3b1ffd3b2999

commit d100dcfef6351bac274b78985651ad0d2e597204
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 16 18:40:42 2014 -0400

    Revert "usb: ehci-msm: enable HCD_OLD_ENUM"

    This reverts commit aafd57b7ff2f3a6117a41a083dbce4d435be042a.

    Change-Id: I4108e7121073c574a1889a5038516594d396f26e

commit 39c2cdc5006527ac5493018bbbce505f16878682
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 16 18:39:15 2014 -0400

    Revert "drivers: usb: Use Android device as USB keyboard/mouse"

    This reverts commit 3eb8c3a879074d8d78e77e94e35eaf41d8911cb5.

    Change-Id: Ib44550d32016e0a5d35a3f44494e295e38a6cb57

commit 027e7556d36d188d3097881916a554ca43945414
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 16 18:38:21 2014 -0400

    Revert "Fixes for GCC error on panel"

    This reverts commit 80087f349ad98d2ba24a5b479309f1f2dc031433.

    Change-Id: I76a1fb252b629c6659e6c0d7e5916536f780d6ff

commit 9d6486b94b2bf25fae36b5f4f1431e5eda9286a3
Merge: c936d00 95f3bb9
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Mon Jun 16 20:10:43 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit 95f3bb9bd690350d1ba58cb1541a26ce2db209e8
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Jun 16 13:46:06 2014 -0700

    Linux 3.4.94

commit a3020684c1976baa2832116a597ab69f74f16fb4
Author: Jérôme Carretero <cJ-ko@zougloub.eu>
Date:   Tue Jun 3 14:56:25 2014 -0400

    ahci: Add Device ID for HighPoint RocketRaid 642L

    commit d251836508fb26cd1a22b41381739835ee23728d upstream.

    This device normally comes with a proprietary driver, using a web GUI
    to configure RAID:
     http://www.highpoint-tech.com/USA_new/series_rr600-download.htm
    But thankfully it also works out of the box with the AHCI driver,
    being just a Marvell 88SE9235.

    Devices 640L, 644L, 644LS should also be supported but not tested here.

    Signed-off-by: Jérôme Carretero <cJ-ko@zougloub.eu>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4829b8f17cb492cd232da05aeb64db05c74657d6
Author: Ben Collins <ben.c@servergy.com>
Date:   Fri Sep 13 12:46:44 2013 -0400

    SCSI: megaraid: Use resource_size_t for PCI resources, not long

    commit 11f8a7b31f2140b0dc164bb484281235ffbe51d3 upstream.

    The assumption that sizeof(long) >= sizeof(resource_size_t) can lead to
    truncation of the PCI resource address, meaning this driver didn't work
    on 32-bit systems with 64-bit PCI adressing ranges.

    Signed-off-by: Ben Collins <ben.c@servergy.com>
    Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 39da9a416814e556060bab8569293b8f3d889765
Author: Andy Lutomirski <luto@amacapital.net>
Date:   Wed May 28 23:09:58 2014 -0400

    auditsc: audit_krule mask accesses need bounds checking

    commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream.

    Fixes an easy DoS and possible information disclosure.

    This does nothing about the broken state of x32 auditing.

    eparis: If the admin has enabled auditd and has specifically loaded
    audit rules.  This bug has been around since before git.  Wow...

    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 35a2bae84d5bc0a6609134b51053f78d235940c2
Author: Rashika Kheria <rashika.kheria@gmail.com>
Date:   Sun Nov 10 22:13:53 2013 +0530

    Staging: zram: Fix memory leak by refcount mismatch

    commit 1b672224d128ec2570eb37572ff803cfe452b4f7 upstream.

    As suggested by Minchan Kim and Jerome Marchand "The code in reset_store
    get the block device (bdget_disk()) but it does not put it (bdput()) when
    it's done using it. The usage count is therefore incremented but never
    decremented."

    This patch also puts bdput() for all error cases.

    Acked-by: Minchan Kim <minchan@kernel.org>
    Acked-by: Jerome Marchand <jmarchan@redhat.com>
    Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com>
    [bwh: Backported to 3.2: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e8af2178cb86033d30c2e468b46e42af8af20d9
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Jun 7 00:07:27 2013 +0800

    zram: protect sysfs handler from invalid memory access

    commit 5863e10b441e7ea4b492f930f1be180a97d026f3 upstream.

    Use zram->init_lock to protect access to zram->meta, otherwise it
    may cause invalid memory access if zram->meta has been freed by
    zram_reset_device().

    This issue may be triggered by:
    Thread 1:
    while true; do cat mem_used_total; done
    Thread 2:
    while true; do echo 8M > disksize; echo 1 > reset; done

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Acked-by: Minchan Kim <minchan@kernel.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 480ed1ba70b1cb6977451763a28a658844d59360
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Thu May 15 09:33:42 2014 -0700

    powerpc: Fix 64 bit builds with binutils 2.24

    commit 7998eb3dc700aaf499f93f50b3d77da834ef9e1d upstream.

    With binutils 2.24, various 64 bit builds fail with relocation errors
    such as

    arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
    	(.text+0x165ee): relocation truncated to fit: R_PPC64_ADDR16_HI
    	against symbol `interrupt_base_book3e' defined in .text section
    	in arch/powerpc/kernel/built-in.o
    arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
    	(.text+0x16602): relocation truncated to fit: R_PPC64_ADDR16_HI
    	against symbol `interrupt_end_book3e' defined in .text section
    	in arch/powerpc/kernel/built-in.o

    The assembler maintainer says:

     I changed the ABI, something that had to be done but unfortunately
     happens to break the booke kernel code.  When building up a 64-bit
     value with lis, ori, shl, oris, ori or similar sequences, you now
     should use @high and @higha in place of @h and @ha.  @h and @ha
     (and their associated relocs R_PPC64_ADDR16_HI and R_PPC64_ADDR16_HA)
     now report overflow if the value is out of 32-bit signed range.
     ie. @h and @ha assume you're building a 32-bit value. This is needed
     to report out-of-range -mcmodel=medium toc pointer offsets in @toc@h
     and @toc@ha expressions, and for consistency I did the same for all
     other @h and @ha relocs.

    Replacing @h with @high in one strategic location fixes the relocation
    errors. This has to be done conditionally since the assembler either
    supports @h or @high but not both.

    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 05d178321eee272e6da5fb4653e75bd8171bccf9
Author: Florian Westphal <fw@strlen.de>
Date:   Fri May 2 15:32:16 2014 +0200

    netfilter: ipv4: defrag: set local_df flag on defragmented skb

    commit 895162b1101b3ea5db08ca6822ae9672717efec0 upstream.

    else we may fail to forward skb even if original fragments do fit
    outgoing link mtu:

    1. remote sends 2k packets in two 1000 byte frags, DF set
    2. we want to forward but only see '2k > mtu and DF set'
    3. we then send icmp error saying that outgoing link is 1500

    But original sender never sent a packet that would not fit
    the outgoing link.

    Setting local_df makes outgoing path test size vs.
    IPCB(skb)->frag_max_size, so we will still send the correct
    error in case the largest original size did not fit
    outgoing link mtu.

    Reported-by: Maxime Bizon <mbizon@freebox.fr>
    Suggested-by: Maxime Bizon <mbizon@freebox.fr>
    Fixes: 5f2d04f1f9 (ipv4: fix path MTU discovery with connection tracking)
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Cc: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b201caa92a22eba5cc513f2cc8c7c0d8c55746f1
Author: Chris Mason <clm@fb.com>
Date:   Tue Apr 15 18:09:24 2014 -0400

    mlx4_en: don't use napi_synchronize inside mlx4_en_netpoll

    commit c98235cb8584a72e95786e17d695a8e5fafcd766 upstream.

    The mlx4 driver is triggering schedules while atomic inside
    mlx4_en_netpoll:

    	spin_lock_irqsave(&cq->lock, flags);
    	napi_synchronize(&cq->napi);
    		^^^^^ msleep here
    	mlx4_en_process_rx_cq(dev, cq, 0);
    	spin_unlock_irqrestore(&cq->lock, flags);

    This was part of a patch by Alexander Guller from Mellanox in 2011,
    but it still isn't upstream.

    Signed-off-by: Chris Mason <clm@fb.com>
    Acked-By: Amir Vadai <amirv@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Masoud Sharbiani <msharbiani@twitter.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c936d00fecb7992de0b3b37d1a430bf2f3878117
Merge: 26a037a 59a30a8
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jun 12 23:26:31 2014 +0000

    Merge "expressatt: fix build after new sensor updates" into cm-11.0

commit 26a037a73a4990ebe79f39c222ee3986702d6f66
Merge: 45d85b9 c75c3b9
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Thu Jun 12 07:18:08 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	drivers/bluetooth/ath3k.c
    	drivers/bluetooth/btusb.c
    	net/bluetooth/l2cap_core.c

    Change-Id: If129079ae25e1d1409d40af08432810e94bf2eaa

commit 45d85b990fb704baa49a6a40e996f2368e49bd65
Merge: c52c4e3 627ba95
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Thu Jun 12 07:09:03 2014 -0500

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Conflicts:
    	net/ipv4/ping.c

    Change-Id: Ib38cd5259369de2c1c1404cde2597df2f144d317

commit 59a30a86cdd8808c44fcdb7b1124a63390c27540
Author: jt1134 <jt1134@gmail.com>
Date:   Wed Jun 11 13:52:45 2014 -0700

    expressatt: fix build after new sensor updates

    - reinclude bma250 accelerometer driver
    - fix board files to work with new geomagnetic driver

    Change-Id: Icda93ba91fad2130517fb82d0c08262cff385589

commit c75c3b96fad0df78ceef6d83164c267dfd3f3820
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Jun 11 12:25:24 2014 -0700

    Linux 3.4.93

commit 4db251fa782d61a3603414cced4361ff732dc119
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Nov 16 14:15:00 2012 -0800

    mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address

    commit 498c2280212327858e521e9d21345d4cc2637f54 upstream.

    kmap_to_page returns the corresponding struct page for a virtual address
    of an arbitrary mapping.  This works by checking whether the address
    falls in the pkmap region and using the pkmap page tables instead of the
    linear mapping if appropriate.

    Unfortunately, the bounds checking means that PKMAP_ADDR(LAST_PKMAP) is
    incorrectly treated as a highmem address and we can end up walking off
    the end of pkmap_page_table and subsequently passing junk to pte_page.

    This patch fixes the bound check to stay within the pkmap tables.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85faa17c6abc754dac48a82f3d9bc70dd1c7453b
Author: Ley Foon Tan <lftan@altera.com>
Date:   Thu Mar 7 10:28:37 2013 +0800

    tty/serial: Add support for Altera serial port

    commit e06c93cacb82dd147266fd1bdb2d0a0bd45ff2c1 upstream.

    Add support for Altera 8250/16550 compatible serial port.

    Signed-off-by: Ley Foon Tan <lftan@altera.com>
    [xr: Backported to 3.4: adjust filenames, context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7400ce7ee9595432b2a1402b6ffcac9faf38d9ae
Author: Stephen Hurd <shurd@broadcom.com>
Date:   Thu Jan 17 14:14:53 2013 -0800

    8250/16?50: Add support for Broadcom TruManage redirected serial port

    commit ebebd49a8eab5e9aa1b1f8f1614ccc3c2120f886 upstream.

    Add support for the UART device present in Broadcom TruManage capable
    NetXtreme chips (ie: 5761m 5762, and 5725).

    This implementation has a hidden transmit FIFO, so running in single-byte
    interrupt mode results in too many interrupts.  The UART_CAP_HFIFO
    capability was added to track this.  It continues to reload the THR as long
    as the THRE and TSRE bits are set in the LSR up to a specified limit (1024
    is used here).

    Signed-off-by: Stephen Hurd <shurd@broadcom.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    [xr: Backported to 3.4:
     - Adjust filenames
     - Adjust context
     - PORT_BRCM_TRUMANAGE is 22 not 24]
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb2249dc3d9d9c6ce6f8bd292770ff72400faab6
Author: Scott Ashcroft <scott.ashcroft@talk21.com>
Date:   Sun Mar 3 21:35:06 2013 +0000

    Fix 4 port and add support for 8 port 'Unknown' PCI serial port cards

    commit d13402a4a944e72612a9ec5c9190e35717c02a9d upstream.

    I've managed to find an 8 port version of the card 4 port card which was discussed here:

    http://marc.info/?l=linux-serial&m=120760744205314&w=2

    Looking back at that thread there were two issues in the original patch.

    1) The I/O ports for the UARTs are within BAR2 not BAR0. This can been seen in the original post.
    2) A serial quirk isn't needed as these cards have no memory in BAR0 which makes pci_plx9050_init just return.

    This patch fixes the 4 port support to use BAR2, removes the bogus quirk and adds support for the 8 port card.

    $ lspci -vvv -n -s 00:08.0
    00:08.0 0780: 10b5:9050 (rev 01)
    	Subsystem: 10b5:1588
    	Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
    	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    	Interrupt: pin A routed to IRQ 17
    	Region 1: I/O ports at ff00 [size=128]
    	Region 2: I/O ports at fe00 [size=64]
    	Region 3: I/O ports at fd00 [size=8]
    	Capabilities: <access denied>
    	Kernel driver in use: serial

    $ dmesg | grep 0000:00:08.0:
    [    0.083320] pci 0000:00:08.0: [10b5:9050] type 0 class 0x000780
    [    0.083355] pci 0000:00:08.0: reg 14: [io  0xff00-0xff7f]
    [    0.083369] pci 0000:00:08.0: reg 18: [io  0xfe00-0xfe3f]
    [    0.083382] pci 0000:00:08.0: reg 1c: [io  0xfd00-0xfd07]
    [    0.083460] pci 0000:00:08.0: PME# supported from D0 D3hot
    [    1.212867] 0000:00:08.0: ttyS4 at I/O 0xfe00 (irq = 17) is a 16550A
    [    1.233073] 0000:00:08.0: ttyS5 at I/O 0xfe08 (irq = 17) is a 16550A
    [    1.253270] 0000:00:08.0: ttyS6 at I/O 0xfe10 (irq = 17) is a 16550A
    [    1.273468] 0000:00:08.0: ttyS7 at I/O 0xfe18 (irq = 17) is a 16550A
    [    1.293666] 0000:00:08.0: ttyS8 at I/O 0xfe20 (irq = 17) is a 16550A
    [    1.313863] 0000:00:08.0: ttyS9 at I/O 0xfe28 (irq = 17) is a 16550A
    [    1.334061] 0000:00:08.0: ttyS10 at I/O 0xfe30 (irq = 17) is a 16550A
    [    1.354258] 0000:00:08.0: ttyS11 at I/O 0xfe38 (irq = 17) is a 16550A

    Signed-off-by: Scott Ashcroft <scott.ashcroft@talk21.com>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1843e9577d2bf2aea6c439be3bfa5038299e079
Author: Ilya Zykov <ilya@ilyx.ru>
Date:   Mon Mar 4 23:19:41 2013 +0400

    tty: Correct tty buffer flush.

    commit 64325a3be08d364a62ee8f84b2cf86934bc2544a upstream.

      The root of problem is carelessly zeroing pointer(in function __tty_buffer_flush()),
    when another thread can use it. It can be cause of "NULL pointer dereference".
      Main idea of the patch, this is never free last (struct tty_buffer) in the active buffer.
    Only flush the data for ldisc(buf->head->read = buf->head->commit).
    At that moment driver can collect(write) data in buffer without conflict.
    It is repeat behavior of flush_to_ldisc(), only without feeding data to ldisc.

    Signed-off-by: Ilya Zykov <ilya@ilyx.ru>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f84f26e72c1286582da55dd76752ef4296faeccd
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Sep 10 12:50:49 2013 +0200

    serial: pch_uart: fix tty-kref leak in rx-error path

    commit fc0919c68cb2f75bb1af759315f9d7e2a9443c28 upstream.

    Fix tty-kref leak introduced by commit 384e301e ("pch_uart: fix a
    deadlock when pch_uart as console") which never put its tty reference.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f88e029fd9a5e45a26614f4d8fe0d30c09c180c
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Sep 10 12:50:50 2013 +0200

    serial: pch_uart: fix tty-kref leak in dma-rx path

    commit 19b85cfb190eb9980eaf416bff96aef4159a430e upstream.

    Fix tty_kref leak when tty_buffer_request room fails in dma-rx path.

    Note that the tty ref isn't really needed anymore, but as the leak has
    always been there, fixing it before removing should makes it easier to
    backport the fix.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 82b9ccd651eb90f28b4336554d82ea0ab9067c63
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Wed Dec 5 12:08:29 2012 +0100

    target/file: Fix 32-bit highmem breakage for SGL -> iovec mapping

    commit 40ff2c3b3da35dd3a00ac6722056a59b4b3f2caf upstream.

    This patch changes vectored file I/O to use kmap + kunmap when mapping
    incoming SGL memory -> struct iovec in order to properly support 32-bit
    highmem configurations.  This is because an extra bounce buffer may be
    required when processing scatterlist pages allocated with GFP_KERNEL.

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: use task->task_sg{,_nents} for iteration]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b102fcef6a89e1bc0b7116125a82b3b03d57d89
Author: Hannes Reinecke <hare@suse.de>
Date:   Mon Dec 17 09:53:32 2012 +0100

    target: use correct sense code for LUN communication failure

    commit 18a9df42d53fabfa43b78be1104838cc8b9762e1 upstream.

    The ASC/ASCQ code for 'Logical Unit Communication failure' is
    0x08/0x00; 0x80/0x00 is vendor specific.

    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Cc: Nicholas Bellinger <nab@risingtidesystems.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: add offset to buffer index]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ff5fd702a5d62a39a9d72ba58003e990a099a08
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Wed May 16 21:52:10 2012 -0700

    target: Fix MAINTENANCE_IN service action CDB checks to use lower 5 bits

    commit ba539743b70cd160c84bab1c82910d0789b820f8 upstream.

    This patch fixes the MAINTENANCE_IN service action type checks to only
    look at the proper lower 5 bits of cdb byte 1.  This addresses the case
    where MI_REPORT_TARGET_PGS w/ extended header using the upper three bits of
    cdb byte 1 was not processed correctly in transport_generic_cmd_sequencer,
    as well as the three cases for standby, unavailable, and transition ALUA
    primary access state checks.

    Also add MAINTENANCE_IN to the excluded list in transport_generic_prepare_cdb()
    to prevent the PARAMETER DATA FORMAT bits from being cleared.

    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Rob Evers <revers@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 422c451501b6276c8ad4bea5ac6bf85322592d1e
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Fri Oct 25 21:53:33 2013 +0800

    target/pscsi: fix return value check

    commit 58932e96e438cd78f75e765d7b87ef39d3533d15 upstream.

    In case of error, the function scsi_host_lookup() returns NULL
    pointer not ERR_PTR(). The IS_ERR() test in the return value check
    should be replaced with NULL test.

    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: pscsi_configure_device() returns a pointer]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 263ee55a37e7fd03646449cbc07e16b7943f0572
Author: Roland Dreier <roland@purestorage.com>
Date:   Mon Nov 5 18:02:42 2012 -0800

    iscsi-target: Always send a response before terminating iSCSI connection

    commit 1c5c12c666fda27c7c494b34934a0a0631a48130 upstream.

    There are some cases, for example when the initiator sends an
    out-of-bounds ErrorRecoveryLevel value, where the iSCSI target
    terminates the connection without sending back any error.  Audit the
    login path and add appropriate iscsit_tx_login_rsp() calls to make
    sure this doesn't happen.

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 437569c5bdfb172fd13d27a82c108724b674bd63
Author: Mike Miller <mike.miller@hp.com>
Date:   Thu Sep 20 16:05:18 2012 -0500

    hpsa: gen8plus Smart Array IDs

    commit fe0c9610bb68dd0aad1017456f5e3c31264d70c2 upstream.

    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0bf3ffd5075b92bf04975c18a44baceab06a848d
Author: Reddy, Sreekanth <Sreekanth.Reddy@lsi.com>
Date:   Tue Feb 26 16:59:59 2013 +0530

    mpt2sas: Fix for issue Missing delay not getting set during system bootup

    commit 93cfcb8c998e3fe2c075fa61ab28f7b018e5049a upstream.

    commit b0df96a0068daee4f9c2189c29b9053eb6e46b17 upstream.

    Missing delay is not getting set properly. The reason is that it is not
    defined in the same file from where it is being invoked.  The fix is to move
    the missing delay module parameter from mpt2sas_base.c to mpt2sas_scsh.c.

    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce7035a6fdded27ad961445f6796a57b9bef04bf
Author: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
Date:   Sat Feb 2 00:56:18 2013 +0530

    mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop

    commit 6241f22ca12a26ee149cbe31b27bac97dbdc8bc4 upstream.

    Modified device scan routine so each configuration page read breaks from the
    while loop when the ioc_status is not equal to MPI2_IOCSTATUS_SUCCESS.

    [jejb: checkpatch fixes]
    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2; adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21b40f509a80e8446748329d9436c8ebffff27de
Author: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
Date:   Thu Jul 11 17:18:58 2013 -0700

    isci: Fix a race condition in the SSP task management path

    commit 96f15f29038e58e1b0a96483e2b369ff446becf1 upstream.

    This commit fixes a race condition in the isci driver abort task and SSP
    device task management path.  The race is caused when an I/O termination
    in the SCU hardware is necessary because of an SSP target timeout condition,
    and the check of the I/O end state races against the HW-termination-driven
    end state.  The failure of the race meant that no TMF was sent to the device
    to clean-up the pending I/O.

    Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
    Reviewed-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6d5f5393d055ba302edf4c59e6bfcee8b8892db
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Wed Feb 26 16:50:01 2014 +0300

    nfsd: check passed socket's net matches NFSd superblock's one

    commit 3064639423c48d6e0eb9ecc27c512a58e38c6c57 upstream.

    There could be a case, when NFSd file system is mounted in network, different
    to socket's one, like below:

    "ip netns exec" creates new network and mount namespace, which duplicates NFSd
    mount point, created in init_net context. And thus NFS server stop in nested
    network context leads to RPCBIND client destruction in init_net.
    Then, on NFSd start in nested network context, rpc.nfsd process creates socket
    in nested net and passes it into "write_ports", which leads to RPCBIND sockets
    creation in init_net context because of the same reason (NFSd monut point was
    created in init_net context). An attempt to register passed socket in nested
    net leads to panic, because no RPCBIND client present in nexted network
    namespace.

    This patch add check that passed socket's net matches NFSd superblock's one.
    And returns -EINVAL error to user psace otherwise.

    v2: Put socket on exit.

    Reported-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c14fee44389ab182ceab1df8fecbf2ffeb3a641
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Fri Feb 1 15:56:12 2013 +0300

    nfsd: containerize NFSd filesystem

    note: this backport is just for the null pointer problem when
    start nfsd in none init netns. The nfsd is still not containerized.

    commit 11f779421a39b86da8a523d97e5fd3477878d44f upstream.

    This patch makes NFSD file system superblock to be created per net.
    This makes possible to get proper network namespace from superblock instead of
    using hard-coded "init_net".

    Note: NFSd fs super-block holds network namespace. This garantees, that
    network namespace won't disappear from underneath of it.
    This, obviously, means, that in case of kill of a container's "init" (which is not a mount
    namespace, but network namespace creator) netowrk namespace won't be
    destroyed.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - export cache not per netns
     - NFSD service structure not per netns]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa16ac16fc1dfe1ddca4b4c9ce71aea73a878402
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Thu Dec 6 18:34:42 2012 +0300

    nfsd: pass proper net to nfsd_destroy() from NFSd kthreads

    commit 88c47666171989ed4c5b1a5687df09511e8c5e35 upstream.

    Since NFSd service is per-net now, we have to pass proper network
    context in nfsd_shutdown() from NFSd kthreads.

    The simplest way I found is to get proper net from one of transports
    with permanent sockets.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bdac1ecae1aed95cfb922bb7c875d6a4cd04f47
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:35 2012 +0300

    nfsd: pass net to __write_ports() and down

    commit 081603520b25f7b35ef63a363376a17c36ef74ed upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - add net_ns parameter to __write_ports_delxprt()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 044b2114e85758b0afee70dd4a3f61cde45bcb32
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:30 2012 +0300

    nfsd: pass net to nfsd_set_nrthreads()

    commit 3938a0d5eb5effcc89c6909741403f4e6a37252d upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b282713737acd21f6f921deb2eb78538c0932a7c
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:25 2012 +0300

    nfsd: pass net to nfsd_svc()

    commit d41a9417cd89a69f58a26935034b4264a2d882d6 upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_svc()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e42e08687cd3eea10a6b43f70a4e3b0375030737
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:20 2012 +0300

    nfsd: pass net to nfsd_create_serv()

    commit 6777436b0f072fb20a025a73e9b67a35ad8a5451 upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4851433beb66690843ac042d947d1a0ade76873f
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:14 2012 +0300

    nfsd: pass net to nfsd_startup() and nfsd_shutdown()

    commit db42d1a76a8dfcaba7a2dc9c591fa4e231db22b3 upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_startup()
     - no net ns initialization in nfsd_shutdown()
     - pass @net to lockd_up() in nfsd_startup()
     - pass @net to lockd_down() in nfsd_shutdown()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e0feda118a2394ff75068b2da3b80f467dff77f
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:09 2012 +0300

    nfsd: pass net to nfsd_init_socks()

    commit db6e182c17cb1a7069f7f8924721ce58ac05d9a3 upstream.

    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.

    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_init_socks()
     - net initialization in nfsd_startup()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e2400e24c096092c7b4cf736160d4e5e9070dec
Author: Amit Shah <amit.shah@redhat.com>
Date:   Fri Mar 29 16:30:08 2013 +0530

    virtio: console: add locking around c_ovq operations

    commit 9ba5c80b1aea8648a3efe5f22dc1f7cacdfbeeb8 upstream.

    When multiple ovq operations are being performed (lots of open/close
    operations on virtio_console fds), the __send_control_msg() function can
    get confused without locking.

    A simple recipe to cause badness is:
    * create a QEMU VM with two virtio-serial ports
    * in the guest, do
      while true;do echo abc >/dev/vport0p1;done
      while true;do echo edf >/dev/vport0p2;done

    In one run, this caused a panic in __send_control_msg().  In another, I
    got

       virtio_console virtio0: control-o:id 0 is not a head!

    This also results repeated messages similar to these on the host:

      qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
      qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0

    Reported-by: FuXiangChun <xfu@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
    Reviewed-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e83f2e8240f4dbc8f2740f9fc999d7bb10351e61
Author: Amit Shah <amit.shah@redhat.com>
Date:   Fri Mar 29 16:30:07 2013 +0530

    virtio: console: rename cvq_lock to c_ivq_lock

    commit 165b1b8bbc17c9469b053bab78b11b7cbce6d161 upstream.

    The cvq_lock was taken for the c_ivq.  Rename the lock to make that
    obvious.

    We'll also add a lock around the c_ovq in the next commit, so there's no
    ambiguity.

    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Asias He <asias@redhat.com>
    Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2:
     - Adjust context
     - Drop change to virtcons_restore()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4:
     - pick change to virtcons_restore() from upsteam patch]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c9f8a4940df47e650d39216de7bc8f21e18e2fa
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Fri May 17 10:44:15 2013 +0930

    virtio_console: fix uapi header

    commit 6407d75afd08545f2252bb39806ffd3f10c7faac upstream.

    uapi should use __u32 not u32.
    Fix a macro in virtio_console.h which uses u32.

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f3874ea67992faee3a7ff4dca382d0cb0ee0c06
Author: Alexander Graf <agraf@suse.de>
Date:   Wed Jan 2 15:37:17 2013 +1030

    virtio-blk: Don't free ida when disk is in use

    commit f4953fe6c4aeada2d5cafd78aa97587a46d2d8f9 upstream.

    When a file system is mounted on a virtio-blk disk, we then remove it
    and then reattach it, the reattached disk gets the same disk name and
    ids as the hot removed one.

    This leads to very nasty effects - mostly rendering the newly attached
    device completely unusable.

    Trying what happens when I do the same thing with a USB device, I saw
    that the sd node simply doesn't get free'd when a device gets forcefully
    removed.

    Imitate the same behavior for vd devices. This way broken vd devices
    simply are never free'd and newly attached ones keep working just fine.

    Signed-off-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6330a0c429c1518714283be51b86dc02b45db882
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:32 2012 +0100

    virtio: 9p: correctly pass physical address to userspace for high pages

    commit 30d395b124c51db66d9f3ba0611cd62021afc392 upstream.

    commit b9cdc88df8e63e81c723b82c286fc97f5d0dc325 upstream.

    When using a virtio transport, the 9p net device may pass the physical
    address of a kernel buffer to userspace via a scatterlist inside a
    virtqueue. If the kernel buffer is mapped outside of the linear mapping
    (e.g. highmem), then virt_to_page will return a bogus value and we will
    populate the scatterlist with junk.

    This patch uses kmap_to_page when populating the page array for a kernel
    buffer.

    Cc: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ad988bcb5b18ad5e1865f638cfc7ba3e600c4d46
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:31 2012 +0100

    mm: highmem: export kmap_to_page for modules

    commit f0263d2d222e9e25f2587e51a9dc58c6fb2a9352 upstream.

    Some virtio device drivers (9p) need to translate high virtual addresses
    to physical addresses, which are inserted into the virtqueue for
    processing by userspace.

    This patch exports the kmap_to_page symbol, so that the affected drivers
    can be compiled as modules.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7e4d02fdb2bb0f47405a0961a7f3991a56b5981b
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Tue Jul 31 16:45:02 2012 -0700

    mm: add kmap_to_page()

    commit fcb8996728fb59eddf84678df7cb213b2c9a2e26 upstream.

    This is extracted from Mel Gorman's commit 5a178119b0fb ('mm: add
    support for direct_IO to highmem pages') upstream.

    Required to backport commit b9cdc88df8e6 ('virtio: 9p: correctly pass
    physical address to userspace for high pages').

    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 984ca88a55ccf51d4eeef67ce2247c58694a2dc5
Author: Asias He <asias@redhat.com>
Date:   Fri May 25 10:34:48 2012 +0800

    virtio-blk: Reset device after blk_cleanup_queue()

    commit 483001c765af6892b3fc3726576cb42f17d1d6b5 upstream.

    blk_cleanup_queue() will call blk_drian_queue() to drain all the
    requests before queue DEAD marking. If we reset the device before
    blk_cleanup_queue() the drain would fail.

    1) if the queue is stopped in do_virtblk_request() because device is
    full, the q->request_fn() will not be called.

    blk_drain_queue() {
       while(true) {
          ...
          if (!list_empty(&q->queue_head))
            __blk_run_queue(q) {
    	    if (queue is not stoped)
    		q->request_fn()
    	}
          ...
       }
    }

    Do no reset the device before blk_cleanup_queue() gives the chance to
    start the queue in interrupt handler blk_done().

    2) In commit b79d866c8b7014a51f611a64c40546109beaf24a, We abort requests
    dispatched to driver before blk_cleanup_queue(). There is a race if
    requests are dispatched to driver after the abort and before the queue
    DEAD mark. To fix this, instead of aborting the requests explicitly, we
    can just reset the device after after blk_cleanup_queue so that the
    device can complete all the requests before queue DEAD marking in the
    drain process.

    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: virtualization@lists.linux-foundation.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Asias He <asias@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af6e24de4b787c77070bbaa2d0cd8e479f1db2d7
Author: Asias He <asias@redhat.com>
Date:   Fri May 25 10:34:47 2012 +0800

    virtio-blk: Call del_gendisk() before disable guest kick

    commit 02e2b124943648fba0a2ccee5c3656a5653e0151 upstream.

    del_gendisk() might not return due to failing to remove the
    /sys/block/vda/serial sysfs entry when another thread (udev) is
    trying to read it.

    virtblk_remove()
      vdev->config->reset() : guest will not kick us through interrupt
        del_gendisk()
          device_del()
            kobject_del(): got stuck, sysfs entry ref count non zero

    sysfs_open_file(): user space process read /sys/block/vda/serial
       sysfs_get_active() : got sysfs entry ref count
          dev_attr_show()
            virtblk_serial_show()
               blk_execute_rq() : got stuck, interrupt is disabled
                                  request cannot be finished

    This patch fixes it by calling del_gendisk() before we disable guest's
    interrupt so that the request sent in virtblk_serial_show() will be
    finished and del_gendisk() will success.

    This fixes another race in hot-unplug process.

    It is save to call del_gendisk(vblk->disk) before
    flush_work(&vblk->config_work) which might access vblk->disk, because
    vblk->disk is not freed until put_disk(vblk->disk).

    Cc: virtualization@lists.linux-foundation.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Asias He <asias@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f515bcabb5e4514126ab1635c215256cce4163a2
Author: Asias He <asias@redhat.com>
Date:   Fri May 4 20:22:04 2012 +0800

    virtio-blk: Fix hot-unplug race in remove method

    commit b79d866c8b7014a51f611a64c40546109beaf24a upstream.

    If we reset the virtio-blk device before the requests already dispatched
    to the virtio-blk driver from the block layer are finised, we will stuck
    in blk_cleanup_queue() and the remove will fail.

    blk_cleanup_queue() calls blk_drain_queue() to drain all requests queued
    before DEAD marking. However it will never success if the device is
    already stopped. We'll have q->in_flight[] > 0, so the drain will not
    finish.

    How to reproduce the race:
    1. hot-plug a virtio-blk device
    2. keep reading/writing the device in guest
    3. hot-unplug while the device is busy serving I/O

    Test:
    ~1000 rounds of hot-plug/hot-unplug test passed with this patch.

    Changes in v3:
    - Drop blk_abort_queue and blk_abort_request
    - Use __blk_end_request_all to complete request dispatched to driver

    Changes in v2:
    - Drop req_in_flight
    - Use virtqueue_detach_unused_buf to get request dispatched to driver

    Signed-off-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36bd1996971bb124f4629994376c5fbb99a0e855
Author: Asias He <asias@redhat.com>
Date:   Fri Mar 30 11:24:10 2012 +0800

    virtio_blk: Drop unused request tracking list

    commit f65ca1dc6a8c81c6bd72297d4399ec5f4c1f3a01 upstream.

    Benchmark shows small performance improvement on fusion io device.

    Before:
      seq-read : io=1,024MB, bw=19,982KB/s, iops=39,964, runt= 52475msec
      seq-write: io=1,024MB, bw=20,321KB/s, iops=40,641, runt= 51601msec
      rnd-read : io=1,024MB, bw=15,404KB/s, iops=30,808, runt= 68070msec
      rnd-write: io=1,024MB, bw=14,776KB/s, iops=29,552, runt= 70963msec

    After:
      seq-read : io=1,024MB, bw=20,343KB/s, iops=40,685, runt= 51546msec
      seq-write: io=1,024MB, bw=20,803KB/s, iops=41,606, runt= 50404msec
      rnd-read : io=1,024MB, bw=16,221KB/s, iops=32,442, runt= 64642msec
      rnd-write: io=1,024MB, bw=15,199KB/s, iops=30,397, runt= 68991msec

    Signed-off-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76b87de061f61314d2db3926639102c0dcf39e0e
Author: Raphael Kubo da Costa <rakuco@FreeBSD.org>
Date:   Mon Sep 2 14:57:51 2013 +0300

    Bluetooth: Add support for BCM20702A0 [0b05, 17cb]

    commit 38a172bef8c93ecbfd69715fd88396988e4073fd upstream.

    Yet another vendor specific ID for this chipset; this one for the ASUS
    USB-BT400 Bluetooth 4.0 adapter.

    T:  Bus=03 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0b05 ProdID=17cb Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=000272C64400
    C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Raphael Kubo da Costa <rakuco@FreeBSD.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 140deab36402de1b4049bcc12a418e16039da041
Author: Peng Chen <pengchen@qti.qualcomm.com>
Date:   Fri Aug 30 17:41:40 2013 +0800

    Bluetooth: Add a new PID/VID 0cf3/e005 for AR3012.

    commit 0a3658cccdf5326ea508efeb1879b0e2508bb0c3 upstream.

    usb device info:

    T:  Bus=06 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 15 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=e005 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms

    Signed-off-by: Peng Chen <pengchen@qca.qualcomm.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae1c727625e893f0c458de607ec3868b194e79c6
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jun 20 13:38:45 2013 +0800

    Bluetooth: Add support for Atheros [0cf3:e003]

    commit 1d5b569ef85d013a775560a90050dc630614c045 upstream.

    Add support for the AR9462 chip

    T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=e003 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d9b03b2af1118a8535db70185857b0fc70a2150e
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Wed Jul 17 11:27:40 2013 +0800

    Bluetooth: Add support for Atheros [0cf3:3121]

    commit 1ebd0b21ab14efb75950079840eac29afea2a26e upstream.

    Add support for the AR3012 chip.

    T:  Bus=03 Lev=01 Prnt=01 Port=06 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=3121 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa6e6074eeeb7f5d70befc5f4503177e07cde572
Author: Sujith Manoharan <sujith@msujith.org>
Date:   Mon Jul 15 09:29:03 2013 +0530

    Bluetooth: ath3k: Add support for ID 0x13d3/0x3402

    commit 5b77a1f3d7b7360dc2b7c6d2188d39b9f8432907 upstream.

    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=13d3 ProdID=3402 Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=59701

    Signed-off-by: Sujith Manoharan <sujith@msujith.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61286bc54e9d1e7c12953dc277a83d8ce49b6fb5
Author: Thomas Loo <tloo@saltstorm.net>
Date:   Wed Jul 3 02:53:54 2013 +0200

    Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330]

    commit fb2e4631a7e23c37b9e2e7b2fd776231bbfc39d4 upstream.

    commit 84eb2ae1807dd1467bf6f500fc69ae61f1907b75 upstream.

    The Fujitsu Lifebook UH552/UH572 ships with a Qualcomm AR9462/AR3012
    WLAN/BT-Combo card.
    Add device ID to the ath3k driver to enable the bluetooth side of things.
    Patch against v3.10.

    T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04c5 ProdID=1330 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: Thomas Loo <tloo@saltstorm.net>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5ff17150132bc8afc4bfa63770b2feb8579067f1
Author: Cho, Yu-Chen <acho@suse.com>
Date:   Tue Jun 4 21:40:26 2013 +0800

    Bluetooth: Add support for Mediatek Bluetooth device [0e8d:763f]

    commit ff98736cbbbeb9087d4e5d7cb89e05c3e8bd01d6 upstream.

    commit 178c059e7640aa8e50213400c6f3dde00189d979 upstream.

    This patch adds support for Mediatek Bluetooth device

    T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
    D:  Ver= 2.01 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0e8d ProdID=763f Rev= 1.00
    S:  Manufacturer=MediaTek
    S:  Product=BT
    S:  SerialNumber=1.0
    C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=450mA
    A:  FirstIf#= 0 IfCount= 2 Cls=ff(vend.) Sub=ff Prot=ff
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    I:  If#= 1 Alt= 6 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms

    Signed-off-by: Cho, Yu-Chen <acho@suse.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27370724e35ea2798b482ec014a08274de3139bd
Author: Noguchi Kazutosi <linux@scaltinof.net>
Date:   Sun Mar 24 23:41:10 2013 +0900

    Bluetooth: Add support for Foxconn/Hon Hai [0489:e04d]

    commit 0fc110f4e4f569e12c472f73f0af485e05631403 upstream.

    Add support for the AR3012 chip.

    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=03 Dev#= 21 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e04d Rev=00.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: Noguchi Kazutosi <linux@scaltinof.net>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1a182cc2740ad9f9831be4b8bdb8b0f5f946269f
Author: Sunguk Lee <d3m3vilurr@gmail.com>
Date:   Tue Mar 12 04:41:58 2013 +0900

    Bluetooth: Device 0cf3:3008 should map AR 3012

    commit 94a32d10f47b637ae24b78b1ddc7ef0e8396fda4 upstream.

    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=3008 Rev= 0.01
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Sunguk Lee <d3m3vilurr@gmail.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d83ff8cd53e72348202f1a5f6110ee07404b7025
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Tue Feb 19 11:54:16 2013 -0500

    Bluetooth: Add support for atheros 04ca:3004 device to ath3k

    commit 3f63c340a72f2872a9362245cb2e03f3d2bb73a6 upstream.

    Yet another version of the atheros bluetooth chipset

    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3004 Rev=00.01
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    This resolves https://bugzilla.redhat.com/show_bug.cgi?id=844750

    Reported-by: niktr@mail.ru
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e98f05ee934efd837fe98a7628affc4956b9471b
Author: Sergio Cambra <sergio@programatica.es>
Date:   Thu Jan 10 01:06:55 2013 +0100

    Bluetooth device 04ca:3008 should use ath3k

    commit f4d6f7dce71a5da93da50272ff1670bf2f1146b1 upstream.

    Output of /sys/kernel/debug/usb/devices
    T:  Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  6 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3008 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Sergio Cambra <sergio@programatica.es>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a344a224e918743ce58928faa6cfd9b4f8e87fe
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jan 3 12:25:00 2013 +0800

    Bluetooth: Add support for Foxconn / Hon Hai [0489:e056]

    commit 2582d529c44d12502a700f1c3db062b9f44679bc upstream.

    Add support for the AR9462 chip

    T: Bus=01 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
    D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0489 ProdID=e056 Rev=00.01
    C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 340733cde963ab8582b5e306db5983942bf67b1a
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jan 3 12:24:59 2013 +0800

    Bluetooth: Add support for Foxconn / Hon Hai [0489:e04e]

    commit 3a61eda81ebcfc006ebb1496764299d53e5bf67f upstream.

    Add support for the AR9462 chip

    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e04e Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a8c99e21fad826a45661da89cd86bd6df69c305
Author: Daniel Schaal <farbing@web.de>
Date:   Sat Dec 29 11:14:34 2012 +0100

    Bluetooth: Add support for GC-WB300D PCIe [04ca:3006] to ath3k.

    commit 2c262b2a5235b7f5b18d4d58394511f76371d7cb upstream.

    T:  Bus=02 Lev=02 Prnt=02 Port=06 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3006 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Daniel Schaal <farbing@web.de>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b36e95cac48b0f632e15e14de5a59163b62afa2
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Tue Dec 11 11:41:20 2012 +0800

    Bluetooth: Add support for IMC Networks [13d3:3393]

    commit eed307e290b96636def331375e065aca43f9069a upstream.

    Add support for the AR9462 chip

    T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=13d3 ProdID=3393 Rev=00.01
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a990f68bde5fc6d8ea83f767575d70eaa0acc48
Author: Jeff Cook <jeff@deserettechnology.com>
Date:   Fri Nov 9 16:39:48 2012 -0700

    Bluetooth: Add support for BCM20702A0 [0b05, 17b5]

    commit 1ee3ff6110c16acfc915a79b1e3feb5013c41e75 upstream.

    Vendor-specific ID for BCM20702A0.
    Support for bluetooth over Asus Wi-Fi GO!, included with Asus P8Z77-V
    Deluxe.

    T:  Bus=07 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0b05 ProdID=17b5 Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=94DBC98AC113
    C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Jeff Cook <jeff@deserettechnology.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit adebaa7a1d6e8838edae80f1d0e4a53c49a1ce04
Author: Jaroslav Resler <resler@cs.cas.cz>
Date:   Tue Sep 11 17:25:32 2012 +0800

    Bluetooth: Add support for BCM20702A0 [04ca, 2003]

    commit 0c1abbd1aa0416258881c303a88e618cbca0759c upstream.

    Add another vendor specific ID for BCM20702A0.

    output of usb-devices:
    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=2003 Rev= 1.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=446D57861623
    C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=  0mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Cho, Yu-Chen <acho@suse.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec5bf54af7cf56eeb106c16a73d0f35d407370a2
Author: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Date:   Wed Aug 15 01:38:11 2012 -0300

    Bluetooth: Add USB_VENDOR_AND_INTERFACE_INFO() for Broadcom/Foxconn

    commit ee66401bb94b1f2ce51089c341dcdd25d26ae631 upstream.

    Foxconn devices has a vendor specific class of device, we will match them
    differently now.

    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1403b36793c0787e82bed2c4d8123ef6593c1ad2
Author: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
Date:   Tue Aug 7 19:48:10 2012 +0530

    Bluetooth: Add support for Sony Vaio T-Series

    commit bc21fde2d549d1cb1ebef04016eb7affa43bb5c1 upstream.

    Add Sony Vaio T-Series Bluetooth Module( 0x489:0xE036) to
    the blacklist of btusb module and add it to the ath3k module.

    output of cat /sys/kernel/debug/usb/devices

    T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e036 Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
    Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1144cac91f26fd79db28fdd261ba435cb4059c7
Author: Michael Gruetzner <mgruetzn@gmx.de>
Date:   Wed May 2 22:33:40 2012 +0200

    Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C

    commit 85d59726c5c66016a507f1f4a60db8e374dd284d upstream.

    Add Foxconn/Hon Hai AR5BBU22 Bluetooth Module( 0x489:0xE03C) to
    the blacklist of btusb module and add it to the ath3k module to properly
    load the firmware in Kernel 3.3.4
    The device is integrated in  e.g. some  Acer Aspire 7750G.

    Output from /sys/kernel/debug/usb/devices:

    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  6 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e03c Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Michael Gruetzner <mgruetzn@gmx.de>
    Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4126da551e92345e6e7da09870da10fba804e04f
Author: Peng Chen <pengchen@qca.qualcomm.com>
Date:   Wed Aug 1 10:11:59 2012 +0800

    Bluetooth: add support for atheros 0489:e057

    commit 2096ae6ca647302d50a68aa36cb66a00e7dfac70 upstream.

        Add support for the AR3012 chip found on Fioxconn.

        usb-devices shows:

        T:  Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 44 Spd=12   MxCh= 0
        D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
        P:  Vendor=0489 ProdID=e057 Rev= 0.02
        C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
        I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
        E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
        E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
        I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
        I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
        I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
        I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
        I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
        I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Peng Chen <pengchen@qca.qualcomm.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2f15c35b2e4152169edf7f1c37c38eb8ec45fe1
Author: Giancarlo Formicuccia <giancarlo.formicuccia@gmail.com>
Date:   Sun Jun 10 08:33:11 2012 +0200

    Bluetooth: add support for atheros 0930:0219

    commit 6c4ae5c2e7bfbb7d10d73611f69ac8a8609d84fd upstream.

    Add support for the AR3012 chip found on the Toshiba Sallite M840-1000-XQ.

    usb-devices shows:

    T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0930 ProdID=0219 Rev=00.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

    Signed-off-by: Giancarlo Formicuccia <giancarlo.formicuccia@gmail.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f801fcbd4bc022d58e39a1cd7f6e84933359d19
Author: Marek Vasut <marex@denx.de>
Date:   Fri Jun 8 14:32:50 2012 +0200

    Bluetooth: Support AR3011 in Acer Iconia Tab W500

    commit 6eda541d12116b4772baa09d3e8d7b0389df4289 upstream.

    Acer used this chip connected via USB:

    Bus 005 Device 005: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth
    Device Descriptor:
      bLength                18
      bDescriptorType         1
      bcdUSB               1.10
      bDeviceClass          224 Wireless
      bDeviceSubClass         1 Radio Frequency
      bDeviceProtocol         1 Bluetooth
      bMaxPacketSize0        64
      idVendor           0x0cf3 Atheros Communications, Inc.
      idProduct          0x3005 AR3011 Bluetooth
      bcdDevice            0.01
      iManufacturer           0
      iProduct                0
      iSerial                 0
      bNumConfigurations      1

    Signed-off-by: Marek Vasut <marex@denx.de>
    Cc: Gustavo Padovan <gustavo@padovan.org>
    Cc: Johan Hedberg <johan.hedberg@gmail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ec88fcb4aa2c33fe2fe2a23c576a7e2581c5c3d
Author: Jaganath Kanakkassery <jaganath.k@samsung.com>
Date:   Fri Jun 21 19:55:11 2013 +0530

    Bluetooth: Fix invalid length check in l2cap_information_rsp()

    commit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream.

    The length check is invalid since the length varies with type of
    info response.

    This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888

    Because of this, l2cap info rsp is not handled and command reject is sent.

    > ACL data: handle 11 flags 0x02 dlen 16
            L2CAP(s): Info rsp: type 2 result 0
              Extended feature mask 0x00b8
                Enhanced Retransmission mode
                Streaming mode
                FCS Option
                Fixed Channels
    < ACL data: handle 11 flags 0x00 dlen 10
            L2CAP(s): Command rej: reason 0
              Command not understood

    Cc: stable@vger.kernel.org
    Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
    Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
    Acked-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ade988a989901a1527c6809aeea0ca3b8639af46
Author: Johan Hedberg <johan.hedberg@intel.com>
Date:   Tue May 28 13:46:30 2013 +0300

    Bluetooth: Fix missing length checks for L2CAP signalling PDUs

    commit cb3b3152b2f5939d67005cff841a1ca748b19888 upstream.

    There has been code in place to check that the L2CAP length header
    matches the amount of data received, but many PDU handlers have not been
    checking that the data received actually matches that expected by the
    specific PDU. This patch adds passing the length header to the specific
    handler functions and ensures that those functions fail cleanly in the
    case of an incorrect amount of data.

    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Move uses of *req below the new check in l2cap_connect_req]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - Adjust context
     - Adjust l2cap_create_channel_rsp()'s parameters]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 653b6fe704e344fe48162a23b60657db1ac84233
Author: Andrey Ryabinin <a.ryabinin@samsung.com>
Date:   Fri Jun 6 19:09:30 2014 +0400

    mm: rmap: fix use-after-free in __put_anon_vma

    commit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream.

    While working address sanitizer for kernel I've discovered
    use-after-free bug in __put_anon_vma.

    For the last anon_vma, anon_vma->root freed before child anon_vma.
    Later in anon_vma_free(anon_vma) we are referencing to already freed
    anon_vma->root to check rwsem.

    This fixes it by freeing the child anon_vma before freeing
    anon_vma->root.

    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Acked-by: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7da536df5fb077e03b8882b586f274409c459861
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Fri May 23 10:45:54 2014 -0400

    USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume

    commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.

    Not all host controller drivers have bus-suspend and bus-resume
    methods.  When one doesn't, it will cause problems if runtime PM is
    enabled in the kernel.  The PM core will attempt to suspend the
    controller's root hub, the suspend will fail because there is no
    bus-suspend routine, and a -EBUSY error code will be returned to the
    PM core.  This will cause the suspend attempt to be repeated shortly
    thereafter, in a never-ending loop.

    Part of the problem is that the original error code -ENOENT gets
    changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM
    core will interpret -ENOENT as meaning that the root hub has gotten
    into a runtime-PM error state.  While this change is appropriate for
    real USB devices, it's not such a good idea for a root hub.  In fact,
    considering the root hub to be in a runtime-PM error state would not
    be far from the truth.  Therefore this patch updates
    usb_runtime_suspend() so that it adjusts error codes only for
    non-root-hub devices.

    Furthermore, the patch attempts to prevent the problem from occurring
    in the first place by not enabling runtime PM by default for root hubs
    whose host controller driver doesn't have bus_suspend and bus_resume
    methods.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Will Deacon <will.deacon@arm.com>
    Tested-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98e74212146e2191a9e6edb673b35389fd8f6aed
Author: Johan Hovold <jhovold@gmail.com>
Date:   Sat Apr 26 11:53:44 2014 +0200

    USB: io_ti: fix firmware download on big-endian machines (part 2)

    commit c03890ff5e24a4bf59059f2d179f427559b7330a upstream.

    A recent patch that purported to fix firmware download on big-endian
    machines failed to add the corresponding sparse annotation to the
    i2c-header. This was reported by the kbuild test robot.

    Adding the appropriate annotation revealed another endianess bug related
    to the i2c-header Size-field in a code path that is exercised when the
    firmware is actually being downloaded (and not just verified and left
    untouched unless older than the firmware at hand).

    This patch adds the required sparse annotation to the i2c-header and
    makes sure that the Size-field is sent in little-endian byte order
    during firmware download also on big-endian machines.

    Note that this patch is only compile-tested, but that there is no
    functional change for little-endian systems.

    Reported-by: kbuild test robot <fengguang.wu@intel.com>
    Cc: Ludovic Drolez <ldrolez@debian.org>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96f169c406101ce9a90c3e534652610bfc46bf67
Author: Alexej Starschenko <starschenko@gmail.com>
Date:   Wed May 7 10:43:29 2014 +0200

    USB: serial: option: add support for Novatel E371 PCIe card

    commit 8a61ba3a47ac39f660702aa66a172185dd605a86 upstream.

    Adds product ID for the Novatel E371 PCI Express Mini Card.

    $ lsusb
    Bus 001 Device 024: ID 1410:9011 Novatel Wireless

    $ usb-devices
    T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=1410 ProdID=9011 Rev=00.03
    S:  Manufacturer=Novatel Wireless, Inc.
    S:  Product=Novatel Wireless HSPA
    S:  SerialNumber=012773002115811
    C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
    I:  If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether

    Tested with kernel 3.2.0.

    Signed-off-by: Alexej Starschenko <starschenko@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 939b9b9297bd427da92dd1b3d3c94a813db8eee0
Author: George McCollister <george.mccollister@gmail.com>
Date:   Sat Apr 26 12:04:47 2014 +0200

    USB: ftdi_sio: add NovaTech OrionLXm product ID

    commit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd upstream.

    The NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and
    console access.

    Here is the lsusb output:
    Bus 004 Device 123: ID 0403:7c90 Future Technology Devices
    International, Ltd

    Signed-off-by: George McCollister <george.mccollister@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 810d7a3bef08c6ebe984a9e1dd12659ef3d37679
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jun 2 15:16:07 2014 +0200

    ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup

    commit 192a98e280e560510a62aca8cfa83b4ae7c095bb upstream.

    The conversion to a fixup table for Replacer model with ALC260 in
    commit 20f7d928 took the wrong widget NID for COEF setups.  Namely,
    NID 0x1a should have been used instead of NID 0x20, which is the
    common node for all Realtek codecs but ALC260.

    Fixes: 20f7d928fa6e ('ALSA: hda/realtek - Replace ALC260 model=replacer with the auto-parser')
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit abd03db4242413c2abd6ed87139559e4d0cb8a19
Author: Ronan Marquet <ronan.marquet@orange.fr>
Date:   Sun Jun 1 18:38:53 2014 +0200

    ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop

    commit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0 upstream.

    Correcion of wrong fixup entries add in commit ca8f0424 to replace
    static model quirk for PB V7900 laptop (will model).

    [note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a
     part of the fix; otherwise the pin is set up wrongly as a headphone,
     and user-space (PulseAudio) may be wrongly trying to detect the jack
     state -- tiwai]

    Fixes: ca8f04247eaa ('ALSA: hda/realtek - Add the fixup codes for ALC260 model=will')
    Signed-off-by: Ronan Marquet <ronan.marquet@orange.fr>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 718c04d410c7a442b59e5e7e372dc011b0ca3dc5
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon May 19 00:56:22 2014 +0100

    Staging: speakup: Move pasting into a work item

    commit d7500135802ca55b3f4e01a16544e8b34082f8c3 upstream.

    Input is handled in softirq context, but when pasting we may
    need to sleep.  speakup_paste_selection() currently tries to
    bodge this by busy-waiting if in_atomic(), but that doesn't
    help because the ldisc may also sleep.

    For bonus breakage, speakup_paste_selection() changes the
    state of current, even though it's not running in process
    context.

    Move it into a work item and make sure to cancel it on exit.

    References: https://bugs.debian.org/735202
    References: https://bugs.debian.org/744015
    Reported-by: Paul Gevers <elbrus@debian.org>
    Reported-and-tested-by: Jarek Czekalski <jarekczek@poczta.onet.pl>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0a3c6603ccd5840452c7d88d7df213f573867d9
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date:   Wed May 28 23:51:13 2014 +0300

    xhci: delete endpoints from bandwidth list before freeing whole device

    commit 5dc2808c4729bf080487e61b80ee04e0fdb12a37 upstream.

    Lists of endpoints are stored for bandwidth calculation for roothub ports.
    Make sure we remove all endpoints from the list before the whole device,
    containing its endpoints list_head stuctures, is freed.

    This used to be done in the wrong order in xhci_mem_cleanup(),
    and triggered an oops in resume from S4 (hibernate).

    Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b78a4287b8cc7c0817b7bc4894d8c9c177bb751
Author: NeilBrown <neilb@suse.de>
Date:   Wed May 28 13:39:23 2014 +1000

    md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".

    commit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream.

    If mddev->ro is set, md_to_sync will (correctly) abort.
    However in that case MD_RECOVERY_INTR isn't set.

    If a RESHAPE had been requested, then ->finish_reshape() will be
    called and it will think the reshape was successful even though
    nothing happened.

    Normally a resync will not be requested if ->ro is set, but if an
    array is stopped while a reshape is on-going, then when the array is
    started, the reshape will be restarted.  If the array is also set
    read-only at this point, the reshape will instantly appear to success,
    resulting in data corruption.

    Consequently, this patch is suitable for any -stable kernel.

    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6e81d4f7b4e8cea2817c7568e3756798cd29aae
Author: Lai Jiangshan <laijs@cn.fujitsu.com>
Date:   Fri May 16 11:50:42 2014 +0800

    sched: Fix hotplug vs. set_cpus_allowed_ptr()

    commit 6acbfb96976fc3350e30d964acb1dbbdf876d55e upstream.

    Lai found that:

      WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b()
      ...
      migration_cpu_stop+0x1d/0x22

    was caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is
    always a sub-set of cpu_online_mask.

    This isn't true since 5fbd036b552f ("sched: Cleanup cpu_active madness").

    So set active and online at the same time to avoid this particular
    problem.

    Fixes: 5fbd036b552f ("sched: Cleanup cpu_active madness")
    Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Michael wang <wangyun@linux.vnet.ibm.com>
    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
    Cc: Toshi Kani <toshi.kani@hp.com>
    Link: http://lkml.kernel.org/r/53758B12.8060609@cn.fujitsu.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee40d72c3e6fc7e6cd5241eb84fa104b61dc8ec3
Author: Andrey Ryabinin <a.ryabinin@samsung.com>
Date:   Wed May 7 08:07:25 2014 +0100

    ARM: 8051/1: put_user: fix possible data corruption in put_user

    commit 537094b64b229bf3ad146042f83e74cf6abe59df upstream.

    According to arm procedure call standart r2 register is call-cloberred.
    So after the result of x expression was put into r2 any following
    function call in p may overwrite r2. To fix this, the result of p
    expression must be saved to the temporary variable before the
    assigment x expression to __r2.

    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Reviewed-by: Nicolas Pitre <nico@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b2a92d89ef65cba15994b3707a512ceede879b8
Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date:   Thu May 22 11:54:21 2014 -0700

    mm/memory-failure.c: fix memory leak by race between poison and unpoison

    commit 3e030ecc0fc7de10fd0da10c1c19939872a31717 upstream.

    When a memory error happens on an in-use page or (free and in-use)
    hugepage, the victim page is isolated with its refcount set to one.

    When you try to unpoison it later, unpoison_memory() calls put_page()
    for it twice in order to bring the page back to free page pool (buddy or
    free hugepage list).  However, if another memory error occurs on the
    page which we are unpoisoning, memory_failure() returns without
    releasing the refcount which was incremented in the same call at first,
    which results in memory leak and unconsistent num_poisoned_pages
    statistics.  This patch fixes it.

    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b2cfc9508d9e509708f85748548e03db696dbcd
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Fri May 2 16:56:01 2014 +0200

    perf: Fix race in removing an event

    commit 46ce0fe97a6be7532ce6126bb26ce89fed81528c upstream.

    When removing a (sibling) event we do:

    	raw_spin_lock_irq(&ctx->lock);
    	perf_group_detach(event);
    	raw_spin_unlock_irq(&ctx->lock);

    	<hole>

    	perf_remove_from_context(event);
    		raw_spin_lock_irq(&ctx->lock);
    		...
    		raw_spin_unlock_irq(&ctx->lock);

    Now, assuming the event is a sibling, it will be 'unreachable' for
    things like ctx_sched_out() because that iterates the
    groups->siblings, and we just unhooked the sibling.

    So, if during <hole> we get ctx_sched_out(), it will miss the event
    and not call event_sched_out() on it, leaving it programmed on the
    PMU.

    The subsequent perf_remove_from_context() call will find the ctx is
    inactive and only call list_del_event() to remove the event from all
    other lists.

    Hereafter we can proceed to free the event; while still programmed!

    Close this hole by moving perf_group_detach() inside the same
    ctx->lock region(s) perf_remove_from_context() has.

    The condition on inherited events only in __perf_event_exit_task() is
    likely complete crap because non-inherited events are part of groups
    too and we're tearing down just the same. But leave that for another
    patch.

    Most-likely-Fixes: e03a9a55b4e ("perf: Change close() semantics for group events")
    Reported-by: Vince Weaver <vincent.weaver@maine.edu>
    Tested-by: Vince Weaver <vincent.weaver@maine.edu>
    Much-staring-at-traces-by: Vince Weaver <vincent.weaver@maine.edu>
    Much-staring-at-traces-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/20140505093124.GN17778@laptop.programming.kicks-ass.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 183f99ecb6a484c142ae2fc99df3ef5cdadc3985
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Thu May 15 20:23:48 2014 +0200

    perf: Limit perf_event_attr::sample_period to 63 bits

    commit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream.

    Vince reported that using a large sample_period (one with bit 63 set)
    results in wreckage since while the sample_period is fundamentally
    unsigned (negative periods don't make sense) the way we implement
    things very much rely on signed logic.

    So limit sample_period to 63 bits to avoid tripping over this.

    Reported-by: Vince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/n/tip-p25fhunibl4y3qi0zuqmyf4b@git.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d41f6026aa0c15d60e75f8f71f1408c32fe1ba4
Author: Jiri Olsa <jolsa@redhat.com>
Date:   Mon Apr 7 11:04:08 2014 +0200

    perf: Prevent false warning in perf_swevent_add

    commit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream.

    The perf cpu offline callback takes down all cpu context
    events and releases swhash->swevent_hlist.

    This could race with task context software event being just
    scheduled on this cpu via perf_swevent_add while cpu hotplug
    code already cleaned up event's data.

    The race happens in the gap between the cpu notifier code
    and the cpu being actually taken down. Note that only cpu
    ctx events are terminated in the perf cpu hotplug code.

    It's easily reproduced with:
      $ perf record -e faults perf bench sched pipe

    while putting one of the cpus offline:
      # echo 0 > /sys/devices/system/cpu/cpu1/online

    Console emits following warning:
      WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0()
      Modules linked in:
      CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G        W    3.14.0+ #256
      Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008
       0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005
       0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046
       ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001
      Call Trace:
       [<ffffffff81665a23>] dump_stack+0x4f/0x7c
       [<ffffffff8104732c>] warn_slowpath_common+0x8c/0xc0
       [<ffffffff8104737a>] warn_slowpath_null+0x1a/0x20
       [<ffffffff8110fb3d>] perf_swevent_add+0x18d/0x1a0
       [<ffffffff811162ae>] event_sched_in.isra.75+0x9e/0x1f0
       [<ffffffff8111646a>] group_sched_in+0x6a/0x1f0
       [<ffffffff81083dd5>] ? sched_clock_local+0x25/0xa0
       [<ffffffff811167e6>] ctx_sched_in+0x1f6/0x450
       [<ffffffff8111757b>] perf_event_sched_in+0x6b/0xa0
       [<ffffffff81117a4b>] perf_event_context_sched_in+0x7b/0xc0
       [<ffffffff81117ece>] __perf_event_task_sched_in+0x43e/0x460
       [<ffffffff81096f1e>] ? put_lock_stats.isra.18+0xe/0x30
       [<ffffffff8107b3c8>] finish_task_switch+0xb8/0x100
       [<ffffffff8166a7de>] __schedule+0x30e/0xad0
       [<ffffffff81172dd2>] ? pipe_read+0x3e2/0x560
       [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
       [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
       [<ffffffff8166b464>] preempt_schedule_irq+0x44/0x70
       [<ffffffff816707f0>] retint_kernel+0x20/0x30
       [<ffffffff8109e60a>] ? lockdep_sys_exit+0x1a/0x90
       [<ffffffff812a4234>] lockdep_sys_exit_thunk+0x35/0x67
       [<ffffffff81679321>] ? sysret_check+0x5/0x56

    Fixing this by tracking the cpu hotplug state and displaying
    the WARN only if current cpu is initialized properly.

    Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1396861448-10097-1-git-send-email-jolsa@redhat.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4e0d105c09b8bec501ff5455b774bf3a845d017c
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Sun Apr 13 09:34:53 2014 -0400

    sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check

    commit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream.

    The check at the beginning of cpupri_find() makes sure that the task_pri
    variable does not exceed the cp->pri_to_cpu array length. But that length
    is CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two
    priorities in that array.

    As task_pri is computed from convert_prio() which should never be bigger
    than CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is
    hit.

    Reported-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1397015410.5212.13.camel@marge.simpson.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 627ba95aff0a053f1338765e8f4b13301d1b9193
Merge: 0ce3c7d cc0d4b7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 11 04:12:57 2014 -0700

    Merge "Merge "ping: prevent NULL pointer dereference on write to msg_name""

commit 72e4b3a44782b123ec7b43bc72d09d55a7df1614
Merge: 4d19c09 ada6c1c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 11 01:08:33 2014 -0700

    Merge "ping: prevent NULL pointer dereference on write to msg_name"

commit cc0d4b7eac3aa066f1416c4e0656af76851c84e0
Merge: 030df42 bfe5eb6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 10 22:34:29 2014 -0700

    Merge "ping: prevent NULL pointer dereference on write to msg_name"

commit ada6c1c73f6cf77fc98d4c8c3eab956418c02f28
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Mon May 19 14:16:47 2014 -0700

    ping: prevent NULL pointer dereference on write to msg_name

    A plain read() on a socket does set msg->msg_name to NULL. So check for
    NULL pointer first.

    Change-Id: I3773934fb633157ce5011d2f10900b7caef73733
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Git-commit: cf970c002d270c36202bd5b9c2804d3097a52da0
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

commit c52c4e39053621d82e6b7ad8aadfd7bea2eb6eff
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Jun 10 21:13:32 2014 -0400

    sensors: update from latest source drop

    Change-Id: Ibcab74240782f82dfa2b6976c7ccaa34f68f1590

commit a428810d76b9066450fc53d0f6120ccc6881cab6
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Jun 10 21:06:46 2014 -0400

    secjack: update driver

    Change-Id: I30a2e5f0b5c416f600879a589362ddeca24038d4

commit ed7299fe8d8640cffb7b6522c1ebbab29d2cb645
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Jun 10 20:50:25 2014 -0400

    update defconfigs

    CONFIG_INPUT_GPIO is required for the new Samsung sec_jack driver
    Google recommends 32768 for CONFIG_LSM_MMAP_MIN_ADDR

    Change-Id: I1f321b317bbf114c86b4ee267ae564c01700dfc1

commit 80087f349ad98d2ba24a5b479309f1f2dc031433
Author: Tom Tartaro <tomtartaro@gmail.com>
Date:   Fri Mar 28 23:14:48 2014 -0700

    Fixes for GCC error on panel
    These four changes fix some compilation warnings. Cutting down is always nice.

    As requested by Nard :)

    Change-Id: Ia74c2569be1d73d2e99ba4884ae79e67a5ab40ae

commit 7e20a2e88a6797e739d2b1ec9657ee50972bdac6
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Tue Jun 10 16:50:01 2014 -0500

    net: ipv6: Amend ipv6_recv_error usage

    Usage of ipv6_recv_error, included in commit f704820, needs to be
    updated to account for the changes in ad25b5d.

    Fixes:
      net/ipv6/ping.c: In function 'pingv6_init':
      net/ipv6/ping.c:84:29: warning: assignment from incompatible pointer type [enabled by default]

    Change-Id: Ia77db6e465072fb794999a20f75f59e848a88b79
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit e7aac60bb41257f6a4e57d43e4a7a7195b34c771
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Tue Jun 10 15:37:05 2014 -0500

    msm: board-m2: Update sec battery configuration

    Use commonized variables based on KK source drop.
    A lot of this was done in previous kernel releases, though the
    sec_bat values were only commonized (based on att, it seems) in
    the latest release.

    Change-Id: Icadb65af12cd86d9351c9b4e71a98d7097d0cd03
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 4d19c094071a6bc61b3d1f0c9b152258757c17d0
Merge: 17aeb03 ca86996
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 10 16:34:34 2014 -0700

    Merge "SELinux: Fix kernel BUG on empty security contexts."

commit 030df42571d93e75d739d457a6d05df3d83ff7d3
Merge: 9f2a1f5 d9024f0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Jun 10 08:33:16 2014 -0700

    Merge "msm: kgsl: Cleanup the memory free list"

commit bfe5eb6ad4fe028266e24c67cddec406d1c0e413
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Mon May 19 14:16:47 2014 -0700

    ping: prevent NULL pointer dereference on write to msg_name

    A plain read() on a socket does set msg->msg_name to NULL. So check for
    NULL pointer first.

    Change-Id: I3773934fb633157ce5011d2f10900b7caef73733
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Git-commit: cf970c002d270c36202bd5b9c2804d3097a52da0
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

commit 7539e8423b8ccc8f53dcf55a1159a808b4dcd170
Author: Josh Cartwright <joshc@codeaurora.org>
Date:   Thu Apr 3 14:50:14 2014 -0700

    rtc: pm8xxx: move device_init_wakeup() before rtc_register

    Setup wakeup capability before rtc_register to ensure the rtc class core
    properly sets up our 'wakealarm' sysfs attribute.

    Signed-off-by: Josh Cartwright <joshc@codeaurora.org>
    Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit fd08aa50d3490abf577f7647f842a169cf0010d5
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jun 8 17:42:53 2014 -0400

    d2: set to default interactive

    We're setting this in userspace anyway

    Change-Id: I80fafdd0c24219312d0961abc83c7b09a5322e3e

commit 1122e452e4d488b424ae552a47cfea50b9e259de
Author: Saket Saurabh <ssaurabh@codeaurora.org>
Date:   Thu Feb 20 13:00:02 2014 +0530

    usb: Avoid incorrect memory leaks reported by kmemleak tool.

    Certain memory allocations are not properly tracked by the kmemleak
    tool, which causes it to incorrectly detect memory leaks. Notify the
    tool by using kmemleak_not_leak() to ignore the memory allocation
    so that incorrect leak reports are avoided.

    CRs-Fixed: 612944
    Change-Id: Ia15d94bb140f415a25d5b7e6996d3b985f33b28b
    Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>

commit e5a0d046f40676b33690b3cdf0d481aa1187894b
Author: Dave Daynard <nardholio@gmail.com>
Date:   Fri May 2 17:15:02 2014 -0400

    Remove extra defconfigs

    Conflicts:
    	arch/arm/configs/at91sam9g45_defconfig
    	arch/arm/configs/fsm9xxx-perf_defconfig
    	arch/arm/configs/mxs_defconfig

    Change-Id: Icc58de766d712fc9607a682f1fb0681c563a8c0d

commit 41c0a822f92658c01dbfdc8bc288bc742cdbfeb9
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Mon Mar 18 21:50:47 2013 -0700

    msm: acpuclock-krait: Enable HFPLL for init only if switching to it

    The existing code left the HFPLL enabled in hfpll_init(), even if
    the CPU was detected to be at a non-HFPLL rate. Correct this for
    power savings between when hfpll_init() and the first runtime CPU
    frequency switch happen. This also ensure votes for HFPLL
    regulators are not left unnecessarily asserted.

    Change-Id: Iaca5dc7e4769bdbd494d669726ba9b500256f793
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit b7b50f3e3bbdfeb24fae7cd351157b238c7bf305
Author: Arik Nemtsov <arik@wizery.com>
Date:   Sun Jul 21 16:36:48 2013 +0300

    regulatory: use correct regulatory initiator on wiphy register

    The current regdomain was not always set by the core. This causes
    cards with a custom regulatory domain to ignore user initiated changes
    if done before the card was registered.

    Signed-off-by: Arik Nemtsov <arik@wizery.com>
    Acked-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Git-commit: 23df0b731954502a9391e739b92927cee4360343
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    CRs-Fixed: 569424
    Change-Id: Ia5462145a27f5ecdd7a1eb9f4235992f7a801097
    [smihir@codeaurora.org: changes to merge cleanly in older kernel]
    Signed-off-by: Mihir Shete <smihir@codeaurora.org>

commit 2a05738a958c18843e4ff00dcb5d14d6bc0fd8b4
Author: Andrew Ruder <andrew.ruder@elecsyscorp.com>
Date:   Thu Jan 30 09:26:54 2014 -0600

    fs/super.c: sync ro remount after blocking writers

    Move sync_filesystem() after sb_prepare_remount_readonly().  If writers
    sneak in anywhere from sync_filesystem() to sb_prepare_remount_readonly()
    it can cause inodes to be dirtied and writeback to occur well after
    sys_mount() has completely successfully.

    This was spotted by corrupted ubifs filesystems on reboot, but appears
    that it can cause issues with any filesystem using writeback.

    CRs-Fixed: 627559
    Change-Id: Ib417b59d39210aab2de4e5ae48b18129e8bc3e26
    Cc: Artem Bityutskiy <dedekind1@gmail.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    CC: Richard Weinberger <richard@nod.at>
    Co-authored-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Andrew Ruder <andrew.ruder@elecsyscorp.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Git-commit: 807612db2f9940b9fa6deaef054eb16d51bd3e00
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>

commit 07cd46bb00e6d58cc477a43911ee7697f5917475
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Mar 30 23:11:34 2012 +0800

    genirq: Introduce irq_do_set_affinity() to reduce duplicated code

    All invocations of chip->irq_set_affinity() are doing the same return
    value checks. Let them all use a common function.

    [ tglx: removed the silly likely while at it ]

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Cc: Jiang Liu <liuj97@gmail.com>
    Cc: Keping Chen <chenkeping@huawei.com>
    Link: http://lkml.kernel.org/r/1333120296-13563-3-git-send-email-jiang.liu@huawei.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit ed7ed4d4016a21f4b958acf61d9a9fce6cbc7bbb
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Fri Apr 4 19:53:30 2014 -0700

    ARM: Don't dump vmalloc addresses with show_data()

    Memory-mapped IO address spaces cannot be safely dumped at will.
    Some addresses may not be available (clocked, powered) at all times,
    and may result in hangs or bus decode errors if accessed. Other
    registers that are accessible may have read side-effects, and dumping
    them may have adverse affects on stability or the functionality of
    the affected peripheral.

    Be safe, and skip dumping such addresses altogether.

    CRs-Fixed: 625442
    Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
    Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>

commit 5f58d927214bed3223e30d9ef45ebfed5d1e7931
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Tue Apr 22 20:01:50 2014 -0700

    ARM: Improve vmalloc address checking in show_data()

    There is an unhandled corner case with the current check
    which has recently been hit. The nbytes argument may be
    large enough for the range being dumped to cross a
    boundary between page-table mappings, and dump addresses
    which are vmalloc'd in the neighboring mapping.

    Check every address being dumped to see if its vmalloc'd,
    not just the address passed to show_data().

    CRs-Fixed: 625442
    Change-Id: I255b093808177321f5202dcacea337ee333bfc63
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit b5cb537a2a05ca4e2786cc6dcc2f2bcb78d5ffe2
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Wed Apr 23 17:14:47 2014 -0700

    iopoll: Use ktime_get() instead of jiffies for timeout calculations

    Presently, small timeout values will round up to 1 jiffy which,
    on CONFIG_HZ=100 systems, corresponds to a full 10 milliseconds.
    This is undesirable for drivers specifying timeouts of only a
    few 10's of microseconds (which is common), since they may end
    up tight-loop spinning for hundreds or thousands of times longer
    than expected before reporting a timeout.

    Additionally, jiffies cannot be reliably used with time_after()
    when the value of jiffies is small (like 1). In rare but real
    scenarios, jiffies may actually increment by more than 1 at a
    time. Specifically, this will occur if interrupts are disabled
    on for more than 1 jiffy (10 milliseconds for CONFIG_HZ=100) on
    the CPU responsible for incrementing jiffies.

    If interrupts are re-enabled on that CPU between the time the
    iopoll code (on another CPU) calculates the timeout value of
    jiffies and when the time_after() comparison is made, then the
    iopoll APIs may return -ETIMEDOUT prematurely, even though the
    specified timeout has not actually expired.

    Using ktime_get() avoid this problem (which arguably also needs
    a generic fix to avoid similar problems for other code which use
    jiffies to calculate timeouts).

    CRs-Fixed: 587801
    Change-Id: I19150f41965b918c59c3fb98e29a8bd2e2c9609f
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 8b8808352917055df47263ab9c6d8428303c0f0d
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Wed Apr 17 16:19:38 2013 -0700

    iopoll: Make readl_poll_timeout() and friends preemption-safe

    With the previous implementation, pre-emption was possible
    between reading the register value and evaluating the break
    condition for the timeout. If jiffies advanced sufficiently to
    expire the timeout before the polling thread was rescheduled,
    the macro would return -ETIMEDOUT incorrectly.

    Fix this by re-reading the register value again after evaluating
    the timeout condition as true.

    Change-Id: I58a42798235db3606373a2f689f7d6c95475702e
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 78fde7f7c6879ff8f2a0f60272fdd4928410428c
Author: Daniel Borkmann <dxchgb@gmail.com>
Date:   Sun Oct 28 08:27:19 2012 +0000

    pktgen: clean up ktime_t helpers

    Some years ago, the ktime_t helper functions ktime_now() and ktime_lt()
    have been introduced. Instead of defining them inside pktgen.c, they
    should either use ktime_t library functions or, if not available, they
    should be defined in ktime.h, so that also others can benefit from them.
    ktime_compare() is introduced with a similar notion as in timespec_compare().

    Change-Id: I3d092b737d46cf2368baf4101c852fe9a4db510f
    Signed-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Stephen Hemminger <shemminger@vyatta.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Acked-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 20dd089d6508883b15a069ee59d70865420172c8
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Mon May 13 21:40:27 2013 +0200

    tick: Upstream fixes

     * Addresses the issue of timers being scheduled on offline CPUs.

    tick: Don't invoke tick_nohz_stop_sched_tick() if the cpu is offline

    commit 5b39939a4 (nohz: Move ts->idle_calls incrementation into strict
    idle logic) moved code out of tick_nohz_stop_sched_tick() and missed
    to bail out when the cpu is offline. That's causing subsequent
    failures as an offline CPU is supposed to die and not to fiddle with
    nohz magic.

    Return false in can_stop_idle_tick() if the cpu is offline.

    Reported-and-tested-by: Jiri Kosina <jkosina@suse.cz>
    Reported-and-tested-by: Prarit Bhargava <prarit@redhat.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: x86@kernel.org
    Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1305132138160.2863@ionos
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

    timers: Consolidate base->next_timer update

    Another bunch of mindlessly copied code. All callers of
    internal_add_timer() except the recascading code updates
    base->next_timer.

    Move this into internal_add_timer() and let the cascading code call
    __internal_add_timer().

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Gilad Ben-Yossef <gilad@benyossef.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Link: http://lkml.kernel.org/r/20120525214819.189946224@linutronix.de

    timers: Create detach_if_pending() and use it

    Most callers of detach_timer() have the same pattern around
    them. Check whether the timer is pending and eventually updating
    base->next_timer.

    Create detach_if_pending() and replace the duplicated code.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Gilad Ben-Yossef <gilad@benyossef.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Link: http://lkml.kernel.org/r/20120525214819.131246037@linutronix.de

    timers: Add accounting of non deferrable timers

    The code in get_next_timer_interrupt() is suboptimal as it has to run
    through the cascade to find the next expiring timer. On a completely
    idle core we should only do that when there is an active timer
    enqueued and base->next_timer does not give us a fast answer.

    Add accounting of the active timers to the now consolidated
    attach/detach code. I deliberately avoided sanity checks because the
    code is fully symetric and any fiddling with timers w/o using the API
    functions will lead to cute explosions anyway. ulong is big enough
    even on 32bit and if we really run into the situation to have more
    than 1<<32 timers enqueued there, then we are definitely not in a
    state to go idle and run through that code.

    This allows us to fix another shortcoming of get_next_timer_interrupt().

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Gilad Ben-Yossef <gilad@benyossef.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Link: http://lkml.kernel.org/r/20120525214819.236377028@linutronix.de

    timers: Improve get_next_timer_interrupt()

    Gilad reported at

     http://lkml.kernel.org/r/1336056962-10465-2-git-send-email-gilad@benyossef.com

    "Current timer code fails to correctly return a value meaning that
     there is no future timer event, with the result that the timer keeps
     getting re-armed in HZ one shot mode even when we could turn it off,
     generating unneeded interrupts.

     What is happening is that when __next_timer_interrupt() wishes
     to return a value that signifies "there is no future timer
     event", it returns (base->timer_jiffies + NEXT_TIMER_MAX_DELTA).

     However, the code in tick_nohz_stop_sched_tick(), which called
     __next_timer_interrupt() via get_next_timer_interrupt(),
     compares the return value to (last_jiffies + NEXT_TIMER_MAX_DELTA)
     to see if the timer needs to be re-armed.

     base->timer_jiffies != last_jiffies and so tick_nohz_stop_sched_tick()
     interperts the return value as indication that there is a distant
     future event 12 days from now and programs the timer to fire next
     after KTIME_MAX nsecs instead of avoiding to arm it. This ends up
     causing a needless interrupt once every KTIME_MAX nsecs."

    Fix this by using the new active timer accounting. This avoids scans
    when no active timer is enqueued completely, so we don't have to rely
    on base->timer_next and base->timer_jiffies anymore.

    Change-Id: I874ee5e5f837a228cebf5e6a084baf520d33cd0f
    Reported-by: Gilad Ben-Yossef <gilad@benyossef.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Link: http://lkml.kernel.org/r/20120525214819.317535385@linutronix.de

commit d179643fc330bb2b96bfb02d250c4f666541ed3f
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Jun 7 21:07:13 2014 -0400

    fs: exfat: update to 1.2.7 from ND8 release

    Change-Id: Ib01801bbbd62f88704545f8f33ee74bc2628411a

commit 446c70b69fbc80dcefec6fd50462a6f93e5aa387
Author: Stephen Smalley <sds@tycho.nsa.gov>
Date:   Tue Apr 29 11:29:04 2014 -0700

    selinux: Report permissive mode in avc: denied messages.

    We cannot presently tell from an avc: denied message whether access was in
    fact denied or was allowed due to global or per-domain permissive mode.
    Add a permissive= field to the avc message to reflect this information.

    Change-Id: I23adf43e417687f1da7354d392d37f5fabbd805e
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

commit 278649bd4c38faf4ad0874ed00dca5a1baa24a5d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jun 5 18:27:31 2014 -0400

    msm8960: update wifi and storage boardfiles from sprint NB8

    Change-Id: I30ccad5011252a5638d70d68c322e38a22eda6fa

    Conflicts:
    	arch/arm/mach-msm/board-8960-storage.c

commit a00035fbc05f42d525f2a7862ad29c3a45e605ff
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Fri May 9 08:28:32 2014 -0500

    bcmdhd: update to 1.141.44 from sprint ND8 source

    Change-Id: Ie87df94d96f99d696ceb80328a993e9aac04ade8

commit ab5dee10488dfe2b2c97a171c679f2d596f17e0c
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jun 5 06:09:13 2014 -0400

    Import Samsung audio changes from ND8 release

    There were others, but these are the only ones that looked interesting

    Change-Id: Ifa0eb6c1b6cc6f2be60c2f01c932fdcf89ef830b

commit 2da1d4d52f6516bf3d66f3947cfd6a3beed0e8f6
Author: Devin Kim <dojip.kim@lge.com>
Date:   Thu Jan 9 16:49:38 2014 -0800

    seq_file: always update file->f_pos in seq_lseek()

    This issue was first pointed out by Jiaxing Wang several months ago, but no
    further comments:
    https://lkml.org/lkml/2013/6/29/41

    As we know pread() does not change f_pos, so after pread(), file->f_pos
    and m->read_pos become different. And seq_lseek() does not update file->f_pos
    if offset equals to m->read_pos, so after pread() and seq_lseek()(lseek to
    m->read_pos), then a subsequent read may read from a wrong position, the
    following program produces the problem:

        char str1[32] = { 0 };
        char str2[32] = { 0 };
        int poffset = 10;
        int count = 20;

        /*open any seq file*/
        int fd = open("/proc/modules", O_RDONLY);

        pread(fd, str1, count, poffset);
        printf("pread:%s\n", str1);

        /*seek to where m->read_pos is*/
        lseek(fd, poffset+count, SEEK_SET);

        /*supposed to read from poffset+count, but this read from position 0*/
        read(fd, str2, count);
        printf("read:%s\n", str2);

    out put:
    pread:
     ck_netbios_ns 12665
    read:
     nf_conntrack_netbios

    /proc/modules:
    nf_conntrack_netbios_ns 12665 0 - Live 0xffffffffa038b000
    nf_conntrack_broadcast 12589 1 nf_conntrack_netbios_ns, Live 0xffffffffa0386000

    So we always update file->f_pos to offset in seq_lseek() to fix this issue.

    cherry-picked from https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=05e16745c0c471bba313961b605b6da3b21a853d

    Signed-off-by: Jiaxing Wang <hello.wjx@gmail.com>
    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

    Conflicts:
    	fs/seq_file.c

    Change-Id: If419b92498e2c3e08669a4342e9b9ebf99ad3768
    Signed-off-by: Devin Kim <dojip.kim@lge.com>

commit 72763fb2225cf7c9efaee64bdb129fbd78d0866f
Author: Devin Kim <dojip.kim@lge.com>
Date:   Thu Jan 9 16:50:14 2014 -0800

    seq_file: always clear m->count when we free m->buf

    Once we'd freed m->buf, m->count should become zero - we have no valid
    contents reachable via m->buf.

    cherry-picked from
    https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/seq_file.c?id=801a76050bcf8d4e500eb8d048ff6265f37a61c8

    Change-Id: I4c1d3e69db4ecf5362e2a5d05bfd7db754dc6dc6
    Reported-by: Charley (Hao Chuan) Chu <charley.chu@broadcom.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Devin Kim <dojip.kim@lge.com>

    Conflicts:
    	fs/seq_file.c

commit ad5458c6d7010c9f7b017b45a7802fb1f3e71203
Author: Devin Kim <dojip.kim@lge.com>
Date:   Wed Jan 8 12:57:37 2014 -0800

    fs/dcache.c: Fix the too small buffer for dname

    temp[64] is used for internal temporary buffer in dynamic_dname().
    This is for dname. But It's too small. dname's size may be > 64.
    In that case, it returns as -ENAMETOOLONG. So Increase the buffer size
    to 256 for avoiding this issue.

    The following was caused by the small buffer.
    WARNING: at /kernel/mm/page_alloc.c:2470 __alloc_pages_nodemask+0x24c/0x938()
    CPU: 2 PID: 505 Comm: android.bg Not tainted 3.10.0-g2f73780-00003-g2ff41d9-dirty #13
    [<c010ba3c>] (unwind_backtrace+0x0/0x11c) from [<c0109cac>] (show_stack+0x10/0x14)
    [<c0109cac>] (show_stack+0x10/0x14) from [<c01939a0>] (warn_slowpath_common+0x48/0x68)
    [<c01939a0>] (warn_slowpath_common+0x48/0x68) from [<c0193a7c>] (warn_slowpath_null+0x18/0x20)
    [<c0193a7c>] (warn_slowpath_null+0x18/0x20) from [<c0222454>] (__alloc_pages_nodemask+0x24c/0x938)
    [<c0222454>] (__alloc_pages_nodemask+0x24c/0x938) from [<c0222b50>] (__get_free_pages+0x10/0x24)
    [<c0222b50>] (__get_free_pages+0x10/0x24) from [<c024faf8>] (kmalloc_order_trace+0x24/0xf0)
    [<c024faf8>] (kmalloc_order_trace+0x24/0xf0) from [<c024fe20>] (__kmalloc+0x30/0x244)
    [<c024fe20>] (__kmalloc+0x30/0x244) from [<c02723c8>] (seq_read+0x270/0x464)
    [<c02723c8>] (seq_read+0x270/0x464) from [<c0256a18>] (vfs_read+0xa4/0x134)
    [<c0256a18>] (vfs_read+0xa4/0x134) from [<c0256de8>] (SyS_read+0x38/0x68)
    [<c0256de8>] (SyS_read+0x38/0x68) from [<c0106140>] (ret_fast_syscall+0x0/0x30)

    Change-Id: I74f5217ba3c4be73e91f33f900f1f0c26810cc05
    Signed-off-by: Devin Kim <dojip.kim@lge.com>

commit da5dd21e9893ff4ab38553fd48c36db885434037
Author: JP Abgrall <jpa@google.com>
Date:   Thu Jan 16 11:11:02 2014 -0800

    android: configs: Grab the android/configs from kernel/common

    This is a squash of all changes from kernel/common android-3.4 up to
      5e35d66 android: configs: add IPV6 ROUTE INFO

    Change-Id: I848f1865ec7da1dfc3338a3e9d7f944a6f00f2a6
    Signed-off-by: JP Abgrall <jpa@google.com>

commit ae39cb35711b62e6ce5e43ff0ddc3e869d008b1d
Author: Naseer Ahmed <naseer@codeaurora.org>
Date:   Wed Jul 17 01:46:38 2013 -0400

    msm: mdp: Free secure memory based on pipe config

    When there is no secure pipe configured, we can unmap secure
    memory instead of relying on unset with secure flag set from
    userspace.

    Bug: 11857675

    Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>

    Conflicts:
    	drivers/video/msm/mdp4_overlay.c

    Change-Id: Ie59ed14b31771c0c9a4ab9623f6d2a20b1147435

commit 1b46f3f71045c04504057754cc15f374ced08b42
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Jun 5 20:41:53 2014 -0400

    Revert "msm: display: clear sec_active when the pipe is not for secure"

    This reverts commit ee1390591f8283e642da6aae38a8d4ab32dbe401.

commit cf18935fa3e90a1684ae6d0e22b859dfe4aa00f9
Merge: a2a8d7d 3eb8c3a
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 9 20:10:48 2014 +0000

    Merge "drivers: usb: Use Android device as USB keyboard/mouse" into cm-11.0

commit a2a8d7d5c5cf5c8d44100dd042e44a7053f2e5fb
Merge: 9e427eb cd5e275
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Jun 9 20:10:24 2014 +0000

    Merge changes I08bbbdd4,I00d90ce3 into cm-11.0

    * changes:
      kswapd: Introduce congestion_wait_kswapd
      usb: otg:  Retry putting the OTG PHY in low power mode.

commit d9024f0ce0ff1f87b4fa190e92101c8409763ddb
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Tue Jun 3 16:00:11 2014 -0600

    msm: kgsl: Cleanup the memory free list

    Tighten up the memory free list code and remove the memory unused
    debugfs file.  Outside of the cleanup the functional changes are
    a) move the mutex to a spinlock for speed, and b) only return the
    last entry in the list for given pid/gpu address combination.

    Conflicts:
    	drivers/gpu/msm/kgsl.c
    	drivers/gpu/msm/kgsl.h
    	drivers/gpu/msm/kgsl_debugfs.c
    	drivers/gpu/msm/kgsl_iommu.c

    Change-Id: Ic0dedbad9595302e2b42de2807fa82c425d1717f
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>

commit 9f2a1f57b7a47e92eba25f33774749a5d949ab70
Merge: 7500f68 4b381ff
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:39 2014 -0700

    Merge "sched: Set MC (multi-core) sched domain's busy_factor attribute to 1"

commit 7500f6844bde5c3c0cf634df7853c81a3b75fefe
Merge: 1142e9d e15e5c0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:38 2014 -0700

    Merge "ARM: 7643/1: sched: correct update_sched_clock()"

commit 1142e9db53bfc05b3b775891e63a3ddcbe6df5bf
Merge: 20dda48 02e6ae5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:37 2014 -0700

    Merge "ARM: 7565/1: sched: stop sched_clock() during suspend"

commit 20dda486651e3036b56bdbf991a6ba43f3aaaa93
Merge: 71be151 2abe435
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:37 2014 -0700

    Merge "ARM: 7486/1: sched_clock: update epoch_cyc on resume"

commit 71be1512f03f591559066ca74abb6c5f412731ae
Merge: b199609 dd30210
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:36 2014 -0700

    Merge "sched: Make sure to not re-read variables after validation"

commit b19960980d756ab91df681e197ce17a919d5e3a1
Merge: 77874d3 a244161
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:35 2014 -0700

    Merge "sched: re-calculate a cpu's next_balance point upon sched domain changes"

commit 77874d36f3e9a0c69c980290d51a436398d3bcda
Merge: bb17c85 1d856ea
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Jun 8 23:25:34 2014 -0700

    Merge "sched: Reset rq->next_interval before going idle"

commit 9e427eb95e6df1b864a8b0b86b6ba07527690a40
Merge: ef7a7b3 22feaed
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Sat Jun 7 20:03:46 2014 -0500

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	fs/ecryptfs/keystore.c
    	kernel/futex.c

    Change-Id: I1bcff1eb1f120c60ca1f6d2dcab273bb8913d2cd

commit 22feaed11f1b0c58aab5df196c0bf011e7095a62
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Jun 7 16:02:54 2014 -0700

    Linux 3.4.92

commit 11b9a7a786232e811cbe988543cb83b5ff1a829c
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:08 2014 +0000

    futex: Make lookup_pi_state more robust

    commit 54a217887a7b658e2650c3feff22756ab80c7339 upstream.

    The current implementation of lookup_pi_state has ambigous handling of
    the TID value 0 in the user space futex.  We can get into the kernel
    even if the TID value is 0, because either there is a stale waiters bit
    or the owner died bit is set or we are called from the requeue_pi path
    or from user space just for fun.

    The current code avoids an explicit sanity check for pid = 0 in case
    that kernel internal state (waiters) are found for the user space
    address.  This can lead to state leakage and worse under some
    circumstances.

    Handle the cases explicit:

           Waiter | pi_state | pi->owner | uTID      | uODIED | ?

      [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
      [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

      [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

      [4]  Found  | Found    | NULL      | 0         | 1      | Valid
      [5]  Found  | Found    | NULL      | >0        | 1      | Invalid

      [6]  Found  | Found    | task      | 0         | 1      | Valid

      [7]  Found  | Found    | NULL      | Any       | 0      | Invalid

      [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
      [9]  Found  | Found    | task      | 0         | 0      | Invalid
      [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

     [1] Indicates that the kernel can acquire the futex atomically. We
         came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

     [2] Valid, if TID does not belong to a kernel thread. If no matching
         thread is found then it indicates that the owner TID has died.

     [3] Invalid. The waiter is queued on a non PI futex

     [4] Valid state after exit_robust_list(), which sets the user space
         value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

     [5] The user space value got manipulated between exit_robust_list()
         and exit_pi_state_list()

     [6] Valid state after exit_pi_state_list() which sets the new owner in
         the pi_state but cannot access the user space value.

     [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.

     [8] Owner and user space value match

     [9] There is no transient state which sets the user space TID to 0
         except exit_robust_list(), but this is indicated by the
         FUTEX_OWNER_DIED bit. See [4]

    [10] There is no transient state which leaves owner and user space
         TID out of sync.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Cc: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a8f96abb1a78f16c498cb1e03386cc1a7b55a28c
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:07 2014 +0000

    futex: Always cleanup owner tid in unlock_pi

    commit 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e upstream.

    If the owner died bit is set at futex_unlock_pi, we currently do not
    cleanup the user space futex.  So the owner TID of the current owner
    (the unlocker) persists.  That's observable inconsistant state,
    especially when the ownership of the pi state got transferred.

    Clean it up unconditionally.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Cc: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2397889b03ef0f394e176b86ba37c421a01a9c89
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex: Validate atomic acquisition in futex_lock_pi_atomic()

    commit b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 upstream.

    We need to protect the atomic acquisition in the kernel against rogue
    user space which sets the user space futex to 0, so the kernel side
    acquisition succeeds while there is existing state in the kernel
    associated to the real owner.

    Verify whether the futex has waiters associated with kernel state.  If
    it has, return -EINVAL.  The state is corrupted already, so no point in
    cleaning it up.  Subsequent calls will fail as well.  Not our problem.

    [ tglx: Use futex_top_waiter() and explain why we do not need to try
      	restoring the already corrupted user space state. ]

    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4cca4db7bd5fb663660da34a3514d9fa8f5f14f3
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

    commit e9c243a5a6de0be8e584c604d353412584b592f8 upstream.

    If uaddr == uaddr2, then we have broken the rule of only requeueing from
    a non-pi futex to a pi futex with this call.  If we attempt this, then
    dangling pointers may be left for rt_waiter resulting in an exploitable
    condition.

    This change brings futex_requeue() in line with futex_wait_requeue_pi()
    which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
    uaddr == uaddr2 in futex_wait_requeue_pi()")

    [ tglx: Compare the resulting keys as well, as uaddrs might be
      	different depending on the mapping ]

    Fixes CVE-2014-3153.

    Reported-by: Pinkie Pie
    Signed-off-by: Will Drewry <wad@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reviewed-by: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c6f9d698ffd5cfbb941177bec02b43542c748d77
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Wed Feb 19 13:15:17 2014 +0100

    ath9k: protect tid->sched check

    commit 21f8aaee0c62708654988ce092838aa7df4d25d8 upstream.

    We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
    is race condition which can result of doing list_del(&tid->list) twice
    (second time with poisoned list node) and cause crash like shown below:

    [424271.637220] BUG: unable to handle kernel paging request at 00100104
    [424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
    ...
    [424271.639953] Call Trace:
    [424271.639998]  [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k]
    [424271.640083]  [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k]
    [424271.640177]  [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211]
    [424271.640258]  [<c10f730e>] ? free_compound_page+0x2e/0x40
    [424271.640346]  [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
    [424271.640437]  [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0
    [424271.640510]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
    [424271.640578]  [<c10fc23c>] ? put_page+0x2c/0x40
    [424271.640640]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
    [424271.640706]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
    [424271.640787]  [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
    [424271.640897]  [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
    [424271.641009]  [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
    [424271.641104]  [<c13846ce>] ? ip_output+0x7e/0xd0
    [424271.641182]  [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211]
    [424271.641266]  [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k]
    [424271.641358]  [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
    [424271.641445]  [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k]

    Bug report:
    https://bugzilla.kernel.org/show_bug.cgi?id=70551

    Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Use spin_unlock_bh() directly]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [gkh: backported to 3.4:
     - adjust context
     - back out bwh's spinlock change]
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a592e24417be6e6f7e31d89e1e88c1c5999771bd
Author: Alan Cox <alan@linux.intel.com>
Date:   Tue Sep 4 15:10:08 2012 +0100

    dj: memory scribble in logi_dj

    commit 8a55ade76551e3927b4e41ee9e7751875d18bc25 upstream.

    Allocate a structure not a pointer to it !

    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Cc: Marc Dionne <marc.c.dionne@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 761dae91fdfa90c58254f9367ff05a37281855c3
Author: Marc Dionne <marc.c.dionne@gmail.com>
Date:   Fri Jun 1 18:12:14 2012 -0400

    HID: logitech: don't use stack based dj_report structures

    commit d8dc3494f77a5cc3b274bae36f7e74e85cf8a407 upstream.

    On a system with a logitech wireless keyboard/mouse and DMA-API debugging
    enabled, this warning appears at boot:

    kernel: WARNING: at lib/dma-debug.c:929 check_for_stack.part.12+0x70/0xa7()
    kernel: Hardware name: MS-7593
    kernel: uhci_hcd 0000:00:1d.1: DMA-API: device driver maps memory fromstack [addr=ffff8801b0079c29]

    Make logi_dj_recv_query_paired_devices and logi_dj_recv_switch_to_dj_mode
    use a structure allocated with kzalloc rather than a stack based one.

    Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 359c6340faa39167666c0e9b9f44ad54a521c409
Author: Joe Lawrence <joe.lawrence@stratus.com>
Date:   Tue Jan 15 15:31:28 2013 -0500

    PCI/ASPM: Don't touch ASPM if forcibly disabled

    commit a26d5ecb3201c11e03663a8f4a7dedc0c5f85c07 upstream.

    Don't allocate and track PCIe ASPM state when "pcie_aspm=off" is specified
    on the kernel command line.

    Based-on-patch-from: Matthew Garrett <mjg59@srcf.ucam.org>
    Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: David Bulkow <david.bulkow@stratus.com>
    Acked-by: Myron Stowe <myron.stowe@redhat.com>
    [wyj: Backported to 3.4: context adjust]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6cc43d85ca1752b61135559aa35b8aebadc17252
Author: Wei Liu <wei.liu2@citrix.com>
Date:   Mon Apr 22 02:20:41 2013 +0000

    xen-netfront: reduce gso_max_size to account for max TCP header

    commit 9ecd1a75d977e2e8c48139c7d3efed183f898d94 upstream.

    The maximum packet including header that can be handled by netfront / netback
    wire format is 65535. Reduce gso_max_size accordingly.

    Drop skb and print warning when skb->len > 65535. This can 1) save the effort
    to send malformed packet to netback, 2) help spotting misconfiguration of
    netfront in the future.

    Signed-off-by: Wei Liu <wei.liu2@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b3c463e8762ce90f22efbef947094467909011ea
Author: Joe Perches <joe@perches.com>
Date:   Sun May 13 21:56:25 2012 +0000

    net: Add net_ratelimited_function and net_<level>_ratelimited macros

    commit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.

    __ratelimit() can be considered an inverted bool test because
    it returns true when not ratelimited.  Several tests in the
    kernel tree use this __ratelimit() function incorrectly.

    No net_ratelimit uses are incorrect currently though.

    Most uses of net_ratelimit are to log something via printk or
    pr_<level>.

    In order to minimize the uses of net_ratelimit, and to start
    standardizing the code style used for __ratelimit() and net_ratelimit(),
    add a net_ratelimited_function() macro and net_<level>_ratelimited()
    logging macros similar to pr_<level>_ratelimited that use the global
    net_ratelimit instead of a static per call site "struct ratelimit_state".

    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8ba2272db8bd9fd6f011949020bf1991605b1c14
Author: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Date:   Tue Nov 19 17:12:47 2013 +0100

    crypto: s390 - Fix aes-xts parameter corruption

    commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream.

    Some s390 crypto algorithms incorrectly use the crypto_tfm structure to
    store private data. As the tfm can be shared among multiple threads, this
    can result in data corruption.

    This patch fixes aes-xts by moving the xts and pcc parameter blocks from
    the tfm onto the stack (48 + 96 bytes).

    Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f7c02bf438f74ce4c7a8fb0c79cd435d85a795be
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Thu Nov 21 18:03:07 2013 +0100

    can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value

    commit 2fea6cd303c0d0cd9067da31d873b6a6d5bd75e7 upstream.

    This patch fixes the issue that the sja1000_interrupt() function may have
    returned IRQ_NONE without processing the optional pre_irq() and post_irq()
    function before. Further the irq processing counter 'n' is moved to the end of
    the while statement to return correct IRQ_[NONE|HANDLED] values at error
    conditions.

    Reported-by: Wolfgang Grandegger <wg@grandegger.com>
    Acked-by: Wolfgang Grandegger <wg@grandegger.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    [bwh: Backported to 3.2: s/SJA1000_IER/REG_IER/; s/SJA1000_IR/REG_IR/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4381872d5a41635275c291f2a7c523197ba1f5e1
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Nov 12 15:09:39 2013 -0800

    backlight: atmel-pwm-bl: fix gpio polarity in remove

    commit ad5066d4c2b1d696749f8d7816357c23b648c4d3 upstream.

    Make sure to honour gpio polarity also at remove so that the backlight is
    actually disabled on boards with active-low enable pin.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Acked-by: Jingoo Han <jg1.han@samsung.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c341968e1a44810713ade43ca8b0f5dd802a1ce9
Author: Brian Norris <computersforpeace@gmail.com>
Date:   Wed Jul 24 18:32:07 2013 -0700

    mtd: m25p80: fix allocation size

    commit 778d226a1462572b51d6777cdb1d611543410cb4 upstream.

    This patch fixes two memory errors:

    1. During a probe failure (in mtd_device_parse_register?) the command
       buffer would not be freed.

    2. The command buffer's size is determined based on the 'fast_read'
       boolean, but the assignment of fast_read is made after this
       allocation. Thus, the buffer may be allocated "too small".

    To fix the first, just switch to the devres version of kzalloc.

    To fix the second, increase MAX_CMD_SIZE unconditionally. It's not worth
    saving a byte to fiddle around with the conditions here.

    This problem was reported by Yuhang Wang a while back.

    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Reported-by: Yuhang Wang <wangyuhang2014@gmail.com>
    Reviewed-by: Sourav Poddar <sourav.poddar@ti.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63badff125489e717a320c5b725026f09256ed19
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Tue Nov 5 19:36:27 2013 +0800

    crypto: s390 - Fix aes-cbc IV corruption

    commit f262f0f5cad0c9eca61d1d383e3b67b57dcbe5ea upstream.

    The cbc-aes-s390 algorithm incorrectly places the IV in the tfm
    data structure.  As the tfm is shared between multiple threads,
    this introduces a possibility of data corruption.

    This patch fixes this by moving the parameter block containing
    the IV and key onto the stack (the block is 48 bytes long).

    The same bug exists elsewhere in the s390 crypto system and they
    will be fixed in subsequent patches.

    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40dccfb2259f13eed66993a0d9b153e0695c8504
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Tue Sep 17 11:15:43 2013 +0200

    mac80211: drop spoofed packets in ad-hoc mode

    commit 6329b8d917adc077caa60c2447385554130853a3 upstream.

    If an Ad-Hoc node receives packets with the Cell ID or its own MAC
    address as source address, it hits a WARN_ON in sta_info_insert_check()
    With many packets, this can massively spam the logs. One way that this
    can easily happen is through having Cisco APs in the area with rouge AP
    detection and countermeasures enabled.
    Such Cisco APs will regularly send fake beacons, disassoc and deauth
    packets that trigger these warnings.

    To fix this issue, drop such spoofed packets early in the rx path.

    Reported-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2: use compare_ether_addr() instead of ether_addr_equal()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 595cfbc5ae5bfaefa29b57a3f4dec04b76e108c5
Author: Marcelo Tosatti <mtosatti@redhat.com>
Date:   Thu Jun 20 18:05:56 2013 -0300

    vgacon.c: add cond reschedule points in vgacon_do_font_op

    commit 7e6d72c15ff4cc0c27573901bb05f9eddbd71ed4 upstream.

    Booting a 64-vcpu KVM guest, with CONFIG_PREEMPT_VOLUNTARY,
    can result in a soft lockup:

    BUG: soft lockup - CPU#41 stuck for 67s! [setfont:1505]
     RIP: 0010:[<ffffffff812c48da>]
    [<ffffffff812c48da>] vgacon_do_font_op.clone.0+0x1ba/0x550

    This is due to the 8192 (cmapsz) IO operations taking longer than expected
    due to lock contention in QEMU.

    Add conditional resched points in between writes allowing other tasks to
    execute.

    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    [bwh: Backported to 3.2: add #include <linux/sched.h>, already present
     upstream]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18c51452a1424cdf55ca9e6de2e4c75604272bb5
Author: Hauke Mehrtens <hauke@hauke-m.de>
Date:   Sun Jun 9 18:53:58 2013 +0200

    b43: ensue that BCMA is "y" when B43 is "y"

    commit 693026ef2e751fd94d2e6c71028e68343cc875d5 upstream.

    When b43 gets build into the kernel and it should use bcma we have to
    ensure that bcma was also build into the kernel and not as a module.
    In this patch this is also done for SSB, although you can not
    build b43 without ssb support for now.

    This fixes a build problem reported by Randy Dunlap in
    5187EB95.2060605@infradead.org

    Reported-By: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 56e9240f53e1d84b024851ab9b1dcf42ca2ff318
Author: Shane Huang <shane.huang@amd.com>
Date:   Mon Jun 3 18:24:55 2013 +0800

    i2c-piix4: Add AMD CZ SMBus device ID

    commit b996ac90f595dda271cbd858b136b45557fc1a57 upstream.

    To add AMD CZ SMBus controller device ID.

    [bhelgaas: drop pci_ids.h update]
    Signed-off-by: Shane Huang <shane.huang@amd.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Tejun Heo <tj@kernel.org>
    Reviewed-by: Jean Delvare <khali@linux-fr.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 377929f225ac24146fda8c5401553e556872a705
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu May 23 18:10:21 2013 +0200

    cfg80211: check wdev->netdev in connection work

    commit c815797663b72e3ac1736f1886538152bc48e4af upstream.

    If a P2P-Device is present and another virtual interface triggers
    the connection work, the system crash because it tries to check
    if the P2P-Device's netdev (which doesn't exist) is up. Skip any
    wdevs that have no netdev to fix this.

    Reported-by: YanBo <dreamfly281@gmail.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77dcc24b5bb3af980e88831266ed27507a788c52
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Fri May 24 15:55:33 2013 -0700

    random: fix accounting race condition with lockless irq entropy_count update

    commit 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 upstream.

    Commit 902c098a3663 ("random: use lockless techniques in the interrupt
    path") turned IRQ path from being spinlock protected into lockless
    cmpxchg-retry update.

    That commit removed r->lock serialization between crediting entropy bits
    from IRQ context and accounting when extracting entropy on userspace
    read path, but didn't turn the r->entropy_count reads/updates in
    account() to use cmpxchg as well.

    It has been observed, that under certain circumstances this leads to
    read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets
    corrupted and becomes negative, which in turn results in propagating 0
    all the way from account() to the actual read() call.

    Convert the accounting code to be the proper lockless counterpart of
    what has been partially done by 902c098a3663.

    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Cc: Theodore Ts'o <tytso@mit.edu>
    Cc: Greg KH <greg@kroah.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 06b08fa44855ef1f292ba720a74e9f8dc07f52eb
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sun Jun 2 03:34:36 2013 +0100

    rapidio/tsi721: Fix interrupt mask when handling MSI

    commit 94e0104bca7d6927e85119030b8e6e31fde88a7a upstream.

    Commit 1619f441963e 'rapidio/tsi721: fix bug in MSI interrupt
    handling' (commit 1ccc819da6fd upstream) makes the MSI handler disable
    and re-enable interrupts.  When re-enabling interrupts, we should set
    the same flags as were originally set, but this changed in Linux 3.5 so
    the flags are now inconsistent in 3.2.  In fact, the extra flag isn't
    even defined in 3.2.  Remove the extra flag from the MSI handler.

    Reported-by: Steve Conklin <steve.conklin@canonical.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 13bbf8c9ea7e22f1ddeb73d0e2e3876ae59b036d
Author: Alexandre Bounine <alexandre.bounine@idt.com>
Date:   Fri May 24 15:55:17 2013 -0700

    rapidio/tsi721: fix bug in MSI interrupt handling

    commit 1ccc819da6fda9bee10ab8b72e9adbb5ad3e4959 upstream.

    Fix bug in MSI interrupt handling which causes loss of event
    notifications.

    Typical indication of lost MSI interrupts are stalled message and
    doorbell transfers between RapidIO endpoints.  To avoid loss of MSI
    interrupts all interrupts from the device must be disabled on entering
    the interrupt handler routine and re-enabled when exiting it.
    Re-enabling device interrupts will trigger new MSI message(s) if Tsi721
    registered new events since entering interrupt handler routine.

    This patch is applicable to kernel versions starting from v3.2.

    Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
    Cc: Matt Porter <mporter@kernel.crashing.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c21fcbb1bd3e7dbf06e75dd8b02101f6d369534d
Author: Maxim Mikityanskiy <maxtram95@gmail.com>
Date:   Sat Dec 15 19:31:31 2012 +0200

    msi-wmi: Fix memory leak

    commit 51c94491c82c3d9029f6e87a1a153db321d88e35 upstream.

    Fix memory leak - don't forget to kfree ACPI object when returning from
    msi_wmi_notify() after suppressing key event.

    Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
    Acked-by: Anisse Astier <anisse@astier.eu>
    Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
    Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b74f336c5553f45e97f710808cbf7617fbcac7f
Author: Jakub Kicinski <jakub.kicinski@intel.com>
Date:   Wed Apr 3 16:50:54 2013 +0000

    ixgbe: fix registration order of driver and DCA nofitication

    commit f01fc1a82c2ee68726b400fadb156bd623b5f2f1 upstream.

    ixgbe_notify_dca cannot be called before driver registration
    because it expects driver's klist_devices to be allocated and
    initialized. While on it make sure debugfs files are removed
    when registration fails.

    Signed-off-by: Jakub Kicinski <jakub.kicinski@intel.com>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2: no debugfs support]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 676bf08007ece185cbbfba33abfdd117e803f769
Author: Laxman Dewangan <ldewangan@nvidia.com>
Date:   Fri Mar 15 05:34:08 2013 +0000

    i2c: tegra: check the clk_prepare_enable() return value

    commit 132c803f7b70b17322579f6f4f3f65cf68e55135 upstream.

    NVIDIA's Tegra SoC allows read/write of controller register only
    if controller clock is enabled. System hangs if read/write happens
    to registers without enabling clock.

    clk_prepare_enable() can be fail due to unknown reason and hence
    adding check for return value of this function. If this function
    success then only access register otherwise return to caller with
    error.

    Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
    Reviewed-by: Stephen Warren <swarren@nvidia.com>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    [bwh: Backported to 3.2:
     - Adjust context
     - Keep calling clk_enable() directly]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cc4b50e025d3b1919db247b1b451835eec31bdb7
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Sun Aug 26 23:35:17 2012 +0200

    speakup: lower default software speech rate

    commit cfd757010691eae4e17acc246f74e7622c3a2f05 upstream.

    Speech synthesis beginners need a low speech rate, and trained people
    want a high speech rate.  A medium speech rate is thus actually not a
    good default for neither.  Since trained people will typically know how
    to change the rate, better default for a low speech rate, which
    beginners can grasp and learn how to increase it afterwards

    This was agreed with users on the speakup mailing list.

    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit de1ba64669367db11718dee87e00c2cd14663e4d
Author: James Ralston <james.d.ralston@intel.com>
Date:   Thu Aug 9 09:34:20 2012 -0700

    ata_piix: Add Device IDs for Intel Lynx Point-LP PCH

    commit 389cd784969e9148fedcde0608f15bd74d6b769e upstream.

    This patch adds the IDE-mode SATA Device IDs for the Intel Lynx Point-LP PCH

    Signed-off-by: James Ralston <james.d.ralston@intel.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd33b5a46edac04bdfe51f4cba28fc11dad94a56
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Tue Feb 12 13:46:19 2013 -0800

    drivers/rtc/rtc-pl031.c: restore ST variant functionality

    commit 3399cfb5df9594495b876d1843a7165f77366b2b upstream.

    Commit e7e034e18a0a ("drivers/rtc/rtc-pl031.c: fix the missing operation
    on enable") accidentally broke the ST variants of PL031.

    The bit that is being poked as "clockwatch" enable bit for the ST
    variants does the work of bit 0 on this variant.  Bit 0 is used for a
    clock divider on the ST variants, and setting it to 1 will affect
    timekeeping in a very bad way.

    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
    Cc: Mian Yousaf KAUKAB <mian.yousaf.kaukab@stericsson.com>
    Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b38e37b0d964cb650bd814e7871ac001dec1923
Author: Maia Kozheva <sikon@ubuntu.com>
Date:   Sun Dec 9 16:07:40 2012 +0700

    rt2800usb: Add support for 2001:3c1e (D-Link DWA-125 rev B1) USB Wi-Fi adapter

    commit fd7b9270120ca7e53fbf0469febe0c68acf6a0a2 upstream.

    D-Link DWA-125/B1 is a relatively new USB Wi-Fi adapter, using a
    Ralink chipset supported by the rt2800usb driver. Currently, to work
    around the problem (it's missing in all present kernel versions,
    up to and including 3.7.x), I had to add this to /etc/rc.local:

    echo 2001 3c1e >> /sys/bus/usb/drivers/rt2800usb/new_id

    After that, the device works without problems. Been using it for over
    a week with no bugs in sight.

    The attached patch is trivial and simply adds the new USB ID to the
    list of devices handled by rt2800usb.

    Signed-off-by: Maia Kozheva <sikon@ubuntu.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 826821471984bd98a2f9c52ed4ae0fb11460b9c7
Author: Jaume Delclòs <jaume@delclos.com>
Date:   Fri Nov 2 23:35:20 2012 +0100

    Wireless: rt2x00: Add device id for Sweex LW323 to rt2800usb.c

    commit 36f318bb124b231c01db6965a009f46d5731f012 upstream.

    This patch adds detection for the Sweex LW323 USB wireless network card
    in the rt2x00 driver (just one line in rt2800usb.c).
    It applies to linux-3.7-rc3.

    Signed-off-by: Jaume Delclòs <jaume@delclos.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af69184e19a87c6f137181e3aeb84fd8934cf72b
Author: Xose Vazquez Perez <xose.vazquez@gmail.com>
Date:   Sat Apr 14 23:00:01 2012 +0200

    wireless: rt2x00: rt{2500,73}usb.c put back duplicate id

    commit 8f35f787b75e9b6435ea37dabcae2d40dc72d31c upstream.

    put back 0x050d,0x7050 to rt73usb, same usb_id for two chips:

    K7SF5D7050A ver 2xxx is rt2500
    K7SF5D7050B ver 3xxx is rt73

    <http://en-us-support.belkin.com/app/answers/detail/a_id/297/kw/K7SF5D7050>

    Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d188fc097b4c8fb907ff871651e4109196ea5c9d
Author: Haojian Zhuang <haojian.zhuang@linaro.org>
Date:   Mon Feb 4 14:28:54 2013 -0800

    drivers/rtc/rtc-pl031.c: fix the missing operation on enable

    commit e7e034e18a0ab6bafb2425c3242cac311164f4d6 upstream.

    The RTC control register should be enabled in the process of
    initializing.

    Without this patch, I failed to enable RTC in Hisilicon Hi3620 SoC.  The
    register mapping section in RTC is always read as zero.  So I doubt that
    ST guys may already enable this register in bootloader.  So they won't
    meet this issue.

    Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
    Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
    Cc: Linus Walleij <linus.walleij@linaro.org>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 309fabafdb5cf7112d1a89922ab6acbe7ea7c790
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Sun Aug 4 12:13:17 2013 -0400

    drm/radeon: always program the MC on startup

    commit 6fab3febf6d949b0a12b1e4e73db38e4a177a79e upstream.

    For r6xx+ asics.  This mirrors the behavior of pre-r6xx
    asics.  We need to program the MC even if something
    else in startup() fails.  Failure to do so results in
    an unusable GPU.

    Based on a fix from: Mark Kettenis <kettenis@openbsd.org>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [wml: Backported to 3.4:
    - adjust context
    - drop changes to cik.c]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d9d3e8ed90d9513ee90af49302cbcfcc636d71a5
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Apr 18 09:36:42 2013 -0400

    drm/radeon: fix hdmi mode enable on RS600/RS690/RS740

    commit dcb852905772416e322536ced5cb3c796d176af5 upstream.

    These chips were previously skipped since they are
    pre-R600.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4:
    - adjust context
    - no !ASIC_IS_DCE3(rdev)]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63034aee5f85e6c4decdaa600ed1febfa90a348f
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Mon Oct 28 02:02:19 2013 -0700

    drm/ttm: Fix memory type compatibility check

    commit 59c8e66378fb78adbcd05f0d09783dde6fef282b upstream.

    Also check the busy placements before deciding to move a buffer object.
    Failing to do this may result in a completely unneccessary move within a
    single memory type.

    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 465282b316e98ed17698900af70fa8260c9c9e70
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Oct 16 09:49:02 2013 +0100

    drm: Pad drm_mode_get_connector to 64-bit boundary

    commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream.

    Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
    the 4 bytes beyond the end of its structure with a 32-bit userspace
    running on a 64-bit kernel. This is due to the padding gcc inserts as
    the drm_mode_get_connector struct includes a u64 and its size is not a
    natural multiple of u64s.

    64-bit kernel:

    sizeof(drm_mode_get_connector)=80, alignof=8
    sizeof(drm_mode_get_encoder)=20, alignof=4
    sizeof(drm_mode_modeinfo)=68, alignof=4

    32-bit userspace:

    sizeof(drm_mode_get_connector)=76, alignof=4
    sizeof(drm_mode_get_encoder)=20, alignof=4
    sizeof(drm_mode_modeinfo)=68, alignof=4

    Fortuituously we can insert explicit padding to the tail of our
    structures without breaking ABI.

    Reported-by: Pavel Roskin <proski@gnu.org>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Dave Airlie <airlied@redhat.com>
    Cc: dri-devel@lists.freedesktop.org
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a27d31e36ba71a3fd2fe7e222a433488a5a2f87a
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Fri Sep 13 18:33:16 2013 -0400

    drm/radeon: fix panel scaling with eDP and LVDS bridges

    commit 855f5f1d882a34e4e9dd27b299737cd3508a5624 upstream.

    We were using the wrong set_properly callback so we always
    ended up with Full scaling even if something else (Center or
    Full aspect) was selected.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60b3d181a406c7e47edbb41e227b54380d35fa8a
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Fri Aug 23 10:50:39 2013 +0300

    drm/i915: try not to lose backlight CBLV precision

    commit cac6a5ae0118832936eb162ec4cedb30f2422bcc upstream.

    ACPI has _BCM and _BQC methods to set and query the backlight
    brightness, respectively. The ACPI opregion has variables BCLP and CBLV
    to hold the requested and current backlight brightness, respectively.

    The BCLP variable has range 0..255 while the others have range
    0..100. This means the _BCM method has to scale the brightness for BCLP,
    and the gfx driver has to scale the requested value back for CBLV. If
    the _BQC method uses the CBLV variable (apparently some implementations
    do, some don't) for current backlight level reporting, there's room for
    rounding errors.

    Use DIV_ROUND_UP for scaling back to CBLV to get back to the same values
    that were passed to _BCM, presuming the _BCM simply uses bclp = (in *
    255) / 100 for scaling to BCLP.

    Reference: https://gist.github.com/aaronlu/6314920
    Reported-by: Aaron Lu <aaron.lu@intel.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Reviewed-by: Aaron Lu <aaron.lu@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2:
     - Adjust context
     - ASLE region is treated as normal memory rather than __iomem]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ac5d182c17af8728ada8cfac051292a8e35d9a90
Author: Ondrej Zary <linux@rainbow-software.org>
Date:   Fri Jul 19 21:08:48 2013 +0200

    drm/radeon: Another card with wrong primary dac adj

    commit f7929f34fa0e0bb6736a2484fdc07d77a1653081 upstream.

    Hello,
    got another card with "too bright" problem:
    Sapphire Radeon VE 7000 DDR (VGA+S-Video)

    lspci -vnn:
    01:00.0 VGA compatible controller [0300]: Advanced Micro Devices [AMD] nee ATI RV100 QY [Radeon 7000/VE] [1002:5159] (prog-if 00 [VGA controller])
            Subsystem: PC Partner Limited Sapphire Radeon VE 7000 DDR [174b:7c28]

    The patch below fixes the problem for this card.
    But I don't like the blacklist, couldn't some heuristic be used instead?
    The interesting thing is that the manufacturer is the same as the other card
    needing the same quirk. I wonder how many different types are broken this way.

    The "wrong" ps2_pdac_adj value that comes from BIOS on this card is 0x300.

    ====================
    drm/radeon: Add primary dac adj quirk for Sapphire Radeon VE 7000 DDR

    Values from BIOS are wrong, causing too bright colors.
    Use default values instead.

    Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9887b229cd239b0daccbaeb0383647af5dfa5a92
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Fri Apr 12 15:18:38 2013 +0300

    drm/i915: ensure single initialization and cleanup of backlight device

    commit dc652f90e088798bfa31f496ba994ddadd5d5680 upstream.

    Backlight cleanup in the eDP connector destroy callback caused the
    backlight device to be removed on some systems that first initialized LVDS
    and then attempted to initialize eDP. Prevent multiple backlight
    initializations, and ensure backlight cleanup is only done once by moving
    it to modeset cleanup.

    A small wrinkle is the introduced asymmetry in backlight
    setup/cleanup. This could be solved by adding refcounting, but it seems
    overkill considering that there should only ever be one backlight device.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55701
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Tested-by: Peter Verthez <peter.verthez@skynet.be>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2:
     - Adjust context
     - s/dev_priv->backlight\.device/dev_priv->backlight/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 58fcd1468315dab98ce90cb9756d4fedfd033f0b
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Apr 4 21:31:03 2013 +0100

    drm/i915: Workaround incoherence between fences and LLC across multiple CPUs

    commit 25ff1195f8a0b3724541ae7bbe331b4296de9c06 upstream.

    In order to fully serialize access to the fenced region and the update
    to the fence register we need to take extreme measures on SNB+, and
    manually flush writes to memory prior to writing the fence register in
    conjunction with the memory barriers placed around the register write.

    Fixes i-g-t/gem_fence_thrash

    v2: Bring a bigger gun
    v3: Switch the bigger gun for heavier bullets (Arjan van de Ven)
    v4: Remove changes for working generations.
    v5: Reduce to a per-cpu wbinvd() call prior to updating the fences.
    v6: Rewrite comments to ellide forgotten history.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=62191
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Jon Bloomfield <jon.bloomfield@intel.com>
    Tested-by: Jon Bloomfield <jon.bloomfield@intel.com> (v2)
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2: insert the cache flush in i915_gem_object_get_fence()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5b5cc72ac42ce8dbd32cae9ed7a4b2392987cfa
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Fri Apr 12 19:15:52 2013 -0400

    drm/radeon: cleanup properly if mmio mapping fails

    commit 0cd9cb76ae26a19df21abc6f94f5fff141e689c7 upstream.

    If we fail to map the mmio BAR, skip driver tear down
    that requires mmio.

    Should fix:
    https://bugzilla.kernel.org/show_bug.cgi?id=56541

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f909046a7bab57744c0498125b8a91450aa12829
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Apr 1 16:06:25 2013 -0400

    drm/radeon: use frac fb div on RS780/RS880

    commit 411678288d61ba17afe1f8afed92200be6bbc65d upstream.

    Monitors seem to prefer it.  Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=37696

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Add to pll->flags, not radeon_crtc->pll_flags]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ace6581eb5abd4608dd05e858a985c0c2f0e3761
Author: Egbert Eich <eich@suse.de>
Date:   Sun Oct 14 15:46:38 2012 +0200

    DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines.

    commit 5f85f176c2f1c9d2a23f60ca0b99e4d0aa5a26a7 upstream.

    NCR machines with LVDS panels using Intel chipsets need to have the
    QUIRK_INVERT_BRIGHTNESS bit set.
    Unfortunately NCR doesn't set a meaningful subvendor/subdevice ID,
    therefore we add a DMI dependent quirk list.

    Signed-off-by: Egbert Eich <eich@suse.de>
    [danvet: fixup whitespace fail.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Acked-by: Jani Nikula <jani.nikula@intel.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Add #include <linux/dmi.h>]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce3a20e79213a1debca10b55df45cd3dda9f46b0
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Tue Jan 22 12:50:36 2013 +0200

    drm/i915: add quirk to invert brightness on Packard Bell NCL20

    commit 5559ecadad5a73b27f863e92f4b4f369501dce6f upstream.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44156
    Reported-by: Alan Zimmerman <alan.zimm@gmail.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4: Adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bf4029831239a3751eff53029f1b25c0402b273
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Tue Jan 22 12:50:35 2013 +0200

    drm/i915: add quirk to invert brightness on eMachines e725

    commit 01e3a8feb40e54b962a20fa7eb595c5efef5e109 upstream.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=31522#c35
    [Note: There are more than one broken setups in the bug. This fixes one.]
    Reported-by: Martins <andrissr@inbox.lv>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4: Adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0fa0f8829eaf4b609a1c34371ae24be94311595
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Tue Jan 22 12:50:34 2013 +0200

    drm/i915: add quirk to invert brightness on eMachines G725

    commit 1ffff60320879830e469e26062c18f75236822ba upstream.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59628
    Reported-by: Roland Gruber <post@rolandgruber.de>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4: Adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 678bb5deb58183028c896c1ae197e6b3e3a0afe9
Author: Carsten Emde <C.Emde@osadl.org>
Date:   Thu Mar 15 15:56:27 2012 +0100

    drm/i915: panel: invert brightness acer aspire 5734z

    commit 5a15ab5b93e4a3ebcd4fa6c76cf646a45e9cf806 upstream.

    Mark the Acer Aspire 5734Z that this machines requires the module to
    invert the panel backlight brightness value after reading from and prior
    to writing to the PCI configuration space.

    Signed-off-by: Carsten Emde <C.Emde@osadl.org>
    Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Acked-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4: Adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed0bff16ccb6ab0219a541f7cbf861a9118dd34b
Author: Carsten Emde <C.Emde@osadl.org>
Date:   Thu Mar 15 15:56:26 2012 +0100

    drm/i915: panel: invert brightness via quirk

    commit 4dca20efb1a9c2efefc28ad2867e5d6c3f5e1955 upstream.

    A machine may need to invert the panel backlight brightness value. This
    patch adds the infrastructure for a quirk to do so.

    Signed-off-by: Carsten Emde <C.Emde@osadl.org>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Acked-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wml: Backported to 3.4:
    - Adjust context
    - one more flag QUIRK_NO_PCH_PWM_ENABLE]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4c4478f4b87b3cc18572d7e50063f7fd34c95c5b
Author: Carsten Emde <C.Emde@osadl.org>
Date:   Thu Mar 15 15:56:25 2012 +0100

    drm/i915: panel: invert brightness via parameter

    commit 7bd90909bbf9ce7c40e1da3d72b97b93839c188a upstream.

    Following the documentation of the Legacy Backlight Brightness (LBB)
    Register in the configuration space of some Intel PCI graphics adapters,
    setting the LBB register with the value 0x0 causes the backlight to be
    turned off, and 0xFF causes the backlight to be set to 100% intensity
    (http://download.intel.com/embedded/processors/Whitepaper/324567.pdf).
    The Acer Aspire 5734Z, however, turns the backlight off at 0xFF and sets
    it to maximum intensity at 0. In consequence, the screen of this systems
    becomes dark at an early boot stage which makes it unusable. The same
    inversion applies to the BLC_PWM_CTL I915 register. This problem was
    introduced in kernel version 2.6.38 when the PCI device of this system
    was first supported by the i915 KMS module.

    This patch adds a parameter to the i915 module to enable inversion of
    the brightness variable (i915.invert_brightness).

    Signed-off-by: Carsten Emde <C.Emde@osadl.org>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Acked-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 13ecaa9385007e7c907fa1db3f8504cbb054b8ec
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Thu Feb 14 11:23:35 2013 +0200

    drm/i915: add missing \n to UTS_RELEASE in the error_state

    commit fdfa175d0a9cfa2082ce24e67e284e5acbba452a upstream.

    Amending
    commit 4518f611ba21ba165ea3714055938a8984a44ff9
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Wed Jan 23 16:16:35 2013 +0100

        drm/i915: dump UTS_RELEASE into the error_state

    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 830a450e266a3471476036c1dbc4896ec5ccfbf7
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Jan 23 16:16:35 2013 +0100

    drm/i915: dump UTS_RELEASE into the error_state

    commit 4518f611ba21ba165ea3714055938a8984a44ff9 upstream.

    Useful for statistics or on overflowing bug reports to keep things all
    lined up.

    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5fbe150df29254ba07b42834d582689c80a00f08
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Jan 2 10:31:22 2013 +0000

    drm/i915; Only increment the user-pin-count after successfully pinning the bo

    commit 93be8788e648817d62fda33e2998eb6ca6ebf3a3 upstream.

    As along the error path we do not correct the user pin-count for the
    failure, we may end up with userspace believing that it has a pinned
    object at offset 0 (when interrupted by a signal for example).

    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c87e58bd2c711816335bb869f747ce25e0ce66ea
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Dec 3 11:36:30 2012 +0000

    drm/i915: Close race between processing unpin task and queueing the flip

    commit e7d841ca03b7ab668620045cd7b428eda9f41601 upstream.

    Before queuing the flip but crucially after attaching the unpin-work to
    the crtc, we continue to setup the unpin-work. However, should the
    hardware fire early, we see the connected unpin-work and queue the task.
    The task then promptly runs and unpins the fb before we finish taking
    the required references or even pinning it... Havoc.

    To close the race, we use the flip-pending atomic to indicate when the
    flip is finally setup and enqueued. So during the flip-done processing,
    we can check more accurately whether the flip was expected.

    v2: Add the appropriate mb() to ensure that the writes to the page-flip
    worker are complete prior to marking it active and emitting the MI_FLIP.
    On the read side, the mb should be enforced by the spinlocks.

    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: stable@vger.kernel.org
    [danvet: Review the barriers a bit, we need a write barrier both
    before and after updating ->pending. Similarly we need a read barrier
    in the interrupt handler both before and after reading ->pending. With
    well-ordered irqs only one barrier in each place should be required,
    but since this patch explicitly sets out to combat spurious interrupts
    with is staged activation of the unpin work we need to go full-bore on
    the barriers, too. Discussed with Chris Wilson on irc and changes
    acked by him.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [wml: Backported to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d889e3fa80632c7d107e4d4410e79d8050ddd05
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Nov 5 16:34:58 2012 +0000

    drm/radeon: fix typo in evergreen_mc_resume()

    commit 695ddeb457584a602f2ba117d08ce37cf6ec1589 upstream.

    Add missing index that may have led us to enabling
    more crtcs than necessary.

    May also fix:
    https://bugs.freedesktop.org/show_bug.cgi?id=56139

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b29fe4dc9e56700e3772be99a35f6209fa4e57aa
Author: Aaro Koskinen <aaro.koskinen@iki.fi>
Date:   Mon Dec 31 03:34:59 2012 +0200

    drm/nouveau: fix init with agpgart-uninorth

    commit eda85d6ad490923152544fba0473798b6cc0edf6 upstream.

    Check that the AGP aperture can be mapped. This follows a similar change
    done for Radeon (commit 365048ff, drm/radeon: AGP memory is only I/O if
    the aperture can be mapped by the CPU.).

    The patch fixes the following error seen on G5 iMac:

    	nouveau E[     DRM] failed to create kernel channel, -12

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58806
    Reviewed-by: Michel Dänzer <michel@daenzer.net>
    Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8b2360118bb16aa06e2f8a165fba5c9f0a18fe88
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Dec 20 16:35:47 2012 -0500

    drm/radeon: add connector table for Mac G4 Silver

    commit cafa59b9011a7790be4ddd5979419259844a165d upstream.

    Apple cards do not provide data tables in the vbios
    so we have to hard code the connector parameters
    in the driver.

    Reported-by: Albrecht Dreß <albrecht.dress@arcor.de>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit befa3d28d06b3fb5ea8232298658eb3ecc2fa62b
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed May 2 12:10:21 2012 -0400

    drm/radeon: add connector table for SAM440ep embedded board

    commit 6a556039e7823d27a0a7f7724d4d455053ea9253 upstream.

    RV250 found on ppc embedded boards.

    Cc: Hans Verkuil <hverkuil@xs4all.nl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 81d0e97cb5797cae879e42b46f43763fe590ac30
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Tue Dec 11 11:56:52 2012 -0500

    drm/radeon: fix amd afusion gpu setup aka sumo v2

    commit bd25f0783dc3fb72e1e2779c2b99b2d34b67fa8a upstream.

    Set the proper number of tile pipe that should be a multiple of
    pipe depending on the number of se engine.

    Fix:
    https://bugs.freedesktop.org/show_bug.cgi?id=56405
    https://bugs.freedesktop.org/show_bug.cgi?id=56720

    v2: Don't change sumo2

    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2: don't define/use *_GB_ADDR_CONFIG_GOLDEN]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 650ab0c0b0ee0496085a98e2ed8943c87de482b0
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Nov 13 18:03:41 2012 -0500

    drm/radeon/dce32+: use fractional fb dividers for high clocks

    commit a02dc74b317d78298cb0587b9b1f6f741fd5c139 upstream.

    Fixes flickering with some high res montiors.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [bwh: Backported to 3.2: use pll->flags instead of radeon_crtc->pll_flags]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5f68cf4c76b5ac3808551555b81764c03c0a3b75
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Fri Nov 9 17:26:32 2012 +0000

    drm: fix documentation for drm_crtc_set_mode()

    commit 4c9287c6009b37754c42e0ba73a4cc79de92d8f8 upstream.

    x and y parameters are offsets, not width/height

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f11a1d5595cb0dc906e23819cfb2e320a524f790
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Mon Nov 12 18:31:35 2012 +0200

    drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures

    commit d0ddfbd3d1346c1f481ec2289eef350cdba64b42 upstream.

    Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call
    left behind ghost connectors, attached (with a dangling pointer) to the
    sdvo that has been cleaned up and freed. Properly destroy any connectors
    attached to the encoder.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381
    CC: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Tested-by: bjo@nord-west.org
    [danvet: added a comment to explain why we need to clean up connectors
    even when sdvo_output_setup fails.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4f9e14fad5e381e075f942677e9c1ae70e0f186e
Author: Jason Wang <jasowang@redhat.com>
Date:   Tue Jun 18 13:04:23 2013 +0800

    drivers: hv: switch to use mb() instead of smp_mb()

    commit 35848f68b07df3f917cb13fc3c134718669f569b upstream.

    Even if guest were compiled without SMP support, it could not assume that host
    wasn't. So switch to use mb() instead of smp_mb() to force memory barriers for
    UP guest.

    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Cc: Haiyang Zhang <haiyangz@microsoft.com>
    Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2:
     - Drop changes to functions that don't exist here
     - hv_ringbuffer_write() has only a write memory barrier]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4:
     - Add the change in hv_ringbuffer_read]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f40ed19c957e23cee2a178a688c45197aa1bc30c
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Wed Feb 27 17:05:25 2013 -0800

    nbd: fsync and kill block device on shutdown

    commit 3a2d63f87989e01437ba994df5f297528c353d7d upstream.

    There are two problems with shutdown in the NBD driver.

    1: Receiving the NBD_DISCONNECT ioctl does not sync the filesystem.

       This patch adds the sync operation into __nbd_ioctl()'s
       NBD_DISCONNECT handler.  This is useful because BLKFLSBUF is restricted
       to processes that have CAP_SYS_ADMIN, and the NBD client may not
       possess it (fsync of the block device does not sync the filesystem,
       either).

    2: Once we clear the socket we have no guarantee that later reads will
       come from the same backing storage.

       The patch adds calls to kill_bdev() in __nbd_ioctl()'s socket
       clearing code so the page cache is cleaned, lest reads that hit on the
       page cache will return stale data from the previously-accessible disk.

    Example:

        # qemu-nbd -r -c/dev/nbd0 /dev/sr0
        # file -s /dev/nbd0
        /dev/stdin: # UDF filesystem data (version 1.5) etc.
        # qemu-nbd -d /dev/nbd0
        # qemu-nbd -r -c/dev/nbd0 /dev/sda
        # file -s /dev/nbd0
        /dev/stdin: # UDF filesystem data (version 1.5) etc.

    While /dev/sda has:

        # file -s /dev/sda
        /dev/sda: x86 boot sector; etc.

    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Acked-by: Paul Clements <Paul.Clements@steeleye.com>
    Cc: Alex Bligh <alex@alex.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2:
     - Adjusted context
     - s/\bnbd\b/lo/
     - Incorporate export of kill_bdev() from commit ff01bb483265
       ('fs: move code out of buffer.c')]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: Adjusted context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 354ad5e4dda15aef33da119a93e413161ae99525
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sun Jun 16 21:27:12 2013 +0100

    x86/efi: Fix dummy variable buffer allocation

    commit b8cb62f82103083a6e8fa5470bfe634a2c06514d upstream.

    1. Check for allocation failure
    2. Clear the buffer contents, as they may actually be written to flash
    3. Don't leak the buffer

    Compile-tested only.

    [ Tested successfully on my buggy ASUS machine - Matt ]

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4f009b04f6ae98e0a147e9b3d3f4078bbd416ee
Author: Matthew Garrett <matthew.garrett@nebula.com>
Date:   Sat Jun 1 16:06:20 2013 -0400

    Modify UEFI anti-bricking code

    commit f8b8404337de4e2466e2e1139ea68b1f8295974f upstream.

    This patch reworks the UEFI anti-bricking code, including an effective
    reversion of cc5a080c and 31ff2f20. It turns out that calling
    QueryVariableInfo() from boot services results in some firmware
    implementations jumping to physical addresses even after entering virtual
    mode, so until we have 1:1 mappings for UEFI runtime space this isn't
    going to work so well.

    Reverting these gets us back to the situation where we'd refuse to create
    variables on some systems because they classify deleted variables as "used"
    until the firmware triggers a garbage collection run, which they won't do
    until they reach a lower threshold. This results in it being impossible to
    install a bootloader, which is unhelpful.

    Feedback from Samsung indicates that the firmware doesn't need more than
    5KB of storage space for its own purposes, so that seems like a reasonable
    threshold. However, there's still no guarantee that a platform will attempt
    garbage collection merely because it drops below this threshold. It seems
    that this is often only triggered if an attempt to write generates a
    genuine EFI_OUT_OF_RESOURCES error. We can force that by attempting to
    create a variable larger than the remaining space. This should fail, but if
    it somehow succeeds we can then immediately delete it.

    I've tested this on the UEFI machines I have available, but I don't have
    a Samsung and so can't verify that it avoids the bricking problem.

    Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    Signed-off-by: Lee, Chun-Y <jlee@suse.com> [ dummy variable cleanup ]
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [bwh: Backported to 3.2: the reverted changes were never applied here]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3fd6f849dd0f9ba7a4f8e2f88b0d9e49659d30b2
Author: Richard Weinberger <richard@nod.at>
Date:   Wed Apr 17 01:00:53 2013 +0200

    x86,efi: Implement efi_no_storage_paranoia parameter

    commit 8c58bf3eec3b8fc8162fe557e9361891c20758f2 upstream.

    Using this parameter one can disable the storage_size/2 check if
    he is really sure that the UEFI does sane gc and fulfills the spec.

    This parameter is useful if a devices uses more than 50% of the
    storage by default.
    The Intel DQSW67 desktop board is such a sucker for exmaple.

    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 891d583c403cbce091f6e759e3f9b411917638f6
Author: Sergey Vlasov <vsu@altlinux.ru>
Date:   Tue Apr 16 18:31:09 2013 +0400

    efi: Export efi_query_variable_store() for efivars.ko

    commit 3668011d4ad556224f7c012c1e870a6eaa0e59da upstream.

    Fixes build with CONFIG_EFI_VARS=m which was broken after the commit
    "x86, efivars: firmware bug workarounds should be in platform code".

    Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d352874118cfe49a1e793c913c9e448e4f5f3245
Author: Richard Weinberger <richard@nod.at>
Date:   Wed Apr 10 10:59:34 2013 +0200

    x86,efi: Check max_size only if it is non-zero.

    commit 7791c8423f1f7f4dad94e753bae67461d5b80be8 upstream.

    Some EFI implementations return always a MaximumVariableSize of 0,
    check against max_size only if it is non-zero.
    My Intel DQ67SW desktop board has such an implementation.

    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b94d72798ba9f2e93891033107af49486650c22
Author: Matt Fleming <matt.fleming@intel.com>
Date:   Mon Mar 25 09:14:30 2013 +0000

    x86, efivars: firmware bug workarounds should be in platform code

    commit a6e4d5a03e9e3587e88aba687d8f225f4f04c792 upstream.

    Let's not burden ia64 with checks in the common efivars code that we're not
    writing too much data to the variable store. That kind of thing is an x86
    firmware bug, plain and simple.

    efi_query_variable_store() provides platforms with a wrapper in which they can
    perform checks and workarounds for EFI variable storage bugs.

    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b28299b42d3fb210fc0a6af6da435041e048fa39
Author: Seiji Aguchi <seiji.aguchi@hds.com>
Date:   Tue Feb 12 13:04:41 2013 -0800

    efi_pstore: Introducing workqueue updating sysfs

    commit a93bc0c6e07ed9bac44700280e65e2945d864fd4 upstream.

    [Problem]
    efi_pstore creates sysfs entries, which enable users to access to NVRAM,
    in a write callback. If a kernel panic happens in an interrupt context,
    it may fail because it could sleep due to dynamic memory allocations during
    creating sysfs entries.

    [Patch Description]
    This patch removes sysfs operations from a write callback by introducing
    a workqueue updating sysfs entries which is scheduled after the write
    callback is called.

    Also, the workqueue is kicked in a just oops case.
    A system will go down in other cases such as panic, clean shutdown and emergency
    restart. And we don't need to create sysfs entries because there is no chance for
    users to access to them.

    efi_pstore will be robust against a kernel panic in an interrupt context with this patch.

    Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
    Acked-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    [xr: Backported to 3.4:
      - Adjust contest
      - Remove repeated definition of helper function variable_is_present]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9001ccbda1be58798d1bd221c3e2a2443133b8bb
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Fri Mar 22 19:56:51 2013 +0000

    efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE

    commit ca0ba26fbbd2d81c43085df49ce0abfe34535a90 upstream.

    The 'CONFIG_' prefix is not implicit in IS_ENABLED().

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Seth Forshee <seth.forshee@canonical.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 026f0287cdb6154517a7c7e23c6541a8ba30979b
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Mon Mar 11 16:17:50 2013 -0500

    efivars: Add module parameter to disable use as a pstore backend

    commit ec0971ba5372a4dfa753f232449d23a8fd98490e upstream.

    We know that with some firmware implementations writing too much data to
    UEFI variables can lead to bricking machines. Recent changes attempt to
    address this issue, but for some it may still be prudent to avoid
    writing large amounts of data until the solution has been proven on a
    wide variety of hardware.

    Crash dumps or other data from pstore can potentially be a large data
    source. Add a pstore_module parameter to efivars to allow disabling its
    use as a backend for pstore. Also add a config option,
    CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE, to allow setting the default
    value of this paramter to true (i.e. disabled by default).

    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Cc: Josh Boyer <jwboyer@redhat.com>
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Cc: Seiji Aguchi <seiji.aguchi@hds.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6a087af822a54e098fd7934d1498256e8627254
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Thu Mar 7 11:40:17 2013 -0600

    efivars: Allow disabling use as a pstore backend

    commit ed9dc8ce7a1c8115dba9483a9b51df8b63a2e0ef upstream.

    Add a new option, CONFIG_EFI_VARS_PSTORE, which can be set to N to
    avoid using efivars as a backend to pstore, as some users may want to
    compile out the code completely.

    Set the default to Y to maintain backwards compatability, since this
    feature has always been enabled until now.

    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Cc: Josh Boyer <jwboyer@redhat.com>
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Cc: Seiji Aguchi <seiji.aguchi@hds.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1c4e6e91fec88f6a544259d5d536991e0a41f5e3
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sat Mar 23 03:49:53 2013 +0000

    efivars: pstore: Do not check size when erasing variable

    commit 80a19debc2f2d398cfa57fae97bc99826748a602 upstream.

    In 3.2, unlike mainline, efi_pstore_erase() calls efi_pstore_write()
    with a size of 0, as the underlying EFI interface treats a size of 0
    as meaning deletion.

    This was not taken into account in my backport of commit d80a361d779a
    'efi_pstore: Check remaining space with QueryVariableInfo() before
    writing data'.  The size check should be omitted when erasing.

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e887bb41a177d6c6f245d80ad427f1b91fbed91e
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Mon Mar 11 17:48:53 2013 -0400

    efi: be more paranoid about available space when creating variables

    commit 68d929862e29a8b52a7f2f2f86a0600423b093cd upstream.

    UEFI variables are typically stored in flash. For various reasons, avaiable
    space is typically not reclaimed immediately upon the deletion of a
    variable - instead, the system will garbage collect during initialisation
    after a reboot.

    Some systems appear to handle this garbage collection extremely poorly,
    failing if more than 50% of the system flash is in use. This can result in
    the machine refusing to boot. The safest thing to do for the moment is to
    forbid writes if they'd end up using more than half of the storage space.
    We can make this more finegrained later if we come up with a method for
    identifying the broken machines.

    Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    [bwh: Backported to 3.2:
     - Drop efivarfs changes and unused check_var_size()
     - Add error codes to include/linux/efi.h, added upstream by
       commit 5d9db883761a ('efi: Add support for a UEFI variable filesystem')
     - Add efi_status_to_err(), added upstream by commit 7253eaba7b17
       ('efivarfs: Return an error if we fail to read a variable')]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff534f031ab3192952fc6403bb8618feda758a38
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Mon Mar 11 17:47:42 2013 -0400

    efivars: Disable external interrupt while holding efivars->lock

    commit 81fa4e581d9283f7992a0d8c534bb141eb840a14 upstream.

    [Problem]
    There is a scenario which efi_pstore fails to log messages in a panic case.

     - CPUA holds an efi_var->lock in either efivarfs parts
       or efi_pstore with interrupt enabled.
     - CPUB panics and sends IPI to CPUA in smp_send_stop().
     - CPUA stops with holding the lock.
     - CPUB kicks efi_pstore_write() via kmsg_dump(KSMG_DUMP_PANIC)
       but it returns without logging messages.

    [Patch Description]
    This patch disables an external interruption while holding efivars->lock
    as follows.

    In efi_pstore_write() and get_var_data(), spin_lock/spin_unlock is
    replaced by spin_lock_irqsave/spin_unlock_irqrestore because they may
    be called in an interrupt context.

    In other functions, they are replaced by spin_lock_irq/spin_unlock_irq.
    because they are all called from a process context.

    By applying this patch, we can avoid the problem above with
    a following senario.

     - CPUA holds an efi_var->lock with interrupt disabled.
     - CPUB panics and sends IPI to CPUA in smp_send_stop().
     - CPUA receives the IPI after releasing the lock because it is
       disabling interrupt while holding the lock.
     - CPUB waits for one sec until CPUA releases the lock.
     - CPUB kicks efi_pstore_write() via kmsg_dump(KSMG_DUMP_PANIC)
       And it can hold the lock successfully.

    Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
    Acked-by: Mike Waychison <mikew@google.com>
    Acked-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    [bwh: Backported to 3.2:
     - Drop efivarfs changes
     - Adjust context
     - Drop change to efi_pstore_erase(), which is implemented using
       efi_pstore_write() here]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e74ecf7da0e7a9d0ef4e2474f87a5cba86b4347
Author: Seiji Aguchi <seiji.aguchi@hds.com>
Date:   Wed Nov 14 20:25:37 2012 +0000

    efi_pstore: Check remaining space with QueryVariableInfo() before writing data

    commit d80a361d779a9f19498943d1ca84243209cd5647 upstream.

    [Issue]

    As discussed in a thread below, Running out of space in EFI isn't a well-tested scenario.
    And we wouldn't expect all firmware to handle it gracefully.
    http://marc.info/?l=linux-kernel&m=134305325801789&w=2

    On the other hand, current efi_pstore doesn't check a remaining space of storage at writing time.
    Therefore, efi_pstore may not work if it tries to write a large amount of data.

    [Patch Description]

    To avoid handling the situation above, this patch checks if there is a space enough to log with
    QueryVariableInfo() before writing data.

    Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
    Acked-by: Mike Waychison <mikew@google.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75a0ac16ab0b957c19795a0e47d774ca614af7c7
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Sun Jan 13 20:36:39 2013 -0800

    x86/Sandy Bridge: mark arrays in __init functions as __initconst

    commit 91c90db1aa92a50fa1d7f289502b49ddb46a90d3 upstream.

    commit ab3cd8670e0b3fcde7f029e1503ed3c5138e9571 upstream.

    Mark static arrays as __initconst so they get removed when the init
    sections are flushed.

    Reported-by: Mathias Krause <minipli@googlemail.com>
    Link: http://lkml.kernel.org/r/75F4BEE6-CB0E-4426-B40B-697451677738@googlemail.com
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit acb33555bc562b8b72c879af8f67bfb09e84cbf5
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Sat Aug 11 18:06:42 2012 +0200

    ptrace/x86: Partly fix set_task_blockstep()->update_debugctlmsr() logic

    commit 95cf00fa5d5e2a200a2c044c84bde8389a237e02 upstream.

    Afaics the usage of update_debugctlmsr() and TIF_BLOCKSTEP in
    step.c was always very wrong.

    1. update_debugctlmsr() was simply unneeded. The child sleeps
       TASK_TRACED, __switch_to_xtra(next_p => child) should notice
       TIF_BLOCKSTEP and set/clear DEBUGCTLMSR_BTF after resume if
       needed.

    2. It is wrong. The state of DEBUGCTLMSR_BTF bit in CPU register
       should always match the state of current's TIF_BLOCKSTEP bit.

    3. Even get_debugctlmsr() + update_debugctlmsr() itself does not
       look right. Irq can change other bits in MSR_IA32_DEBUGCTLMSR
       register or the caller can be preempted in between.

    4. It is not safe to play with TIF_BLOCKSTEP if task != current.
       DEBUGCTLMSR_BTF and TIF_BLOCKSTEP should always match each
       other if the task is running. The tracee is stopped but it
       can be SIGKILL'ed right before set/clear_tsk_thread_flag().

    However, now that uprobes uses user_enable_single_step(current)
    we can't simply remove update_debugctlmsr(). So this patch adds
    the additional "task == current" check and disables irqs to avoid
    the race with interrupts/preemption.

    Unfortunately this patch doesn't solve the last problem, we need
    another fix. Probably we should teach ptrace_stop() to set/clear
    single/block stepping after resume.

    And afaics there is yet another problem: perf can play with
    MSR_IA32_DEBUGCTLMSR from nmi, this obviously means that even
    __switch_to_xtra() has problems.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa060a3631ad4f9d555e0bc6d9a4d4147137cef9
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Fri Aug 3 17:31:46 2012 +0200

    ptrace/x86: Introduce set_task_blockstep() helper

    commit 848e8f5f0ad3169560c516fff6471be65f76e69f upstream.

    No functional changes, preparation for the next fix and for uprobes
    single-step fixes.

    Move the code playing with TIF_BLOCKSTEP/DEBUGCTLMSR_BTF into the
    new helper, set_task_blockstep().

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65d41bb38519d09387b630e411e109423ccfff29
Author: Radu Caragea <sinaelgl@gmail.com>
Date:   Wed Aug 21 20:55:59 2013 +0300

    x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member

    commit 41aacc1eea645c99edbe8fbcf78a97dc9b862adc upstream.

    This is the updated version of df54d6fa5427 ("x86 get_unmapped_area():
    use proper mmap base for bottom-up direction") that only randomizes the
    mmap base address once.

    Signed-off-by: Radu Caragea <sinaelgl@gmail.com>
    Reported-and-tested-by: Jeff Shorey <shoreyjeff@gmail.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Michel Lespinasse <walken@google.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Adrian Sendroiu <molecula2788@gmail.com>
    Cc: Greg KH <greg@kroah.com>
    Cc: Kamal Mostafa <kamal@canonical.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65947f14c1c811bf7b6e6d2f78c57cdff4b18b59
Author: Russ Gorby <russ.gorby@intel.com>
Date:   Mon Aug 13 13:45:15 2012 +0100

    n_gsm: replace kfree_skb w/ appropriate dev_* versions

    commit 329e56780e514a7ab607bcb51a52ab0dc2669414 upstream.

    Drivers are supposed to use the dev_* versions of the kfree_skb
    interfaces. In a couple of cases we were called with IRQs
    disabled as well which kfree_skb() does not expect.

    Replaced kfree_skb calls w/ dev_kfree_skb and dev_kfree_skb_any

    Signed-off-by: Russ Gorby <russ.gorby@intel.com>
    Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 401a93e7e742379f6f5382098adc556b13e96fe5
Author: Russ Gorby <russ.gorby@intel.com>
Date:   Mon Aug 13 13:44:59 2012 +0100

    n_gsm: avoid accessing freed memory during CMD_FCOFF condition

    commit b4338e1efc339986cf6c0a3652906e914a86e2d3 upstream.

    gsm_data_kick was recently modified to allow messages on the
    tx queue bound for DLCI0 to flow even during FCOFF conditions.
    Unfortunately we introduced a bug discovered by code inspection
    where subsequent list traversers can access freed memory if
    the DLCI0 messages were not all at the head of the list.

    Replaced singly linked tx list w/ a list_head and used
    provided interfaces for traversing and deleting members.

    Signed-off-by: Russ Gorby <russ.gorby@intel.com>
    Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 10e03a431b2dd84b2cd671ddc402bf1a18a33906
Author: samix.lebsir <samix.lebsir@intel.com>
Date:   Mon Aug 13 13:44:22 2012 +0100

    char: n_gsm: remove message filtering for contipated DLCI

    commit 10c6c383e43565c9c6ec07ff8eb2825f8091bdf0 upstream.

    The design of uplink flow control in the mux driver is
    that for constipated channels data will backup into the
    per-channel fifos, and any messages that make it to the
    outbound message queue will still go out.
    Code was added to also stop messages that were in the outbound
    queue but this requires filtering through all the messages on the
    queue for stopped dlcis and changes some of the mux logic unneccessarily.

    The message fiiltering was removed to be in line w/ the original design
    as the message filtering does not provide any solution.
    Extra debug messages used during investigation were also removed.

    Signed-off-by: samix.lebsir <samix.lebsir@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28bae9a8ddef6184e91c1d4efa85fcb70237d344
Author: Frederic Berat <fredericx.berat@intel.com>
Date:   Mon Aug 13 13:43:58 2012 +0100

    n_gsm : Flow control handling in Mux driver

    commit c01af4fec2c8f303d6b3354d44308d9e6bef8026 upstream.

    - Correcting handling of FCon/FCoff in order to respect 27.010 spec
    - Consider FCon/off will overide all dlci flow control except for
      dlci0 as we must be able to send control frames.
    - Dlci constipated handling according to FC, RTC and RTR values.
    - Modifying gsm_dlci_data_kick and gsm_dlci_data_sweep according
      to dlci constipated value

    Signed-off-by: Frederic Berat <fredericx.berat@intel.com>
    Signed-off-by: Russ Gorby <russ.gorby@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6aa07d6b6ea43ec513a3fb2c64369a9cfe56167f
Author: Randy Dunlap <rdunlap@infradead.org>
Date:   Tue Jun 18 12:33:40 2013 -0700

    x86: fix build error and kconfig for ia32_emulation and binfmt

    commit d1603990ea626668c78527376d9ec084d634202d upstream.

    Fix kconfig warning and build errors on x86_64 by selecting BINFMT_ELF
    when COMPAT_BINFMT_ELF is being selected.

    warning: (IA32_EMULATION) selects COMPAT_BINFMT_ELF which has unmet direct dependencies (COMPAT && BINFMT_ELF)

    fs/built-in.o: In function `elf_core_dump':
    compat_binfmt_elf.c:(.text+0x3e093): undefined reference to `elf_core_extra_phdrs'
    compat_binfmt_elf.c:(.text+0x3ebcd): undefined reference to `elf_core_extra_data_size'
    compat_binfmt_elf.c:(.text+0x3eddd): undefined reference to `elf_core_write_extra_phdrs'
    compat_binfmt_elf.c:(.text+0x3f004): undefined reference to `elf_core_write_extra_data'

    [ hpa: This was sent to me for -next but it is a low risk build fix ]

    Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
    Link: http://lkml.kernel.org/r/51C0B614.5000708@infradead.org
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 570a73ebc127470b325a39f5d8b18eeedb05cc58
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Wed Oct 23 18:30:12 2013 -0700

    x86/apic: Disable I/O APIC before shutdown of the local APIC

    commit 522e66464467543c0d88d023336eec4df03ad40b upstream.

    In reboot and crash path, when we shut down the local APIC, the I/O APIC is
    still active. This may cause issues because external interrupts
    can still come in and disturb the local APIC during shutdown process.

    To quiet external interrupts, disable I/O APIC before shutdown local APIC.

    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Link: http://lkml.kernel.org/r/1382578212-4677-1-git-send-email-fenghua.yu@intel.com
    [ I suppose the 'issue' is a hang during shutdown. It's a fine change nevertheless. ]
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ad128f9d1c899983847a0581385a95ea9d491ff
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Mon Dec 9 15:43:38 2013 -0800

    x86, build: Pass in additional -mno-mmx, -mno-sse options

    commit 8b3b005d675726e38bc504d2e35a991e55819155 upstream.

    In checkin

        5551a34e5aea x86-64, build: Always pass in -mno-sse

    we unconditionally added -mno-sse to the main build, to keep newer
    compilers from generating SSE instructions from autovectorization.
    However, this did not extend to the special environments
    (arch/x86/boot, arch/x86/boot/compressed, and arch/x86/realmode/rm).
    Add -mno-sse to the compiler command line for these environments, and
    add -mno-mmx to all the environments as well, as we don't want a
    compiler to generate MMX code either.

    This patch also removes a $(cc-option) call for -m32, since we have
    long since stopped supporting compilers too old for the -m32 option,
    and in fact hardcode it in other places in the Makefiles.

    Reported-by: Kevin B. Smith <kevin.b.smith@intel.com>
    Cc: Sunil K. Pandey <sunil.k.pandey@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: H. J. Lu <hjl.tools@gmail.com>
    Link: http://lkml.kernel.org/n/tip-j21wzqv790q834n7yc6g80j1@git.kernel.org
    [bwh: Backported to 3.2:
     - Drop changes to arch/x86/Makefile, which sets these flags earlier
     - Adjust context
     - Drop changes to arch/x86/realmode/rm/Makefile which doesn't exist]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c1dca2262846a50ca30f816ec361500d92ec3fe
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Tue Dec 10 14:56:06 2013 -0800

    x86, build, icc: Remove uninitialized_var() from compiler-intel.h

    commit 503cf95c061a0551eb684da364509297efbe55d9 upstream.

    When compiling with icc, <linux/compiler-gcc.h> ends up included
    because the icc environment defines __GNUC__.  Thus, we neither need
    nor want to have this macro defined in both compiler-gcc.h and
    compiler-intel.h, and the fact that they are inconsistent just makes
    the compiler spew warnings.

    Reported-by: Sunil K. Pandey <sunil.k.pandey@intel.com>
    Cc: Kevin B. Smith <kevin.b.smith@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Link: http://lkml.kernel.org/n/tip-0mbwou1zt7pafij09b897lg3@git.kernel.org
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d981d3fc5bf7923c1b9bf46016c4a6e83ee843b9
Author: Dirk Behme <dirk.behme@de.bosch.com>
Date:   Fri Aug 31 10:02:47 2012 +0200

    tty: serial: imx: don't reinit clock in imx_setup_ufcr()

    commit 7be0670f7b9198382938a03ff3db7f47ef6b4780 upstream.

    Remove the clock configuration from imx_setup_ufcr(). This
    isn't needed here and will cause garbage output if done.

    To be be sure that we only touch the bits we want (TXTL and RXTL)
    we have to mask out all other bits of the UFCR register. Add
    one non-existing bit macro for this, too (bit 6, DCEDTE on i.MX6).

    Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
    CC: Shawn Guo <shawn.guo@linaro.org>
    CC: Sascha Hauer <s.hauer@pengutronix.de>
    CC: Troy Kisky <troy.kisky@boundarydevices.com>
    CC: Xinyu Chen <xinyu.chen@freescale.com>
    Acked-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: deleted code in imx_setup_ufcr() refers to
     sport->clk not sport->clk_per]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ffb88d59ca6ddb54e4ed24155b8f9a77bf200680
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Nov 6 18:47:42 2013 +0100

    ALSA: hda - Add support for CX20952

    commit 8f42d7698751a45cd9f7134a5da49bc5b6206179 upstream.

    It's a superset of the existing CX2075x codecs, so we can reuse the
    existing parser code.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a162811ff92ab4de3dba3941a627ffae47d9f09f
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jan 21 16:53:37 2013 +0100

    ALSA: hda - Add Conexant CX20755/20756/20757 codec IDs

    commit 42c364ace52ae6b4699105b39f2559c256b6cd4c upstream.

    These are just compatible with other CX2075x codecs.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1168045bcc57f64c661e215082307724a4f66a5c
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri May 11 08:39:24 2012 +0200

    ALSA: hda/conexant - Correct vendor IDs for new codecs

    commit 2d825fd82eb765412a558a56e193b77117d56699 upstream.

    Never trust datasheet...

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cdab1ea80688e84c47319607a52e293289a6b115
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Dec 12 12:10:01 2012 +0100

    ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522

    commit 63a077e27648b4043b1ca1b4e29f0c42d99616b6 upstream.

    Acer Aspire One 522 has the infamous digital mic unit that needs the
    phase inversion fixup for stereo.

    Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=715737

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d3ecba4704c3e15008eea16333710383f7d99f62
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Tue Apr 10 13:05:29 2012 +0200

    ALSA: hda - Fix oops caused by recent commit "Fix internal mic for Lenovo Ideapad U300s"

    commit 83b0c6ba999643ee8ad6329f26e1cdc870e1a920 upstream.

    Make sure we don't dereference the "quirk" pointer when it is null.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 419f4dff0eca95853a22c582e7dc754887a14a8d
Author: Felix Kaechele <felix@fetzig.org>
Date:   Wed Sep 26 01:20:44 2012 +0200

    ALSA: hda - Add inverted internal mic quirk for Lenovo IdeaPad U310

    commit e4db0952e542090c605fd41d31d761f1b4624f4a upstream.

    The Lenovo IdeaPad U310 has an internal mic where the right channel
    is phase inverted.

    Signed-off-by: Felix Kaechele <felix@fetzig.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8194af4024e631882afdb7c200dfee11e469e47b
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Thu Jun 21 16:03:01 2012 +0200

    ALSA: HDA: Add inverted internal mic quirk for Lenovo S205

    commit b3c5dce81584391af8b6dedb0647e65c17aab3a2 upstream.

    The Lenovo Ideapad S205 has an internal mic where the right channel
    is phase inverted.

    BugLink: https://bugs.launchpad.net/bugs/884652
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2467a26e7069cb61fe52d8a8fc7c6f2e5c7fa935
Author: Alex Hung <alex.hung@canonical.com>
Date:   Tue Apr 24 16:40:52 2012 +0800

    thinkpad-acpi: fix issuing duplicated key events for brightness up/down

    commit ff413195e830541afeae469fc866ecd0319abd7e upstream.

    The tp_features.bright_acpimode will not be set correctly for brightness
    control because ACPI_VIDEO_HID will not be located in ACPI. As a result,
    a duplicated key event will always be sent. acpi_video_backlight_support()
    is sufficient to detect standard ACPI brightness control.

    Signed-off-by: Alex Hung <alex.hung@canonical.com>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Cc: Andreas Sturmlechner <andreas.sturmlechner@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51a937d48eee52b33ba1f2feb2b8b40d254800c9
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Fri Jan 11 12:21:15 2013 -0700

    PCI: shpchp: Use per-slot workqueues to avoid deadlock

    commit f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd upstream.

    When we have an SHPC-capable bridge with a second SHPC-capable bridge
    below it, pushing the upstream bridge's attention button causes a
    deadlock.

    The deadlock happens because we use the shpchp_wq workqueue to run
    shpchp_pushbutton_thread(), which uses shpchp_disable_slot() to remove
    devices below the upstream bridge.  When we remove the downstream bridge,
    we call shpc_remove(), the shpchp driver's .remove() method.  That calls
    flush_workqueue(shpchp_wq), which deadlocks because the
    shpchp_pushbutton_thread() work item is still running.

    This patch avoids the deadlock by creating a workqueue for every slot
    and removing the single shared workqueue.

    Here's the call path that leads to the deadlock:

      shpchp_queue_pushbutton_work
        queue_work(shpchp_wq)		# shpchp_pushbutton_thread
        ...

      shpchp_pushbutton_thread
        shpchp_disable_slot
          remove_board
            shpchp_unconfigure_device
              pci_stop_and_remove_bus_device
                ...
                  shpc_remove		# shpchp driver .remove method
                    hpc_release_ctlr
                      cleanup_slots
                        flush_workqueue(shpchp_wq)

    This change is based on code inspection, since we don't have hardware
    with this topology.

    Based-on-patch-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a2c0d4b76454fe93fa4a5042962cfd76a0a31e2
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Mon Dec 3 12:56:33 2012 +0100

    mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL

    commit 5b632fe85ec82e5c43740b52e74c66df50a37db3 upstream.

    Commit f0425beda4d404a6e751439b562100b902ba9c98 "mac80211: retry sending
    failed BAR frames later instead of tearing down aggr" caused regression
    on rt2x00 hardware (connection hangs). This regression was fixed by
    commit be03d4a45c09ee5100d3aaaedd087f19bc20d01 "rt2x00: Don't let
    mac80211 send a BAR when an AMPDU subframe fails". But the latter
    commit caused yet another problem reported in
    https://bugzilla.kernel.org/show_bug.cgi?id=42828#c22

    After long discussion in this thread:
    http://mid.gmane.org/20121018075615.GA18212@redhat.com
    and testing various alternative solutions, which failed on one or other
    setup, we have no other good fix for the issues like just revert both
    mentioned earlier commits.

    To do not affect other hardware which benefit from commit
    f0425beda4d404a6e751439b562100b902ba9c98, instead of reverting it,
    introduce flag that when used will restore mac80211 behaviour before
    the commit.

    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    [replaced link with mid.gmane.org that has message-id]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6f6a6494dbe3be2992ae95baa52f94356d98c81
Author: Bruce Allan <bruce.w.allan@intel.com>
Date:   Fri Aug 24 20:38:11 2012 +0000

    e1000e: DoS while TSO enabled caused by link partner with small MSS

    commit d821a4c4d11ad160925dab2bb009b8444beff484 upstream.

    With a low enough MSS on the link partner and TSO enabled locally, the
    networking stack can periodically send a very large (e.g.  64KB) TCP
    message for which the driver will attempt to use more Tx descriptors than
    are available by default in the Tx ring.  This is due to a workaround in
    the code that imposes a limit of only 4 MSS-sized segments per descriptor
    which appears to be a carry-over from the older e1000 driver and may be
    applicable only to some older PCI or PCIx parts which are not supported in
    e1000e.  When the driver gets a message that is too large to fit across the
    configured number of Tx descriptors, it stops the upper stack from queueing
    any more and gets stuck in this state.  After a timeout, the upper stack
    assumes the adapter is hung and calls the driver to reset it.

    Remove the unnecessary limitation of using up to only 4 MSS-sized segments
    per Tx descriptor, and put in a hard failure test to catch when attempting
    to check for message sizes larger than would fit in the whole Tx ring.
    Refactor the remaining logic that limits the size of data per Tx descriptor
    from a seemingly arbitrary 8KB to a limit based on the dynamic size of the
    Tx packet buffer as described in the hardware specification.

    Also, fix the logic in the check for space in the Tx ring for the next
    largest possible packet after the current one has been successfully queued
    for transmit, and use the appropriate defines for default ring sizes in
    e1000_probe instead of magic values.

    This issue goes back to the introduction of e1000e in 2.6.24 when it was
    split off from e1000.

    Reported-by: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7b5c6cd19c6ecfe7380c76b88ffdac349d60589
Author: Alexander Stein <alexander.stein@systec-electronic.com>
Date:   Thu Dec 13 10:06:10 2012 +0100

    can: c_can: Set reserved bit in IFx_MASK2 to 1 on write

    commit 2bd3bc4e8472424f1a6009825397639a8968920a upstream.

    According to C_CAN documentation, the reserved bit in IFx_MASK2 register is
    fixed 1.

    Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a070047141a84e11ea0a6c2a568763d874825675
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed Jan 16 23:40:01 2013 +0100

    intel_idle: Don't register CPU notifier if we are not running.

    commit 6f8c2e7933679f54b6478945dc72e59ef9a3d5e0 upstream.

    The 'intel_idle_probe' probes the CPU and sets the CPU notifier.
    But if later on during the module initialization we fail (say
    in cpuidle_register_driver), we stop loading, but we neglect
    to unregister the CPU notifier.  This means that during CPU
    hotplug events the system will fail:

    calling  intel_idle_init+0x0/0x326 @ 1
    intel_idle: MWAIT substates: 0x1120
    intel_idle: v0.4 model 0x2A
    intel_idle: lapic_timer_reliable_states 0xffffffff
    intel_idle: intel_idle yielding to none
    initcall intel_idle_init+0x0/0x326 returned -19 after 14 usecs

    ... some time later, offlining and onlining a CPU:

    cpu 3 spinlock event irq 62
    BUG: unable to ] __cpuidle_register_device+0x1c/0x120
    PGD 99b8b067 PUD 99b95067 PMD 0
    Oops: 0000 [#1] SMP
    Modules linked in: xen_evtchn nouveau mxm_wmi wmi radeon ttm i915 fbcon tileblit font atl1c bitblit softcursor drm_kms_helper video xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd mperf
    CPU 0
    Pid: 2302, comm: udevd Not tainted 3.8.0-rc3upstream-00249-g09ad159 #1 MSI MS-7680/H61M-P23 (MS-7680)
    RIP: e030:[<ffffffff814d956c>]  [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
    RSP: e02b:ffff88009dacfcb8  EFLAGS: 00010286
    RAX: 0000000000000000 RBX: ffff880105380000 RCX: 000000000000001c
    RDX: 0000000000000000 RSI: 0000000000000055 RDI: ffff880105380000
    RBP: ffff88009dacfce8 R08: ffffffff81a4f048 R09: 0000000000000008
    R10: 0000000000000008 R11: 0000000000000000 R12: ffff880105380000
    R13: 00000000ffffffdd R14: 0000000000000000 R15: ffffffff81a523d0
    FS:  00007f37bd83b7a0(0000) GS:ffff880105200000(0000) knlGS:0000000000000000
    CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000008 CR3: 00000000a09ea000 CR4: 0000000000042660
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process udevd (pid: 2302, threadinfo ffff88009dace000, task ffff88009afb47f0)
    Stack:
     ffffffff8107f2d0 ffffffff810c2fb7 ffff88009dacfce8 00000000ffffffea
     ffff880105380000 00000000ffffffdd ffff88009dacfd08 ffffffff814d9882
     0000000000000003 ffff880105380000 ffff88009dacfd28 ffffffff81340afd
    Call Trace:
     [<ffffffff8107f2d0>] ? collect_cpu_info_local+0x30/0x30
     [<ffffffff810c2fb7>] ? __might_sleep+0xe7/0x100
     [<ffffffff814d9882>] cpuidle_register_device+0x32/0x70
     [<ffffffff81340afd>] intel_idle_cpu_init+0xad/0x110
     [<ffffffff81340bc8>] cpu_hotplug_notify+0x68/0x80
     [<ffffffff8166023d>] notifier_call_chain+0x4d/0x70
     [<ffffffff810bc369>] __raw_notifier_call_chain+0x9/0x10
     [<ffffffff81094a4b>] __cpu_notify+0x1b/0x30
     [<ffffffff81652cf7>] _cpu_up+0x103/0x14b
     [<ffffffff81652e18>] cpu_up+0xd9/0xec
     [<ffffffff8164a254>] store_online+0x94/0xd0
     [<ffffffff814122fb>] dev_attr_store+0x1b/0x20
     [<ffffffff81216404>] sysfs_write_file+0xf4/0x170
     [<ffffffff811a1024>] vfs_write+0xb4/0x130
     [<ffffffff811a17ea>] sys_write+0x5a/0xa0
     [<ffffffff816643a9>] system_call_fastpath+0x16/0x1b
    Code: 03 18 00 c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 30 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 e8 84 08 00 00 <48> 8b 78 08 49 89 c4 e8 f8 7f c1 ff 89 c2 b8 ea ff ff ff 84 d2
    RIP  [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
     RSP <ffff88009dacfcb8>

    This patch fixes that by moving the CPU notifier registration
    as the last item to be done by the module.

    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    [bwh: Backported to 3.2: notifier is registered only if we do not have ARAT]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af857f1c3e407fd2650665f5e5c92f70994905fa
Author: Axel Lin <axel.lin@ingics.com>
Date:   Wed Jan 9 19:34:57 2013 +0800

    regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel

    commit e8d9897ff064b1683c11c15ea1296a67a45d77b0 upstream.

    commit 81d0a6ae7befb24c06f4aa4856af7f8d1f612171 upstream.

    Use DIV_ROUND_UP to prevent truncation by integer division issue.
    This ensures we return enough delay time.

    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    [bwh: Backported to 3.2: delay is done by driver, not returned to the caller]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd858528541c10bb879436da8fce44e0c9c85b97
Author: Axel Lin <axel.lin@ingics.com>
Date:   Fri Dec 28 17:09:03 2012 +0800

    regulator: max8997: Use uV in voltage_map_desc

    commit bc3b7756b5ff66828acf7bc24f148d28b8d61108 upstream.

    Current code does integer division (min_vol = min_uV / 1000) before pass
    min_vol to max8997_get_voltage_proper_val().
    So it is possible min_vol is truncated to a smaller value.

    For example, if the request min_uV is 800900 for ldo.
    min_vol = 800900 / 1000 = 800 (mV)
    Then max8997_get_voltage_proper_val returns 800 mV for this case which is lower
    than the requested voltage.

    Use uV rather than mV in voltage_map_desc to prevent truncation by integer
    division.

    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - voltage_map_desc also has an n_bits field]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7e0950c2d360599d5b859ff43caf142115ac518
Author: Krzysztof Mazur <krzysiek@podlesie.net>
Date:   Wed Dec 19 11:03:41 2012 +0100

    i915: ensure that VGA plane is disabled

    commit 0fde901f1ddd2ce0e380a6444f1fb7ca555859e9 upstream.

    Some broken systems (like HP nc6120) in some cases, usually after LID
    close/open, enable VGA plane, making display unusable (black screen on LVDS,
    some strange mode on VGA output). We used to disable VGA plane only once at
    startup. Now we also check, if VGA plane is still disabled while changing
    mode, and fix that if something changed it.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=57434
    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    [bwh: Backported to 3.2: intel_modeset_setup_hw_state() does not
     exist, so call i915_redisable_vga() directly from intel_lid_notify()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cabb4147cb8b0d92b8c779dfaff63e695f204598
Author: Mauro Carvalho Chehab <mchehab@redhat.com>
Date:   Mon Oct 15 21:48:48 2012 -0300

    i82975x_edac: Fix dimm label initialization

    commit 479696840239e0cc43efb3c917bdcad2174d2215 upstream.

    The driver has only 4 hardcoded labels, but allows much more memory.
    Fix it by removing the hardcoded logic, using snprintf() instead.

    [   19.833972] general protection fault: 0000 [#1] SMP
    [   19.837733] Modules linked in: i82975x_edac(+) edac_core firewire_ohci firewire_core crc_itu_t nouveau mxm_wmi wmi video i2c_algo_bit drm_kms_helper ttm drm i2c_core
    [   19.837733] CPU 0
    [   19.837733] Pid: 390, comm: udevd Not tainted 3.6.1-1.fc17.x86_64.debug #1 Dell Inc.                 Precision WorkStation 390    /0MY510
    [   19.837733] RIP: 0010:[<ffffffff813463a8>]  [<ffffffff813463a8>] strncpy+0x18/0x30
    [   19.837733] RSP: 0018:ffff880078535b68  EFLAGS: 00010202
    [   19.837733] RAX: ffff880069fa9708 RBX: ffff880078588000 RCX: ffff880069fa9708
    [   19.837733] RDX: 000000000000001f RSI: 5f706f5f63616465 RDI: ffff880069fa9708
    [   19.837733] RBP: ffff880078535b68 R08: ffff880069fa9727 R09: 000000000000fffe
    [   19.837733] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
    [   19.837733] R13: 0000000000000000 R14: ffff880069fa9290 R15: ffff880079624a80
    [   19.837733] FS:  00007f3de01ee840(0000) GS:ffff88007c400000(0000) knlGS:0000000000000000
    [   19.837733] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   19.837733] CR2: 00007f3de00b9000 CR3: 0000000078dbc000 CR4: 00000000000007f0
    [   19.837733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [   19.837733] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    [   19.837733] Process udevd (pid: 390, threadinfo ffff880078534000, task ffff880079642450)
    [   19.837733] Stack:
    [   19.837733]  ffff880078535c18 ffffffffa017c6b8 00040000816d627f ffff880079624a88
    [   19.837733]  ffffc90004cd6000 ffff880079624520 ffff88007ac21148 0000000000000000
    [   19.837733]  0000000000000000 0004000000000000 feda000078535bc8 ffffffff810d696d
    [   19.837733] Call Trace:
    [   19.837733]  [<ffffffffa017c6b8>] i82975x_init_one+0x2e6/0x3e6 [i82975x_edac]
    ...

    Fix bug reported at:
    	https://bugzilla.redhat.com/show_bug.cgi?id=848149
    And, very likely:
    	https://bbs.archlinux.org/viewtopic.php?id=148033
    	https://bugzilla.kernel.org/show_bug.cgi?id=47171

    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Use csrow->channels[chan].label not csrow->channels[chan]->dimm->label]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fb35bbb9a046982828c481137aebe8566ee9c074
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Thu Sep 13 16:06:48 2012 +0200

    MISC: hpilo, remove pci_disable_device

    commit bcdee04ea7ae0406ae69094f6df1aacb66a69a0b upstream.

    pci_disable_device(pdev) used to be in pci remove function. But this
    PCI device has two functions with interrupt lines connected to a
    single pin. The other one is a USB host controller. So when we disable
    the PIN there e.g. by rmmod hpilo, the controller stops working. It is
    because the interrupt link is disabled in ACPI since it is not
    refcounted yet. See acpi_pci_link_free_irq called from
    acpi_pci_irq_disable.

    It is not the best solution whatsoever, but as a workaround until the
    ACPI irq link refcounting is sorted out this should fix the reported
    errors.

    References: https://lkml.org/lkml/2008/11/4/535

    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Grant Grundler <grundler@parisc-linux.org>
    Cc: Nobin Mathew <nobin.mathew@gmail.com>
    Cc: Robert Hancock <hancockr@shaw.ca>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: David Altobelli <david.altobelli@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85923c3d426b2059121171c042ccd82fc1beab21
Author: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Date:   Mon Aug 27 20:56:54 2012 -0300

    floppy: properly handle failure on add_disk loop

    commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream.

    On floppy initialization, if something failed inside the loop we call
    add_disk, there was no cleanup of previous iterations in the error
    handling.

    Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ad4751d31602b7e5334e3c9d6cd488ca35d0b89c
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Fri Sep 28 10:29:21 2012 -0700

    Input: synaptics - adjust threshold for treating position values as negative

    commit 824efd37415961d38821ecbd9694e213fb2e8b32 upstream.

    Commit c039450 (Input: synaptics - handle out of bounds values from the
    hardware) caused any hardware reported values over 7167 to be treated as
    a wrapped-around negative value. It turns out that some firmware uses
    the value 8176 to indicate a finger near the edge of the touchpad whose
    actual position cannot be determined. This value now gets treated as
    negative, which can cause pointer jumps and broken edge scrolling on
    these machines.

    I only know of one touchpad which reports negative values, and this
    hardware never reports any value lower than -8 (i.e. 8184). Moving the
    threshold for treating a value as negative up to 8176 should work fine
    then for any hardware we currently know about, and since we're dealing
    with unspecified behavior it's probably the best we can do. The special
    8176 value is also likely to result in sudden jumps in position, so
    let's also clamp this to the maximum specified value for the axis.

    BugLink: http://bugs.launchpad.net/bugs/1046512
    https://bugzilla.kernel.org/show_bug.cgi?id=46371

    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
    Tested-by: Alan Swanson <swanson@ukfsn.org>
    Tested-by: Arteom <arutemus@gmail.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b2d995371398e957f9bde58786b719162434f0aa
Author: Matthieu CASTET <matthieu.castet@parrot.com>
Date:   Wed Aug 22 16:03:46 2012 +0200

    UBI: erase free PEB with bitflip in EC header

    commit 193819cf2e6e395b1e1be2d36785dc5563a6edca upstream.

    Without this patch, these PEB are not scrubbed until we put data in them.
    Bitflip can accumulate latter and we can loose the EC header (but VID header
    should be intact and allow to recover data).

    Signed-off-by: Matthieu Castet <matthieu.castet@parrot.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    [bwh: Backported to 3.2: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70e8fcb681a1f43568778bbb74b7ad2655fa8e74
Author: Rashika Kheria <rashika.kheria@gmail.com>
Date:   Wed Oct 30 18:36:32 2013 +0530

    Staging: zram: Fix access of NULL pointer

    commit 46a51c80216cb891f271ad021f59009f34677499 upstream.

    This patch fixes the bug in reset_store caused by accessing NULL pointer.

    The bdev gets its value from bdget_disk() which could fail when memory
    pressure is severe and hence can return NULL because allocation of
    inode in bdget could fail.

    Hence, this patch introduces a check for bdev to prevent reference to a
    NULL pointer in the later part of the code. It also removes unnecessary
    check of bdev for fsync_bdev().

    Acked-by: Jerome Marchand <jmarchan@redhat.com>
    Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com>
    Acked-by: Minchan Kim <minchan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1f6074590c50b7a7bc1ef49ff02d749664b9d46d
Author: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Date:   Sat Jun 22 17:21:00 2013 +0300

    zram: allow request end to coincide with disksize

    commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.

    Pass valid_io_request() checks if request end coincides with disksize
    (end equals bound), only fail if we attempt to read beyond the bound.

    mkfs.ext2 produces numerous errors:
    [ 2164.632747] quiet_error: 1 callbacks suppressed
    [ 2164.633260] Buffer I/O error on device zram0, logical block 153599
    [ 2164.633265] lost page write due to I/O error on zram0

    Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3ec6e7a5ba399b324470aae720b3696049fb3e2
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Jun 7 00:07:26 2013 +0800

    zram: avoid access beyond the zram device

    commit 12a7ad3b810e77137d0caf97a6dd97591e075b30 upstream.

    Function valid_io_request() should verify the entire request are within
    the zram device address range. Otherwise it may cause invalid memory
    access when accessing/modifying zram->meta->table[index] because the
    'index' is out of range. Then it may access non-exist memory, randomly
    modify memory belong to other subsystems, which is hard to track down.

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 11fc2ee51436c4bbcf9872ed3d31457490e071de
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Jun 7 00:07:24 2013 +0800

    zram: destroy all devices on error recovery path in zram_init()

    commit 39a9b8ac9333e4268ecff7da6c9d1ab3823ff243 upstream.

    On error recovery path of zram_init(), it leaks the zram device object
    causing the failure. So change create_device() to free allocated
    resources on error path.

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Acked-by: Minchan Kim <minchan@kernel.org>
    Acked-by: Jerome Marchand <jmarchan@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e84bf6dcac8cdf4bbe10b238efe8bf3c85012dd
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Jun 7 00:07:22 2013 +0800

    zram: avoid invalid memory access in zram_exit()

    commit 6030ea9b35971a4200062f010341ab832e878ac9 upstream.

    Memory for zram->disk object may have already been freed after returning
    from destroy_device(zram), then it's unsafe for zram_reset_device(zram)
    to access zram->disk again.

    We can't solve this bug by flipping the order of destroy_device(zram)
    and zram_reset_device(zram), that will cause deadlock issues to the
    zram sysfs handler.

    So fix it by holding an extra reference to zram->disk before calling
    destroy_device(zram).

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74eb879bd073a9a40b7f33ebc551b4510337b4e3
Author: Minchan Kim <minchan@kernel.org>
Date:   Wed Jan 30 11:41:39 2013 +0900

    zram: Fix deadlock bug in partial read/write

    commit 7e5a5104c6af709a8d97d5f4711e7c917761d464 upstream.

    Now zram allocates new page with GFP_KERNEL in zram I/O path
    if IO is partial. Unfortunately, It may cause deadlock with
    reclaim path like below.

    write_page from fs
    fs_lock
    allocation(GFP_KERNEL)
    reclaim
    pageout
    				write_page from fs
    				fs_lock <-- deadlock

    This patch fixes it by using GFP_NOIO.  In read path, we
    reorganize code flow so that kmap_atomic is called after the
    GFP_NOIO allocation.

    Acked-by: Jerome Marchand <jmarchand@redhat.com>
    Acked-by: Nitin Gupta <ngupta@vflare.org>
    [ penberg@kernel.org: don't use GFP_ATOMIC ]
    Signed-off-by: Pekka Enberg <penberg@kernel.org>
    Signed-off-by: Minchan Kim <minchan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: no reordering is needed in the read path]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 87dba703d0d9eb4352506dbd8f8878e3e2ee92f0
Author: Joe Thornber <ejt@redhat.com>
Date:   Wed Mar 20 17:21:24 2013 +0000

    dm thin: fix discard corruption

    commit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.

    Fix a bug in dm_btree_remove that could leave leaf values with incorrect
    reference counts.  The effect of this was that removal of a shared block
    could result in the space maps thinking the block was no longer used.
    More concretely, if you have a thin device and a snapshot of it, sending
    a discard to a shared region of the thin could corrupt the snapshot.

    Thinp uses a 2-level nested btree to store it's mappings.  This first
    level is indexed by thin device, and the second level by logical
    block.

    Often when we're removing an entry in this mapping tree we need to
    rebalance nodes, which can involve shadowing them, possibly creating a
    copy if the block is shared.  If we do create a copy then children of
    that node need to have their reference counts incremented.  In this
    way reference counts percolate down the tree as shared trees diverge.

    The rebalance functions were incrementing the children at the
    appropriate time, but they were always assuming the children were
    internal nodes.  This meant the leaf values (in our case packed
    block/flags entries) were not being incremented.

    Signed-off-by: Joe Thornber <ejt@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    [bwh: Backported to 3.2: bump target version numbers from 1.0.1 to 1.0.2]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [xr: Backported to 3.4: bump target version numbers to 1.1.1]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e301eba0a521b3682aec467eb13a94dd6c4027a
Author: Shiva Krishna Merla <shivakrishna.merla@netapp.com>
Date:   Wed Oct 30 03:26:38 2013 +0000

    dm mpath: fix race condition between multipath_dtr and pg_init_done

    commit 954a73d5d3073df2231820c718fdd2f18b0fe4c9 upstream.

    Whenever multipath_dtr() is happening we must prevent queueing any
    further path activation work.  Implement this by adding a new
    'pg_init_disabled' flag to the multipath structure that denotes future
    path activation work should be skipped if it is set.  By disabling
    pg_init and then re-enabling in flush_multipath_work() we also avoid the
    potential for pg_init to be initiated while suspending an mpath device.

    Without this patch a race condition exists that may result in a kernel
    panic:

    1) If after pg_init_done() decrements pg_init_in_progress to 0, a call
       to wait_for_pg_init_completion() assumes there are no more pending path
       management commands.
    2) If pg_init_required is set by pg_init_done(), due to retryable
       mode_select errors, then process_queued_ios() will again queue the
       path activation work.
    3) If free_multipath() completes before activate_path() work is called a
       NULL pointer dereference like the following can be seen when
       accessing members of the recently destructed multipath:

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
    RIP: 0010:[<ffffffffa003db1b>]  [<ffffffffa003db1b>] activate_path+0x1b/0x30 [dm_multipath]
    [<ffffffff81090ac0>] worker_thread+0x170/0x2a0
    [<ffffffff81096c80>] ? autoremove_wake_function+0x0/0x40

    [switch to disabling pg_init in flush_multipath_work & header edits by Mike Snitzer]
    Signed-off-by: Shiva Krishna Merla <shivakrishna.merla@netapp.com>
    Reviewed-by: Krishnasamy Somasundaram <somasundaram.krishnasamy@netapp.com>
    Tested-by: Speagle Andy <Andy.Speagle@netapp.com>
    Acked-by: Junichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Bump version to 1.3.2 not 1.6.0]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [xr: Backported to 3.4: Adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d110fd5113953b6f539dee75dbabd9a86dce790f
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Fri Nov 29 18:13:37 2013 -0500

    dm snapshot: avoid snapshot space leak on crash

    commit 230c83afdd9cd384348475bea1e14b80b3b6b1b8 upstream.

    There is a possible leak of snapshot space in case of crash.

    The reason for space leaking is that chunks in the snapshot device are
    allocated sequentially, but they are finished (and stored in the metadata)
    out of order, depending on the order in which copying finished.

    For example, supposed that the metadata contains the following records
    SUPERBLOCK
    METADATA (blocks 0 ... 250)
    DATA 0
    DATA 1
    DATA 2
    ...
    DATA 250

    Now suppose that you allocate 10 new data blocks 251-260. Suppose that
    copying of these blocks finish out of order (block 260 finished first
    and the block 251 finished last). Now, the snapshot device looks like
    this:
    SUPERBLOCK
    METADATA (blocks 0 ... 250, 260, 259, 258, 257, 256)
    DATA 0
    DATA 1
    DATA 2
    ...
    DATA 250
    DATA 251
    DATA 252
    DATA 253
    DATA 254
    DATA 255
    METADATA (blocks 255, 254, 253, 252, 251)
    DATA 256
    DATA 257
    DATA 258
    DATA 259
    DATA 260

    Now, if the machine crashes after writing the first metadata block but
    before writing the second metadata block, the space for areas DATA 250-255
    is leaked, it contains no valid data and it will never be used in the
    future.

    This patch makes dm-snapshot complete exceptions in the same order they
    were allocated, thus fixing this bug.

    Note: when backporting this patch to the stable kernel, change the version
    field in the following way:
    * if version in the stable kernel is {1, 11, 1}, change it to {1, 12, 0}
    * if version in the stable kernel is {1, 10, 0} or {1, 10, 1}, change it
      to {1, 10, 2}
    Userspace reads the version to determine if the bug was fixed, so the
    version change is needed.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    [xr: Backported to 3.4: adjust version]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4834ca940bf17fd203487ad93b69276ebff49688
Author: Harshula Jayasuriya <harshula@redhat.com>
Date:   Tue Jul 23 14:21:35 2013 +1000

    nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file

    commit e4daf1ffbe6cc3b12aab4d604e627829e93e9914 upstream.

    The following call chain:
    ------------------------------------------------------------
    nfs4_get_vfs_file
    - nfsd_open
      - dentry_open
        - do_dentry_open
          - __get_file_write_access
            - get_write_access
              - return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY;
    ------------------------------------------------------------

    can result in the following state:
    ------------------------------------------------------------
    struct nfs4_file {
    ...
      fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0},
      fi_access = {{
          counter = 0x1
        }, {
          counter = 0x0
        }},
    ...
    ------------------------------------------------------------

    1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
    NULL, hence nfsd_open() is called where we get status set to an error
    and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach
    nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented.

    2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
    NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but
    nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented.
    Thus we leave a landmine in the form of the nfs4_file data structure in
    an incorrect state.

    3) Eventually, when __nfs4_file_put_access() is called it finds
    fi_access[O_WRONLY] being non-zero, it decrements it and calls
    nfs4_file_put_fd() which tries to fput -ETXTBSY.
    ------------------------------------------------------------
    ...
         [exception RIP: fput+0x9]
         RIP: ffffffff81177fa9  RSP: ffff88062e365c90  RFLAGS: 00010282
         RAX: ffff880c2b3d99cc  RBX: ffff880c2b3d9978  RCX: 0000000000000002
         RDX: dead000000100101  RSI: 0000000000000001  RDI: ffffffffffffffe6
         RBP: ffff88062e365c90   R8: ffff88041fe797d8   R9: ffff88062e365d58
         R10: 0000000000000008  R11: 0000000000000000  R12: 0000000000000001
         R13: 0000000000000007  R14: 0000000000000000  R15: 0000000000000000
         ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
      #9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd]
     #10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd]
     #11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd]
     #12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd]
     #13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd]
     #14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd]
     #15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd]
     #16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc]
     #17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc]
     #18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd]
     #19 [ffff88062e365ee8] kthread at ffffffff81090886
     #20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a
    ------------------------------------------------------------

    Signed-off-by: Harshula Jayasuriya <harshula@redhat.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 352f526f91dca8673d9be1ba3166411fd8fea918
Author: NeilBrown <neilb@suse.de>
Date:   Thu Sep 27 12:35:21 2012 +1000

    md/raid10: fix "enough" function for detecting if array is failed.

    commit 80b4812407c6b1f66a4f2430e69747a13f010839 upstream.

    The 'enough' function is written to work with 'near' arrays only
    in that is implicitly assumes that the offset from one 'group' of
    devices to the next is the same as the number of copies.
    In reality it is the number of 'near' copies.

    So change it to make this number explicit.

    This bug makes it possible to run arrays without enough drives
    present, which is dangerous.
    It is appropriate for an -stable kernel, but will almost certainly
    need to be modified for some of them.

    Reported-by: Jakub Husák <jakub@gooseman.cz>
    Signed-off-by: NeilBrown <neilb@suse.de>
    [bwh: Backported to 3.2: s/geo->/conf->/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4bf93019b63da30c8f9e9edb436862998865865
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Fri Mar 1 22:45:47 2013 +0000

    dm snapshot: add missing module aliases

    commit 23cb21092eb9dcec9d3604b68d95192b79915890 upstream.

    Add module aliases so that autoloading works correctly if the user
    tries to activate "snapshot-origin" or "snapshot-merge" targets.

    Reference: https://bugzilla.redhat.com/889973

    Reported-by: Chao Yang <chyang@redhat.com>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bed74df4fd8380c87adb576c121f40cb1037435b
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Fri May 10 14:37:15 2013 +0100

    dm bufio: avoid a possible __vmalloc deadlock

    commit 502624bdad3dba45dfaacaf36b7d83e39e74b2d2 upstream.

    This patch uses memalloc_noio_save to avoid a possible deadlock in
    dm-bufio.  (it could happen only with large block size, at most
    PAGE_SIZE << MAX_ORDER (typically 8MiB).

    __vmalloc doesn't fully respect gfp flags. The specified gfp flags are
    used for allocation of requested pages, structures vmap_area, vmap_block
    and vm_struct and the radix tree nodes.

    However, the kernel pagetables are allocated always with GFP_KERNEL.
    Thus the allocation of pagetables can recurse back to the I/O layer and
    cause a deadlock.

    This patch uses the function memalloc_noio_save to set per-process
    PF_MEMALLOC_NOIO flag and the function memalloc_noio_restore to restore
    it. When this flag is set, all allocations in the process are done with
    implied GFP_NOIO flag, thus the deadlock can't happen.

    This should be backported to stable kernels, but they don't have the
    PF_MEMALLOC_NOIO flag and memalloc_noio_save/memalloc_noio_restore
    functions. So, PF_MEMALLOC should be set and restored instead.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    [bwh: Backported to 3.2 as recommended]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ba7959277325911b09944c5aedf3c4bf139be2f2
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Wed Jan 30 13:04:10 2013 -0500

    NFSv4.1: Handle NFS4ERR_DELAY when resetting the NFSv4.1 session

    commit c489ee290bdbbace6bb63ebe6ebd4dd605819495 upstream.

    NFS4ERR_DELAY is a legal reply when we call DESTROY_SESSION. It
    usually means that the server is busy handling an unfinished RPC
    request. Just sleep for a second and then retry.
    We also need to be able to handle the NFS4ERR_BACK_CHAN_BUSY return
    value. If the NFS server has outstanding callbacks, we just want to
    similarly sleep & retry.

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c5fa16a931d8c8297bff1da1cdb98a6fb8f3377
Author: Weston Andros Adamson <dros@netapp.com>
Date:   Fri Feb 15 16:03:46 2013 -0500

    NFSv4.1: Don't decode skipped layoutgets

    commit 085b7a45c63d3da5be155faab9249a5cab224561 upstream.

    layoutget's prepare hook can call rpc_exit with status = NFS4_OK (0).
    Because of this, nfs4_proc_layoutget can't depend on a 0 status to mean
    that the RPC was successfully sent, received and parsed.

    To fix this, use the result's len member to see if parsing took place.

    This fixes the following OOPS -- calling xdr_init_decode() with a buffer length
    0 doesn't set the stream's 'p' member and ends up using uninitialized memory
    in filelayout_decode_layout.

    BUG: unable to handle kernel paging request at 0000000000008050
    IP: [<ffffffff81282e78>] memcpy+0x18/0x120
    PGD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/irq
    CPU 1
    Modules linked in: nfs_layout_nfsv41_files nfs lockd fscache auth_rpcgss nfs_acl autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_mirror dm_region_hash dm_log dm_mod ppdev parport_pc parport snd_ens1371 snd_rawmidi snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000 microcode vmware_balloon i2c_piix4 i2c_core sg shpchp ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix mptspi mptscsih mptbase scsi_transport_spi [last unloaded: speedstep_lib]

    Pid: 1665, comm: flush-0:22 Not tainted 2.6.32-356-test-2 #2 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
    RIP: 0010:[<ffffffff81282e78>]  [<ffffffff81282e78>] memcpy+0x18/0x120
    RSP: 0018:ffff88003dfab588  EFLAGS: 00010206
    RAX: ffff88003dc42000 RBX: ffff88003dfab610 RCX: 0000000000000009
    RDX: 000000003f807ff0 RSI: 0000000000008050 RDI: ffff88003dc42000
    RBP: ffff88003dfab5b0 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000080 R12: 0000000000000024
    R13: ffff88003dc42000 R14: ffff88003f808030 R15: ffff88003dfab6a0
    FS:  0000000000000000(0000) GS:ffff880003420000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 0000000000008050 CR3: 000000003bc92000 CR4: 00000000001407e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process flush-0:22 (pid: 1665, threadinfo ffff88003dfaa000, task ffff880037f77540)
    Stack:
    ffffffffa0398ac1 ffff8800397c5940 ffff88003dfab610 ffff88003dfab6a0
    <d> ffff88003dfab5d0 ffff88003dfab680 ffffffffa01c150b ffffea0000d82e70
    <d> 000000508116713b 0000000000000000 0000000000000000 0000000000000000
    Call Trace:
    [<ffffffffa0398ac1>] ? xdr_inline_decode+0xb1/0x120 [sunrpc]
    [<ffffffffa01c150b>] filelayout_decode_layout+0xeb/0x350 [nfs_layout_nfsv41_files]
    [<ffffffffa01c17fc>] filelayout_alloc_lseg+0x8c/0x3c0 [nfs_layout_nfsv41_files]
    [<ffffffff8150e6ce>] ? __wait_on_bit+0x7e/0x90

    Signed-off-by: Weston Andros Adamson <dros@netapp.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 079ee145e792069d09ebd0aaa4e6574cc35ca676
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Wed Mar 20 12:34:32 2013 -0400

    NFSv4.1: Fix a race in pNFS layoutcommit

    commit a073dbff359f4741013ae4b8395f5364c5e00b48 upstream.

    We need to clear the NFS_LSEG_LAYOUTCOMMIT bits atomically with the
    NFS_INO_LAYOUTCOMMIT bit, otherwise we may end up with situations
    where the two are out of sync.
    The first half of the problem is to ensure that pnfs_layoutcommit_inode
    clears the NFS_LSEG_LAYOUTCOMMIT bit through pnfs_list_write_lseg.
    We still need to keep the reference to those segments until the RPC call
    is finished, so in order to make it clear _where_ those references come
    from, we add a helper pnfs_list_write_lseg_done() that cleans up after
    pnfs_list_write_lseg.

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Acked-by: Benny Halevy <bhalevy@tonian.com>
    [bwh: Backported to 3.2: s/pnfs_put_lseg/put_lseg/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f40661f4d28ae5060a88117f8a37e2d63e659b5f
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Wed Jul 11 16:30:32 2012 -0400

    NFS: nfs_getaclargs.acl_len is a size_t

    commit 56d08fef2369d5ca9ad2e1fc697f5379fd8af751 upstream.

    Squelch compiler warnings:

    fs/nfs/nfs4proc.c: In function ‘__nfs4_get_acl_uncached’:
    fs/nfs/nfs4proc.c:3811:14: warning: comparison between signed and
    	unsigned integer expressions [-Wsign-compare]
    fs/nfs/nfs4proc.c:3818:15: warning: comparison between signed and
    	unsigned integer expressions [-Wsign-compare]

    Introduced by commit bf118a34 "NFSv4: include bitmap in nfsv4 get
    acl data", Dec 7, 2011.

    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 79854e6ee54195b89217e72fb0443c49e158c3bd
Author: fanchaoting <fanchaoting@cn.fujitsu.com>
Date:   Mon Apr 1 21:07:22 2013 +0800

    nfsd: don't run get_file if nfs4_preprocess_stateid_op return error

    commit b022032e195ffca83d7002d6b84297d796ed443b upstream.

    we should return error status directly when nfs4_preprocess_stateid_op
    return error.

    Signed-off-by: fanchaoting <fanchaoting@cn.fujitsu.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42b607da2d04e91439ba58d263e90a70d0243388
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Jun 12 10:37:08 2012 +0300

    NFSv4.1: integer overflow in decode_cb_sequence_args()

    commit 0439f31c35d1da0b28988b308ea455e38e6a350d upstream.

    This seems like it could overflow on 32 bits.  Use kmalloc_array() which
    has overflow protection built in.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ca36e74e1b126d0e02987a23bbe0b59922f4c548
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Nov 19 17:32:43 2013 -0500

    nfsd4: fix xdr decoding of large non-write compounds

    commit 365da4adebb1c012febf81019ad3dc5bb52e2a13 upstream.

    This fixes a regression from 247500820ebd02ad87525db5d9b199e5b66f6636
    "nfsd4: fix decoding of compounds across page boundaries".  The previous
    code was correct: argp->pagelist is initialized in
    nfs4svc_deocde_compoundargs to rqstp->rq_arg.pages, and is therefore a
    pointer to the page *after* the page we are currently decoding.

    The reason that patch nevertheless fixed a problem with decoding
    compounds containing write was a bug in the write decoding introduced by
    5a80a54d21c96590d013378d8c5f65f879451ab4 "nfsd4: reorganize write
    decoding", after which write decoding no longer adhered to the rule that
    argp->pagelist point to the next page.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [bwh: Backported to 3.2: adjust context; there is only one instance to fix]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e9d735ee08140122dfab5752ab54ed506f2100dd
Author: Andy Adamson <andros@netapp.com>
Date:   Fri Nov 15 16:36:16 2013 -0500

    NFSv4 wait on recovery for async session errors

    commit 4a82fd7c4e78a1b7a224f9ae8bb7e1fd95f670e0 upstream.

    When the state manager is processing the NFS4CLNT_DELEGRETURN flag, session
    draining is off, but DELEGRETURN can still get a session error.
    The async handler calls nfs4_schedule_session_recovery returns -EAGAIN, and
    the DELEGRETURN done then restarts the RPC task in the prepare state.
    With the state manager still processing the NFS4CLNT_DELEGRETURN flag with
    session draining off, these DELEGRETURNs will cycle with errors filling up the
    session slots.

    This prevents OPEN reclaims (from nfs_delegation_claim_opens) required by the
    NFS4CLNT_DELEGRETURN state manager processing from completing, hanging the
    state manager in the __rpc_wait_for_completion_task in nfs4_run_open_task
    as seen in this kernel thread dump:

    kernel: 4.12.32.53-ma D 0000000000000000     0  3393      2 0x00000000
    kernel: ffff88013995fb60 0000000000000046 ffff880138cc5400 ffff88013a9df140
    kernel: ffff8800000265c0 ffffffff8116eef0 ffff88013fc10080 0000000300000001
    kernel: ffff88013a4ad058 ffff88013995ffd8 000000000000fbc8 ffff88013a4ad058
    kernel: Call Trace:
    kernel: [<ffffffff8116eef0>] ? cache_alloc_refill+0x1c0/0x240
    kernel: [<ffffffffa0358110>] ? rpc_wait_bit_killable+0x0/0xa0 [sunrpc]
    kernel: [<ffffffffa0358152>] rpc_wait_bit_killable+0x42/0xa0 [sunrpc]
    kernel: [<ffffffff8152914f>] __wait_on_bit+0x5f/0x90
    kernel: [<ffffffffa0358110>] ? rpc_wait_bit_killable+0x0/0xa0 [sunrpc]
    kernel: [<ffffffff815291f8>] out_of_line_wait_on_bit+0x78/0x90
    kernel: [<ffffffff8109b520>] ? wake_bit_function+0x0/0x50
    kernel: [<ffffffffa035810d>] __rpc_wait_for_completion_task+0x2d/0x30 [sunrpc]
    kernel: [<ffffffffa040d44c>] nfs4_run_open_task+0x11c/0x160 [nfs]
    kernel: [<ffffffffa04114e7>] nfs4_open_recover_helper+0x87/0x120 [nfs]
    kernel: [<ffffffffa0411646>] nfs4_open_recover+0xc6/0x150 [nfs]
    kernel: [<ffffffffa040cc6f>] ? nfs4_open_recoverdata_alloc+0x2f/0x60 [nfs]
    kernel: [<ffffffffa0414e1a>] nfs4_open_delegation_recall+0x6a/0xa0 [nfs]
    kernel: [<ffffffffa0424020>] nfs_end_delegation_return+0x120/0x2e0 [nfs]
    kernel: [<ffffffff8109580f>] ? queue_work+0x1f/0x30
    kernel: [<ffffffffa0424347>] nfs_client_return_marked_delegations+0xd7/0x110 [nfs]
    kernel: [<ffffffffa04225d8>] nfs4_run_state_manager+0x548/0x620 [nfs]
    kernel: [<ffffffffa0422090>] ? nfs4_run_state_manager+0x0/0x620 [nfs]
    kernel: [<ffffffff8109b0f6>] kthread+0x96/0xa0
    kernel: [<ffffffff8100c20a>] child_rip+0xa/0x20
    kernel: [<ffffffff8109b060>] ? kthread+0x0/0xa0
    kernel: [<ffffffff8100c200>] ? child_rip+0x0/0x20

    The state manager can not therefore process the DELEGRETURN session errors.
    Change the async handler to wait for recovery on session errors.

    Signed-off-by: Andy Adamson <andros@netapp.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - There's no restart_call label]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 38feb080dcee05067222c77c32286710de2cba6d
Author: Mateusz Guzik <mguzik@redhat.com>
Date:   Fri Mar 8 16:30:03 2013 +0100

    cifs: delay super block destruction until all cifsFileInfo objects are gone

    commit 24261fc23db950951760d00c188ba63cc756b932 upstream.

    cifsFileInfo objects hold references to dentries and it is possible that
    these will still be around in workqueues when VFS decides to kill super
    block during unmount.

    This results in panics like this one:
    BUG: Dentry ffff88001f5e76c0{i=66b4a,n=1M-2} still in use (1) [unmount of cifs cifs]
    ------------[ cut here ]------------
    kernel BUG at fs/dcache.c:943!
    [..]
    Process umount (pid: 1781, threadinfo ffff88003d6e8000, task ffff880035eeaec0)
    [..]
    Call Trace:
     [<ffffffff811b44f3>] shrink_dcache_for_umount+0x33/0x60
     [<ffffffff8119f7fc>] generic_shutdown_super+0x2c/0xe0
     [<ffffffff8119f946>] kill_anon_super+0x16/0x30
     [<ffffffffa036623a>] cifs_kill_sb+0x1a/0x30 [cifs]
     [<ffffffff8119fcc7>] deactivate_locked_super+0x57/0x80
     [<ffffffff811a085e>] deactivate_super+0x4e/0x70
     [<ffffffff811bb417>] mntput_no_expire+0xd7/0x130
     [<ffffffff811bc30c>] sys_umount+0x9c/0x3c0
     [<ffffffff81657c19>] system_call_fastpath+0x16/0x1b

    Fix this by making each cifsFileInfo object hold a reference to cifs
    super block, which implicitly keeps VFS super block around as well.

    Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Reported-and-Tested-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b67aeff9256ad337e22b0f3b228b7ec01ff2a20
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Apr 28 14:55:17 2012 -0700

    VFS: make vfs_fstat() use f[get|put]_light()

    commit e994defb7b6813ba6fa7a2a36e86d2455ad1dc35 upstream.

    Use the *_light() versions that properly avoid doing the file user count
    updates when they are unnecessary.

    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [xr: Backported to 3.4: adjust function name]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4652951d1202cef2798b1a0dfbf4122794594b41
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Thu Mar 14 14:20:54 2013 -0400

    tracing: Keep overwrite in sync between regular and snapshot buffers

    commit 80902822658aab18330569587cdb69ac1dfdcea8 upstream.

    Changing the overwrite mode for the ring buffer via the trace
    option only sets the normal buffer. But the snapshot buffer could
    swap with it, and then the snapshot would be in non overwrite mode
    and the normal buffer would be in overwrite mode, even though the
    option flag states otherwise.

    Keep the two buffers overwrite modes in sync.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 926685e95e4d6518110794b77676b3bb7f9c4be0
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Fri Apr 12 11:05:54 2013 +0800

    perf: Fix error return code

    commit c481420248c6730246d2a1b1773d5d7007ae0835 upstream.

    Fix to return -ENOMEM in the allocation error case instead of 0
    (if pmu_bus_running == 1), as done elsewhere in this function.

    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Cc: a.p.zijlstra@chello.nl
    Cc: paulus@samba.org
    Cc: acme@ghostprotocols.net
    Link: http://lkml.kernel.org/r/CAPgLHd8j_fWcgqe%3DKLWjpBj%2B%3Do0Pw6Z-SEq%3DNTPU08c2w1tngQ@mail.gmail.com
    [ Tweaked the error code setting placement and the changelog. ]
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5f1ec5d39f6d59bfe5c53f4b28a94e3a4245e02
Author: libin <huawei.libin@huawei.com>
Date:   Mon Apr 8 14:39:12 2013 +0800

    sched/debug: Fix sd->*_idx limit range avoiding overflow

    commit fd9b86d37a600488dbd80fe60cca46b822bff1cd upstream.

    Commit 201c373e8e ("sched/debug: Limit sd->*_idx range on
    sysctl") was an incomplete bug fix.

    This patch fixes sd->*_idx limit range to [0 ~ CPU_LOAD_IDX_MAX-1]
    avoiding array overflow caused by setting sd->*_idx to CPU_LOAD_IDX_MAX
    on sysctl.

    Signed-off-by: Libin <huawei.libin@huawei.com>
    Cc: <jiang.liu@huawei.com>
    Cc: <guohanjun@huawei.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/51626610.2040607@huawei.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4aff95ab8f985d14f585187b5f78c65a56dd716b
Author: Namhyung Kim <namhyung.kim@lge.com>
Date:   Thu Aug 16 17:03:24 2012 +0900

    sched/debug: Limit sd->*_idx range on sysctl

    commit 201c373e8e4823700d3160d5c28e1ab18fd1193e upstream.

    Various sd->*_idx's are used for refering the rq's load average table
    when selecting a cpu to run.  However they can be set to any number
    with sysctl knobs so that it can crash the kernel if something bad is
    given. Fix it by limiting them into the actual range.

    Signed-off-by: Namhyung Kim <namhyung@kernel.org>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/r/1345104204-8317-1-git-send-email-namhyung@kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74d86ed74b4ddf37de24a9ad979a8aafd2d4c25f
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Tue Jul 30 00:04:32 2013 -0400

    ftrace: Check module functions being traced on reload

    commit 8c4f3c3fa9681dc549cd35419b259496082fef8b upstream.

    There's been a nasty bug that would show up and not give much info.
    The bug displayed the following warning:

     WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
     Pid: 20903, comm: bash Tainted: G           O 3.6.11+ #38405.trunk
     Call Trace:
      [<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
      [<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
      [<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
      [<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
      [<ffffffff811401cc>] ? kfree+0x2c/0x110
      [<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
      [<ffffffff81149f1e>] __fput+0xae/0x220
      [<ffffffff8114a09e>] ____fput+0xe/0x10
      [<ffffffff8105fa22>] task_work_run+0x72/0x90
      [<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
      [<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
      [<ffffffff815c0f88>] int_signal+0x12/0x17
     ---[ end trace 793179526ee09b2c ]---

    It was finally narrowed down to unloading a module that was being traced.

    It was actually more than that. When functions are being traced, there's
    a table of all functions that have a ref count of the number of active
    tracers attached to that function. When a function trace callback is
    registered to a function, the function's record ref count is incremented.
    When it is unregistered, the function's record ref count is decremented.
    If an inconsistency is detected (ref count goes below zero) the above
    warning is shown and the function tracing is permanently disabled until
    reboot.

    The ftrace callback ops holds a hash of functions that it filters on
    (and/or filters off). If the hash is empty, the default means to filter
    all functions (for the filter_hash) or to disable no functions (for the
    notrace_hash).

    When a module is unloaded, it frees the function records that represent
    the module functions. These records exist on their own pages, that is
    function records for one module will not exist on the same page as
    function records for other modules or even the core kernel.

    Now when a module unloads, the records that represents its functions are
    freed. When the module is loaded again, the records are recreated with
    a default ref count of zero (unless there's a callback that traces all
    functions, then they will also be traced, and the ref count will be
    incremented).

    The problem is that if an ftrace callback hash includes functions of the
    module being unloaded, those hash entries will not be removed. If the
    module is reloaded in the same location, the hash entries still point
    to the functions of the module but the module's ref counts do not reflect
    that.

    With the help of Steve and Joern, we found a reproducer:

     Using uinput module and uinput_release function.

     cd /sys/kernel/debug/tracing
     modprobe uinput
     echo uinput_release > set_ftrace_filter
     echo function > current_tracer
     rmmod uinput
     modprobe uinput
     # check /proc/modules to see if loaded in same addr, otherwise try again
     echo nop > current_tracer

     [BOOM]

    The above loads the uinput module, which creates a table of functions that
    can be traced within the module.

    We add uinput_release to the filter_hash to trace just that function.

    Enable function tracincg, which increments the ref count of the record
    associated to uinput_release.

    Remove uinput, which frees the records including the one that represents
    uinput_release.

    Load the uinput module again (and make sure it's at the same address).
    This recreates the function records all with a ref count of zero,
    including uinput_release.

    Disable function tracing, which will decrement the ref count for uinput_release
    which is now zero because of the module removal and reload, and we have
    a mismatch (below zero ref count).

    The solution is to check all currently tracing ftrace callbacks to see if any
    are tracing any of the module's functions when a module is loaded (it already does
    that with callbacks that trace all functions). If a callback happens to have
    a module function being traced, it increments that records ref count and starts
    tracing that function.

    There may be a strange side effect with this, where tracing module functions
    on unload and then reloading a new module may have that new module's functions
    being traced. This may be something that confuses the user, but it's not
    a big deal. Another approach is to disable all callback hashes on module unload,
    but this leaves some ftrace callbacks that may not be registered, but can
    still have hashes tracing the module's function where ftrace doesn't know about
    it. That situation can cause the same bug. This solution solves that case too.
    Another benefit of this solution, is it is possible to trace a module's
    function on unload and load.

    Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com

    Reported-by: Jörn Engel <joern@logfs.org>
    Reported-by: Dave Jones <davej@redhat.com>
    Reported-by: Steve Hodgson <steve@purestorage.com>
    Tested-by: Steve Hodgson <steve@purestorage.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1fbbea7be9248d652fc2bb191e6ec9e823df422c
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Mon Oct 28 13:55:29 2013 +0100

    perf: Fix perf ring buffer memory ordering

    commit bf378d341e4873ed928dc3c636252e6895a21f50 upstream.

    The PPC64 people noticed a missing memory barrier and crufty old
    comments in the perf ring buffer code. So update all the comments and
    add the missing barrier.

    When the architecture implements local_t using atomic_long_t there
    will be double barriers issued; but short of introducing more
    conditional barrier primitives this is the best we can do.

    Reported-by: Victor Kaplansky <victork@il.ibm.com>
    Tested-by: Victor Kaplansky <victork@il.ibm.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
    Cc: michael@ellerman.id.au
    Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Michael Neuling <mikey@neuling.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: anton@samba.org
    Cc: benh@kernel.crashing.org
    Link: http://lkml.kernel.org/r/20131025173749.GG19466@laptop.lan
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76504c2489ad9e9bdc20fc8e24d23ac5e39b88b6
Author: Justin Lecher <jlec@gentoo.org>
Date:   Mon Jul 30 14:42:53 2012 -0700

    fs: cachefiles: add support for large files in filesystem caching

    commit 98c350cda2c14a343d34ea01a3d9c24fea5ec66d upstream.

    Support the caching of large files.

    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=31182

    Signed-off-by: Justin Lecher <jlec@gentoo.org>
    Signed-off-by: Suresh Jayaraman <sjayaraman@suse.com>
    Tested-by: Suresh Jayaraman <sjayaraman@suse.com>
    Acked-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - dentry_open() takes dentry and vfsmount pointers, not a path pointer]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e4191b3109e2399bda9192313cc1fb2a95681a6
Author: Geyslan G. Bem <geyslan@gmail.com>
Date:   Fri Oct 11 16:49:16 2013 -0300

    ecryptfs: Fix memory leakage in keystore.c

    commit 3edc8376c06133e3386265a824869cad03a4efd4 upstream.

    In 'decrypt_pki_encrypted_session_key' function:

    Initializes 'payload' pointer and releases it on exit.

    Signed-off-by: Geyslan G. Bem <geyslan@gmail.com>
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 47532a2912f1840809a23b733d2a5bdf09a906ee
Author: Pavel Shilovsky <pshilovsky@etersoft.ru>
Date:   Wed Aug 29 21:13:38 2012 +0400

    CIFS: Fix error handling in cifs_push_mandatory_locks

    commit e2f2886a824ff0a56da1eaa13019fde86aa89fa6 upstream.

    Signed-off-by: Pavel Shilovsky <pshilovsky@etersoft.ru>
    Signed-off-by: Steve French <smfrench@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afaf7f61a5fbb5e6e7d264519806453e805ebf40
Author: Steve French <smfrench@gmail.com>
Date:   Fri Nov 15 20:41:32 2013 -0600

    setfacl removes part of ACL when setting POSIX ACLs to Samba

    commit b1d93356427be6f050dc55c86eb019d173700af6 upstream.

    setfacl over cifs mounts can remove the default ACL when setting the
    (non-default part of) the ACL and vice versa (we were leaving at 0
    rather than setting to -1 the count field for the unaffected
    half of the ACL.  For example notice the setfacl removed
    the default ACL in this sequence:

    steven@steven-GA-970A-DS3:~/cifs-2.6$ getfacl /mnt/test-dir ; setfacl
    -m default:user:test:rwx,user:test:rwx /mnt/test-dir
    getfacl: Removing leading '/' from absolute path names
    user::rwx
    group::r-x
    other::r-x
    default:user::rwx
    default:user:test:rwx
    default:group::r-x
    default:mask::rwx
    default:other::r-x

    steven@steven-GA-970A-DS3:~/cifs-2.6$ getfacl /mnt/test-dir
    getfacl: Removing leading '/' from absolute path names
    user::rwx
    user:test:rwx
    group::r-x
    mask::rwx
    other::r-x

    Signed-off-by: Steve French <smfrench@gmail.com>
    Acked-by: Jeremy Allison <jra@samba.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c5e98d553d9cf7a76a5e9e390a568ac9cdd1aac
Author: Horia Geanta <horia.geanta@freescale.com>
Date:   Fri Apr 18 13:01:42 2014 +0300

    crypto: caam - add allocation failure handling in SPRINTFCAT macro

    commit 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 upstream.

    GFP_ATOMIC memory allocation could fail.
    In this case, avoid NULL pointer dereference and notify user.

    Cc: Kim Phillips <kim.phillips@freescale.com>
    Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7ad8d3dbd9f2f203e14c265e73e82f1fd8d4758e
Author: Du, Wenkai <wenkai.du@intel.com>
Date:   Thu Apr 10 23:03:19 2014 +0000

    i2c: designware: Mask all interrupts during i2c controller enable

    commit 47bb27e78867997040a228328f2a631c3c7f2c82 upstream.

    There have been "i2c_designware 80860F41:00: controller timed out" errors
    on a number of Baytrail platforms. The issue is caused by incorrect value in
    Interrupt Mask Register (DW_IC_INTR_MASK)  when i2c core is being enabled.
    This causes call to __i2c_dw_enable() to immediately start the transfer which
    leads to timeout. There are 3 failure modes observed:

    1. Failure in S0 to S3 resume path

    The default value after reset for DW_IC_INTR_MASK is 0x8ff. When we start
    the first transaction after resuming from system sleep, TX_EMPTY interrupt
    is already unmasked because of the hardware default.

    2. Failure in normal operational path

    This failure happens rarely and is hard to reproduce. Debug trace showed that
    DW_IC_INTR_MASK had value of 0x254 when failure occurred, which meant
    TX_EMPTY was unmasked.

    3. Failure in S3 to S0 suspend path

    This failure also happens rarely and is hard to reproduce. Adding debug trace
    that read DW_IC_INTR_MASK made this failure not reproducible. But from ISR
    call trace we could conclude TX_EMPTY was unmasked when problem occurred.

    The patch masks all interrupts before the controller is enabled to resolve the
    faulty DW_IC_INTR_MASK conditions.

    Signed-off-by: Wenkai Du <wenkai.du@intel.com>
    Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    [wsa: improved the comment and removed typo in commit msg]
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb09378539c61d236a373c1765f968a155a291cd
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon May 5 11:38:09 2014 +0200

    ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX

    commit f6e6e1b9fee88c90586787b71dc49bb3ce62bb89 upstream.

    Without this this EEE PC exports a non working WMI interface, with this it
    exports a working "good old" eeepc_laptop interface, fixing brightness control
    not working as well as rfkill being stuck in a permanent wireless blocked
    state.

    This is not an ideal way to fix this, but various attempts to fix this
    otherwise have failed, see:

    References: https://bugzilla.redhat.com/show_bug.cgi?id=1067181
    Reported-and-tested-by: lou.cardone@gmail.com
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5cc5b9c0f4acab5757785706528010288b52c2c
Author: Marcel Apfelbaum <marcel.a@redhat.com>
Date:   Thu May 15 12:42:49 2014 -0600

    PCI: shpchp: Check bridge's secondary (not primary) bus speed

    commit 93fa9d32670f5592c8e56abc9928fc194e1e72fc upstream.

    When a new device is added below a hotplug bridge, the bridge's secondary
    bus speed and the device's bus speed must match.  The shpchp driver
    previously checked the bridge's *primary* bus speed, not the secondary bus
    speed.

    This caused hot-add errors like:

      shpchp 0000:00:03.0: Speed of bus ff and adapter 0 mismatch

    Check the secondary bus speed instead.

    [bhelgaas: changelog]
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=75251
    Fixes: 3749c51ac6c1 ("PCI: Make current and maximum bus speeds part of the PCI core")
    Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 215990aad3c4f5312970ae2da206bcfff3ce720e
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed May 14 16:33:54 2014 -0700

    x86-64, modify_ldt: Make support for 16-bit segments a runtime option

    commit fa81511bb0bbb2b1aace3695ce869da9762624ff upstream.

    Checkin:

    b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

    disabled 16-bit segments on 64-bit kernels due to an information
    leak.  However, it does seem that people are genuinely using Wine to
    run old 16-bit Windows programs on Linux.

    A proper fix for this ("espfix64") is coming in the upcoming merge
    window, but as a temporary fix, create a sysctl to allow the
    administrator to re-enable support for 16-bit segments.

    It adds a "/proc/sys/abi/ldt16" sysctl that defaults to zero (off). If
    you hit this issue and care about your old Windows program more than
    you care about a kernel stack address information leak, you can do

       echo 1 > /proc/sys/abi/ldt16

    as root (add it to your startup scripts), and you should be ok.

    The sysctl table is only added if you have COMPAT support enabled on
    x86-64, but I assume anybody who runs old windows binaries very much
    does that ;)

    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Link: http://lkml.kernel.org/r/CA%2B55aFw9BPoD10U1LfHbOMpHWZkvJTkMcfCs9s3urPr1YyWBxw@mail.gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18390a2aba619ceb5cb38489c80cf438327ab11e
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Tue May 13 13:45:15 2014 +0100

    ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile

    commit 44330ab516c15dda8a1e660eeaf0003f84e43e3f upstream.

    The register CLASS_D_CONTROL_1 is marked as volatile because it contains
    a bit, DAC_MUTE, which is also mirrored in the ADC_DAC_CONTROL_1
    register. This causes problems for the "Speaker Switch" control, which
    will report an error if the CODEC is suspended because it relies on a
    volatile register.

    To resolve this issue mark CLASS_D_CONTROL_1 as non-volatile and
    manually keep the register cache in sync by updating both bits when
    changing the mute status.

    Reported-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Tested-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6baddd03b577bfdbf103570c0b3257679c99e267
Author: Jianyu Zhan <nasa4836@gmail.com>
Date:   Mon Apr 14 13:47:40 2014 +0800

    percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

    commit 5a838c3b60e3a36ade764cf7751b8f17d7c9c2da upstream.

    pcpu_chunk_struct_size = sizeof(struct pcpu_chunk) +
    	BITS_TO_LONGS(pcpu_unit_pages) * sizeof(unsigned long)

    It hardly could be ever bigger than PAGE_SIZE even for large-scale machine,
    but for consistency with its couterpart pcpu_mem_zalloc(),
    use pcpu_mem_free() instead.

    Commit b4916cb17c26 ("percpu: make pcpu_free_chunk() use
    pcpu_mem_free() instead of kfree()") addressed this problem, but
    missed this one.

    tj: commit message updated

    Signed-off-by: Jianyu Zhan <nasa4836@gmail.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Fixes: 099a19d91ca4 ("percpu: allow limited allocation before slab is online)
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a18e4c1145390fbedb21fd805dd1f155172d628a
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue May 20 15:55:21 2014 -0400

    nfsd4: remove lockowner when removing lock stateid

    commit a1b8ff4c97b4375d21b6d6c45d75877303f61b3b upstream.

    The nfsv4 state code has always assumed a one-to-one correspondance
    between lock stateid's and lockowners even if it appears not to in some
    places.

    We may actually change that, but for now when FREE_STATEID releases a
    lock stateid it also needs to release the parent lockowner.

    Symptoms were a subsequent LOCK crashing in find_lockowner_str when it
    calls same_lockowner_ino on a lockowner that unexpectedly has an empty
    so_stateids list.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d9eea1ccc7008c95043ad4076e50edeb37f1e865
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Thu May 8 11:19:41 2014 -0400

    nfsd4: warn on finding lockowner without stateid's

    commit 27b11428b7de097c42f205beabb1764f4365443b upstream.

    The current code assumes a one-to-one lockowner<->lock stateid
    correspondance.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ba3ac4483f506394dd096eb7d06b4b10ce061c2
Author: Kinglong Mee <kinglongmee@gmail.com>
Date:   Fri Apr 18 20:49:04 2014 +0800

    NFSD: Call ->set_acl with a NULL ACL structure if no entries

    commit aa07c713ecfc0522916f3cd57ac628ea6127c0ec upstream.

    After setting ACL for directory, I got two problems that caused
    by the cached zero-length default posix acl.

    This patch make sure nfsd4_set_nfs4_acl calls ->set_acl
    with a NULL ACL structure if there are no entries.

    Thanks for Christoph Hellwig's advice.

    First problem:
    ............ hang ...........

    Second problem:
    [ 1610.167668] ------------[ cut here ]------------
    [ 1610.168320] kernel BUG at /root/nfs/linux/fs/nfsd/nfs4acl.c:239!
    [ 1610.168320] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
    [ 1610.168320] Modules linked in: nfsv4(OE) nfs(OE) nfsd(OE)
    rpcsec_gss_krb5 fscache ip6t_rpfilter ip6t_REJECT cfg80211 xt_conntrack
    rfkill ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
    ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6
    ip6table_mangle ip6table_security ip6table_raw ip6table_filter
    ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
    nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw
    auth_rpcgss nfs_acl snd_intel8x0 ppdev lockd snd_ac97_codec ac97_bus
    snd_pcm snd_timer e1000 pcspkr parport_pc snd parport serio_raw joydev
    i2c_piix4 sunrpc(OE) microcode soundcore i2c_core ata_generic pata_acpi
    [last unloaded: nfsd]
    [ 1610.168320] CPU: 0 PID: 27397 Comm: nfsd Tainted: G           OE
    3.15.0-rc1+ #15
    [ 1610.168320] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
    VirtualBox 12/01/2006
    [ 1610.168320] task: ffff88005ab653d0 ti: ffff88005a944000 task.ti:
    ffff88005a944000
    [ 1610.168320] RIP: 0010:[<ffffffffa034d5ed>]  [<ffffffffa034d5ed>]
    _posix_to_nfsv4_one+0x3cd/0x3d0 [nfsd]
    [ 1610.168320] RSP: 0018:ffff88005a945b00  EFLAGS: 00010293
    [ 1610.168320] RAX: 0000000000000001 RBX: ffff88006700bac0 RCX:
    0000000000000000
    [ 1610.168320] RDX: 0000000000000000 RSI: ffff880067c83f00 RDI:
    ffff880068233300
    [ 1610.168320] RBP: ffff88005a945b48 R08: ffffffff81c64830 R09:
    0000000000000000
    [ 1610.168320] R10: ffff88004ea85be0 R11: 000000000000f475 R12:
    ffff880068233300
    [ 1610.168320] R13: 0000000000000003 R14: 0000000000000002 R15:
    ffff880068233300
    [ 1610.168320] FS:  0000000000000000(0000) GS:ffff880077800000(0000)
    knlGS:0000000000000000
    [ 1610.168320] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    [ 1610.168320] CR2: 00007f5bcbd3b0b9 CR3: 0000000001c0f000 CR4:
    00000000000006f0
    [ 1610.168320] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
    0000000000000000
    [ 1610.168320] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400
    [ 1610.168320] Stack:
    [ 1610.168320]  ffffffff00000000 0000000b67c83500 000000076700bac0
    0000000000000000
    [ 1610.168320]  ffff88006700bac0 ffff880068233300 ffff88005a945c08
    0000000000000002
    [ 1610.168320]  0000000000000000 ffff88005a945b88 ffffffffa034e2d5
    000000065a945b68
    [ 1610.168320] Call Trace:
    [ 1610.168320]  [<ffffffffa034e2d5>] nfsd4_get_nfs4_acl+0x95/0x150 [nfsd]
    [ 1610.168320]  [<ffffffffa03400d6>] nfsd4_encode_fattr+0x646/0x1e70 [nfsd]
    [ 1610.168320]  [<ffffffff816a6e6e>] ? kmemleak_alloc+0x4e/0xb0
    [ 1610.168320]  [<ffffffffa0327962>] ?
    nfsd_setuser_and_check_port+0x52/0x80 [nfsd]
    [ 1610.168320]  [<ffffffff812cd4bb>] ? selinux_cred_prepare+0x1b/0x30
    [ 1610.168320]  [<ffffffffa0341caa>] nfsd4_encode_getattr+0x5a/0x60 [nfsd]
    [ 1610.168320]  [<ffffffffa0341e07>] nfsd4_encode_operation+0x67/0x110
    [nfsd]
    [ 1610.168320]  [<ffffffffa033844d>] nfsd4_proc_compound+0x21d/0x810 [nfsd]
    [ 1610.168320]  [<ffffffffa0324d9b>] nfsd_dispatch+0xbb/0x200 [nfsd]
    [ 1610.168320]  [<ffffffffa00850cd>] svc_process_common+0x46d/0x6d0 [sunrpc]
    [ 1610.168320]  [<ffffffffa0085433>] svc_process+0x103/0x170 [sunrpc]
    [ 1610.168320]  [<ffffffffa032472f>] nfsd+0xbf/0x130 [nfsd]
    [ 1610.168320]  [<ffffffffa0324670>] ? nfsd_destroy+0x80/0x80 [nfsd]
    [ 1610.168320]  [<ffffffff810a5202>] kthread+0xd2/0xf0
    [ 1610.168320]  [<ffffffff810a5130>] ? insert_kthread_work+0x40/0x40
    [ 1610.168320]  [<ffffffff816c1ebc>] ret_from_fork+0x7c/0xb0
    [ 1610.168320]  [<ffffffff810a5130>] ? insert_kthread_work+0x40/0x40
    [ 1610.168320] Code: 78 02 e9 e7 fc ff ff 31 c0 31 d2 31 c9 66 89 45 ce
    41 8b 04 24 66 89 55 d0 66 89 4d d2 48 8d 04 80 49 8d 5c 84 04 e9 37 fd
    ff ff <0f> 0b 90 0f 1f 44 00 00 55 8b 56 08 c7 07 00 00 00 00 8b 46 0c
    [ 1610.168320] RIP  [<ffffffffa034d5ed>] _posix_to_nfsv4_one+0x3cd/0x3d0
    [nfsd]
    [ 1610.168320]  RSP <ffff88005a945b00>
    [ 1610.257313] ---[ end trace 838254e3e352285b ]---

    Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit efb36edc5e9dcc4c93b83c85aa504aa4d300c401
Author: Romain Izard <romain.izard.pro@gmail.com>
Date:   Tue Mar 4 10:09:39 2014 +0100

    trace: module: Maintain a valid user count

    commit 098507ae3ec2331476fb52e85d4040c1cc6d0ef4 upstream.

    The replacement of the 'count' variable by two variables 'incs' and
    'decs' to resolve some race conditions during module unloading was done
    in parallel with some cleanup in the trace subsystem, and was integrated
    as a merge.

    Unfortunately, the formula for this replacement was wrong in the tracing
    code, and the refcount in the traces was not usable as a result.

    Use 'count = incs - decs' to compute the user count.

    Link: http://lkml.kernel.org/p/1393924179-9147-1-git-send-email-romain.izard.pro@gmail.com

    Acked-by: Ingo Molnar <mingo@kernel.org>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Fixes: c1ab9cab7509 "merge conflict resolution"
    Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d1a999df834a81d751be87dd62b88f2f99bc650a
Author: Salva Peiró <speiro@ai2.upv.es>
Date:   Wed Apr 30 19:48:02 2014 +0200

    media: media-device: fix infoleak in ioctl media_enum_entities()

    commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.

    This fixes CVE-2014-1739.

    Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e6c336b4ee4b512d1536c0a6d16e8dda2e703da
Author: Tim Chen <tim.c.chen@linux.intel.com>
Date:   Mon Mar 17 16:52:26 2014 -0700

    crypto: crypto_wq - Fix late crypto work queue initialization

    commit 130fa5bc81b44b6cc1fbdea3abf6db0da22964e0 upstream.

    The crypto algorithm modules utilizing the crypto daemon could
    be used early when the system start up.  Using module_init
    does not guarantee that the daemon's work queue is initialized
    when the cypto alorithm depending on crypto_wq starts.  It is necessary
    to initialize the crypto work queue earlier at the subsystem
    init time to make sure that it is initialized
    when used.

    Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3cf2aab961c888ef1add8fbdbb206e2403f0f243
Author: Geert Uytterhoeven <geert+renesas@glider.be>
Date:   Mon Apr 14 18:52:14 2014 +0200

    Documentation: Update stable address in Chinese and Japanese translations

    commit 98b0f811aade1b7c6e7806c86aa0befd5919d65f upstream.

    The English and Korean translations were updated, the Chinese and Japanese
    weren't.

    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36f26e715d5af2ded7ea0faf970d4e6f84788b5b
Author: Ilia Mirkin <imirkin@alum.mit.edu>
Date:   Wed Mar 26 19:37:21 2014 -0400

    drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi

    commit a3d0b1218d351c6e6f3cea36abe22236a08cb246 upstream.

    There appear to be a crop of new hardware where the vbios is not
    available from PROM/PRAMIN, but there is a valid _ROM method in ACPI.
    The data read from PCIROM almost invariably contains invalid
    instructions (still has the x86 opcodes), which makes this a low-risk
    way to try to obtain a valid vbios image.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=76475
    Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 576d1afddd63a92a99f8a08adc28ce3fd9bb7c9d
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sat Apr 26 21:59:04 2014 +0100

    rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()

    commit 3234f5b06fc3094176a86772cc64baf3decc98fc upstream.

    Fixes: a53268be0cb9 ('rtlwifi: rtl8192cu: Fix too long disable of IRQs')
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b2437c2a0316013a52cfa55c0486aafe5b94f77
Author: Liu Hua <sdu.liu@huawei.com>
Date:   Thu Mar 27 06:56:18 2014 +0100

    ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr

    commit 8fad87bca7ac9737e413ba5f1656f1114a8c314d upstream.

    When we configure CONFIG_ARM_LPAE=y, pfn << PAGE_SHIFT will
    overflow if pfn >= 0x100000 in copy_oldmem_page.
    So use __pfn_to_phys for converting.

    Signed-off-by: Liu Hua <sdu.liu@huawei.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa9869e6b2c03052c024e97a71871841516a2497
Author: Christoph Hellwig <hch@lst.de>
Date:   Sun May 4 13:03:32 2014 +0200

    posix_acl: handle NULL ACL in posix_acl_equiv_mode

    commit 50c6e282bdf5e8dabf8d7cf7b162545a55645fd9 upstream.

    Various filesystems don't bother checking for a NULL ACL in
    posix_acl_equiv_mode, and thus can dereference a NULL pointer when it
    gets passed one. This usually happens from the NFS server, as the ACL tools
    never pass a NULL ACL, but instead of one representing the mode bits.

    Instead of adding boilerplat to all filesystems put this check into one place,
    which will allow us to remove the check from other filesystems as well later
    on.

    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Reported-by: Ben Greear <greearb@candelatech.com>
    Reported-by: Marco Munderloh <munderl@tnt.uni-hannover.de>,
    Cc: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60d3d144fc5e5dfb786e6699231d6a6bfacc065c
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Thu Apr 17 11:08:47 2014 +0200

    rt2x00: fix beaconing on USB

    commit 8834d3608cc516f13e2e510f4057c263f3d2ce42 upstream.

    When disable beaconing we clear register with beacon and newer set it
    back, what make we stop send beacons infinitely.

    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9fb8be4c5b6a35612cc7c6b8a89d8edab543cc79
Author: Daniele Forsi <dforsi@gmail.com>
Date:   Mon Apr 28 17:09:11 2014 +0200

    USB: Nokia 5300 should be treated as unusual dev

    commit 6ed07d45d09bc2aa60e27b845543db9972e22a38 upstream.

    Signed-off-by: Daniele Forsi <dforsi@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae5b7325ee162291119a8d85b0d16c6467562f94
Author: Victor A. Santos <victoraur.santos@gmail.com>
Date:   Sat Apr 26 23:20:14 2014 -0300

    USB: Nokia 305 should be treated as unusual dev

    commit f0ef5d41792a46a1085dead9dfb0bdb2c574638e upstream.

    Signed-off-by: Victor A. Santos <victoraur.santos@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 201b8e0b566f66dee8a1ae3914fdc11af3888ff1
Author: Daniele Forsi <dforsi@gmail.com>
Date:   Tue Apr 29 11:44:03 2014 +0200

    usb: storage: shuttle_usbat: fix discs being detected twice

    commit df602c2d2358f02c6e49cffc5b49b9daa16db033 upstream.

    Even if the USB-to-ATAPI converter supported multiple LUNs, this
    driver would always detect the same physical device or media because
    it doesn't use srb->device->lun in any way.
    Tested with an Hewlett-Packard CD-Writer Plus 8200e.

    Signed-off-by: Daniele Forsi <dforsi@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e50ded310417919655baba7b2eb3081dfc3df4cb
Author: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Date:   Wed Mar 12 17:30:08 2014 +0100

    usb: gadget: at91-udc: fix irq and iomem resource retrieval

    commit 886c7c426d465732ec9d1b2bbdda5642fc2e7e05 upstream.

    When using dt resources retrieval (interrupts and reg properties) there is
    no predefined order for these resources in the platform dev resource
    table. Also don't expect the number of resource to be always 2.

    Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
    Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0eaa5aa5fa2075c82a657904bdce01a816857e3
Author: Alex Deucher <alexdeucher@gmail.com>
Date:   Tue Apr 15 12:44:34 2014 -0400

    drm/radeon: fix ATPX detection on non-VGA GPUs

    commit e9a4099a59cc598a44006059dd775c25e422b772 upstream.

    Some newer PX laptops have the pci device class
    set to DISPLAY_OTHER rather than DISPLAY_VGA.  This
    properly detects ATPX on those laptops.

    Based on a patch from: Pali Rohár <pali.rohar@gmail.com>

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: airlied@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 546c518fb111a753a00f55af9052ea275ab69f12
Author: NeilBrown <neilb@suse.de>
Date:   Tue May 6 09:36:08 2014 +1000

    md: avoid possible spinning md thread at shutdown.

    commit 0f62fb220aa4ebabe8547d3a9ce4a16d3c045f21 upstream.

    If an md array with externally managed metadata (e.g. DDF or IMSM)
    is in use, then we should not set safemode==2 at shutdown because:

    1/ this is ineffective: user-space need to be involved in any 'safemode' handling,
    2/ The safemode management code doesn't cope with safemode==2 on external metadata
       and md_check_recover enters an infinite loop.

    Even at shutdown, an infinite-looping process can be problematic, so this
    could cause shutdown to hang.

    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 11f87a6a6049455cd0d1e6db13c0b984a888a4b4
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Mon May 12 13:42:29 2014 +0530

    hrtimer: Set expiry time before switch_hrtimer_base()

    commit 84ea7fe37908254c3bd90910921f6e1045c1747a upstream.

    switch_hrtimer_base() calls hrtimer_check_target() which ensures that
    we do not migrate a timer to a remote cpu if the timer expires before
    the current programmed expiry time on that remote cpu.

    But __hrtimer_start_range_ns() calls switch_hrtimer_base() before the
    new expiry time is set. So the sanity check in hrtimer_check_target()
    is operating on stale or even uninitialized data.

    Update expiry time before calling switch_hrtimer_base().

    [ tglx: Rewrote changelog once again ]

    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Cc: linaro-kernel@lists.linaro.org
    Cc: linaro-networking@linaro.org
    Cc: fweisbec@gmail.com
    Cc: arvind.chauhan@arm.com
    Link: http://lkml.kernel.org/r/81999e148745fc51bbcd0615823fbab9b2e87e23.1399882253.git.viresh.kumar@linaro.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a91ccfcaaaa358eba4579965d9a85dbb756c2596
Author: Leon Ma <xindong.ma@intel.com>
Date:   Wed Apr 30 16:43:10 2014 +0800

    hrtimer: Prevent remote enqueue of leftmost timers

    commit 012a45e3f4af68e86d85cce060c6c2fed56498b2 upstream.

    If a cpu is idle and starts an hrtimer which is not pinned on that
    same cpu, the nohz code might target the timer to a different cpu.

    In the case that we switch the cpu base of the timer we already have a
    sanity check in place, which determines whether the timer is earlier
    than the current leftmost timer on the target cpu. In that case we
    enqueue the timer on the current cpu because we cannot reprogram the
    clock event device on the target.

    If the timers base is already the target CPU we do not have this
    sanity check in place so we enqueue the timer as the leftmost timer in
    the target cpus rb tree, but we cannot reprogram the clock event
    device on the target cpu. So the timer expires late and subsequently
    prevents the reprogramming of the target cpu clock event device until
    the previously programmed event fires or a timer with an earlier
    expiry time gets enqueued on the target cpu itself.

    Add the same target check as we have for the switch base case and
    start the timer on the current cpu if it would become the leftmost
    timer on the target.

    [ tglx: Rewrote subject and changelog ]

    Signed-off-by: Leon Ma <xindong.ma@intel.com>
    Link: http://lkml.kernel.org/r/1398847391-5994-1-git-send-email-xindong.ma@intel.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3d8b2f5e4007d4b28ac760e1aa72e91f4021ea90
Author: Stuart Hayes <stuart.w.hayes@gmail.com>
Date:   Tue Apr 29 17:55:02 2014 -0500

    hrtimer: Prevent all reprogramming if hang detected

    commit 6c6c0d5a1c949d2e084706f9e5fb1fccc175b265 upstream.

    If the last hrtimer interrupt detected a hang it sets hang_detected=1
    and programs the clock event device with a delay to let the system
    make progress.

    If hang_detected == 1, we prevent reprogramming of the clock event
    device in hrtimer_reprogram() but not in hrtimer_force_reprogram().

    This can lead to the following situation:

    hrtimer_interrupt()
       hang_detected = 1;
       program ce device to Xms from now (hang delay)

    We have two timers pending:
       T1 expires 50ms from now
       T2 expires 5s from now

    Now T1 gets canceled, which causes hrtimer_force_reprogram() to be
    invoked, which in turn programs the clock event device to T2 (5
    seconds from now).

    Any hrtimer_start after that will not reprogram the hardware due to
    hang_detected still being set. So we effectivly block all timers until
    the T2 event fires and cleans up the hang situation.

    Add a check for hang_detected to hrtimer_force_reprogram() which
    prevents the reprogramming of the hang delay in the hardware
    timer. The subsequent hrtimer_interrupt will resolve all outstanding
    issues.

    [ tglx: Rewrote subject and changelog and fixed up the comment in
      	hrtimer_force_reprogram() ]

    Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
    Link: http://lkml.kernel.org/r/53602DC6.2060101@gmail.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9dbdf25ec58ee67beee56e9bcc2f193ee29cc7b3
Author: Grant Likely <grant.likely@linaro.org>
Date:   Tue Apr 29 12:05:22 2014 +0100

    drivercore: deferral race condition fix

    commit 58b116bce13612e5aa6fcd49ecbd4cf8bb59e835 upstream.

    When the kernel is built with CONFIG_PREEMPT it is possible to reach a state
    when all modules loaded but some driver still stuck in the deferred list
    and there is a need for external event to kick the deferred queue to probe
    these drivers.

    The issue has been observed on embedded systems with CONFIG_PREEMPT enabled,
    audio support built as modules and using nfsroot for root filesystem.

    The following log fragment shows such sequence when all audio modules
    were loaded but the sound card is not present since the machine driver has
    failed to probe due to missing dependency during it's probe.
    The board is am335x-evmsk (McASP<->tlv320aic3106 codec) with davinci-evm
    machine driver:

    ...
    [   12.615118] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: ENTER
    [   12.719969] davinci_evm sound.3: davinci_evm_probe: ENTER
    [   12.725753] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card
    [   12.753846] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component
    [   12.922051] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component DONE
    [   12.950839] davinci_evm sound.3: ASoC: platform (null) not registered
    [   12.957898] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card DONE (-517)
    [   13.099026] davinci-mcasp 4803c000.mcasp: Kicking the deferred list
    [   13.177838] davinci-mcasp 4803c000.mcasp: really_probe: probe_count = 2
    [   13.194130] davinci_evm sound.3: snd_soc_register_card failed (-517)
    [   13.346755] davinci_mcasp_driver_init: LEAVE
    [   13.377446] platform sound.3: Driver davinci_evm requests probe deferral
    [   13.592527] platform sound.3: really_probe: probe_count = 0

    In the log the machine driver enters it's probe at 12.719969 (this point it
    has been removed from the deferred lists). McASP driver already executing
    it's probing (since 12.615118).
    The machine driver tries to construct the sound card (12.950839) but did
    not found one of the components so it fails. After this McASP driver
    registers all the ASoC components (the machine driver still in it's probe
    function after it failed to construct the card) and the deferred work is
    prepared at 13.099026 (note that this time the machine driver is not in the
    lists so it is not going to be handled when the work is executing).
    Lastly the machine driver exit from it's probe and the core places it to
    the deferred list but there will be no other driver going to load and the
    deferred queue is not going to be kicked again - till we have external event
    like connecting USB stick, etc.

    The proposed solution is to try the deferred queue once more when the last
    driver is asking for deferring and we had drivers loaded while this last
    driver was probing.

    This way we can avoid drivers stuck in the deferred queue.

    Signed-off-by: Grant Likely <grant.likely@linaro.org>
    Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
    Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 786f95ca604ce585d6feee71ab653b04d4bb9a50
Author: Josef Gajdusek <atx@atx.name>
Date:   Mon May 12 13:48:26 2014 +0200

    hwmon: (emc1403) Support full range of known chip revision numbers

    commit 3a18e1398fc2dc9c32bbdc50664da3a77959a8d1 upstream.

    The datasheet for EMC1413/EMC1414, which is fully compatible to
    EMC1403/1404 and uses the same chip identification, references revision
    numbers 0x01, 0x03, and 0x04. Accept the full range of revision numbers
    from 0x01 to 0x04 to make sure none are missed.

    Signed-off-by: Josef Gajdusek <atx@atx.name>
    [Guenter Roeck: Updated headline and description]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73cff75c551fb35bc952e96583a83b47ec33ee89
Author: Josef Gajdusek <atx@atx.name>
Date:   Sun May 11 14:40:44 2014 +0200

    hwmon: (emc1403) fix inverted store_hyst()

    commit 17c048fc4bd95efea208a1920f169547d8588f1f upstream.

    Attempts to set the hysteresis value to a temperature below the target
    limit fails with "write error: Numerical result out of range" due to
    an inverted comparison.

    Signed-off-by: Josef Gajdusek <atx@atx.name>
    Reviewed-by: Jean Delvare <jdelvare@suse.de>
    [Guenter Roeck: Updated headline and description]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ebe3d11087a74fea05620b13e33b0a30f6af2d0
Author: Chen Yucong <slaoub@gmail.com>
Date:   Thu May 22 11:54:15 2014 -0700

    hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

    commit b985194c8c0a130ed155b71662e39f7eaea4876f upstream.

    For handling a free hugepage in memory failure, the race will happen if
    another thread hwpoisoned this hugepage concurrently.  So we need to
    check PageHWPoison instead of !PageHWPoison.

    If hwpoison_filter(p) returns true or a race happens, then we need to
    unlock_page(hpage).

    Signed-off-by: Chen Yucong <slaoub@gmail.com>
    Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Reviewed-by: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fb57ba5d095b7a660d5bc7d1d5b385392020c07
Author: Anthony Iliopoulos <anthony.iliopoulos@huawei.com>
Date:   Wed May 14 11:29:48 2014 +0200

    x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow()

    commit 9844f5462392b53824e8b86726e7c33b5ecbb676 upstream.

    The invalidation is required in order to maintain proper semantics
    under CoW conditions. In scenarios where a process clones several
    threads, a thread operating on a core whose DTLB entry for a
    particular hugepage has not been invalidated, will be reading from
    the hugepage that belongs to the forked child process, even after
    hugetlb_cow().

    The thread will not see the updated page as long as the stale DTLB
    entry remains cached, the thread attempts to write into the page,
    the child process exits, or the thread gets migrated to a different
    processor.

    Signed-off-by: Anthony Iliopoulos <anthony.iliopoulos@huawei.com>
    Link: http://lkml.kernel.org/r/20140514092948.GA17391@server-36.huawei.corp
    Suggested-by: Shay Goikhman <shay.goikhman@huawei.com>
    Acked-by: Dave Hansen <dave.hansen@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c16d9a8078cd2599228cb274027ce8b255ae76b5
Author: Corey Minyard <cminyard@mvista.com>
Date:   Mon Apr 14 09:46:52 2014 -0500

    ipmi: Reset the KCS timeout when starting error recovery

    commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

    The OBF timer in KCS was not reset in one situation when error recovery
    was started, resulting in an immediate timeout.

    Reported-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21eaf4442aee2b5e25e698c7431b67c5961bce05
Author: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Date:   Mon Apr 14 09:46:51 2014 -0500

    ipmi: Fix a race restarting the timer

    commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.

    With recent changes it is possible for the timer handler to detect an
    idle interface and not start the timer, but the thread to start an
    operation at the same time.  The thread will not start the timer in that
    instance, resulting in the timer not running.

    Instead, move all timer operations under the lock and start the timer in
    the thread if it detect non-idle and the timer is not already running.
    Moving under locks allows the last timeout to be set in both the thread
    and the timer.  'Timer is not running' means that the timer is not
    pending and smi_timeout() is not running.  So we need a flag to detect
    this correctly.

    Also fix a few other timeout bugs: setting the last timeout when the
    interrupt has to be disabled and the timer started, and setting the last
    timeout in check_start_timer_thread possibly racing with the timer

    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 11e69564f65b6c7a1089c5d45929714e3ed6a921
Author: Jiri Bohac <jbohac@suse.cz>
Date:   Fri Apr 18 17:23:11 2014 +0200

    timer: Prevent overflow in apply_slack

    commit 98a01e779f3c66b0b11cd7e64d531c0e41c95762 upstream.

    On architectures with sizeof(int) < sizeof (long), the
    computation of mask inside apply_slack() can be undefined if the
    computed bit is > 32.

    E.g. with: expires = 0xffffe6f5 and slack = 25, we get:

    expires_limit = 0x20000000e
    bit = 33
    mask = (1 << 33) - 1  /* undefined */

    On x86, mask becomes 1 and and the slack is not applied properly.
    On s390, mask is -1, expires is set to 0 and the timer fires immediately.

    Use 1UL << bit to solve that issue.

    Suggested-by: Deborah Townsend <dstownse@us.ibm.com>
    Signed-off-by: Jiri Bohac <jbohac@suse.cz>
    Link: http://lkml.kernel.org/r/20140418152310.GA13654@midget.suse.cz
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3be2bb4956e5d9d849329d5d1b92f6510ac12315
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Apr 22 13:49:40 2014 -0700

    mm: make fixup_user_fault() check the vma access rights too

    commit 1b17844b29ae042576bea588164f2f1e9590a8bc upstream.

    fixup_user_fault() is used by the futex code when the direct user access
    fails, and the futex code wants it to either map in the page in a usable
    form or return an error.  It relied on handle_mm_fault() to map the
    page, and correctly checked the error return from that, but while that
    does map the page, it doesn't actually guarantee that the page will be
    mapped with sufficient permissions to be then accessed.

    So do the appropriate tests of the vma access rights by hand.

    [ Side note: arguably handle_mm_fault() could just do that itself, but
      we have traditionally done it in the caller, because some callers -
      notably get_user_pages() - have been able to access pages even when
      they are mapped with PROT_NONE.  Maybe we should re-visit that design
      decision, but in the meantime this is the minimal patch. ]

    Found by Dave Jones running his trinity tool.

    Reported-by: Dave Jones <davej@redhat.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 72c2f03ad9cb37d1673c0c986bdb341c1ae8052a
Author: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Date:   Mon Mar 31 19:51:14 2014 +0200

    pata_at91: fix ata_host_activate() failure handling

    commit 27aa64b9d1bd0d23fd692c91763a48309b694311 upstream.

    Add missing clk_put() call to ata_host_activate() failure path.

    Sergei says,

      "Hm, I have once fixed that (see that *if* (!ret)) but looks like a
       later commit 477c87e90853d136b188c50c0e4a93d01cad872e (ARM:
       at91/pata: use gpio_is_valid to check the gpio) broke it again. :-(
       Would be good if the changelog did mention that..."

    Cc: Andrew Victor <linux@maxim.org.za>
    Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
    Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f4c0e8b5438725d66c6c27f11cb2a1c61c6d6c5
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Thu Apr 24 10:40:12 2014 -0400

    ftrace/module: Hardcode ftrace_module_init() call into load_module()

    commit a949ae560a511fe4e3adf48fa44fefded93e5c2b upstream.

    A race exists between module loading and enabling of function tracer.

    	CPU 1				CPU 2
    	-----				-----
      load_module()
       module->state = MODULE_STATE_COMING

    				register_ftrace_function()
    				 mutex_lock(&ftrace_lock);
    				 ftrace_startup()
    				  update_ftrace_function();
    				   ftrace_arch_code_modify_prepare()
    				    set_all_module_text_rw();
    				   <enables-ftrace>
    				    ftrace_arch_code_modify_post_process()
    				     set_all_module_text_ro();

    				[ here all module text is set to RO,
    				  including the module that is
    				  loading!! ]

       blocking_notifier_call_chain(MODULE_STATE_COMING);
        ftrace_init_module()

         [ tries to modify code, but it's RO, and fails!
           ftrace_bug() is called]

    When this race happens, ftrace_bug() will produces a nasty warning and
    all of the function tracing features will be disabled until reboot.

    The simple solution is to treate module load the same way the core
    kernel is treated at boot. To hardcode the ftrace function modification
    of converting calls to mcount into nops. This is done in init/main.c
    there's no reason it could not be done in load_module(). This gives
    a better control of the changes and doesn't tie the state of the
    module to its notifiers as much. Ftrace is special, it needs to be
    treated as such.

    The reason this would work, is that the ftrace_module_init() would be
    called while the module is in MODULE_STATE_UNFORMED, which is ignored
    by the set_all_module_text_ro() call.

    Link: http://lkml.kernel.org/r/1395637826-3312-1-git-send-email-indou.takao@jp.fujitsu.com

    Reported-by: Takao Indoh <indou.takao@jp.fujitsu.com>
    Acked-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6427aede5eaac2e39a1d2b3306d960a603d7c3d9
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Mon May 12 20:45:35 2014 +0000

    futex: Prevent attaching to kernel threads

    commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream.

    We happily allow userspace to declare a random kernel thread to be the
    owner of a user space PI futex.

    Found while analysing the fallout of Dave Jones syscall fuzzer.

    We also should validate the thread group for private futexes and find
    some fast way to validate whether the "alleged" owner has RW access on
    the file which backs the SHM, but that's a separate issue.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Darren Hart <darren@dvhart.com>
    Cc: Davidlohr Bueso <davidlohr@hp.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Clark Williams <williams@redhat.com>
    Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Carlos ODonell <carlos@redhat.com>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bf0aee237176a3edcd054b80dba2dad3e2be7ff
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Mon May 12 20:45:34 2014 +0000

    futex: Add another early deadlock detection check

    commit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.

    Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
    detection code of rtmutex:
      http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com

    That underlying issue has been fixed with a patch to the rtmutex code,
    but the futex code must not call into rtmutex in that case because
        - it can detect that issue early
        - it avoids a different and more complex fixup for backing out

    If the user space variable got manipulated to 0x80000000 which means
    no lock holder, but the waiters bit set and an active pi_state in the
    kernel is found we can figure out the recursive locking issue by
    looking at the pi_state owner. If that is the current task, then we
    can safely return -EDEADLK.

    The check should have been added in commit 59fa62451 (futex: Handle
    futex_pi OWNER_DIED take over correctly) already, but I did not see
    the above issue caused by user space manipulation back then.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Darren Hart <darren@dvhart.com>
    Cc: Davidlohr Bueso <davidlohr@hp.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Clark Williams <williams@redhat.com>
    Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Carlos ODonell <carlos@redhat.com>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d16beab575e17e46a4b187fb9f8211fab3adfbae
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Apr 3 09:28:10 2014 -0700

    net-gro: reset skb->truesize in napi_reuse_skb()

    [ Upstream commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb ]

    Recycling skb always had been very tough...

    This time it appears GRO layer can accumulate skb->truesize
    adjustments made by drivers when they attach a fragment to skb.

    skb_gro_receive() can only subtract from skb->truesize the used part
    of a fragment.

    I spotted this problem seeing TcpExtPruneCalled and
    TcpExtTCPRcvCollapsed that were unexpected with a recent kernel, where
    TCP receive window should be sized properly to accept traffic coming
    from a driver not overshooting skb->truesize.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1102122b2bdf4307cae269c725fab4c9c6141f5b
Author: Alexander Duyck <alexander.h.duyck@intel.com>
Date:   Fri May 4 14:26:56 2012 +0000

    skb: Add inline helper for getting the skb end offset from head

    [ Upstream commit ec47ea82477404631d49b8e568c71826c9b663ac ]

    With the recent changes for how we compute the skb truesize it occurs to me
    we are probably going to have a lot of calls to skb_end_pointer -
    skb->head.  Instead of running all over the place doing that it would make
    more sense to just make it a separate inline skb_end_offset(skb) that way
    we can return the correct value without having gcc having to do all the
    optimization to cancel out skb->head - skb->head.

    Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 62e1a647e74f708eeabf1c79f3d40833d8ce45eb
Author: Li RongQing <roy.qing.li@gmail.com>
Date:   Thu May 22 16:36:55 2014 +0800

    ipv4: initialise the itag variable in __mkroute_input

    [ Upstream commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a ]

    the value of itag is a random value from stack, and may not be initiated by
    fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
    is not set

    This will make the cached dst uncertainty

    Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
    Acked-by: Alexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c8a60a9e3cdfcc04bc4de488876c07225fa0347
Author: Jason Wang <jasowang@redhat.com>
Date:   Wed Aug 15 20:44:27 2012 +0000

    act_mirred: do not drop packets when fails to mirror it

    [ Upstream commit 16c0b164bd24d44db137693a36b428ba28970c62 ]

    We drop packet unconditionally when we fail to mirror it. This is not intended
    in some cases. Consdier for kvm guest, we may mirror the traffic of the bridge
    to a tap device used by a VM. When kernel fails to mirror the packet in
    conditions such as when qemu crashes or stop polling the tap, it's hard for the
    management software to detect such condition and clean the the mirroring
    before. This would lead all packets to the bridge to be dropped and break the
    netowrk of other virtual machines.

    To solve the issue, the patch does not drop packets when kernel fails to mirror
    it, and only drop the redirected packets.

    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dfe37ad5ddd74bfb299bb50b62db2f5c6b0bc78a
Author: Sergey Popovich <popovich_sergei@mail.ru>
Date:   Tue May 6 18:23:08 2014 +0300

    ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation

    [ Upstream commit aeefa1ecfc799b0ea2c4979617f14cecd5cccbfd ]

    Increment fib_info_cnt in fib_create_info() right after successfuly
    alllocating fib_info structure, overwise fib_metrics allocation failure
    leads to fib_info_cnt incorrectly decremented in free_fib_info(), called
    on error path from fib_create_info().

    Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd91cb56f951a7b0da8c3098ea9cd56854ece66c
Author: Florian Westphal <fw@strlen.de>
Date:   Sun May 4 23:24:31 2014 +0200

    net: ipv4: ip_forward: fix inverted local_df test

    [ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

    local_df means 'ignore DF bit if set', so if its set we're
    allowed to perform ip fragmentation.

    This wasn't noticed earlier because the output path also drops such skbs
    (and emits needed icmp error) and because netfilter ip defrag did not
    set local_df until couple of days ago.

    Only difference is that DF-packets-larger-than MTU now discarded
    earlier (f.e. we avoid pointless netfilter postrouting trip).

    While at it, drop the repeated test ip_exceeds_mtu, checking it once
    is enough...

    Fixes: fe6cc55f3a9 ("net: ip, ipv6: handle gso skbs in forwarding path")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8b4577dff4f2d0964546a6ee9dcb542b13c3337
Author: Liu Yu <allanyuliu@tencent.com>
Date:   Wed Apr 30 17:34:09 2014 +0800

    tcp_cubic: fix the range of delayed_ack

    [ Upstream commit 0cda345d1b2201dd15591b163e3c92bad5191745 ]

    commit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent
    divide error) try to prevent divide error, but there is still a little
    chance that delayed_ack can reach zero. In case the param cnt get
    negative value, then ratio+cnt would overflow and may happen to be zero.
    As a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.

    In some old kernels, such as 2.6.32, there is a bug that would
    pass negative param, which then ultimately leads to this divide error.

    commit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count
    with skb MSS) fixed the negative param issue. However,
    it's safe that we fix the range of delayed_ack as well,
    to make sure we do not hit a divide by zero.

    CC: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: Liu Yu <allanyuliu@tencent.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c11ea07f5818be0043b59aa85e7a3ceb927af5e
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Tue Apr 29 10:09:51 2014 -0400

    Revert "macvlan : fix checksums error when we are in bridge mode"

    [ Upstream commit f114890cdf84d753f6b41cd0cc44ba51d16313da ]

    This reverts commit 12a2856b604476c27d85a5f9a57ae1661fc46019.
    The commit above doesn't appear to be necessary any more as the
    checksums appear to be correctly computed/validated.

    Additionally the above commit breaks kvm configurations where
    one VM is using a device that support checksum offload (virtio) and
    the other VM does not.
    In this case, packets leaving virtio device will have CHECKSUM_PARTIAL
    set.  The packets is forwarded to a macvtap that has offload features
    turned off.  Since we use CHECKSUM_UNNECESSARY, the host does does not
    update the checksum and thus a bad checksum is passed up to
    the guest.

    CC: Daniel Lezcano <daniel.lezcano@free.fr>
    CC: Patrick McHardy <kaber@trash.net>
    CC: Andrian Nord <nightnord@gmail.com>
    CC: Eric Dumazet <eric.dumazet@gmail.com>
    CC: Michael S. Tsirkin <mst@redhat.com>
    CC: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a17d3e6da875f6cccb3233af73272d7ac38389f
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Thu Apr 24 10:22:36 2014 +1000

    rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set

    [ Upstream commit c53864fd60227de025cb79e05493b13f69843971 ]

    Since 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with
    buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST
    attribute if they were solicited by a GETLINK message containing an
    IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.

    That was done because some user programs broke when they received more data
    than expected - because IFLA_VFINFO_LIST contains information for each VF
    it can become large if there are many VFs.

    However, the IFLA_VF_PORTS attribute, supplied for devices which implement
    ndo_get_vf_port (currently the 'enic' driver only), has the same problem.
    It supplies per-VF information and can therefore become large, but it is
    not currently conditional on the IFLA_EXT_MASK value.

    Worse, it interacts badly with the existing EXT_MASK handling.  When
    IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at
    NLMSG_GOODSIZE.  If the information for IFLA_VF_PORTS exceeds this, then
    rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.
    netlink_dump() will misinterpret this as having finished the listing and
    omit data for this interface and all subsequent ones.  That can cause
    getifaddrs(3) to enter an infinite loop.

    This patch addresses the problem by only supplying IFLA_VF_PORTS when
    IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.

    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Reviewed-by: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fab0f56cea44d39a2ab41e2869a7ec30c309204
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Thu Apr 24 10:22:35 2014 +1000

    rtnetlink: Warn when interface's information won't fit in our packet

    [ Upstream commit 973462bbde79bb827824c73b59027a0aed5c9ca6 ]

    Without IFLA_EXT_MASK specified, the information reported for a single
    interface in response to RTM_GETLINK is expected to fit within a netlink
    packet of NLMSG_GOODSIZE.

    If it doesn't, however, things will go badly wrong,  When listing all
    interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first
    message in a packet as the end of the listing and omit information for
    that interface and all subsequent ones.  This can cause getifaddrs(3) to
    enter an infinite loop.

    This patch won't fix the problem, but it will WARN_ON() making it easier to
    track down what's going wrong.

    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Reviewed-by: Jiri Pirko <jpirko@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7dedf9d07e1471acec49947f3aacd77ea379bdf
Author: Ivan Vecera <ivecera@redhat.com>
Date:   Thu Apr 17 14:51:08 2014 +0200

    tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled

    The patch fixes a problem with dropped jumbo frames after usage of
    'ethtool -G ... rx'.

    Scenario:
    1. ip link set eth0 up
    2. ethtool -G eth0 rx N # <- This zeroes rx-jumbo
    3. ip link set mtu 9000 dev eth0

    The ethtool command set rx_jumbo_pending to zero so any received jumbo
    packets are dropped and you need to use 'ethtool -G eth0 rx-jumbo N'
    to workaround the issue.
    The patch changes the logic so rx_jumbo_pending value is changed only if
    jumbo frames are enabled (MTU > 1500).

    Signed-off-by: Ivan Vecera <ivecera@redhat.com>
    Acked-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dca1b9e80e5742b8edfd747dbee9fee5995c3cf
Author: Mathias Krause <minipli@googlemail.com>
Date:   Sun Apr 13 18:23:33 2014 +0200

    filter: prevent nla extensions to peek beyond the end of the message

    [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]

    The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
    for a minimal message length before testing the supplied offset to be
    within the bounds of the message. This allows the subtraction of the nla
    header to underflow and therefore -- as the data type is unsigned --
    allowing far to big offset and length values for the search of the
    netlink attribute.

    The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
    also wrong. It has the minuend and subtrahend mixed up, therefore
    calculates a huge length value, allowing to overrun the end of the
    message while looking for the netlink attribute.

    The following three BPF snippets will trigger the bugs when attached to
    a UNIX datagram socket and parsing a message with length 1, 2 or 3.

     ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
     | ld	#0x87654321
     | ldx	#42
     | ld	#nla
     | ret	a
     `---

     ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
     | ld	#0x87654321
     | ldx	#42
     | ld	#nlan
     | ret	a
     `---

     ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
     | ; (needs a fake netlink header at offset 0)
     | ld	#0
     | ldx	#42
     | ld	#nlan
     | ret	a
     `---

    Fix the first issue by ensuring the message length fulfills the minimal
    size constrains of a nla header. Fix the second bug by getting the math
    for the remainder calculation right.

    Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
    Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Acked-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 67c6fc9e79121c69134efdd03a6d35aa6adf6c92
Author: Wang, Xiaoming <xiaoming.wang@intel.com>
Date:   Mon Apr 14 12:30:45 2014 -0400

    net: ipv4: current group_info should be put after using.

    [ Upstream commit b04c46190219a4f845e46a459e3102137b7f6cac ]

    Plug a group_info refcount leak in ping_init.
    group_info is only needed during initialization and
    the code failed to release the reference on exit.
    While here move grabbing the reference to a place
    where it is actually needed.

    Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
    Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
    Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6392b2685b864f0ace1eaae43c998dccb856bd30
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Apr 10 21:23:36 2014 -0700

    ipv6: Limit mtu to 65575 bytes

    [ Upstream commit 30f78d8ebf7f514801e71b88a10c948275168518 ]

    Francois reported that setting big mtu on loopback device could prevent
    tcp sessions making progress.

    We do not support (yet ?) IPv6 Jumbograms and cook corrupted packets.

    We must limit the IPv6 MTU to (65535 + 40) bytes in theory.

    Tested:

    ifconfig lo mtu 70000
    netperf -H ::1

    Before patch : Throughput :   0.05 Mbits

    After patch : Throughput : 35484 Mbits

    Reported-by: Francois WELLENREITER <f.wellenreiter@gmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cedc89a20df8cb06e3fee2f3f7b9d90430142e22
Author: Thomas Richter <tmricht@linux.vnet.ibm.com>
Date:   Wed Apr 9 12:52:59 2014 +0200

    bonding: Remove debug_fs files when module init fails

    [ Upstream commit db29868653394937037d71dc3545768302dda643 ]

    Remove the bonding debug_fs entries when the
    module initialization fails. The debug_fs
    entries should be removed together with all other
    already allocated resources.

    Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
    Signed-off-by: Jay Vosburgh <j.vosburgh@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20874f008f43d98548af632bbbfb54336183a98a
Author: Florian Westphal <fw@strlen.de>
Date:   Wed Apr 9 10:28:50 2014 +0200

    net: core: don't account for udp header size when computing seglen

    [ Upstream commit 6d39d589bb76ee8a1c6cde6822006ae0053decff ]

    In case of tcp, gso_size contains the tcpmss.

    For UFO (udp fragmentation offloading) skbs, gso_size is the fragment
    payload size, i.e. we must not account for udp header size.

    Otherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet
    will be needlessly fragmented in the forward path, because we think its
    individual segments are too large for the outgoing link.

    Fixes: fe6cc55f3a9a053 ("net: ip, ipv6: handle gso skbs in forwarding path")
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Reported-by: Tobias Brunner <tobias@strongswan.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f32abfaa76f1859eae458ea4b6fee2f9385a0d59
Author: Dmitry Petukhov <dmgenp@gmail.com>
Date:   Wed Apr 9 02:23:20 2014 +0600

    l2tp: take PMTU from tunnel UDP socket

    [ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]

    When l2tp driver tries to get PMTU for the tunnel destination, it uses
    the pointer to struct sock that represents PPPoX socket, while it
    should use the pointer that represents UDP socket of the tunnel.

    Signed-off-by: Dmitry Petukhov <dmgenp@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7658e7de68b967b01be536c998b0b90d0b6ec013
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Wed Apr 9 16:10:20 2014 +0200

    net: sctp: test if association is dead in sctp_wake_up_waiters

    [ Upstream commit 1e1cdf8ac78793e0875465e98a648df64694a8d0 ]

    In function sctp_wake_up_waiters(), we need to involve a test
    if the association is declared dead. If so, we don't have any
    reference to a possible sibling association anymore and need
    to invoke sctp_write_space() instead, and normally walk the
    socket's associations and notify them of new wmem space. The
    reason for special casing is that otherwise, we could run
    into the following issue when a sctp_primitive_SEND() call
    from sctp_sendmsg() fails, and tries to flush an association's
    outq, i.e. in the following way:

    sctp_association_free()
    `-> list_del(&asoc->asocs)         <-- poisons list pointer
        asoc->base.dead = true
        sctp_outq_free(&asoc->outqueue)
        `-> __sctp_outq_teardown()
         `-> sctp_chunk_free()
          `-> consume_skb()
           `-> sctp_wfree()
            `-> sctp_wake_up_waiters() <-- dereferences poisoned pointers
                                           if asoc->ep->sndbuf_policy=0

    Therefore, only walk the list in an 'optimized' way if we find
    that the current association is still active. We could also use
    list_del_init() in addition when we call sctp_association_free(),
    but as Vlad suggests, we want to trap such bugs and thus leave
    it poisoned as is.

    Why is it safe to resolve the issue by testing for asoc->base.dead?
    Parallel calls to sctp_sendmsg() are protected under socket lock,
    that is lock_sock()/release_sock(). Only within that path under
    lock held, we're setting skb/chunk owner via sctp_set_owner_w().
    Eventually, chunks are freed directly by an association still
    under that lock. So when traversing association list on destruction
    time from sctp_wake_up_waiters() via sctp_wfree(), a different
    CPU can't be running sctp_wfree() while another one calls
    sctp_association_free() as both happens under the same lock.
    Therefore, this can also not race with setting/testing against
    asoc->base.dead as we are guaranteed for this to happen in order,
    under lock. Further, Vlad says: the times we check asoc->base.dead
    is when we've cached an association pointer for later processing.
    In between cache and processing, the association may have been
    freed and is simply still around due to reference counts. We check
    asoc->base.dead under a lock, so it should always be safe to check
    and not race against sctp_association_free(). Stress-testing seems
    fine now, too.

    Fixes: cd253f9f357d ("net: sctp: wake up all assocs if sndbuf policy is per socket")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Cc: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Vlad Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0fc175dff42444b3fe24dff93d25aa5c7c427724
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Tue Apr 8 17:26:13 2014 +0200

    net: sctp: wake up all assocs if sndbuf policy is per socket

    [ Upstream commit 52c35befb69b005c3fc5afdaae3a5717ad013411 ]

    SCTP charges chunks for wmem accounting via skb->truesize in
    sctp_set_owner_w(), and sctp_wfree() respectively as the
    reverse operation. If a sender runs out of wmem, it needs to
    wait via sctp_wait_for_sndbuf(), and gets woken up by a call
    to __sctp_write_space() mostly via sctp_wfree().

    __sctp_write_space() is being called per association. Although
    we assign sk->sk_write_space() to sctp_write_space(), which
    is then being done per socket, it is only used if send space
    is increased per socket option (SO_SNDBUF), as SOCK_USE_WRITE_QUEUE
    is set and therefore not invoked in sock_wfree().

    Commit 4c3a5bdae293 ("sctp: Don't charge for data in sndbuf
    again when transmitting packet") fixed an issue where in case
    sctp_packet_transmit() manages to queue up more than sndbuf
    bytes, sctp_wait_for_sndbuf() will never be woken up again
    unless it is interrupted by a signal. However, a still
    remaining issue is that if net.sctp.sndbuf_policy=0, that is
    accounting per socket, and one-to-many sockets are in use,
    the reclaimed write space from sctp_wfree() is 'unfairly'
    handed back on the server to the association that is the lucky
    one to be woken up again via __sctp_write_space(), while
    the remaining associations are never be woken up again
    (unless by a signal).

    The effect disappears with net.sctp.sndbuf_policy=1, that
    is wmem accounting per association, as it guarantees a fair
    share of wmem among associations.

    Therefore, if we have reclaimed memory in case of per socket
    accounting, wake all related associations to a socket in a
    fair manner, that is, traverse the socket association list
    starting from the current neighbour of the association and
    issue a __sctp_write_space() to everyone until we end up
    waking ourselves. This guarantees that no association is
    preferred over another and even if more associations are
    taken into the one-to-many session, all receivers will get
    messages from the server and are not stalled forever on
    high load. This setting still leaves the advantage of per
    socket accounting in touch as an association can still use
    up global limits if unused by others.

    Fixes: 4eb701dfc618 ("[SCTP] Fix SCTP sendbuffer accouting.")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Cc: Thomas Graf <tgraf@suug.ch>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Cc: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Vlad Yasevich <vyasevic@redhat.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fce85b081c08c1326d9bcab0ff9ea1c85b7e9858
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Nov 12 15:10:01 2013 -0800

    list: introduce list_next_entry() and list_prev_entry()

    [ Upstream commit 008208c6b26f21c2648c250a09c55e737c02c5f8 ]

    Add two trivial helpers list_next_entry() and list_prev_entry(), they
    can have a lot of users including list.h itself.  In fact the 1st one is
    already defined in events/core.c and bnx2x_sp.c, so the patch simply
    moves the definition to list.h.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Eilon Greenstein <eilong@broadcom.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ced68efe273377c2f525418da0b75f8d2d6d2402
Author: Alex Deucher <alexdeucher@gmail.com>
Date:   Mon Mar 31 11:19:46 2014 -0400

    drm/radeon: call drm_edid_to_eld when we update the edid

    commit 16086279353cbfecbb3ead474072dced17b97ddc upstream.

    This needs to be done to update some of the fields in
    the connector structure used by the audio code.

    Noticed by several users on irc.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8a0ddefa0086479a20270c43fb00f71cb5ce573
Author: Christopher Friedt <chrisfriedt@gmail.com>
Date:   Sat Feb 1 10:01:15 2014 -0500

    drm/vmwgfx: correct fb_fix_screeninfo.line_length

    commit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.

    Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust
    the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.

    See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.

    Signed-off-by: Christopher Friedt <chrisfriedt@gmail.com>
    Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b8b56486c1cb6bb0ea3a5eafc5f54748fd05c7a
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 18:49:20 2014 +0200

    usb: option: add and update a number of CMOTech devices

    commit 34f972d6156fe9eea2ab7bb418c71f9d1d5c8e7b upstream.

    A number of older CMOTech modems are based on Qualcomm
    chips.  The blacklisted interfaces are QMI/wwan.

    Reported-by: Lars Melin <larsm17@gmail.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3794e546cf34fa6da751518a9e3aeac62cc82202
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 18:49:19 2014 +0200

    usb: option: add Alcatel L800MA

    commit dd6b48ecec2ea7d15f28d5e5474388681899a5e1 upstream.

    Device interface layout:
    0: ff/ff/ff - serial
    1: ff/00/00 - serial AT+PPP
    2: ff/ff/ff - QMI/wwan
    3: 08/06/50 - storage

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08e1505871a4bde2e454591a8c3d2fb522fecd69
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Apr 25 18:49:18 2014 +0200

    usb: option: add Olivetti Olicard 500

    commit 533b3994610f316e5cd61b56d0c4daa15c830f89 upstream.

    Device interface layout:
    0: ff/ff/ff - serial
    1: ff/ff/ff - serial AT+PPP
    2: 08/06/50 - storage
    3: ff/ff/ff - serial
    4: ff/ff/ff - QMI/wwan

    Reported-by: Julio Araujo <julio.araujo@wllctel.com.br>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 818346b5be68137e39adf5895fe0172a9c84b949
Author: Johan Hovold <jhovold@gmail.com>
Date:   Fri Apr 25 15:23:03 2014 +0200

    USB: io_ti: fix firmware download on big-endian machines

    commit 5509076d1b4485ce9fb07705fcbcd2695907ab5b upstream.

    During firmware download the device expects memory addresses in
    big-endian byte order. As the wIndex parameter which hold the address is
    sent in little-endian byte order regardless of host byte order, we need
    to use swab16 rather than cpu_to_be16.

    Also make sure to handle the struct ti_i2c_desc size parameter which is
    returned in little-endian byte order.

    Reported-by: Ludovic Drolez <ldrolez@debian.org>
    Tested-by: Ludovic Drolez <ldrolez@debian.org>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d3972467efba36977afd3810c23617ecf5853656
Author: Johan Hovold <jhovold@gmail.com>
Date:   Fri Mar 28 18:05:10 2014 +0100

    Revert "USB: serial: add usbid for dell wwan card to sierra.c"

    commit 2e01280d2801c72878cf3a7119eac30077b463d5 upstream.

    This reverts commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321.

    This device was erroneously added to the sierra driver even though it's
    not a Sierra device and was already handled by the option driver.

    Cc: Richard Farina <sidhayn@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1611e6cc002b38a449e61dc69e8f24b2a627854
Author: Daniele Palmas <dnlplm@gmail.com>
Date:   Wed Apr 2 11:19:48 2014 +0200

    usb: option driver, add support for Telit UE910v2

    commit d6de486bc22255779bd54b0fceb4c240962bf146 upstream.

    option driver, added VID/PID for Telit UE910v2 modem

    Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f72c55d0b8869aa40181b1e8b5456a800c4c154
Author: Michele Baldessari <michele@acksyn.org>
Date:   Mon Mar 31 10:51:00 2014 +0200

    USB: serial: ftdi_sio: add id for Brainboxes serial cards

    commit efe26e16b1d93ac0085e69178cc18811629e8fc5 upstream.

    Custom VID/PIDs for Brainboxes cards as reported in
    https://bugzilla.redhat.com/show_bug.cgi?id=1071914

    Signed-off-by: Michele Baldessari <michele@acksyn.org>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 971779e857794be65387204ceee8fd4e9afddb72
Author: Tristan Bruns <tristan@tristanbruns.de>
Date:   Sun Apr 13 23:57:16 2014 +0200

    USB: cp210x: Add 8281 (Nanotec Plug & Drive)

    commit 72b3007951010ce1bbf950e23b19d9839fa905a5 upstream.

    Signed-off-by: Tristan Bruns <tristan@tristanbruns.de>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b08f08b56fdbff8617e4d85182500684f754890e
Author: Michael Ulbricht <michael.ulbricht@systec-electronic.com>
Date:   Tue Mar 25 10:34:18 2014 +0100

    USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver

    commit 895d240d1db0b2736d779200788e4c4aea28a0c6 upstream.

    By specifying NO_UNION_NORMAL the ACM driver does only use the first two
    USB interfaces (modem data & control). The AT Port, Diagnostic and NMEA
    interfaces are left to the USB serial driver.

    Signed-off-by: Michael Ulbricht <michael.ulbricht@systec-electronic.com>
    Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4e351a30ae3928b889cf23e5153075591938926
Author: Mizuma, Masayoshi <m.mizuma@jp.fujitsu.com>
Date:   Fri Apr 18 15:07:18 2014 -0700

    mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()

    commit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.

    soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm:
    hugetlb: fix softlockup when a large number of hugepages are freed." can
    happen in return_unused_surplus_pages(), so let's fix it.

    Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Michal Hocko <mhocko@suse.cz>
    Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 69ec67c1c1360345aa949fa571039bd8c69d7721
Author: Helge Deller <deller@gmx.de>
Date:   Sun Apr 13 00:03:55 2014 +0200

    parisc: fix epoll_pwait syscall on compat kernel

    commit ab3e55b119c9653b19ea4edffb86f04db867ac98 upstream.

    This bug was detected with the libio-epoll-perl debian package where the
    test case IO-Ppoll-compat.t failed.

    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ef7a7b3a6067ccce4459f4316b545a4bd7ca9470
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:08 2014 +0000

    futex: Make lookup_pi_state more robust

    The current implementation of lookup_pi_state has ambigous handling of
    the TID value 0 in the user space futex. We can get into the kernel
    even if the TID value is 0, because either there is a stale waiters
    bit or the owner died bit is set or we are called from the requeue_pi
    path or from user space just for fun.

    The current code avoids an explicit sanity check for pid = 0 in case
    that kernel internal state (waiters) are found for the user space
    address. This can lead to state leakage and worse under some
    circumstances.

    Handle the cases explicit:

         Waiter | pi_state | pi->owner | uTID      | uODIED | ?

    [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
    [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

    [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

    [4]  Found  | Found    | NULL      | 0         | 1      | Valid
    [5]  Found  | Found    | NULL      | >0        | 1      | Invalid

    [6]  Found  | Found    | task      | 0         | 1      | Valid

    [7]  Found  | Found    | NULL      | Any       | 0      | Invalid

    [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
    [9]  Found  | Found    | task      | 0         | 0      | Invalid
    [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

    [1]  Indicates that the kernel can acquire the futex atomically. We
         came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

    [2]  Valid, if TID does not belong to a kernel thread. If no matching
         thread is found then it indicates that the owner TID has died.

    [3]  Invalid. The waiter is queued on a non PI futex

    [4]  Valid state after exit_robust_list(), which sets the user space
         value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

    [5]  The user space value got manipulated between exit_robust_list()
         and exit_pi_state_list()

    [6]  Valid state after exit_pi_state_list() which sets the new owner in
         the pi_state but cannot access the user space value.

    [7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

    [8]  Owner and user space value match

    [9]  There is no transient state which sets the user space TID to 0
         except exit_robust_list(), but this is indicated by the
         FUTEX_OWNER_DIED bit. See [4]

    [10] There is no transient state which leaves owner and user space
         TID out of sync.

    Backport to 3.13
      conflicts: kernel/futex.c

    Change-Id: Ibec82fe154f4ed702332d2d259ec88317b6fede1
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Cc: Darren Hart <dvhart@linux.intel.com>
    Cc: stable@vger.kernel.org

commit 86245f3643435998c86d9eeeea5f9b6877ae7036
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:07 2014 +0000

    futex: Always cleanup owner tid in unlock_pi

    If the owner died bit is set at futex_unlock_pi, we currently do not
    cleanup the user space futex. So the owner TID of the current owner
    (the unlocker) persists. That's observable inconsistant state,
    especially when the ownership of the pi state got transferred.

    Clean it up unconditionally.

    Change-Id: I8708a8c38c82ac4565634421fce8f916a6da873b
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Cc: Darren Hart <dvhart@linux.intel.com>
    Cc: stable@vger.kernel.org

commit c2ee83fca8568c3db2cf3415f4462da3de4ea962
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex: Validate atomic acquisition in futex_lock_pi_atomic()

    We need to protect the atomic acquisition in the kernel against rogue
    user space which sets the user space futex to 0, so the kernel side
    acquisition succeeds while there is existing state in the kernel
    associated to the real owner.

    Verify whether the futex has waiters associated with kernel state. If
    it has, return -EINVAL. The state is corrupted already, so no point in
    cleaning it up. Subsequent calls will fail as well. Not our problem.

    [ tglx: Use futex_top_waiter() and explain why we do not need to try
      	restoring the already corrupted user space state. ]

    Change-Id: Ifca31cf91f32a408171a01b8db1e49c14411a776
    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Will Drewry <wad@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit d499910df85d67f023e0e8f4e2eb559701953e4d
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Jun 3 12:27:06 2014 +0000

    futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

    If uaddr == uaddr2, then we have broken the rule of only requeueing
    from a non-pi futex to a pi futex with this call. If we attempt this,
    then dangling pointers may be left for rt_waiter resulting in an
    exploitable condition.

    This change brings futex_requeue() into line with
    futex_wait_requeue_pi() which performs the same check as per commit
    6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

    [ tglx: Compare the resulting keys as well, as uaddrs might be
      	different depending on the mapping ]

    Fixes CVE-2014-3153.

    Change-Id: I6bfa0943ee54d6331e6faa7779d621f9cf19fe52
    Reported-by: Pinkie Pie
    Signed-off-by: Will Drewry <wad@chromium.org>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit 903a5ca2b7c3eb079847a43dcac6b9320bba0445
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Mon May 12 20:45:34 2014 +0000

    futex: Add another early deadlock detection check

    Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
    detection code of rtmutex:
      http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com

    That underlying issue has been fixed with a patch to the rtmutex code,
    but the futex code must not call into rtmutex in that case because
        - it can detect that issue early
        - it avoids a different and more complex fixup for backing out

    If the user space variable got manipulated to 0x80000000 which means
    no lock holder, but the waiters bit set and an active pi_state in the
    kernel is found we can figure out the recursive locking issue by
    looking at the pi_state owner. If that is the current task, then we
    can safely return -EDEADLK.

    The check should have been added in commit 59fa62451 (futex: Handle
    futex_pi OWNER_DIED take over correctly) already, but I did not see
    the above issue caused by user space manipulation back then.

    Change-Id: I038ce8d61ee0d427574939b048035877149a2981
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Darren Hart <darren@dvhart.com>
    Cc: Davidlohr Bueso <davidlohr@hp.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Clark Williams <williams@redhat.com>
    Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Carlos ODonell <carlos@redhat.com>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org

commit 19bf68af5f197131f9f37491d17e1351aba94fd3
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Mon May 12 20:45:35 2014 +0000

    futex: Prevent attaching to kernel threads

    We happily allow userspace to declare a random kernel thread to be the
    owner of a user space PI futex.

    Found while analysing the fallout of Dave Jones syscall fuzzer.

    We also should validate the thread group for private futexes and find
    some fast way to validate whether the "alleged" owner has RW access on
    the file which backs the SHM, but that's a separate issue.

    Change-Id: Id43144232efa7c3ae7c630cffa69f55ff83d8fd9
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Darren Hart <darren@dvhart.com>
    Cc: Davidlohr Bueso <davidlohr@hp.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Clark Williams <williams@redhat.com>
    Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Carlos ODonell <carlos@redhat.com>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org

commit c4f1f8cec1e3c7e3526f6666939f22d23fcd8714
Merge: bb17c85 040a604
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Jun 5 06:00:45 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.061 on remote branch"

commit ca86996eb7566c6c8d4ae2b4447fca2589b7bc18
Author: Stephen Smalley <sds@tycho.nsa.gov>
Date:   Thu Jan 30 11:26:59 2014 -0500

    SELinux: Fix kernel BUG on empty security contexts.

    Setting an empty security context (length=0) on a file will
    lead to incorrectly dereferencing the type and other fields
    of the security context structure, yielding a kernel BUG.
    As a zero-length security context is never valid, just reject
    all such security contexts whether coming from userspace
    via setxattr or coming from the filesystem upon a getxattr
    request by SELinux.

    Setting a security context value (empty or otherwise) unknown to
    SELinux in the first place is only possible for a root process
    (CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
    if the corresponding SELinux mac_admin permission is also granted
    to the domain by policy.  In Fedora policies, this is only allowed for
    specific domains such as livecd for setting down security contexts
    that are not defined in the build host policy.

    [On Android, this can only be set by root/CAP_MAC_ADMIN processes,
    and if running SELinux in enforcing mode, only if mac_admin permission
    is granted in policy.  In Android 4.4, this would only be allowed for
    root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
    AOSP master, mac_admin is not allowed for any domains except the recovery
    console which has a legitimate need for it.  The other potential vector
    is mounting a maliciously crafted filesystem for which SELinux fetches
    xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
    only a local denial-of-service (DOS) due to kernel BUG.  This fix is
    queued for 3.14.]

    Reproducer:
    su
    setenforce 0
    touch foo
    setfattr -n security.selinux foo

    Caveat:
    Relabeling or removing foo after doing the above may not be possible
    without booting with SELinux disabled.  Any subsequent access to foo
    after doing the above will also trigger the BUG.

    BUG output from Matthew Thode:
    [  473.893141] ------------[ cut here ]------------
    [  473.962110] kernel BUG at security/selinux/ss/services.c:654!
    [  473.995314] invalid opcode: 0000 [#6] SMP
    [  474.027196] Modules linked in:
    [  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
    3.13.0-grsec #1
    [  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
    07/29/10
    [  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
    ffff8805f50cd488
    [  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
    context_struct_compute_av+0xce/0x308
    [  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
    [  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
    0000000000000100
    [  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
    ffff8805e8aaa000
    [  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
    0000000000000006
    [  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
    0000000000000006
    [  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
    0000000000000000
    [  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
    knlGS:0000000000000000
    [  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
    00000000000207f0
    [  474.556058] Stack:
    [  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
    ffff8805f1190a40
    [  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
    ffff8805e8aac860
    [  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
    ffff8805c0ac3d94
    [  474.690461] Call Trace:
    [  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
    [  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
    [  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
    [  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
    [  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
    [  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
    [  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
    [  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
    [  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
    [  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
    [  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
    [  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
    [  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
    [  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
    8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
    75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
    [  475.255884] RIP  [<ffffffff814681c7>]
    context_struct_compute_av+0xce/0x308
    [  475.296120]  RSP <ffff8805c0ac3c38>
    [  475.328734] ---[ end trace f076482e9d754adc ]---

    [sds:  commit message edited to note Android implications and
    to generate a unique Change-Id for gerrit]

    Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
    Reported-by:  Matthew Thode <mthode@mthode.org>
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: stable@vger.kernel.org
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>

commit 040a6048104f91849ab1b453e86cf1310240896a
Merge: bb17c85 6475d6a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Jun 5 03:38:48 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.061 on remote branch

    Change-Id: I6888a2aaf3d3804594cf09597a33b9f43b29c75f

commit 6475d6ae132eea1f5c480c72647c347b0f9151ae
Merge: bb17c85 c6dc52f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 4 02:49:42 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.060 on remote branch"

commit c6dc52fc80767b8cda441ac460a4759bb8b60538
Merge: bb17c85 1262e51
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Jun 4 02:04:04 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.060 on remote branch

    Change-Id: I50b57c78b7ed81dd3f373f4e4d2c333e584f98f4

commit 3eb8c3a879074d8d78e77e94e35eaf41d8911cb5
Author: Pranav Vashi <neobuddy89@gmail.com>
Date:   Mon May 19 00:27:36 2014 +0530

    drivers: usb: Use Android device as USB keyboard/mouse

    Adapt to 3.4.y 8974/hammerhead
    Base project: https://github.com/pelya/android-keyboard-gadget
    Required app:
    https://play.google.com/store/apps/details?id=remote.hid.keyboard.client

    Steps:
    * Start ADB Debugging
    * Start app
    * Connect device to system via USB cable

    All credits to @pelya for this sweet hack.

    Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>

    Conflicts:
    	drivers/usb/gadget/android.c

    Change-Id: I775ba52925bdc52d865d8915e238ee7e5fc1455e

commit cd5e275acf578afbe3da36cd87c94b57ebf02449
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Mon Apr 14 17:47:41 2014 -0500

    kswapd: Introduce congestion_wait_kswapd

    congestion_wait for kswapd is similar to congestion_wait, the vital
    difference is that congestion_wait_kswapd uses schedule_timeout
    instead of io_schedule_timeout (which can cause IO wait conditions,
    due to nr_iowait usage).

    Derived from: https://github.com/oppo-source/Find5-Kernel-Source-4.2/commit/c7b44a43a970b699ecd68655bd6f83a8fbb3d74d
    Original author: huanggd @oppo-source

    Change-Id: I08bbbdd49c8764a3180c0d7a9197d2b9c8112d81
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 39225093680e6a923a646cab9b384b6bbc064548
Author: Jason Hrycay <jason.hrycay@motorola.com>
Date:   Fri Jul 26 07:54:30 2013 -0500

    usb: otg:  Retry putting the OTG PHY in low power mode.

    The MSM OTG PHY does not go into low power mode when powered up with a
    charger. Hence reset the PHY and add logic to retry the LPM Handshake.
    This will avoid the msm_otg wakelock getting stuck forever when powered
    up with a charger.

    Change-Id: I00d90ce3bf3bb23e36aa42233a2e91a719264ec9
    Signed-off-by: Ravikumar Vembu <a18394@motorola.com>
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 01460a0acfe8336a8cc5c93cac3cd1f853c51c00
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jun 1 22:22:32 2014 -0400

    d2lte: I like MHL

    Change-Id: I33759f7e3d54c1edc0e33c1a5982ec0c272f5fd0

commit 5874f20fdf91e506b0afa38d7ff8c09cc79d47ce
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jun 1 22:37:26 2014 -0400

    sec_battery: driver changes from ND8 release

    Change-Id: Ia5319d41ea390ea2e18785995b46039ecf087dca

commit b70faaff83690e1c3baca33fe0d7a36c9d21cd92
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jun 1 21:55:15 2014 -0400

    apexq: small driver change from ND8 release

    Someone should really update the d2 stuff

    Change-Id: I6cfb1dc2ebb549e64aa6245ee0d575c689b2e2e4

commit df11b535d98237768ecc37cbc079bcf0e1833836
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Jun 1 14:20:02 2014 -0400

    Everyone likes 7 step call volumes

    Change-Id: I4d5986dd59438311c65dc71341835bb4b857eb60

commit cc48444839552b83033c7953eb4057d2ac91d4ff
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat May 31 16:51:55 2014 -0400

    drivers: staging: prima: yadda yadda from caf

commit 88ea3b1a536ef065e236bcfe43d1c60985e2289a
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat May 31 16:23:36 2014 -0400

    fix minor mismerge

commit 8d44a39bc40db9c1054c29d0ba039e78bd577bc2
Author: sbrissen <sbrissen@hotmail.com>
Date:   Fri Mar 28 08:17:17 2014 -0400

    d2: cypress-touchkey - add keydisabler

    Change-Id: I85efd4c5b2d6a7283c430f5eca2a730ef6b03d18

commit 08873c51028f96e23106f82b429123db3e4b560d
Author: Evan McClain <aeroevan@gmail.com>
Date:   Sun Mar 16 19:46:33 2014 -0400

    Update d2 defconfig and turn on F2FS

    Also turn on f2fs security for selinux

    Change-Id: Ibec3dc8943b15cd8720520d37b50fe0782a79550

commit d0fa93c8245dabbb1c6b4c398eae812afc9618c6
Author: Changman Lee <cm224.lee@samsung.com>
Date:   Fri Nov 15 10:42:51 2013 +0900

    f2fs: Update to version in 3.14

    f2fs: introduce __find_rev_next(_zero)_bit

    When f2fs_set_bit is used, in a byte MSB and LSB is reversed,
    in that case we can use __find_rev_next_bit or __find_rev_next_zero_bit.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    [Jaegeuk Kim: change the function names]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: improve searching speed of __next_free_blkoff

    To find a zero bit using the result of OR operation between ckpt_valid_map
    and cur_valid_map is more fast than find a zero bit in each bitmap.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    [Jaegeuk Kim: adjust changed function name]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a slab cache entry for small discards

    This patch adds a slab cache entry for small discards.

    Each entry consists of:

    struct discard_entry {
    	struct list_head list;	/* list head */
    	block_t blkaddr;	/* block address to be discarded */
    	int len;		/* # of consecutive blocks of the discard */
    };

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add key functions for small discards

    This patch adds key functions to activate the small discard feature.

    Note that this procedure is conducted during the checkpoint only.

    In flush_sit_entries(), when a new dirty sit entry is flushed, f2fs calls
    add_discard_addrs() which searches candidates to be discarded.
    The candidates should be marked *invalidated* and also previous checkpoint
    recognizes it as *valid*.

    At the end of a checkpoint procedure, f2fs throws discards based on the
    discard entry list.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a sysfs entry to control max_discards

    If frequent small discards are issued to the device, the performance would
    be degraded significantly.
    So, this patch adds a sysfs entry to control the number of discards to be
    issued during a checkpoint procedure.

    By default, f2fs does not issue any small discards, which means max_discards
    is zero.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce f2fs_issue_discard() to clean up

    Change log from v1:
     o fix 32bit drops reported by Dan Carpenter

    This patch adds f2fs_issue_discard() to clean up blkdev_issue_discard() flows.

    Dan carpenter reported:
    "block_t is a 32 bit type and sector_t is a 64 bit type.  The upper 32
    bits of the sector_t are not used because the shift will wrap."

    Bug-Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a tracepoint for f2fs_issue_discard

    This patch adds a tracepoint for f2fs_issue_discard.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: use f2fs_put_page to release page for uniform style

    We should use f2fs_put_page to release page for uniform style of f2fs code.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: clean up the do_submit_bio flow

    This patch introduces PAGE_TYPE_OF_BIO() and cleans up do_submit_bio() with it.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: use sbi->write_mutex for write bios

    This patch removes an unnecessary semaphore (i.e., sbi->bio_sem).
    There is no reason to use the semaphore when f2fs submits read and write IOs.
    Instead, let's use a write mutex and cover the sbi->bio[] by the lock.

    Change log from v1:
     o split write_mutex suggested by Chao Yu

    Chao described,
    "All DATA/NODE/META bio buffers in superblock is protected by
    'sbi->write_mutex', but each bio buffer area is independent, So we
    should split write_mutex to three for DATA/NODE/META."

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: disable the extent cache ops on high fragmented files

    The f2fs manages an extent cache to search a number of consecutive data blocks
    very quickly.

    However it conducts unnecessary cache operations if the file is highly
    fragmented with no valid extent cache.

    In such the case, we don't need to handle the extent cache, but just can disable
    the cache facility.

    Nevertheless, this patch gives one more chance to enable the extent cache.

    For example,
    1. create a file
    2. write data sequentially which produces a large valid extent cache
    3. update some data, resulting in a fragmented extent
    4. if the fragmented extent is too small, then drop extent cache
    5. close the file

    6. open the file again
    7. give another chance to make a new extent cache
    8. write data sequentially again which creates another big extent cache.
    ...

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce a bio array for per-page write bios

    The f2fs has three bio types, NODE, DATA, and META, and manages some data
    structures per each bio types.

    The codes are a little bit messy, thus, this patch introduces a bio array
    which groups individual data structures as follows.

    struct f2fs_bio_info {
    	struct bio *bio;		/* bios to merge */
    	sector_t last_block_in_bio;	/* last block number */
    	struct mutex io_mutex;		/* mutex for bio */
    };

    struct f2fs_sb_info {
    	...
    	struct f2fs_bio_info write_io[NR_PAGE_TYPE];	/* for write bios */
    	...
    };

    The code changes from this new data structure are trivial.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert remove_inode_page to void

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert dev_valid_block_count to void

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert inc/dec_valid_node_count to inc/dec one count

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: simplify write_orphan_inodes for better readable

    Simplify write_orphan_inodes for better readable. Because we hold the
    orphan_inode_mutex, so it's safe to use list_for_each_entry instead of
    list_for_each_safe.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: move the list_head initialization into the lock protection region

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a new function to support for merging contiguous read

    For better read performance, we add a new function to support for merging
    contiguous read as the one for write.

    v1-->v2:
     o add declarations here as Gu Zheng suggested.
     o use new structure f2fs_bio_info introduced by Jaegeuk Kim.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Acked-by: Gu Zheng <guz.fnst@cn.fujitsu.com>

    f2fs: merge read IOs at ra_nat_pages()

    Change log from v1:
      o add mark_page_accessed() not to reclaim the nat pages.

    This patch changes the policy of submitting read bios at ra_nat_pages.

    Previously, f2fs submits small read bios with block plugging.
    But, with this patch, f2fs itself merges read bios first and then submits a
    large bio, which can reduce the bio handling overheads.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: simplify IS_DATASEG and IS_NODESEG macro

    It is not efficient comparing each segment type to find node or data.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    [Jaegeuk Kim: remove unnecessary white spaces]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: adds a tracepoint for submit_read_page

    This patch adds a tracepoint for submit_read_page.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: integrate tracepoints of f2fs_submit_read(_write)_page]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: adds a tracepoint for f2fs_submit_read_bio

    This patch adds a tracepoint for f2fs_submit_read_bio.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: integrate tracepoints of f2fs_submit_read(_write)_bio]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: read contiguous sit entry pages by merging for mount performance

    Previously we read sit entries page one by one, this method lost the chance
    of reading contiguous page together. So we read pages as contiguous as
    possible for better mount performance.

    change log:
     o merge judgements/use 'Continue' or 'Break' instead of 'Goto' as Gu Zheng
       suggested.
     o add mark_page_accessed() before release page to delay VM reclaiming.
     o remove '*order' for simplification of function as Jaegeuk Kim suggested.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: fix a bug on the block address calculation]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid lock debugging overhead

    If CONFIG_F2FS_CHECK_FS is unset, we don't need to add any debugging overhead.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a new function: f2fs_reserve_block()

    Add the function f2fs_reserve_block() to easily reserve new blocks, and
    use it to clean up more codes.

    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Haicheng Li <haicheng.li@linux.intel.com>
    Signed-off-by: Weihong Xu <weihong.xu@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add detailed information of bio types in the tracepoints

    This patch inserts information of bio types in more detail.
    So, we can now see REQ_META and REQ_PRIO too.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: send REQ_META or REQ_PRIO when reading meta area

    Let's send REQ_META or REQ_PRIO when reading meta area such as NAT/SIT
    etc.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add flags and helpers to support inline data

    Add new inode flags F2FS_INLINE_DATA and FI_INLINE_DATA to indicate
    whether the inode has inline data.

    Inline data makes use of inode block's data indices region to save small
    file. Currently there are 923 data indices in an inode block. Since
    inline xattr has made use of the last 50 indices to save its data, there
    are 873 indices left which can be used for inline data. When
    FI_INLINE_DATA is set, the layout of inode block's indices region is
    like below:

    +-----------------+
    |                 | Reserved. reserve_new_block() will make use of
    | i_addr[0]       | i_addr[0] when we need to reserve a new data block
    |                 | to convert inline data into regular one's.
    |-----------------|
    |                 | Used by inline data. A file whose size is less than
    | i_addr[1~872]   | 3488 bytes(~3.4k) and doesn't reserve extra
    |                 | blocks by fallocate() can be saved here.
    |-----------------|
    |                 |
    | i_addr[873~922] | Reserved for inline xattr
    |                 |
    +-----------------+

    Signed-off-by: Haicheng Li <haicheng.li@linux.intel.com>
    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Weihong Xu <weihong.xu@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a new mount option: inline_data

    Add a mount option: inline_data. If the mount option is set,
    data of New created small files can be stored in their inode.

    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Haicheng Li <haicheng.li@linux.intel.com>
    Signed-off-by: Weihong Xu <weihong.xu@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove unnecessary return value

    Let's remove the unnecessary return value.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: fix a potential out of range issue

    Fix a potential out of range issue introduced by commit:
    22fb72225a
    f2fs: simplify write_orphan_inodes for better readable

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: bug fix on bit overflow from 32bits to 64bits

    This patch fixes some bit overflows by the shift operations.

    Dan Carpenter reported potential bugs on bit overflows as follows.

    fs/f2fs/segment.c:910 submit_write_page()
    	warn: should 'blk_addr << ((sbi)->log_blocksize - 9)' be a 64 bit type?
    fs/f2fs/checkpoint.c:429 get_valid_checkpoint()
    	warn: should '1 << ()' be a 64 bit type?
    fs/f2fs/data.c:408 f2fs_readpage()
    	warn: should 'blk_addr << ((sbi)->log_blocksize - 9)' be a 64 bit type?
    fs/f2fs/data.c:457 submit_read_page()
    	warn: should 'blk_addr << ((sbi)->log_blocksize - 9)' be a 64 bit type?
    fs/f2fs/data.c:525 get_data_block_ro()
    	warn: should 'i << blkbits' be a 64 bit type?

    Bug-Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove unnecessary condition checks

    This patch removes the unnecessary condition checks on:

    fs/f2fs/gc.c:667 do_garbage_collect() warn: 'sum_page' isn't an ERR_PTR
    fs/f2fs/f2fs.h:795 f2fs_put_page() warn: 'page' isn't an ERR_PTR

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove unneeded code in punch_hole

    Because FALLOC_FL_PUNCH_HOLE flag must be ORed with FALLOC_FL_KEEP_SIZE
    in fallocate, so we could remove the useless 'keep size' branch code which
    will never be excuted in punch_hole.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Fan Li <fanofcode.li@samsung.com>
    [Jaegeuk Kim: remove an unnecessary parameter togather]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid to calculate incorrect max orphan number

    Because we will write node summaries when do_checkpoint with umount flag,
    our number of max orphan blocks should minus NR_CURSEG_NODE_TYPE additional.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Shu Tan <shu.tan@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: correct type of wait in struct bio_private

    The void *wait in bio_private is used for waiting completion of checkpoint bio.
    So we don't need to use its type as void, but declare it as completion type.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: add description]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: use true and false for boolean variable

    The inode_page_locked should be a boolean variable.

    struct dnode_of_data {
    	struct inode *inode;            /* vfs inode pointer */
    	struct page *inode_page;        /* its inode page, NULL is possible */
    	struct page *node_page;         /* cached direct node page */
    	nid_t nid;                      /* node id of the direct node block */
    	unsigned int ofs_in_node;       /* data offset in the node page */
    ==>	bool inode_page_locked;         /* inode page is locked or not */
    	block_t data_blkaddr;           /* block address of the node block */
    };

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: add description]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: check return value of f2fs_readpage in find_data_page

    We should return error if we do not get an updated page in find_date_page
    when f2fs_readpage failed.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert recover_orphan_inodes to void

    The recover_orphan_inodes() returns no error all the time, so we don't need to
    check its errors.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: add description]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove the own bi_private allocation

    Previously f2fs allocates its own bi_private data structure all the time even
    though we don't use it. But, can we remove this bi_private allocation?

    This patch removes such the additional bi_private allocation.

    1. Retrieve f2fs_sb_info from its page->mapping->host->i_sb.
     - This removes the usecases of bi_private in end_io.

    2. Use bi_private only when we really need it.
     - The bi_private is used only when the checkpoint procedure is conducted.
     - When conducting the checkpoint, f2fs submits a META_FLUSH bio to wait its bio
    completion.
     - Since we have no dependancies to remove bi_private now, let's just use
     bi_private pointer as the completion pointer.

    Reviewed-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: refactor bio-related operations

    This patch integrates redundant bio operations on read and write IOs.

    1. Move bio-related codes to the top of data.c.
    2. Replace f2fs_submit_bio with f2fs_submit_merged_bio, which handles read
       bios additionally.
    3. Introduce __submit_merged_bio to submit the merged bio.
    4. Change f2fs_readpage to f2fs_submit_page_bio.
    5. Introduce f2fs_submit_page_mbio to integrate previous submit_read_page and
       submit_write_page.

    Reviewed-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com >
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: readahead contiguous pages for restore_node_summary

    If cp has no CP_UMOUNT_FLAG, we will read all pages in whole node segment
    one by one, it makes low performance. So let's merge contiguous pages and
    readahead for better performance.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: adjust the new bio operations]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove debufs dir if debugfs_create_file() failed

    When debugfs_create_file() failed in f2fs_create_root_stats(),
    debugfs_root should be remove.

    Signed-off-by: Younger Liu <liuyiyang@hisense.com>
    Cc: Younger Liu <younger.liucn@gmail.com>
    Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: replace the debugfs_root with f2fs_debugfs_root

    This minor change for the naming conventions of debugfs_root
    to avoid any possible conflicts to the other filesystem.

    Signed-off-by: Younger Liu <younger.liucn@gmail.com>
    Cc: Younger Liu <younger.liucn@gmail.com>
    Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>
    [Jaegeuk Kim: change the patch name]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: use inner macro GFP_F2FS_ZERO for simplification

    Use inner macro GFP_F2FS_ZERO to instead of GFP_NOFS | __GFP_ZERO for
    simplification of code.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid unneeded page release for correct _count of page

    In find_fsync_dnodes() and recover_data(), our flow is like this:

    ->f2fs_submit_page_bio()
    	-> f2fs_put_page()
    		-> page_cache_release()	---- page->_count declined to zero.
    ->__free_pages()
    	-> put_page_testzero() ---- page->_count will be declined again.

    We will get a segment fault in put_page_testzero when CONFIG_DEBUG_VM
    is on, or return MM with a bad page with wrong _count num.

    So let's just release this page.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add unlikely() macro for compiler optimization

    As we know, some of our branch condition will rarely be true. So we could add
    'unlikely' to let compiler optimize these code, by this way we could drop
    unneeded 'jump' assemble code to improve performance.

    change log:
     o add *unlikely* as many as possible across the whole source files at once
       suggested by Jaegeuk Kim.

    Suggested-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add unlikely() macro for compiler more aggressively

    This patch adds unlikely() macro into the most of codes.
    The basic rule is to add that when:
    - checking unusual errors,
    - checking page mappings,
    - and the other unlikely conditions.

    Change log from v1:
     - Don't add unlikely for the NULL test and error test: advised by Andi Kleen.

    Cc: Chao Yu <chao2.yu@samsung.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: merge pages with the same sync_mode flag

    Previously f2fs submits most of write requests using WRITE_SYNC, but f2fs_write_data_pages
    submits last write requests by sync_mode flags callers pass.

    This causes a performance problem since continuous pages with different sync flags
    can't be merged in cfq IO scheduler(thanks yu chao for pointing it out), and synchronous
    requests often take more time.

    This patch makes the following modifies to DATA writebacks:

    1. every page will be written back using the sync mode caller pass.
    2. only pages with the same sync mode can be merged in one bio request.

    These changes are restricted to DATA pages.Other types of writebacks are modified
    To remain synchronous.

    In my test with tiotest, f2fs sequence write performance is improved by about 7%-10% ,
    and this patch has no obvious impact on other performance tests.

    Signed-off-by: Fan Li <fanofcode.li@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: refactor bio->rw handling

    This patch introduces f2fs_io_info to mitigate the complex parameter list.

    struct f2fs_io_info {
    	enum page_type type;		/* contains DATA/NODE/META/META_FLUSH */
    	int rw;				/* contains R/RS/W/WS */
    	int rw_flag;			/* contains REQ_META/REQ_PRIO */
    }

    1. f2fs_write_data_pages
     - DATA
     - WRITE_SYNC is set when wbc->WB_SYNC_ALL.

    2. sync_node_pages
     - NODE
     - WRITE_SYNC all the time

    3. sync_meta_pages
     - META
     - WRITE_SYNC all the time
     - REQ_META | REQ_PRIO all the time

     ** f2fs_submit_merged_bio() handles META_FLUSH.

    4. ra_nat_pages, ra_sit_pages, ra_sum_pages
     - META
     - READ_SYNC

    Cc: Fan Li <fanofcode.li@samsung.com>
    Cc: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: fix the location of tracepoint

    We need to get a trace before submit_bio, since its bi_sector is remapped during
    the submit_bio.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: missing kmem_cache_destroy for discard_entry

    insmod f2fs.ko is failed after insmod and rmmod firstly.

    $ sudo insmod fs/f2fs/f2fs.ko
    insmod: error inserting 'fs/f2fs/f2fs.ko': -1 Cannot allocate memory

    -- dmesg --
    kmem_cache_sanity_check (free_nid): Cache name already exists.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce sysfs entry to control in-place-update policy

    This patch introduces new sysfs entries for users to control the policy of
    in-place-updates, namely IPU, in f2fs.

    Sometimes f2fs suffers from performance degradation due to its out-of-place
    update policy that produces many additional node block writes.
    If the storage performance is very dependant on the amount of data writes
    instead of IO patterns, we'd better drop this out-of-place update policy.

    This patch suggests 5 polcies and their triggering conditions as follows.

    [sysfs entry name = ipu_policy]

    0: F2FS_IPU_FORCE       all the time,
    1: F2FS_IPU_SSR         if SSR mode is activated,
    2: F2FS_IPU_UTIL        if FS utilization is over threashold,
    3: F2FS_IPU_SSR_UTIL    if SSR mode is activated and FS utilization is over
                            threashold,
    4: F2FS_IPU_DISABLE    disable IPU. (=default option)

    [sysfs entry name = min_ipu_util]

    This parameter controls the threshold to trigger in-place-updates.
    The number indicates percentage of the filesystem utilization, and used by
    F2FS_IPU_UTIL and F2FS_IPU_SSR_UTIL policies.

    For more details, see need_inplace_update() in segment.h.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce a new direct_IO write path

    Previously, f2fs doesn't support direct IOs with high performance, which throws
    every write requests via the buffered write path, resulting in highly
    performance degradation due to memory opeations like copy_from_user.

    This patch introduces a new direct IO path in which every write requests are
    processed by generic blockdev_direct_IO() with enhanced get_block function.

    The get_data_block() in f2fs handles:
    1. if original data blocks are allocates, then give them to blockdev.
    2. otherwise,
      a. preallocate requested block addresses
      b. do not use extent cache for better performance
      c. give the block addresses to blockdev

    This policy induces that:
    - new allocated data are sequentially written to the disk
    - updated data are randomly written to the disk.
    - f2fs gives consistency on its file meta, not file data.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: write dirty meta pages collectively

    This patch enhances writing dirty meta pages collectively in background.
    During the file data writes, it'd better avoid to write small dirty meta pages
    frequently.
    So let's give a chance to collect a number of dirty meta pages for a while.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: move all the bio initialization into __bio_alloc

    Move all the bio initialization into __bio_alloc, and some minor cleanups are
    also added.

    v3:
      Use 'bool' rather than 'int' as Kim suggested.

    v2:
      Use 'is_read' rather than 'rw' as Yu Chao suggested.
      Remove the needless initialization of bio->bi_private.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove the rw_flag domain from f2fs_io_info

    When using the f2fs_io_info in the low level, we still need to merge the
    rw and rw_flag, so use the rw to hold all the io flags directly,
    and remove the rw_flag field.

    ps.It is based on the previous patch:
    f2fs: move all the bio initialization into __bio_alloc

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: update several comments

    Update several comments:
    1. use f2fs_{un}lock_op install of mutex_{un}lock_op.
    2. update comment of get_data_block().
    3. update description of node offset.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid to set wrong pino of inode when rename dir

    When we rename a dir to new name which is not exist previous,
    we will set pino of parent inode with ino of child inode in f2fs_set_link.
    It destroy consistency of pino, it should be fixed.

    Thanks for previous work of Shu Tan.

    Signed-off-by: Shu Tan <shu.tan@samsung.com>
    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: check filename length in recover_dentry

    In current flow, we will get Null return value of f2fs_find_entry in
    recover_dentry when name.len is bigger than F2FS_NAME_LEN, and then we
    still add this inode into its dir entry.
    To avoid this situation, we must check filename length before we use it.

    Another point is that we could remove the code of checking filename length
    In f2fs_find_entry, because f2fs_lookup will be called previously to ensure of
    validity of filename length.

    V2:
     o add WARN_ON() as Jaegeuk Kim suggested.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce F2FS_INODE macro to get f2fs_inode

    This patch introduces F2FS_INODE that returns struct f2fs_inode * from the inode
    page.
    By using this macro, we can remove unnecessary casting codes like below.

       struct f2fs_inode *ri = &F2FS_NODE(inode_page)->i;
    -> struct f2fs_inode *ri = F2FS_INODE(inode_page);

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: should put the dnode when NEW_ADDR is detected

    When get_dnode_of_data() in get_data_block() returns a successful dnode, we
    should put the dnode.
    But, previously, if its data block address is equal to NEW_ADDR, we didn't do
    that, resulting in a deadlock condition.
    So, this patch splits original error conditions with this case, and then calls
    f2fs_put_dnode before finishing the function.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: check the blocksize before calling generic_direct_IO path

    The f2fs supports 4KB block size. If user requests dwrite with under 4KB data,
    it allocates a new 4KB data block.
    However, f2fs doesn't add zero data into the untouched data area inside the
    newly allocated data block.

    This incurs an error during the xfstest #263 test as follow.

    263 12s ... [failed, exit status 1] - output mismatch (see 263.out.bad)
    	--- 263.out	2013-03-09 03:37:15.043967603 +0900
    	+++ 263.out.bad	2013-12-27 04:20:39.230203114 +0900
    	@@ -1,3 +1,976 @@
    	QA output created by 263
    	fsx -N 10000 -o 8192 -l 500000 -r PSIZE -t BSIZE -w BSIZE -Z
    	-fsx -N 10000 -o 128000 -l 500000 -r PSIZE -t BSIZE -w BSIZE -Z
    	+fsx -N 10000 -o 8192 -l 500000 -r PSIZE -t BSIZE -w BSIZE -Z
    	+truncating to largest ever: 0x12a00
    	+truncating to largest ever: 0x75400
    	+fallocating to largest ever: 0x79cbf
    	...
    	(Run 'diff -u 263.out 263.out.bad' to see the entire diff)
    	Ran: 263
    	Failures: 263
    	Failed 1 of 1 tests

    It turns out that, when the test tries to write 2KB data with dio, the new dio
    path allocates 4KB data block without filling zero data inside the remained 2KB
    area. Finally, the output file contains a garbage data for that region.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert max_orphans to a field of f2fs_sb_info

    Previously, we need to calculate the max orphan num when we try to acquire an
    orphan inode, but it's a stable value since the super block was inited. So
    converting it to a field of f2fs_sb_info and use it directly when needed seems
    a better choose.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: key functions to handle inline data

    Functions to implement inline data read/write, and move inline data to
    normal data block when file size exceeds inline data limitation.

    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Haicheng Li <haicheng.li@linux.intel.com>
    Signed-off-by: Weihong Xu <weihong.xu@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: handle inline data operations

    Hook inline data read/write, truncate, fallocate, setattr, etc.

    Files need meet following 2 requirement to inline:
     1) file size is not greater than MAX_INLINE_DATA;
     2) file doesn't pre-allocate data blocks by fallocate().

    FI_INLINE_DATA will not be set while creating a new regular inode because
    most of the files are bigger than ~3.4K. Set FI_INLINE_DATA only when
    data is submitted to block layer, ranther than set it while creating a new
    inode, this also avoids converting data from inline to normal data block
    and vice versa.

    While writting inline data to inode block, the first data block should be
    released if the file has a block indexed by i_addr[0].

    On the other hand, when a file operation is appied to a file with inline
    data, we need to test if this file can remain inline by doing this
    operation, otherwise it should be convert into normal file by reserving
    a new data block, copying inline data to this new block and clear
    FI_INLINE_DATA flag. Because reserve a new data block here will make use
    of i_addr[0], if we save inline data in i_addr[0..872], then the first
    4 bytes would be overwriten. This problem can be avoided simply by
    not using i_addr[0] for inline data.

    Signed-off-by: Huajun Li <huajun.li@intel.com>
    Signed-off-by: Haicheng Li <haicheng.li@linux.intel.com>
    Signed-off-by: Weihong Xu <weihong.xu@intel.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: don't need to get f2fs_lock_op for the inline_data test

    This patch locates checking the inline_data prior to calling f2fs_lock_op()
    in truncate_blocks(), since getting the lock is unnecessary.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: convert inline_data for punch_hole

    In the punch_hole(), let's convert inline_data all the time for simplicity and
    to avoid potential deadlock conditions.
    It is pretty much not a big deal to do this.

    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: call f2fs_put_page at the error case

    In f2fs_write_begin(), if f2fs_conver_inline_data() returns an error like
    -ENOSPC, f2fs should call f2fs_put_page().
    Otherwise, it is remained as a locked page, resulting in the following bug.

    [<ffffffff8114657e>] sleep_on_page+0xe/0x20
    [<ffffffff81146567>] __lock_page+0x67/0x70
    [<ffffffff81157d08>] truncate_inode_pages_range+0x368/0x5d0
    [<ffffffff81157ff5>] truncate_inode_pages+0x15/0x20
    [<ffffffff8115804b>] truncate_pagecache+0x4b/0x70
    [<ffffffff81158082>] truncate_setsize+0x12/0x20
    [<ffffffffa02a1842>] f2fs_setattr+0x72/0x270 [f2fs]
    [<ffffffff811cdae3>] notify_change+0x213/0x400
    [<ffffffff811ab376>] do_truncate+0x66/0xa0
    [<ffffffff811ab541>] vfs_truncate+0x191/0x1b0
    [<ffffffff811ab5bc>] do_sys_truncate+0x5c/0xa0
    [<ffffffff811ab78e>] SyS_truncate+0xe/0x10
    [<ffffffff81756052>] system_call_fastpath+0x16/0x1b
    [<ffffffffffffffff>] 0xffffffffffffffff

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: refactor f2fs_convert_inline_data

    Change log from v1:
     o handle NULL pointer of grab_cache_page_write_begin() pointed by Chao Yu.

    This patch refactors f2fs_convert_inline_data to check a couple of conditions
    internally for deciding whether it needs to convert inline_data or not.

    So, the new f2fs_convert_inline_data initially checks:
    1) f2fs_has_inline_data(), and
    2) the data size to be changed.

    If the inode has inline_data but the size to fill is less than MAX_INLINE_DATA,
    then we don't need to convert the inline_data with data allocation.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add the number of inline_data files to status info

    This patch adds the number of inline_data files into the status information.
    Note that the number is reset whenever the filesystem is newly mounted.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add inline_data recovery routine

    This patch adds a inline_data recovery routine with the following policy.

    [prev.] [next] of inline_data flag
       o       o  -> recover inline_data
       o       x  -> remove inline_data, and then recover data blocks
       x       o  -> remove inline_data, and then recover inline_data
       x       x  -> recover data blocks

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: handle errors correctly during f2fs_reserve_block

    The get_dnode_of_data nullifies inode and node page when error is occurred.

    There are two cases that passes inode page into get_dnode_of_data().

    1. make_empty_dir()
        -> get_new_data_page()
          -> f2fs_reserve_block(ipage)
    	-> get_dnode_of_data()

    2. f2fs_convert_inline_data()
        -> __f2fs_convert_inline_data()
          -> f2fs_reserve_block(ipage)
    	-> get_dnode_of_data()

    This patch adds correct error handling codes when get_dnode_of_data() returns
    an error.

    At first, f2fs_reserve_block() calls f2fs_put_dnode() whenever reserve_new_block
    returns an error.
    So, the rule of f2fs_reserve_block() is to nullify inode page when there is any
    error internally.

    Finally, two callers of f2fs_reserve_block() should call f2fs_put_dnode()
    appropriately if they got an error since successful f2fs_reserve_block().

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: fix truncate_partial_nodes bug

    The truncate_partial_nodes puts pages incorrectly in the following two cases.
    Note that the value for argc 'depth' can only be 2 or 3.
    Please see truncate_inode_blocks() and truncate_partial_nodes().

    1) An err is occurred in the first 'for' loop
      When err is occurred with depth = 2, pages[0] is invalid, so this page doesn't
      need to be put. There is no problem, however, when depth is 3, it doesn't put
      the pages correctly where pages[0] is valid and pages[1] is invalid.
      In this case, depth is set to 2 (ref to statemnt depth = i + 1), and then
      'goto fail'.
      In label 'fail', for (i = depth - 3; i >= 0; i--) cannot meet the condition
      because i = -1, so pages[0] cann't be put.

    2) An err happened in the second 'for' loop
      Now we've got pages[0] with depth = 2, or we've got pages[0] and pages[1]
      with depth = 3. When an err is detected, we need 'goto fail' to put such
      the pages.
      When depth is 2, in label 'fail', for (i = depth - 3; i >= 0; i--) cann't
      meet the condition because i = -1, so pages[0] cann't be put.
      When depth is 3, in label 'fail', for (i = depth - 3; i >= 0; i--) can
      only put pages[0], pages[1] also cann't be put.

    Note that 'depth' has been changed before first 'goto fail' (ref to statemnt
    depth = i + 1), so passing this modified 'depth' to the tracepoint,
    trace_f2fs_truncate_partial_nodes, is also incorrect.

    Signed-off-by: Shifei Ge <shifei10.ge@samsung.com>
    [Jaegeuk Kim: modify the description and fix one bug]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid to left uninitialized data in page when read inline data

    Change log from v1:
     o reduce unneeded memset in __f2fs_convert_inline_data

    >From 58796be2bd2becbe8d52305210fb2a64e7dd80b6 Mon Sep 17 00:00:00 2001
    From: Chao Yu <chao2.yu@samsung.com>
    Date: Mon, 30 Dec 2013 09:21:33 +0800
    Subject: [PATCH] f2fs: avoid to left uninitialized data in page when read
     inline data

    We left uninitialized data in the tail of page when we read an inline data
    page. So let's initialize left part of the page excluding inline data region.

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid to read inline data except first page

    Here is a case which could read inline page data not from first page.

    1. write inline data
    2. lseek to offset 4096
    3. read 4096 bytes from offset 4096
    	(read_inline_data read inline data page to non-first page,
    	And previously VFS has add this page to page cache)
    4. ftruncate offset 8192
    5. read 4096 bytes from offset 4096
    	(we meet this updated page with inline data in cache)

    So we should leave this page with inited data and uptodate flag
    for this case.

    Change log from v1:
     o fix a deadlock bug

    Signed-off-by: Chao Yu <chao2.yu@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: improve write performance under frequent fsync calls

    When considering a bunch of data writes with very frequent fsync calls, we
    are able to think the following performance regression.

    N: Node IO, D: Data IO, IO scheduler: cfq

    Issue    pending IOs
    	 D1 D2 D3 D4
     D1         D2 D3 D4 N1
     D2            D3 D4 N1 N2
     N1            D3 D4 N2 D1
     --> N1 can be selected by cfq becase of the same priority of N and D.
         Then D3 and D4 would be delayed, resuling in performance degradation.

    So, when processing the fsync call, it'd better give higher priority to data IOs
    than node IOs by assigning WRITE and WRITE_SYNC respectively.
    This patch improves the random wirte performance with frequent fsync calls by up
    to 10%.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add a sysfs entry to control max_victim_search

    Previously during SSR and GC, the maximum number of retrials to find a victim
    segment was hard-coded by MAX_VICTIM_SEARCH, 4096 by default.

    This number makes an effect on IO locality, when SSR mode is activated, which
    results in performance fluctuation on some low-end devices.

    If max_victim_search = 4, the victim will be searched like below.
    ("D" represents a dirty segment, and "*" indicates a selected victim segment.)

     D1 D2 D3 D4 D5 D6 D7 D8 D9
    [   *       ]
          [   *    ]
                [         * ]
    	                [ ....]

    This patch adds a sysfs entry to control the number dynamically through:
      /sys/fs/f2fs/$dev/max_victim_search

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove the needless parameter of f2fs_wait_on_page_writeback

    "boo sync" parameter is never referenced in f2fs_wait_on_page_writeback.
    We should remove this parameter.

    Signed-off-by: Yuan Zhong <yuan.mark.zhong@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: move grabing orphan pages out of protection region

    Move grabing orphan block page out of protection region, and grab all
    the orphan block pages ahead.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Reviewed-by: Chao Yu <chao2.yu@samsung.com>
    [Jaegeuk Kim: remove unnecessary code pointed by Chao Yu]
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: move alloc new orphan node out of lock protection region

    Move alloc new orphan node out of lock protection region.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: use spinlock rather than mutex for better speed

    With the 2 previous changes, all the long time operations are moved out
    of the protection region, so here we can use spinlock rather than mutex
    (orphan_inode_mutex) for lower overhead.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add delimiter to seperate name and value in debug phrase

    Support for f2fs-tools/tools/f2stat to monitor
    /sys/kernel/debug/f2fs/status

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: avoid f2fs_balance_fs call during pageout

    This patch should resolve the following bug.

    =========================================================
    [ INFO: possible irq lock inversion dependency detected ]
    3.13.0-rc5.f2fs+ #6 Not tainted
    ---------------------------------------------------------
    kswapd0/41 just changed the state of lock:
     (&sbi->gc_mutex){+.+.-.}, at: [<ffffffffa030503e>] f2fs_balance_fs+0xae/0xd0 [f2fs]
    but this lock took another, RECLAIM_FS-READ-unsafe lock in the past:
     (&sbi->cp_rwsem){++++.?}

    and interrupts could create inverse lock ordering between them.

    other info that might help us debug this:
    Chain exists of:
      &sbi->gc_mutex --> &sbi->cp_mutex --> &sbi->cp_rwsem

     Possible interrupt unsafe locking scenario:

           CPU0                    CPU1
           ----                    ----
      lock(&sbi->cp_rwsem);
                                   local_irq_disable();
                                   lock(&sbi->gc_mutex);
                                   lock(&sbi->cp_mutex);
      <Interrupt>
        lock(&sbi->gc_mutex);

     *** DEADLOCK ***

    This bug is due to the f2fs_balance_fs call in f2fs_write_data_page.
    If f2fs_write_data_page is triggered by wbc->for_reclaim via kswapd, it should
    not call f2fs_balance_fs which tries to get a mutex grabbed by original syscall
    flow.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: missing REQ_META and REQ_PRIO when sync_meta_pages(META_FLUSH)

    Doing sync_meta_pages with META_FLUSH when checkpoint, we overide rw
    using WRITE_FLUSH_FUA. At this time, we also should set
    REQ_META|REQ_PRIO.

    Signed-off-by: Changman Lee <cm224.lee@samsung.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: clean checkpatch warnings

    Fixed a variety of trivial checkpatch warnings.  The only delta should
    be some minor formatting on log strings that were split / too long.

    Signed-off-by: Chris Fries <cfries@motorola.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: call mark_inode_dirty to flush dirty pages

    If a dentry page is updated, we should call mark_inode_dirty to add the inode
    into the dirty list, so that its dentry pages are flushed to the disk.
    Otherwise, the inode can be evicted without flush.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: move a branch for code redability

    This patch moves a function in f2fs_delete_entry for code readability.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: add help function META_MAPPING

    Introduce help function META_MAPPING() to get the cache meta blocks'
    address space.

    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: remove the orphan block page array

    As the orphan_blocks may be max to 504, so it is not security
    and rigorous to store such a large array in the kernel stack
    as Dan Carpenter said.
    In fact, grab_meta_page has locked the page in the page cache,
    and we can use find_get_page() to fetch the page safely in the
    downstream, so we can remove the page array directly.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: introduce NODE_MAPPING for code consistency

    This patch adds NODE_MAPPING which is similar as META_MAPPING introduced by
    Gu Zheng.

    Cc: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    f2fs: drop obsolete node page when it is truncated

    If a node page is trucated, we'd better drop the page in the node_inode's page
    cache for better memory footprint.

    Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>

    Change-Id: I1b7c3378b7f7adb13477376164e91ab080b50d8b

commit f454e9b178c901fb102e2014eea60395c5966ed5
Author: Evan McClain <aeroevan@gmail.com>
Date:   Thu Mar 20 09:12:16 2014 -0400

    F2FS: Backport to 3.4

    Based off of patches here:
    nowcomputing/f2fs-backports#1

    Change-Id: I2be6d8abf4e3e4c6b9e8d635700930af432fe37a

commit 031d1dd204b7bb9505222661d28bfc4fa6ec7fc6
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Dec 20 13:54:51 2012 -0800

    f2fs: Pull in from upstream 3.13 kernel

    Merge tag 'for-3.8-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull new F2FS filesystem from Jaegeuk Kim:
     "Introduce a new file system, Flash-Friendly File System (F2FS), to
      Linux 3.8.

      Highlights:
       - Add initial f2fs source codes
       - Fix an endian conversion bug
       - Fix build failures on random configs
       - Fix the power-off-recovery routine
       - Minor cleanup, coding style, and typos patches"

    From the Kconfig help text:

      F2FS is based on Log-structured File System (LFS), which supports
      versatile "flash-friendly" features. The design has been focused on
      addressing the fundamental issues in LFS, which are snowball effect
      of wandering tree and high cleaning overhead.

      Since flash-based storages show different characteristics according to
      the internal geometry or flash memory management schemes aka FTL, F2FS
      and tools support various parameters not only for configuring on-disk
      layout, but also for selecting allocation and cleaning algorithms.

    and there's an article by Neil Brown about it on lwn.net:

      http://lwn.net/Articles/518988/

    * tag 'for-3.8-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (36 commits)
      f2fs: fix tracking parent inode number
      f2fs: cleanup the f2fs_bio_alloc routine
      f2fs: introduce accessor to retrieve number of dentry slots
      f2fs: remove redundant call to f2fs_put_page in delete entry
      f2fs: make use of GFP_F2FS_ZERO for setting gfp_mask
      f2fs: rewrite f2fs_bio_alloc to make it simpler
      f2fs: fix a typo in f2fs documentation
      f2fs: remove unused variable
      f2fs: move error condition for mkdir at proper place
      f2fs: remove unneeded initialization
      f2fs: check read only condition before beginning write out
      f2fs: remove unneeded memset from init_once
      f2fs: show error in case of invalid mount arguments
      f2fs: fix the compiler warning for uninitialized use of variable
      f2fs: resolve build failures
      f2fs: adjust kernel coding style
      f2fs: fix endian conversion bugs reported by sparse
      f2fs: remove unneeded version.h header file from f2fs.h
      f2fs: update the f2fs document
      f2fs: update Kconfig and Makefile
      ...

    Conflicts:
    	include/uapi/linux/magic.h

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs bug fixes from Jaegeuk Kim:
     "This patch-set includes two major bug fixes:
       - incorrect IUsed provided by *df -i*, and
       - lookup failure of parent inodes in corner cases.

      [Other Bug Fixes]
       - Fix error handling routines
       - Trigger recovery process correctly
       - Resolve build failures due to missing header files

      [Etc]
       - Add a MAINTAINERS entry for f2fs
       - Fix and clean up variables, functions, and equations
       - Avoid warnings during compilation"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs:
      f2fs: unify string length declarations and usage
      f2fs: clean up unused variables and return values
      f2fs: clean up the start_bidx_of_node function
      f2fs: remove unneeded variable from f2fs_sync_fs
      f2fs: fix fsync_inode list addition logic and avoid invalid access to memory
      f2fs: remove unneeded initialization of nr_dirty in dirty_seglist_info
      f2fs: handle error from f2fs_iget_nowait
      f2fs: fix equation of has_not_enough_free_secs()
      f2fs: add MAINTAINERS entry
      f2fs: return a default value for non-void function
      f2fs: invalidate the node page if allocation is failed
      f2fs: add missing #include <linux/prefetch.h>
      f2fs: do f2fs_balance_fs in front of dir operations
      f2fs: should recover orphan and fsync data
      f2fs: fix handling errors got by f2fs_write_inode
      f2fs: fix up f2fs_get_parent issue to retrieve correct parent inode number
      f2fs: fix wrong calculation on f_files in statfs
      f2fs: remove set_page_dirty for atomic f2fs_end_io_write

    Merge tag 'f2fs-for-3.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs fixes from Jaegeuk Kim:
     o Support swap file and link generic_file_remap_pages
     o Enhance the bio streaming flow and free section control
     o Major bug fix on recovery routine
     o Minor bug/warning fixes and code cleanups

    * tag 'f2fs-for-3.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (22 commits)
      f2fs: use _safe() version of list_for_each
      f2fs: add comments of start_bidx_of_node
      f2fs: avoid issuing small bios due to several dirty node pages
      f2fs: support swapfile
      f2fs: add remap_pages as generic_file_remap_pages
      f2fs: add __init to functions in init_f2fs_fs
      f2fs: fix the debugfs entry creation path
      f2fs: add global mutex_lock to protect f2fs_stat_list
      f2fs: remove the blk_plug usage in f2fs_write_data_pages
      f2fs: avoid redundant time update for parent directory in f2fs_delete_entry
      f2fs: remove redundant call to set_blocksize in f2fs_fill_super
      f2fs: move f2fs_balance_fs to punch_hole
      f2fs: add f2fs_balance_fs in several interfaces
      f2fs: revisit the f2fs_gc flow
      f2fs: check return value during recovery
      f2fs: avoid null dereference in f2fs_acl_from_disk
      f2fs: initialize newly allocated dnode structure
      f2fs: update f2fs partition info about SIT/NAT layout
      f2fs: update f2fs document to reflect SIT/NAT layout correctly
      f2fs: remove unneeded INIT_LIST_HEAD at few places
      ...

    Merge tag 'f2fs-for-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs update from Jaegeuk Kim:
     "[Major bug fixes]
       o Store device file information correctly
       o Fix -EIO handling with respect to power-off-recovery
       o Allocate blocks with global locks
       o Fix wrong calculation of the SSR cost

      [Cleanups]
       o Get rid of fake on-stack dentries

      [Enhancement]
       o Support (un)freeze_fs
       o Enhance the f2fs_gc flow
       o Support 32-bit binary execution on 64-bit kernel"

    * tag 'f2fs-for-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (29 commits)
      f2fs: avoid build warning
      f2fs: add compat_ioctl to provide backward compatability
      f2fs: fix calculation of max. gc cost in the SSR case
      f2fs: clarify and enhance the f2fs_gc flow
      f2fs: optimize the return condition for has_not_enough_free_secs
      f2fs: make an accessor to get sections for particular block type
      f2fs: mark gc_thread as NULL when thread creation is failed
      f2fs: name gc task as per the block device
      f2fs: remove unnecessary gc option check and balance_fs
      f2fs: remove repeated F2FS_SET_SB_DIRT call
      f2fs: when check superblock failed, try to check another superblock
      f2fs: use F2FS_BLKSIZE to judge bloksize and page_cache_size
      f2fs: add device name in debugfs
      f2fs: stop repeated checking if cp is needed
      f2fs: avoid balanc_fs during evict_inode
      f2fs: remove the use of page_cache_release
      f2fs: fix typo mistake for data_version description
      f2fs: reorganize code for ra_node_page
      f2fs: avoid redundant call to has_not_enough_free_secs in f2fs_gc
      f2fs: add un/freeze_fs into super_operations
      ...

    Merge tag 'f2fs-for-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs updates from Jaegeuk Kim:
     "This patch-set includes the following major enhancement patches.
       - introduce a new gloabl lock scheme
       - add tracepoints on several major functions
       - fix the overall cleaning process focused on victim selection
       - apply the block plugging to merge IOs as much as possible
       - enhance management of free nids and its list
       - enhance the readahead mode for node pages
       - address several cretical deadlock conditions
       - reduce lock_page calls

      The other minor bug fixes and enhancements are as follows.
       - calculation mistakes: overflow
       - bio types: READ, READA, and READ_SYNC
       - fix the recovery flow, data races, and null pointer errors"

    * tag 'f2fs-for-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (68 commits)
      f2fs: cover free_nid management with spin_lock
      f2fs: optimize scan_nat_page()
      f2fs: code cleanup for scan_nat_page() and build_free_nids()
      f2fs: bugfix for alloc_nid_failed()
      f2fs: recover when journal contains deleted files
      f2fs: continue to mount after failing recovery
      f2fs: avoid deadlock during evict after f2fs_gc
      f2fs: modify the number of issued pages to merge IOs
      f2fs: remove useless #include <linux/proc_fs.h> as we're now using sysfs as debug entry.
      f2fs: fix inconsistent using of NM_WOUT_THRESHOLD
      f2fs: check truncation of mapping after lock_page
      f2fs: enhance alloc_nid and build_free_nids flows
      f2fs: add a tracepoint on f2fs_new_inode
      f2fs: check nid == 0 in add_free_nid
      f2fs: add REQ_META about metadata requests for submit
      f2fs: give a chance to merge IOs by IO scheduler
      f2fs: avoid frequent background GC
      f2fs: add tracepoints to debug checkpoint request
      f2fs: add tracepoints for write page operations
      f2fs: add tracepoints to debug the block allocation
      ...

    Merge tag 'for-f2fs-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs updates from Jaegeuk Kim:
     "This patch-set includes the following major enhancement patches:
       - remount_fs callback function
       - restore parent inode number to enhance the fsync performance
       - xattr security labels
       - reduce the number of redundant lock/unlock data pages
       - avoid frequent write_inode calls

      The other minor bug fixes are as follows.
       - endian conversion bugs
       - various bugs in the roll-forward recovery routine"

    * tag 'for-f2fs-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (56 commits)
      f2fs: fix to recover i_size from roll-forward
      f2fs: remove the unused argument "sbi" of func destroy_fsync_dnodes()
      f2fs: remove reusing any prefree segments
      f2fs: code cleanup and simplify in func {find/add}_gc_inode
      f2fs: optimize the init_dirty_segmap function
      f2fs: fix an endian conversion bug detected by sparse
      f2fs: fix crc endian conversion
      f2fs: add remount_fs callback support
      f2fs: recover wrong pino after checkpoint during fsync
      f2fs: optimize do_write_data_page()
      f2fs: make locate_dirty_segment() as static
      f2fs: remove unnecessary parameter "offset" from __add_sum_entry()
      f2fs: avoid freqeunt write_inode calls
      f2fs: optimise the truncate_data_blocks_range() range
      f2fs: use the F2FS specific flags in f2fs_ioctl()
      f2fs: sync dir->i_size with its block allocation
      f2fs: fix i_blocks translation on various types of files
      f2fs: set sb->s_fs_info before calling parse_options()
      f2fs: support xattr security labels
      f2fs: fix iget/iput of dir during recovery
      ...

    Merge tag 'for-f2fs-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs updates from Jaegeuk Kim:
     "This patch-set includes the following major enhancement patches:
       - support inline xattrs
       - add sysfs support to control GCs explicitly
       - add proc entry to show the current segment usage information
       - improve the GC/SSR performance

      The other bug fixes are as follows:
       - avoid the overflow on status calculation
       - fix some error handling routines
       - fix inconsistent xattr states after power-off-recovery
       - fix incorrect xattr node offset definition
       - fix deadlock condition in fsync
       - fix the fdatasync routine for power-off-recovery"

    * tag 'for-f2fs-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (40 commits)
      f2fs: optimize gc for better performance
      f2fs: merge more bios of node block writes
      f2fs: avoid an overflow during utilization calculation
      f2fs: trigger GC when there are prefree segments
      f2fs: use strncasecmp() simplify the string comparison
      f2fs: fix omitting to update inode page
      f2fs: support the inline xattrs
      f2fs: add the truncate_xattr_node function
      f2fs: introduce __find_xattr for readability
      f2fs: reserve the xattr space dynamically
      f2fs: add flags for inline xattrs
      f2fs: fix error return code in init_f2fs_fs()
      f2fs: fix wrong BUG_ON condition
      f2fs: fix memory leak when init f2fs filesystem fail
      f2fs: fix a compound statement label error
      f2fs: avoid writing inode redundantly when creating a file
      f2fs: alloc_page() doesn't return an ERR_PTR
      f2fs: should cover i_xattr_nid with its xattr node page lock
      f2fs: check the free space first in new_node_page
      f2fs: clean up the needless end 'return' of void function
      ...

    Merge tag 'for-f2fs-3.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

    Pull f2fs updates from Jaegeuk Kim:
     "This patch-set includes the following major enhancement patches.
       - add a sysfs to control reclaiming free segments
       - enhance the f2fs global lock procedures
       - enhance the victim selection flow
       - wait for selected node blocks during fsync
       - add some tracepoints
       - add a config to remove abundant BUG_ONs

      The other bug fixes are as follows.
       - fix deadlock on acl operations
       - fix some bugs with respect to orphan inodes

      And, there are a bunch of cleanups"

    * tag 'for-f2fs-3.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (42 commits)
      f2fs: issue more large discard command
      f2fs: fix memory leak after kobject init failed in fill_super
      f2fs: cleanup waiting routine for writeback pages in cp
      f2fs: avoid to use a NULL point in destroy_segment_manager
      f2fs: remove unnecessary TestClearPageError when wait pages writeback
      f2fs: update f2fs document
      f2fs: avoid to wait all the node blocks during fsync
      f2fs: check all ones or zeros bitmap with bitops for better mount performance
      f2fs: change the method of calculating the number summary blocks
      f2fs: fix calculating incorrect free size when update xattr in __f2fs_setxattr
      f2fs: add an option to avoid unnecessary BUG_ONs
      f2fs: introduce CONFIG_F2FS_CHECK_FS for BUG_ON control
      f2fs: fix a deadlock during init_acl procedure
      f2fs: clean up acl flow for better readability
      f2fs: remove unnecessary segment bitmap updates
      f2fs: add tracepoint for vm_page_mkwrite
      f2fs: add tracepoint for set_page_dirty
      f2fs: remove redundant set_page_dirty from write_compacted_summaries
      f2fs: add reclaiming control by sysfs
      f2fs: introduce f2fs_balance_fs_bg for some background jobs
      ...

    Change-Id: Ied5488471d49d64ce6abb4be19237c4e90829ff6

commit d93c41d9563164cf1197b3d4077e9b2feb170e90
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Tue Jan 15 20:12:37 2013 +0100

    lockdep, rwsem: fix down_write_nest_lock() if !CONFIG_DEBUG_LOCK_ALLOC

    Commit 1b963c81b145 ("lockdep, rwsem: provide down_write_nest_lock()")
    contains a bug in a codepath when CONFIG_DEBUG_LOCK_ALLOC is disabled,
    which causes down_read() to be called instead of down_write() by mistake
    on such configurations.  Fix that.

    Change-Id: I1b463f6df91cf12e6c23f3fa751cdbd315d07f88
    Reported-and-tested-by: Andrew Clayton <andrew@digital-domain.net>
    Reported-and-tested-by: Zlatko Calusic <zlatko.calusic@iskon.hr>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 310562f1e3619115cba19db86b59387905967052
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Fri Jan 11 14:31:56 2013 -0800

    lockdep, rwsem: provide down_write_nest_lock()

    down_write_nest_lock() provides a means to annotate locking scenario
    where an outer lock is guaranteed to serialize the order nested locks
    are being acquired.

    This is analogoue to already existing mutex_lock_nest_lock() and
    spin_lock_nest_lock().

    Change-Id: Ib6124fd59cfc01c225cdb6fa46eec2b6d57f8c18
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 5e8ab94b8652a9a353c0bdb17854e56568f15415
Author: Daniel Lezcano <daniel.lezcano@linaro.org>
Date:   Tue Apr 23 08:54:33 2013 +0000

    cpuidle: make a single register function for all

    The usual scheme to initialize a cpuidle driver on a SMP is:

    	cpuidle_register_driver(drv);
    	for_each_possible_cpu(cpu) {
    		device = &per_cpu(cpuidle_dev, cpu);
    		cpuidle_register_device(device);
    	}

    This code is duplicated in each cpuidle driver.

    On UP systems, it is done this way:

    	cpuidle_register_driver(drv);
    	device = &per_cpu(cpuidle_dev, cpu);
    	cpuidle_register_device(device);

    On UP, the macro 'for_each_cpu' does one iteration:

            for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)

    Hence, the initialization loop is the same for UP than SMP.

    Beside, we saw different bugs / mis-initialization / return code unchecked in
    the different drivers, the code is duplicated including bugs. After fixing all
    these ones, it appears the initialization pattern is the same for everyone.

    Please note, some drivers are doing dev->state_count = drv->state_count. This is
    not necessary because it is done by the cpuidle_enable_device function in the
    cpuidle framework. This is true, until you have the same states for all your
    devices. Otherwise, the 'low level' API should be used instead with the specific
    initialization for the driver.

    Let's add a wrapper function doing this initialization with a cpumask parameter
    for the coupled idle states and use it for all the drivers.

    That will save a lot of LOC, consolidate the code, and the modifications in the
    future could be done in a single place. Another benefit is the consolidation of
    the cpuidle_device variable which is now in the cpuidle framework and no longer
    spread accross the different arch specific drivers.

    Change-Id: I8f75188d5770871620f758c2973b74384ac570d5
    Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Karthik Parsha <kparsha@codeaurora.org>
    Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>

commit af62bf5ea4ddb714163762c33d00f8b98603d059
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Wed Mar 26 13:03:12 2014 +0900

    net: support marking accepting TCP sockets

    When using mark-based routing, sockets returned from accept()
    may need to be marked differently depending on the incoming
    connection request.

    This is the case, for example, if different socket marks identify
    different networks: a listening socket may want to accept
    connections from all networks, but each connection should be
    marked with the network that the request came in on, so that
    subsequent packets are sent on the correct network.

    This patch adds a sysctl to mark TCP sockets based on the fwmark
    of the incoming SYN packet. If enabled, and an unmarked socket
    receives a SYN, then the SYN packet's fwmark is written to the
    connection's inet_request_sock, and later written back to the
    accepted socket when the connection is established.  If the
    socket already has a nonzero mark, then the behaviour is the same
    as it is today, i.e., the listening socket's fwmark is used.

    Black-box tested using user-mode linux:

    - IPv4/IPv6 SYN+ACK, FIN, etc. packets are routed based on the
      mark of the incoming SYN packet.
    - The socket returned by accept() is marked with the mark of the
      incoming SYN packet.
    - Tested with syncookies=1 and syncookies=2.

    Change-Id: I5e8c9b989762a93f3eb5a0c1b4df44f62d57f3cb
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

commit 7bcaf98e85c6d65e3c4455f3998f8772eec3e3df
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Tue Mar 18 20:52:27 2014 +0900

    net: add a sysctl to reflect the fwmark on replies

    Kernel-originated IP packets that have no user socket associated
    with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.)
    are emitted with a mark of zero. Add a sysctl to make them have
    the same mark as the packet they are replying to.

    This allows an administrator that wishes to do so to use
    mark-based routing, firewalling, etc. for these replies by
    marking the original packets inbound.

    Tested using user-mode linux:
    - ICMP/ICMPv6 echo replies and errors.
    - TCP RST packets (IPv4 and IPv6).

    Change-Id: I95d896647b278d092ef331d1377b959da1deb042
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

    Conflicts:
    	Documentation/networking/ip-sysctl.txt

commit 46012f5cb82628444286caf01096a51f9e612309
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Wed Mar 26 19:35:41 2014 +0900

    net: ipv6: autoconf routes into per-device tables

    Currently, IPv6 router discovery always puts routes into
    RT6_TABLE_MAIN. This causes problems for connection managers
    that want to support multiple simultaneous network connections
    and want control over which one is used by default (e.g., wifi
    and wired).

    To work around this connection managers typically take the routes
    they prefer and copy them to static routes with low metrics in
    the main table. This puts the burden on the connection manager
    to watch netlink to see if the routes have changed, delete the
    routes when their lifetime expires, etc.

    Instead, this patch adds a per-interface sysctl to have the
    kernel put autoconf routes into different tables. This allows
    each interface to have its own autoconf table, and choosing the
    default interface (or using different interfaces at the same
    time for different types of traffic) can be done using
    appropriate ip rules.

    The sysctl behaves as follows:

    - = 0: default. Put routes into RT6_TABLE_MAIN as before.
    - > 0: manual. Put routes into the specified table.
    - < 0: automatic. Add the absolute value of the sysctl to the
           device's ifindex, and use that table.

    The automatic mode is most useful in conjunction with
    net.ipv6.conf.default.accept_ra_rt_table. A connection manager
    or distribution could set it to, say, -100 on boot, and
    thereafter just use IP rules.

    Change-Id: I093d39fb06ec413905dc0d0d5792c1bc5d5c73a9
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>

    Conflicts:
    	include/linux/ipv6.h
    	net/ipv6/route.c

commit 5dde956c23b1681b5fae033161c316c0ed811fb8
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Thu Feb 27 13:38:26 2014 +0900

    net: ipv6: ping: Use socket mark in routing lookup

    [net-next commit bf439b3154ce49d81a79b14f9fab18af99018ae2]

    Change-Id: I8356e9132088c75d4510021c6e4c2641d772087a
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 62c656ac3b1ade38a878fb4e7f4442b660050f57
Merge: 60bf9a6 25c7b87
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat May 31 15:40:26 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit 60bf9a6a94516e9f6fd7b96ef1eba49c222f31f8
Merge: 22944b1 0ce3c7d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat May 31 15:40:02 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Conflicts:
    	drivers/video/msm/msm_fb.h

commit 22944b16e73e793f56bee26964af76cd165e024d
Author: Mahesh Sivasubramanian <msivasub@codeaurora.org>
Date:   Wed Mar 5 15:22:03 2014 -0700

    arm: arch_timer: set memory mapped timer interrupt as IRQF_TIMER

    The memory mapped timer is used as a broadcast timer to wake the core for
    timer interrupts when the arch timer might not be functional. When interrupt
    is not marked as IRQF_NO_SUSPEND, the interrupt gets disabled during the
    suspend_device_irqs() callback in the suspend path. If a core were to enter a
    idle low power mode which relies on broadcast timer to process the interrupt,
    the core is never woken up for timer interrupts.

    Mark the interrupt with IRQF_TIMER which marks this interrupt as a timer
    interrupt and also marks it as IRQF_NO_SUSPEND

    CRs-fixed: 636712
    Change-Id: I0484e92a9d05f66a0c5b3c00c584a3dd3fe6ae85
    Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>

commit 9bb338150e98547d8d3e3907ba1c6089afea67b1
Author: Karthik Parsha <kparsha@codeaurora.org>
Date:   Wed Nov 20 13:27:17 2013 -0800

    ARM: Set CLK_EVT_FEAT_DYNIRQ flag memory mapped timers

    Memory mapped timers are used as broadcast timers to wake up a core
    across reset. CLK_EVT_FEAT_DYNIRQ ensures only the intended cores are
    woken up instead of the default core that they are routed to, thereby
    saving power.

    Change-Id: I535faa0d1fd328fefe4422a6f362b17c94ab5b8e
    Signed-off-by: Karthik Parsha <kparsha@codeaurora.org>
    Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>

commit 75057df8518da9cd3bd2eb3fe69d819775702525
Author: Stephen Boyd <sboyd@codeaurora.org>
Date:   Thu Sep 26 10:27:30 2013 -0700

    clocksource: arm_arch_timer: Use clocksource for suspend timekeeping

    The ARM architected timers keep counting during suspend so we can
    mark this clocksource with the CLOCK_SOURCE_SUSPEND_NONSTOP. This
    flag will indicate that this clocksource can be used for
    calculating suspend time and injecting sleep time into the
    timekeeping core. This will usually be more accurate than using
    an external RTC or architecture specific persistent clock.

    CRs-fixed: 536881
    Change-Id: I882bf19a87ceb642aa069bbf26802c66c96b4426
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>

commit e20854dd324c6bf26409179448496b30cd54367a
Author: Daniel Lezcano <daniel.lezcano@linaro.org>
Date:   Sat Mar 2 11:10:11 2013 +0100

    tick: Dynamically set broadcast irq affinity

    When a cpu goes to a deep idle state where its local timer is
    shutdown, it notifies the time frame work to use the broadcast timer
    instead.  Unfortunately, the broadcast device could wake up any CPU,
    including an idle one which is not concerned by the wake up at all. So
    in the worst case an idle CPU will wake up to send an IPI to the CPU
    whose timer expired.

    Provide an opt-in feature CLOCK_EVT_FEAT_DYNIRQ which tells the core
    that is should set the interrupt affinity of the broadcast interrupt
    to the cpu which has the earliest expiry time. This avoids unnecessary
    spurious wakeups and IPIs.

    [ tglx: Adopted to cpumask rework, silenced an uninitialized warning,
      massaged changelog ]

    Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
    Cc: viresh.kumar@linaro.org
    Cc: jacob.jun.pan@linux.intel.com
    Cc: linux-arm-kernel@lists.infradead.org
    Cc: santosh.shilimkar@ti.com
    Cc: linaro-kernel@lists.linaro.org
    Cc: patches@linaro.org
    Cc: rickard.andersson@stericsson.com
    Cc: vincent.guittot@linaro.org
    Cc: linus.walleij@stericsson.com
    Cc: john.stultz@linaro.org
    Link: http://lkml.kernel.org/r/1362219013-18173-3-git-send-email-daniel.lezcano@linaro.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

    Change-Id: I6a880a39dd595526b80a6d72b88be74163513da9
    Signed-off-by: Karthik Parsha <kparsha@codeaurora.org>
    Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>

commit 02ea82befff0dc36547e3da345b3e81bf27a7c68
Author: Feng Tang <feng.tang@intel.com>
Date:   Tue Mar 12 11:56:48 2013 +0800

    timekeeping: utilize the suspend-nonstop clocksource to count suspended time

    There are some new processors whose TSC clocksource won't stop during
    suspend. Currently, after system resumes, kernel will use persistent
    clock or RTC to compensate the sleep time, but with these nonstop
    clocksources, we could skip the special compensation from external
    sources, and just use current clocksource for time recounting.

    This can solve some time drift bugs caused by some not-so-accurate or
    error-prone RTC devices.

    The current way to count suspended time is first try to use the persistent
    clock, and then try the RTC if persistent clock can't be used. This
    patch will change the trying order to:
    	suspend-nonstop clocksource -> persistent clock -> RTC

    When counting the sleep time with nonstop clocksource, use an accurate way
    suggested by Jason Gunthorpe to cover very large delta cycles.

    CRs-fixed: 536881
    Change-Id: I59c21b1ce5ae81cebc8cf3e817d9b3f951302a3d
    Signed-off-by: Feng Tang <feng.tang@intel.com>
    [jstultz: Small optimization, avoiding re-reading the clocksource]
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Git-commit: e445cf1c4257cc0238d72e4129eb4739f46fd3de)
    [sboyd: Took tk and clock local variables]
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>

commit 13f57f631867078ea02a406c6c9b3355de8a41dd
Author: Feng Tang <feng.tang@intel.com>
Date:   Tue Mar 12 11:56:46 2013 +0800

    clocksource: Add new feature flag CLOCK_SOURCE_SUSPEND_NONSTOP

    Some x86 processors have a TSC clocksource, which continues to run
    even when system is suspended. Also most OMAP platforms have a
    32 KHz timer which has similar capability. Add a feature flag so that
    it could be utilized.

    CRs-fixed: 536881
    Change-Id: I863678fec5a3021158240f2c5b144c552ba0b16a
    Signed-off-by: Feng Tang <feng.tang@intel.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Git-commit: 5caf4636259ae3af0efbb9bfc4cd97874b547c7d
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>

commit e242ed4c2625b93f51b5646dd27a235480fae2a4
Author: Pushkar Joshi <pushkarj@codeaurora.org>
Date:   Mon Aug 19 10:56:19 2013 -0700

    arm: tracing: disable tracing for the timer clock functions

    The function graph tracer causes a kernel crash when enabled. This is
    because the counter_get_cntvct_cp15 and the trace_local_clock functions
    call each other recursively causing a kernel stack overflow. Fix this
    by annotating the timer clock functions with notrace.

    Change-Id: I89864012cf98054265ac8c5ed1fb4870ca00c5a4
    CRs-Fixed: 525920
    Signed-off-by: Pushkar Joshi <pushkarj@codeaurora.org>

commit adc7ef3fdc6d574aa46d3bd501a8e0e442e8ea4b
Author: Stephen Boyd <sboyd@codeaurora.org>
Date:   Wed Apr 10 13:23:27 2013 -0700

    arm: arch_timer: Allow mmio and cp15 timers to coexist

    We need to support both instances of the architected timers at
    runtime so that we can register an mmio timer as the broadcast
    device. We also need to mark the cp15 timers as FEAT_C3_STOP
    because they lost their state in certain low power modes.

    Get rid of the pointer indirection and just have multiple
    functions for the mmio and cp15 cases. We also assume that the
    first frame is always available to us to simplify the logic. This
    should be good enough for us for now.

    Change-Id: I96f529744f9fa47c04efaf716e475267bae7043c
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>

commit 9a0e10e1072d94b17d611455d4f797dbc81e4034
Author: Abhimanyu Kapur <abhimany@codeaurora.org>
Date:   Tue Mar 26 16:26:49 2013 -0700

    ARM: architected timers: remove percpu_timer_setup

    A call to percpu_timer_setup is not needed as its done
    by the smp routines. This also leads to a compilation
    failure on non-SMP targets.

    Change-Id: I261f9c3df659f469de883263bf5f8e2a768a6b1d
    Signed-off-by: Abhimanyu Kapur <abhimany@codeaurora.org>

commit c6f35aa525596526452958764b64c50c89317e86
Author: Marc Zyngier <marc.zyngier@arm.com>
Date:   Fri Jan 20 10:47:00 2012 +0000

    ARM: architected timers: add support for UP timer

    If CONFIG_LOCAL_TIMERS is not defined, let the architected timer
    driver register a single clock_event_device that is used as a
    global timer.

    Change-Id: I28f8380ef88f16739c9f75ca21ecccb8e6241711
    Git-commit: 273d16adbccdfe3e4a9d02d286b8f1d76dc9e63f
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Abhimanyu Kapur <abhimany@codeaurora.org>

commit d91ebde91b710e3242dd91a07562490cbc7a9dd0
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Wed Aug 28 18:45:18 2013 -0700

    msm: cpufreq: Move cpu_frequency_* trace points from acpuclock to cpufreq

    acpuclock is not used on newer targets, so move the trace points
    in it up to the generic msm cpufreq driver. Also drop the use of
    the 'trace_cpu_frequency' entirely, since it's already present in
    generic cpufreq code.

    As a side effect of this change, these trace events will no longer
    track cpu frequency changes from the power-collapse path. Only
    frequency changes coming from cpufreq will be tracked.

    CRs-Fixed: 535512
    Change-Id: Ib69d92f5d3209a7e36be678997b79bcdac92f953
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit a24b75296b5e735966b1d95b51882c65d1037080
Author: Vikram Mulukutla <markivx@codeaurora.org>
Date:   Mon Mar 11 12:10:45 2013 -0700

    msm: acpuclock: Add a null check for acpuclk_data

    If acpuclock fails to probe before a client calls acpuclk_get_rate,
    a null dereference will occur. Fix this by adding the appropriate
    checks.

    Change-Id: If873a64711e9cc807b1734996f7c9358bb08161a
    Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

commit 5b6e83a216ce969a9c6bcfb17a0a58839cc3f19d
Author: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Date:   Mon Jan 27 12:17:38 2014 -0800

    sched: convert WARN_ON() to printk_sched() in try_to_wake_up_local()

    try_to_wake_up_local() is called with the rq lock held. Printing to
    console in this context can result in a deadlock if klogd needs to
    be woken up. Print to the kernel log buffer via printk_sched()
    instead which avoids the wakeup.

    Change-Id: Ia07baea3cb7e0b158545207fdbbb866203256d3c
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit ce353820963a3617cdb16561317b65918732ad89
Author: Matt Wagantall <mattw@codeaurora.org>
Date:   Thu Dec 5 20:01:32 2013 -0800

    sched/debug: Make sysrq prints of sched debug data optional

    Calls to sysrq_sched_debug_show() can yield rather verbose output
    which contributes to log spew and, under heavy load, may increase
    the chances of a watchdog bark.

    Make printing of this data optional with the introduction of a
    new Kconfig, CONFIG_SYSRQ_SCHED_DEBUG.

    Change-Id: I5f54d901d0dea403109f7ac33b8881d967a899ed
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 51c8bddb6812c3162a3115fb22f01b2a798d8754
Author: Vincent Guittot <vincent.guittot@linaro.org>
Date:   Wed Jun 5 10:13:11 2013 +0200

    sched: Fix clear NOHZ_BALANCE_KICK

    I have faced a sequence where the Idle Load Balance was sometime not
    triggered for a while on my platform, in the following scenario:

     CPU 0 and CPU 1 are running tasks and CPU 2 is idle

     CPU 1 kicks the Idle Load Balance
     CPU 1 selects CPU 2 as the new Idle Load Balancer
     CPU 2 sets NOHZ_BALANCE_KICK for CPU 2
     CPU 2 sends a reschedule IPI to CPU 2

     While CPU 3 wakes up, CPU 0 or CPU 1 migrates a waking up task A on CPU 2

     CPU 2 finally wakes up, runs task A and discards the Idle Load Balance
           task A quickly goes back to sleep (before a tick occurs on CPU 2)
     CPU 2 goes back to idle with NOHZ_BALANCE_KICK set

    Whenever CPU 2 will be selected as the ILB, no reschedule IPI will be sent
    because NOHZ_BALANCE_KICK is already set and no Idle Load Balance will be
    performed.

    We must wait for the sched softirq to be raised on CPU 2 thanks to another
    part the kernel to come back to clear NOHZ_BALANCE_KICK.

    The proposed solution clears NOHZ_BALANCE_KICK in schedule_ipi if
    we can't raise the sched_softirq for the Idle Load Balance.

    Change since V1:

    - move the clear of NOHZ_BALANCE_KICK in got_nohz_idle_kick if the ILB
      can't run on this CPU (as suggested by Peter)

    Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1370419991-13870-1-git-send-email-vincent.guittot@linaro.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Git-commit: 873b4c65b519fd769940eb281f77848227d4e5c1
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [smuckle@codeaurora.org: minor merge resolution for 3.4 in scheduler_ipi()]
    Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
    Change-Id: I3548612057cccc2ecc29429c129c44183083831f

commit 0f7df4f8423538f43d50c0f6e2fca4cafe1c9df0
Author: Steve Muckle <smuckle@codeaurora.org>
Date:   Tue Nov 19 14:16:53 2013 -0800

    tracing/sched: add load balancer tracepoint

    When doing performance analysis it can be useful to see exactly
    what is going on with the load balancer - when it runs and why
    exactly it may not be redistributing load.

    This additional tracepoint will show the idle context of the
    load balance operation (idle, not idle, newly idle), various
    values from the load balancing operation, the final result,
    and the new balance interval.

    Change-Id: I9e5c97ae3878bea44e60d189ff3cec2275f2c75e
    Signed-off-by: Steve Muckle <smuckle@codeaurora.org>

commit f87e6e84728bd59c6d6a3805393aa5ecdab7a082
Author: Arun Bharadwaj <abharadw@codeaurora.org>
Date:   Wed Jul 3 10:35:02 2013 -0700

    tracing/sched: Add trace events to track cpu hotplug.

    Add ftrace event trace_sched_cpu_hotplug to track cpu
    hot-add and hot-remove events.

    This is useful in a variety of power, performance and
    debug analysis scenarios.

    Change-Id: I5d202c7a229ffacc3aafb7cf9afee0b0ee7b0931
    Signed-off-by: Arun Bharadwaj <abharadw@codeaurora.org>

commit bb17c85c44bed8f254b9ad999688bd0b0d794479
Merge: 9418874 5ba496e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 28 08:56:31 2014 -0700

    Merge "msm: dma: Moving queue_work() function within spinlock"

commit 9418874a451a831187db958d937fd6d6d1fc1a7a
Merge: 8c60c4b dc41b90
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 27 06:34:42 2014 -0700

    Merge "msm: kgsl: use %pK to restrict printing GPU / memory addresses"

commit 8c60c4baef01f89c1eb776798316ca0d50bb9656
Merge: c8cde43 b675850
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 27 06:34:41 2014 -0700

    Merge "msm: kgsl: Add the buffer user address to the debugfs memory list"

commit 5ba496edb4ee5b28e77d3c85529c87717f1b982b
Author: Utsab Bose <ubose@codeaurora.org>
Date:   Wed Nov 28 12:49:13 2012 +0530

    msm: dma: Moving queue_work() function within spinlock

    Currently we are adding a dma command to the staged list with in a
    spinlock and then adding to workqueue using queue_work after unlocking
    the spinlock. With this there is chance of executing DMA commands in out
    of order in below concurrency case.

    Tread1                                Thread2
    __msm_dmov_enqueue_cmd_ext
       spin_lock_irqsave(..)
       list_add_tail(..)
       spin_unlock_irqrestore(..)
           --PREEMPT--
                                          __msm_dmov_enqueue_cmd_ext
                                             spin_lock_irqsave(..)
                                             list_add_tail(..)
                                             spin_unlock_irqrestore(..)
                                             queue_work()
                                             ..
       queue_work()
    So adding queue_work with in spin_lock will make sure that the
    work added in the work_queue is processed in the same order as they
    are added in staged_commands.

    CRs-Fixed: 423190,669409
    Change-Id: I2ffd1327fb5f0cd1f06db7de9c026d1c4997fe4d
    Acked-by: Gopi Krishna Nedanuri <gnedanur@qti.qualcomm.com>
    Signed-off-by: Utsab Bose <ubose@codeaurora.org>
    Signed-off-by: Vijay Kumar T M <vtmuni@codeaurora.org>

commit 0ce3c7d1f8ab7f16ebb09942e4d52e2a07a7ef6a
Merge: ffdc847f 75f41d89
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 26 04:59:21 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Enable protected register mode for A2XX"""

commit 75f41d899f3f650cd030c64a43a6db16142a8a61
Merge: ffdc847f c8cde43
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 26 00:41:11 2014 -0700

    Merge "Merge "msm: kgsl: Enable protected register mode for A2XX""

commit 17aeb035c94397e341a4095375af2d5aeb05af30
Merge: 83c9592 65ad896
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:54 2014 -0700

    Merge "msm: kgsl: Enable protected register mode for A2XX"

commit 83c95924b1bd84d75aae35bf5be6d7a9695f8b2f
Merge: 18d4b1e 526fdd8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:53 2014 -0700

    Merge "msm: kgsl: Mark the IOMMU setstate memory as read only"

commit 18d4b1e9ec4f8e1293bfefb9303fec30d6712e76
Merge: 56066dc 36bad5c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:52 2014 -0700

    Merge "msm: kgsl: Protect CP_STATE_DEBUG_INDEX"

commit 56066dc337505fb9a868fb75c0efc815810511b9
Merge: 6837f23 3f3d0d0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:51 2014 -0700

    Merge "msm: kgsl: Print the register that causes a protected mode error"

commit 6837f23ae7d37adf6411b4ba86439a57bb352312
Merge: 5e89279 ffe7947
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:50 2014 -0700

    Merge "msm: kgsl: Protect SMMU registers from being written by the GPU"

commit 5e89279b92aa921e2b081c6b16a27402f2a061fc
Merge: d1711ff 673cec2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:49 2014 -0700

    Merge "msm: kgsl: Enable protected register mode for A3XX"

commit d1711ff28cb6117807f32860cb32839d2987dc7b
Merge: 1b923ae f12dceb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 25 23:34:49 2014 -0700

    Merge "msm: kgsl: Setup a3xx protection in its start function"

commit 65ad89635cf39c0bc7d91f435b21baa678eb6d6a
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Tue May 6 18:36:36 2014 +0530

    msm: kgsl: Enable protected register mode for A2XX

    Turn on protected register mode for the A2XX GPU family.

    Change-Id: Iecf88d648c9f86faef4fa53e90c2ce81101c58fa
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 526fdd8662f3e0bd121578a61f4e073dc52848af
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Thu Apr 17 10:05:21 2014 -0600

    msm: kgsl: Mark the IOMMU setstate memory as read only

    Mark the IOMMU setstate memory as read only in the pagetable.

    Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 36bad5cda5ba3a41d47d3951200562a1164669a6
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Apr 21 15:04:54 2014 -0600

    msm: kgsl: Protect CP_STATE_DEBUG_INDEX

    Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
    to keep it from being written from an IB1. Doing so however opens
    up a subtle "feature" in the microcode: memory read opcodes turn off
    protected mode in the microcode to do the read and then turns it
    back on regardless of the initial state. This is a problem if the
    memory read happens while protected mode is turned off and then we
    try to access a protected register which then complains and goes boom.

    To account for this irregularity explicitly turn back off protected
    mode in all the places where we know this will be a problem.

    Conflicts:
    	drivers/gpu/msm/adreno.c
    	drivers/gpu/msm/adreno_a3xx.c

    Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 3f3d0d00b6e7313a07ea52a2caa551acdf5443cd
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Oct 7 16:51:03 2013 -0600

    msm: kgsl: Print the register that causes a protected mode error

    When we get a protected mode error print out the register information
    that caused the exception.

    Change-Id: Ic0dedbad4f586c5715669226619b51665ef9681f
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit ffe79474cf600222fe3543d3dd2c475dcbe2a49d
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Feb 3 10:48:33 2014 -0700

    msm: kgsl: Protect SMMU registers from being written by the GPU

    Put the SMMU register range in protected mode to shield them from
    IB1/IB2 writes from userspace.

    CRs-Fixed: 599971
    Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 673cec218a4ab425a91fcb503d5202c15515220b
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Sep 30 09:51:26 2013 -0600

    msm: kgsl: Enable protected register mode for A3XX

    Turn on protected register mode for the A3XX GPU family and add 0x63
    (RBBM_INT_0_MASK) to the list of protected registers.

    Conflicts:
    	drivers/gpu/msm/adreno.h
    	drivers/gpu/msm/adreno_a3xx.c
    	drivers/gpu/msm/adreno_ringbuffer.c

    Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit f12dceb8dc8ae9ef03c6a5cb59ea4677d44e25d6
Author: Shubhraprakash Das <sadas@codeaurora.org>
Date:   Mon Apr 29 12:25:42 2013 -0700

    msm: kgsl: Setup a3xx protection in its start function

    Setup the protection registers for a3xx towards the end of its
    start function instead of doing it in generic ringbuffer start

    Conflicts:
    	drivers/gpu/msm/adreno_ringbuffer.c

    Change-Id: I66df496afa5d1fdf7dea790306f5358c2098674d
    Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 4b381ff1ae938cda6935a5a6775f4d315c83b659
Author: Srivatsa Vaddagiri <vatsa@codeaurora.org>
Date:   Tue May 21 10:16:19 2013 -0700

    sched: Set MC (multi-core) sched domain's busy_factor attribute to 1

    busy_factor attribute of a scheduler domain causes busy CPUs (CPUs
    that are not idle) to load balance less frequently in that domain,
    which could impact performance by increasing scheduling latency for
    tasks.

    As an example, consider MC scheduler domain's attribute values of
    max_interval = 4ms and busy_factor = 64. Further consider
    max_load_balance_interval = 100 (HZ/10). In this case, a non-idle CPU
    could put off load balance check in MC domain by 100ms. This
    effectively means that a CPU running a single task in its queue could
    fail to notice increased load on another CPU (that is in same MC
    domain) for upto 100ms, before picking up load from the overloaded
    CPU. Needless to say, this leads to increased scheduling latency for
    tasks, affecting performance adversely.

    By setting MC domain's busy_factor value to 1, we limit maximum
    interval that busy CPU can put off load balance checks to 4ms
    (effectively 10ms, given HZ value of 100).

    Change-Id: Id45869d06f5556ea8eec602b65c2ffd2143fe060
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit e15e5c0d4d43d84f1e3627fb004561555ab3d9ce
Author: Joonsoo Kim <js1304@gmail.com>
Date:   Sat Feb 9 05:52:45 2013 +0100

    ARM: 7643/1: sched: correct update_sched_clock()

    If we want load epoch_cyc and epoch_ns atomically,
    we should update epoch_cyc_copy first of all.
    This notify reader that updating is in progress.

    If we update epoch_cyc first like as current implementation,
    there is subtle error case.
    Look at the below example.

    <Initial Condition>
    cyc = 9
    ns = 900
    cyc_copy = 9

    == CASE 1 ==
    <CPU A = reader>           <CPU B = updater>
                               write cyc = 10
    read cyc = 10
    read ns = 900
                               write ns = 1000
                               write cyc_copy = 10
    read cyc_copy = 10

    output = (10, 900)

    == CASE 2 ==
    <CPU A = reader>           <CPU B = updater>
    read cyc = 9
                               write cyc = 10
                               write ns = 1000
    read ns = 1000
    read cyc_copy = 9
                               write cyc_copy = 10
    output = (9, 1000)

    If atomic read is ensured, output should be (9, 900) or (10, 1000).
    But, output in example case are not.

    So, change updating sequence in order to correct this problem.

    Change-Id: Ia9196dd50a519f516f70c3138233624b669ef96a
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    CRs-Fixed: 497236
    Git-commit: 7c4e9ced424be4d36df6a3e3825763e97ee97607
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit 02e6ae507c248474fefa028c9912d09bad9986e8
Author: Felipe Balbi 2 <balbi@ti.com>
Date:   Tue Oct 23 19:00:03 2012 +0100

    ARM: 7565/1: sched: stop sched_clock() during suspend

    The scheduler imposes a requirement to sched_clock()
    which is to stop the clock during suspend, if we don't
    do that any RT thread will be rescheduled in the future
    which might cause any sort of problems.

    This became an issue on OMAP when we converted omap-i2c.c
    to use threaded IRQs, it turned out that depending on how
    much time we spent on suspend, the I2C IRQ thread would
    end up being rescheduled so far in the future that I2C
    transfers would timeout and, because omap_hsmmc depends
    on an I2C-connected device to detect if an MMC card is
    inserted in the slot, our rootfs would just vanish.

    arch/arm/kernel/sched_clock.c already had an optional
    implementation (sched_clock_needs_suspend()) which would
    handle scheduler's requirement properly, what this patch
    does is simply to make that implementation non-optional.

    Note that this has the side-effect that printk timings
    won't reflect the actual time spent on suspend so other
    methods to measure that will have to be used.

    This has been tested with beagleboard XM (OMAP3630) and
    pandaboard rev A3 (OMAP4430). Suspend to RAM is now working
    after this patch.

    Thanks to Kevin Hilman for helping out with debugging.

    Change-Id: Ie2f9e3b22eb3d1f3806cf8c598f22e2fa1b8651f
    Acked-by: Kevin Hilman <khilman@ti.com>
    Acked-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    CRs-Fixed: 497236
    Git-commit: 6a4dae5e138a32b45ca5218cc2b81802f9d378c3
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit 2abe4357c477cb6d94d37a3282807cf17611015a
Author: Colin Cross <ccross@android.com>
Date:   Tue Aug 7 19:05:10 2012 +0100

    ARM: 7486/1: sched_clock: update epoch_cyc on resume

    Many clocks that are used to provide sched_clock will reset during
    suspend.  If read_sched_clock returns 0 after suspend, sched_clock will
    appear to jump forward.  This patch resets cd.epoch_cyc to the current
    value of read_sched_clock during resume, which causes sched_clock() just
    after suspend to return the same value as sched_clock() just before
    suspend.

    In addition, during the window where epoch_ns has been updated before
    suspend, but epoch_cyc has not been updated after suspend, it is unknown
    whether the clock has reset or not, and sched_clock() could return a
    bogus value.  Add a suspended flag, and return the pre-suspend epoch_ns
    value during this period.

    The new behavior is triggered by calling setup_sched_clock_needs_suspend
    instead of setup_sched_clock.

    Change-Id: I7441ef74dc6802c00eea61f3b8c0a25ac00a724d
    Signed-off-by: Colin Cross <ccross@android.com>
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    CRs-Fixed: 497236
    Git-commit: 237ec6f2e51d2fc2ff37c7c5f1ccc9264d09c85b
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit dd30210db4e9846febe1e3c36579ad89dcee6341
Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date:   Tue May 22 14:04:28 2012 +0200

    sched: Make sure to not re-read variables after validation

    We could re-read rq->rt_avg after we validated it was smaller than
    total, invalidating the check and resulting in an unintended negative.

    Change-Id: I8543974aad539107768e9e513ca3a8c4cb79b2ff
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: David Rientjes <rientjes@google.com>
    Link: http://lkml.kernel.org/r/1337688268.9698.29.camel@twins
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    CRs-Fixed: 497236
    Git-commit: b654f7de41b0e3903ee2b51d3b8db77fe52ce728
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit a2441619d122ed35525738f7c0a0f0e1ceef1cc0
Author: Srivatsa Vaddagiri <vatsa@codeaurora.org>
Date:   Tue Jun 11 17:43:09 2013 -0700

    sched: re-calculate a cpu's next_balance point upon sched domain changes

    Commit 55ddeb0f (sched: Reset rq->next_interval before going idle) reset
    a cpu's rq->next_balance when pulled_task = 0, which will be true when
    the cpu failed to pull any task, causing it go idle. However that patch
    relied on next_balance being calculated as a result of traversing cpu's
    sched domain hierarchy.

    A cpu that is the only online cpu will however not be attached to any
    sched domain hierarchy. When such a cpu calls into idle_balance(), we
    will end up initializing next_balance to be 1sec away! Such a CPU will
    defer load balance check for another 1sec, even though we may bring up
    more cpus in the meantime requiring it to check for load imbalance more
    frequently. This could then lead to increased scheduling latency for
    some tasks.

    This patch results in a cpu's next_balance being re-calculated when its
    attaching to a new sched domain hierarchy.  This should let cpus call
    load balance checks at the right time we expect them to!

    Change-Id: I855cff8da5ca28d278596c3bb0163b839d4704bc
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit 1d856ea9cfebb281232fa0ca1fbda61cd3de6cc1
Author: Srivatsa Vaddagiri <vatsa@codeaurora.org>
Date:   Thu Mar 7 12:14:53 2013 -0800

    sched: Reset rq->next_interval before going idle

    next_balance, the point in jiffy time scale when a cpu will next load
    balance, could have been calculated when the cpu was busy. A busy cpu
    will apply its sched domain's busy_factor (usually > 1) in computing
    next_balance for that sched domain, which causes the (busy) cpu to load
    balance less frequently in its sched domains. However when the same cpu
    is going idle, its next_balance needs to be reset without consideration
    of busy_factor. Failure to do so would not trigger nohz idle balancer on
    that cpu for unnecessarily long time (introducing additional scheduling
    latencies for tasks). Fix bug in scheduler which aims to reset
    next_balance before a cpu goes idle (as per existing comment) but is
    clearly not doing so.

    Change-Id: I7e027a51686528c4092d770c7d33c874d38f5df4
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
    Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>

commit c8cde43ee8af91295c8837782ffd4356b051a8c5
Merge: 8ef619b 10e7d0a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:41 2014 -0700

    Merge "msm: kgsl: Enable protected register mode for A2XX"

commit 8ef619bb88145b81d5351d0bf9eb1a8f05a0c2a0
Merge: 6012d07 970b5dd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:40 2014 -0700

    Merge "msm: kgsl: Mark the IOMMU setstate memory as read only"

commit 6012d07a977fafd7df1641c8eb9ef926915c1683
Merge: 9048ebf 3fe88e4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:39 2014 -0700

    Merge "msm: kgsl: Protect CP_STATE_DEBUG_INDEX"

commit 9048ebf46edafaf2a40cc849e9a3e96deee67e5a
Merge: 5a2ac4b dce015d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:38 2014 -0700

    Merge "msm: kgsl: Print the register that causes a protected mode error"

commit 5a2ac4b1bb8618788cccdc8ffdf338bd6c18aeda
Merge: 25014f8 5d70f8b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:37 2014 -0700

    Merge "msm: kgsl: Protect SMMU registers from being written by the GPU"

commit 25014f810358ed8e3d3a497677a0e8c713338080
Merge: 11e0c40 3897a1b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:36 2014 -0700

    Merge "msm: kgsl: Enable protected register mode for A3XX"

commit 11e0c404f0bd38382909cce4b65c5f542a5ecac3
Merge: 2784520 441bd29
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 23 06:07:36 2014 -0700

    Merge "msm: kgsl: Setup a3xx protection in its start function"

commit ffdc847fb896cd0a2265f386be7373e109f917ad
Merge: 50da72b 94996c6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 22 14:14:40 2014 -0700

    Merge "Merge "Merge "ASoC: qdsp6v2: fix the audio record failure"""

commit 94996c6f9798896e5b17c330cf27ef6e8d39b949
Merge: 50da72b 2784520
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 22 07:53:10 2014 -0700

    Merge "Merge "ASoC: qdsp6v2: fix the audio record failure""

commit 2784520534675f64906f7bee5429a5f30e882256
Merge: 87e13e3 4a55518
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 22 05:54:00 2014 -0700

    Merge "ASoC: qdsp6v2: fix the audio record failure"

commit 50da72b6698876af3163902ae8811175d9b93377
Merge: 3b3eace 9673189
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 21 14:02:47 2014 -0700

    Merge "Merge "Merge "cfg80211: fix possible circular lock on reg_regdb_search()"""

commit 9673189d95b72c7607b7aa6ee26593b610f9003d
Merge: 3b3eace 87e13e3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 21 09:09:56 2014 -0700

    Merge "Merge "cfg80211: fix possible circular lock on reg_regdb_search()""

commit 3b3eace993fbe1789b459ce5e91954ca48587611
Merge: 8cdced7 0c22759
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 21 06:46:48 2014 -0700

    Merge "Merge "Merge "cfg80211: fix possible circular lock on reg_regdb_search()"""

commit 0c227594296ffe17d467d25cd2319810117b654e
Merge: 8cdced7 87e13e3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 21 02:52:20 2014 -0700

    Merge "Merge "cfg80211: fix possible circular lock on reg_regdb_search()""

commit 87e13e3ea168df9da0086406977d1a0c7b0a73fe
Merge: de1f12a 23bd41b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 11:33:21 2014 -0700

    Merge "cfg80211: fix possible circular lock on reg_regdb_search()"

commit de1f12a2f31d69cb24dca7dba064746d9bc02846
Merge: 38b7694 7e78959
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 11:33:17 2014 -0700

    Merge "wcnss: add API to check if wcnss is undergoing an SSR"

commit 38b7694ea7702f5c94d02c75882b45692a499d1c
Merge: 1fdaee6 ed80534
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 11:33:16 2014 -0700

    Merge "wcnss: Log debug registers when receives certain notification"

commit 1b923ae2a6bbe418407d48ebd0d5df646e817c7c
Merge: 520abbb 25cc770
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 05:08:42 2014 -0700

    Merge "msm: msm_fb: Handle out of order msm_fb ioctls"

commit 25cc770d7a11d9391549f4eee2ee7626b077e524
Author: Nirmal Abraham <nabrah@codeaurora.org>
Date:   Mon May 12 18:52:24 2014 +0530

    msm: msm_fb: Handle out of order msm_fb ioctls

    Handle two cases when ioctls are received when they are not expected.
     - Writeback ioctls received when writeback (FB2) is not active.
     - Writeback ioctls received in random sequence when writeback (FB2)
       is active.

    Change-Id: I54982e1aef09fd9c7df9354a139ac34219017951
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

commit 1fdaee6ace2dc43905d805746157290ca6355bb8
Merge: a90fd6a eacc878
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 01:24:34 2014 -0700

    Merge "msm: msm_fb: set dma pan info when continuous splash is enabled."

commit 520abbba7daf49414942d5ac75a25cf2b0f85cdd
Merge: 97e71ec b3d2378
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 20 01:15:30 2014 -0700

    Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."

commit b3d2378f7bc641994f0634761bb1197c6f54c0fb
Author: Vijaya Kumar T M <vtmuni@codeaurora.org>
Date:   Tue Apr 15 18:12:45 2014 +0530

    msm: camera: Enable interrupts before returning during Invalid Image mode.

    CRs-Fixed:649474
    Change-Id: Ifd77870dc888232ddc665e0e29974aa6d23db77e
    Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit f9a437e45751bc070077904b6e9645e35b5e496c
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Wed May 14 14:35:49 2014 -0400

    msm: perf: set filter bits for cycle counter on krait

    When programming the cycle counter on krait, the filter
    register needs to be programmed in order to set the
    usermode/kernelmode filter options.

    Change-Id: Ifd5b032c9a5df4821706438d4359f84d8f614468
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 2101ad20cb092679048a5d0a3c32375e16bae942
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Thu May 23 16:05:41 2013 -0400

    msm: arm: make nohlt readable

    Make the debugfs node 'nohlt' readable.

    It is a common use case to want to turn nohlt
    on or off, but there is no way to see the current state.
    Writing to nohlt increments or decrements its reference
    counter, and does not absolutely set the state. By making
    it readable, its current state can be checked so that
    it can be determined if a write is needed to change the
    state.

    Change-Id: I08e327808299aef3e125f04bff8b6aad28d020cc
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 792fa7cce864fe7f5a42546bab34985731cfc7aa
Author: Ming Lei <tom.leiming@gmail.com>
Date:   Mon Dec 2 16:56:16 2013 -0500

    scripts/kallsyms: filter symbols not in kernel address space

    This patch uses CONFIG_PAGE_OFFSET to filter symbols which
    are not in kernel address space because these symbols are
    generally for generating code purpose and can't be run at
    kernel mode, so we needn't keep them in /proc/kallsyms.

    For example, on ARM there are some symbols which may be
    linked in relocatable code section, then perf can't parse
    symbols any more from /proc/kallsyms, this patch fixes the
    problem (introduced b9b32bf70f2fb710b07c94e13afbc729afe221da)

    Change-Id: I3d6321b7d87727c7c2802b3924f2e89a28e4b9ca
    Cc: Russell King <linux@arm.linux.org.uk>
    Cc: linux-arm-kernel@lists.infradead.org
    Cc: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Ming Lei <tom.leiming@gmail.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Cc: stable@vger.kernel.org
    Git-commit: f6537f2f0eba4eba3354e48dbe3047db6d8b6254
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [nleeder@codeaurora.org: move flag to Makefile because original file
     scripts/link-vmlinux.sh does not exist in 3.4]
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 9eedbfcc31e6a00e5f691d7dfb7e3c1da3ceb3b0
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Fri Feb 7 13:47:00 2014 -0500

    Perf: Reset pmu after hotplug

    The counter enable bits were staying in undefined state after CPU
    came out of hotplug when perf was not enabled.
    This was resulting into non-zero values for counters in ftrace buffer
    which were not enabled by perf.
    Clear the pmu when CPU comes out of hotplug and perf is not enabled.

    Change-Id: I31e17565ad914650a12102a5c359b363f8f2ca2a
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 455717aefa0c2d4d6205f8309d3022873dd15dac
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Fri Feb 7 12:21:17 2014 -0500

    msm: perf: tracectr: Initialize cnts after hotplug

    Due to the mismatch between counter values saved across CPU hotplug
    by perf and tracecounter logic, incorrect values are calculated for
    first entry in trace buffer.
    Ignore the first entry when CPU comes out of hotplug and set previous
    counter values in this scenario.

    Change-Id: Ieeeaa301d713f338f11f6e84aeb984a3708e45fc
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 4b83d21d5f1042e6ca565337d684af5e7aa1d935
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Wed Jan 8 16:50:42 2014 -0500

    msm: perf: Fix cpu id logic in tracectr notifier

    The code in tracecounter context switch notifier was using
    smp_processor_id() in order to get cpu number. This was resulting
    into following dmesg error: "BUG: using smp_processor_id() in
    preemptible [00000000] code".
    Use thread_info struct to get the cpu #.

    Change-Id: Ic7c995d2c2bc25c4389248854dec91fb84ce3128
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit f0191cc64fa6dc8cf8fc6078d26ff587f63a0353
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Wed Dec 18 13:10:04 2013 -0500

    msm: perf: fix formatting of trace entry

    Remove extraneous comma which breaks processing of
    the trace data.

    Change-Id: I5fda44cde6a39b16be06c72bc968afc19636b32f
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit ea9e11ee8f535e368953b1eaf0cab7e605e629d9
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Thu Dec 5 14:45:54 2013 -0500

    Perf: preserve registers across hotplug

    Preserve the registers with userspace bits in them
    across hotplug and power collapse. This allows
    userspace applications to use the performance counters.

    Change-Id: I391563ab770df9aabb5d717b6bc4725750ad0283
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit ebc2b4a965f67bf912eca0b39a43fe9e04e1e3f9
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Wed Nov 20 15:04:04 2013 -0500

    Perf: Fix PID for tracepoints

    Make previous value of PID a per_cpu variable.
    This is required to get the correct value for previous_pid.

    Change-Id: I63baf8164ae9226189c745339b122d806901789d
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 653258c06641d780e9d7d66a6ca44837dc83caf1
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Tue Oct 15 14:48:52 2013 -0400

    Perf: Make per-process counters cumulative

    In order to get overall value for performance counters, remove reset during
    context switches. Add mechanism to calculate deltas for output to the trace
    buffer.

    Change-Id: I03d894a1b3bd400d8c256c3068f917ed001fbfd9
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 15d8f1ef6b18f4c96cc5f95fc3acc204deeb2469
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Mon Oct 21 17:58:20 2013 -0400

    msm: perf: clean up duplicate constraint events

    Events with a duplicate constraint are set to state=OFF when detected,
    so that their duplicate counts are not read. However, they were not being
    cleaned up because the core code only cleaned up ACTIVE events.
    This resulted in counters not being freed and eventually running out
    of resources.

    Clean up the events with state==OFF that were marked that way because of
    constraint duplication.
    Ensure counts are not updated for OFF events.

    Change-Id: If532801c79e6ad6809869eb0a3063774f00c92c3
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit dc223cee085ac3e417b2c614ca9036bca28560fb
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Fri Sep 20 11:37:28 2013 -0400

    msm: perf: initialise krait perf L2 counter enables

    Clear the L2 counter enables at initialisation.
    They are undefined out of reset.

    Change-Id: I957106012625ae09efec47d4f657381963d87a5a
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 13f898ac02a320773d70d2998a4803f07c58734d
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Fri Aug 30 13:47:36 2013 -0400

    Perf: Support sw events across hotplug

    When CPUs are hotplugged off and on, let the various
    sw events continue after the hotplug.

    Change-Id: Id1aaf30c459c9cf7c9c38967f9ccad56d4062fd3
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 44971e3ed77d8f46c11b90ec1fed7a6134bc0c0e
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Wed Aug 28 14:31:18 2013 -0400

    Perf: bring CPU online if needed when disabling irq

    When disabling an irq, check that the CPU is online
    before trying to run on that CPU. Bring the CPU
    online if necessary.

    This fixes a problem where a CPU that was not online
    when disabling the irq caused the disable and the
    free to fail. A subsequent attempt to request the irq
    also failed because it had not been freed.

    Change-Id: Ib873b5ded83ab843ea4e609f196a31ef0083a213
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit 8165d84a0d90b1976ea6bb370a36df1b0cc14c63
Author: Neil Leeder <nleeder@codeaurora.org>
Date:   Mon Apr 8 17:13:21 2013 -0400

    Perf: keep events across hotplug

    Keep event list alive across a CPU hotplug so that perf
    can resume when the CPU comes back online. Bring a CPU
    online when exiting a perf session so it can be cleaned
    up properly.

    Change-Id: Ie0e4a43f751beb77afdc84e9d52b21780f279d80
    Signed-off-by: Neil Leeder <nleeder@codeaurora.org>

commit e749cc109fc924105f6aa514ee33344da9c597e0
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Mon May 19 15:08:22 2014 -0400

    msm: perf: Fix debug node permissions

    Fix testAllFilesInSysAreNotWritable failure by changing permissions
    for [/sys/kernel/debug/perf_debug_tp/enabled] from 0777 to 0660

    Change-Id: Iea7fc2072ea00f011fd7a91fd16c936e42272b14
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 25c7b871a00b8cbe3522ec22300f564c81b73134
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun May 18 05:26:09 2014 -0700

    Linux 3.4.91

commit 3ddd37aaf5db2fbcd0f8a485a9a3390d22574371
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:42:43 2014 -0500

    tgafb: fix mode setting with fbset

    commit 624966589041deb32a2626ee2e176e8274581101 upstream.

    Mode setting in the TGA driver is broken for these reasons:

    - info->fix.line_length is set just once in tgafb_init_fix function. If
      we change videomode, info->fix.line_length is not recalculated - so
      the video mode is changed but the screen is corrupted because of wrong
      info->fix.line_length.

    - info->fix.smem_len is set in tgafb_init_fix to the size of the default
      video mode (640x480). If we set a higher resolution,
      info->fix.smem_len is smaller than the current screen size, preventing
      the userspace program from mapping the framebuffer.

    This patch fixes it:

    - info->fix.line_length initialization is moved to tgafb_set_par so that
      it is recalculated with each mode change.

    - info->fix.smem_len is set to a fixed value representing the real
      amount of video ram (the values are taken from xfree86 driver).

    - add a check to tgafb_check_var to prevent us from setting a videomode
      that doesn't fit into videoram.

    - in tgafb_register, tgafb_init_fix is moved upwards, to be called
      before fb_find_mode (because fb_find_mode already needs the videoram
      size set in tgafb_init_fix).

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dff32efd24849aca3ab1eabe8b867025f34a3f8
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Mon Dec 30 15:31:17 2013 +0100

    powerpc: Add vr save/restore functions

    commit 8fe9c93e7453e67b8bd09f263ec1bb0783c733fc upstream.

    GCC 4.8 now generates out-of-line vr save/restore functions when
    optimizing for size.  They are needed for the raid6 altivec support.

    Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bd3c53d12e0e454091ad35090410267af0e4a84
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Feb 26 10:54:36 2014 -0500

    tracepoint: Do not waste memory on mods with no tracepoints

    commit 7dec935a3aa04412cba2cebe1524ae0d34a30c24 upstream.

    No reason to allocate tp_module structures for modules that have no
    tracepoints. This just wastes memory.

    Fixes: b75ef8b44b1c "Tracepoint: Dissociate from module mutex"
    Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8ed40c122919cd79bc3c059e5864e5e7d9d455f0
Author: Thomas Graf <tgraf@suug.ch>
Date:   Fri Apr 4 17:57:45 2014 +0200

    netfilter: Can't fail and free after table replacement

    commit c58dd2dd443c26d856a168db108a0cd11c285bf3 upstream.

    All xtables variants suffer from the defect that the copy_to_user()
    to copy the counters to user memory may fail after the table has
    already been exchanged and thus exposed. Return an error at this
    point will result in freeing the already exposed table. Any
    subsequent packet processing will result in a kernel panic.

    We can't copy the counters before exposing the new tables as we
    want provide the counter state after the old table has been
    unhooked. Therefore convert this into a silent error.

    Cc: Florian Westphal <fw@strlen.de>
    Signed-off-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ede126ea94672827d60e5237ed2c6624b06a255
Author: Joe Perches <joe@perches.com>
Date:   Sun May 13 21:56:25 2012 +0000

    net: Add net_ratelimited_function and net_<level>_ratelimited macros

    commit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.

    __ratelimit() can be considered an inverted bool test because
    it returns true when not ratelimited.  Several tests in the
    kernel tree use this __ratelimit() function incorrectly.

    No net_ratelimit uses are incorrect currently though.

    Most uses of net_ratelimit are to log something via printk or
    pr_<level>.

    In order to minimize the uses of net_ratelimit, and to start
    standardizing the code style used for __ratelimit() and net_ratelimit(),
    add a net_ratelimited_function() macro and net_<level>_ratelimited()
    logging macros similar to pr_<level>_ratelimited that use the global
    net_ratelimit instead of a static per call site "struct ratelimit_state".

    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b87f408045848f42ae574326faf64073f92f2af
Author: Andrey Vagin <avagin@openvz.org>
Date:   Fri Mar 28 13:54:32 2014 +0400

    netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len

    commit 223b02d923ecd7c84cf9780bb3686f455d279279 upstream.

    "len" contains sizeof(nf_ct_ext) and size of extensions. In a worst
    case it can contain all extensions. Bellow you can find sizes for all
    types of extensions. Their sum is definitely bigger than 256.

    nf_ct_ext_types[0]->len = 24
    nf_ct_ext_types[1]->len = 32
    nf_ct_ext_types[2]->len = 24
    nf_ct_ext_types[3]->len = 32
    nf_ct_ext_types[4]->len = 152
    nf_ct_ext_types[5]->len = 2
    nf_ct_ext_types[6]->len = 16
    nf_ct_ext_types[7]->len = 8

    I have seen "len" up to 280 and my host has crashes w/o this patch.

    The right way to fix this problem is reducing the size of the ecache
    extension (4) and Florian is going to do this, but these changes will
    be quite large to be appropriate for a stable tree.

    Fixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)
    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Cc: "David S. Miller" <davem@davemloft.net>
    Signed-off-by: Andrey Vagin <avagin@openvz.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14eee5bd065d6aac0acbdc6092a25ba68c55b9c8
Author: Roman Pen <r.peniaev@gmail.com>
Date:   Tue Mar 4 23:13:10 2014 +0900

    blktrace: fix accounting of partially completed requests

    commit af5040da01ef980670b3741b3e10733ee3e33566 upstream.

    trace_block_rq_complete does not take into account that request can
    be partially completed, so we can get the following incorrect output
    of blkparser:

      C   R 232 + 240 [0]
      C   R 240 + 232 [0]
      C   R 248 + 224 [0]
      C   R 256 + 216 [0]

    but should be:

      C   R 232 + 8 [0]
      C   R 240 + 8 [0]
      C   R 248 + 8 [0]
      C   R 256 + 8 [0]

    Also, the whole output summary statistics of completed requests and
    final throughput will be incorrect.

    This patch takes into account real completion size of the request and
    fixes wrong completion accounting.

    Signed-off-by: Roman Pen <r.peniaev@gmail.com>
    CC: Steven Rostedt <rostedt@goodmis.org>
    CC: Frederic Weisbecker <fweisbec@gmail.com>
    CC: Ingo Molnar <mingo@redhat.com>
    CC: linux-kernel@vger.kernel.org
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 664c0fc651b6ca2ab43ddbb73bbda2acdb2c9915
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Sat May 3 14:04:59 2014 +0200

    n_tty: Fix n_tty_write crash when echoing in raw mode

    commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST.  And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.

    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;

    so the race of the two can result in something like this:
                  A                                B
    __tty_buffer_request_room
                                      __tty_buffer_request_room
    memcpy(buf(tb->used), ...)
    tb->used += space;
                                      memcpy(buf(tb->used), ...) ->BOOM

    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.

    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes.  This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.

    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.

    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call

    References: CVE-2014-0196
    Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

commit 3307c63bcea0f3a2d912bec9f460335fe051aaa8
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Oct 30 20:13:51 2013 +0300

    SCSI: megaraid: missing bounds check in mimd_to_kioc()

    commit 3de2260140417759c669d391613d583baf03b0cf upstream.

    pthru32->dataxferlen comes from the user so we need to check that it's
    not too large so we don't overflow the buffer.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a55518c7bbb07906e7318624019c11368efbc05
Author: Aviral Gupta <aviralg@codeaurora.org>
Date:   Wed May 7 14:24:36 2014 +0530

    ASoC: qdsp6v2: fix the audio record failure

    When the number of buffers are configured dynamically then
    the bufcount can be different to FRAME_NUM.
    Fix by modifying the check for the buffer count greater than
    the FRAME_NUM.

    CRs-Fixed: 653473
    Change-Id: Ic0da57fd517a285880ae490e99ba632cb898bd51
    Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>

commit 8cdced72cb581b77eadc5cca5f26de0c03479657
Merge: e79fa0d 736503f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 18:23:36 2014 -0700

    Merge "Merge "Merge "msm: msm_fb: Handle out of order msm_fb ioctls"""

commit a90fd6a0e7cd255b4ffb1bf9e7241d3362c3c6ae
Merge: cf84f81 0c66603
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 17:32:57 2014 -0700

    Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."

commit cf84f81cd06e6f564769e7721cbe79787c732563
Merge: b0d5ce2 50deb42
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 17:32:57 2014 -0700

    Merge "'Revert "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 736503f9b289ff7ef4946d9bfedcf6c95fadd41d
Merge: e79fa0d b0d5ce2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 12:24:53 2014 -0700

    Merge "Merge "msm: msm_fb: Handle out of order msm_fb ioctls""

commit e79fa0d575ed59ce70664be89ad83b55da1af90f
Merge: 2f6bfab c95d49c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 12:14:33 2014 -0700

    Merge "Merge "Merge "msm: msm_fb: Handle out of order msm_fb ioctls"""

commit c95d49cf84ea2235cdab51c1d378bdf3e2ab0db5
Merge: 2f6bfab b0d5ce2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 08:05:21 2014 -0700

    Merge "Merge "msm: msm_fb: Handle out of order msm_fb ioctls""

commit 2f6bfabd68e4ee31df1dafc4952e343d3ceb7e5d
Merge: edfec01 1bff272
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 04:47:40 2014 -0700

    Merge "Merge "Merge "msm: camera: Sanity check in ispif release Add BUG_ON for ispif address and check ispif base address validity in ispif release function."""

commit 97e71ec9e455616c8705d0297f451fade8f0c548
Merge: 679912b b120487
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 04:04:53 2014 -0700

    Merge "msm: Create shadow files under /sys/kernel/ipv4"

commit b0d5ce2ae624d5a2d757257cb6e43b697e1dbc4a
Merge: a336361 7953d0b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 04:03:55 2014 -0700

    Merge "msm: msm_fb: Handle out of order msm_fb ioctls"

commit eacc8787eb503950e0dd60ebbad5e390bec0909d
Author: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Date:   Mon Sep 16 16:19:30 2013 +0530

    msm: msm_fb: set dma pan info when continuous splash is enabled.

    Enable vsync_enable flag when continous splash is present. This is
    needed to program Tearcheck params for command mode panels.

    Change-Id: Ia704b9076628e20a308fbac6f202fa7d20f5f966
    Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>

commit 1bff2724aa3dd60930b34d497c53a6bf822f3564
Merge: edfec01 a336361
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 15 00:25:51 2014 -0700

    Merge "Merge "msm: camera: Sanity check in ispif release Add BUG_ON for ispif address and check ispif base address validity in ispif release function.""

commit 679912b6d9973470149bd53b1907c2321f2894ac
Merge: 97fb6f7 f8428e9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 14 21:12:18 2014 -0700

    Merge "qseecom: Validate pointer offset in qseecom_send_modfd_cmd"

commit a3363615ea102bcd905f639ab6aa8d8869a79594
Merge: 3cf5694 f78810a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 14 16:34:24 2014 -0700

    Merge "msm: camera: Sanity check in ispif release Add BUG_ON for ispif address and check ispif base address validity in ispif release function."

commit f8428e92686c3f2fa14205208a70b655f647abe5
Author: Zhen Kong <zkong@codeaurora.org>
Date:   Thu Mar 27 12:44:15 2014 -0700

    qseecom: Validate pointer offset in qseecom_send_modfd_cmd

    Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
    make sure cmd buffer address to be within shared bufffer.

    Signed-off-by: Zhen Kong <zkong@codeaurora.org>

    Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
    Signed-off-by: Zhen Kong <zkong@codeaurora.org>
    Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>

commit 3cf5694145ab56a3115a20c821f47e4944005221
Merge: 4af7f9a c4737d0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed May 14 13:35:55 2014 -0700

    Merge "qseecom: Validate pointer offset in qseecom_send_modfd_cmd"

commit 0c666039970952441fda7a41c7452ba0c668b22a
Author: Vijaya Kumar T M <vtmuni@codeaurora.org>
Date:   Tue Apr 15 18:12:45 2014 +0530

    msm: camera: Enable interrupts before returning during Invalid Image mode.

    CRs-Fixed:649474
    Change-Id: Ifd77870dc888232ddc665e0e29974aa6d23db77e
    Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>

commit 50deb42dd93e1613de02ba04e40f68048dcf6eea
Author: Vijaya Kumar T M <vtmuni@codeaurora.org>
Date:   Wed May 14 11:16:23 2014 +0530

    'Revert "msm: camera: Enable interrupts before returning during Invalid Image mode."

    This reverts commit e6f398d23b8a7ad154ad1f9a7e7c9ae4d6f0b22f.

    Change-Id: Ib18e458055695322cf34c73da5e7113ec7ee6cbd
    Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>

commit b12048700c4c19fabe716c84adce17f8112f5983
Author: Ravi Joshi <ravij@codeaurora.org>
Date:   Mon May 5 15:25:39 2014 -0700

    msm: Create shadow files under /sys/kernel/ipv4

    The TCP delayed ack parameters can be configured from user space
    application which runs with non-root credentials and does not have
    direct write access to /proc entries. This commit creates shadow
    files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

    CRs-Fixed: 628139
    Change-Id: If9f5e8f1f5f31c39090555b7b0c40efcdf6ccd08
    Signed-off-by: Ravi Joshi <ravij@codeaurora.org>

commit ee01a58a81a981155dde0ffab1153cde1a66900e
Merge: c1f6824 f39c8bf
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue May 13 19:45:25 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	drivers/usb/host/xhci.c

    Change-Id: I9a988f9e382f4ce25a49239e12081250407ca687

commit c1f68247fa2f00dd70bd81207daaf58cbdac5ccf
Merge: ce8164e edfec01
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue May 13 19:40:49 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

commit ce8164e7405ecf3533513c9b8fe40a2c22747b21
Author: Saket Saurabh <ssaurabh@codeaurora.org>
Date:   Thu Apr 10 16:58:34 2014 +0530

    usb: Fix race between diag_function_disable() and usb_diag_write()

    There is a race when diag_function_disable() and usb_diag_write()
    executes in parallel.
    The diag context attribute is set to NULL in diag_function_disable()
    which is later accessed in usb_diag_write() leading to NULL pointer
    dereference.
    Fix the issue by adding proper synchronization protection
    for the diag context attribute in usb_diag_write().

    CRs-Fixed: 620348
    Change-Id: Ia2439c135bcab6ec9ed8191bd2e55cc1ac3abfdb
    Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>

commit 345be761a4b2871b77c120c6950e88366737b8cf
Author: Ingo Molnar <mingo@kernel.org>
Date:   Fri Apr 26 10:05:59 2013 +0200

    nohz: Reduce overhead under high-freq idling patterns

    One testbox of mine (Intel Nehalem, 16-way) uses MWAIT for its idle routine,
    which apparently can break out of its idle loop rather frequently, with
    high frequency.

    In that case NO_HZ_FULL=y kernels show high ksoftirqd overhead and constant
    context switching, because tick_nohz_stop_sched_tick() will, if
    delta_jiffies == 0, mis-identify this as a timer event - activating the
    TIMER_SOFTIRQ, which wakes up ksoftirqd.

    Fix this by treating delta_jiffies == 0 the same way we treat other short
    wakeups, delta_jiffies == 1.

    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Chris Metcalf <cmetcalf@tilera.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Geoff Levand <geoff@infradead.org>
    Cc: Gilad Ben Yossef <gilad@benyossef.com>
    Cc: Hakan Akkan <hakanakkan@gmail.com>
    Cc: Kevin Hilman <khilman@linaro.org>
    Cc: Li Zhong <zhong@linux.vnet.ibm.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>

    Change-Id: I2a9956cb493d50c2d599d527fc3917eef41d01a4
    Signed-off-by: Ingo Molnar <mingo@kernel.org>

commit 19d3024b69ab94986de0a1c59ff3a83f0b13d629
Author: myfluxi <linflux@arcor.de>
Date:   Wed Apr 23 23:09:11 2014 +0200

    cpufreq: interactive: Optimize sync_freq implementation

    Don't let frequency drop below sync_freq if either load or
    frequency among other cpus is above a certain threshold,
    not necessarily both.

    Change-Id: Iada28e08e812498e16d5189b309a7314f88814dd

commit 8135c79811f45d1c0875c7fb2dce82390b4b7876
Author: Liam Mark <lmark@codeaurora.org>
Date:   Fri Aug 30 12:10:39 2013 -0700

    android/lowmemorykiller: Account for total_swapcache_pages

    The lowmemorykiller relies on NR_FILE_PAGES when measureing
    the amount of reclaimable memory in the system.
    However when swap is enabled swap cache pages are counted
    in NR_FILE_PAGES, and swap cache pages aren't as reclaimable
    in low memory as file cache pages. Therefore a large swap
    cache can result in the lowmemorykiller not running and
    an OOM occuring.

    In order to ensure the lowmemorykiller properly evaluates the
    amount of reclaimable memory don't count the swap cache pages.

    Change-Id: I38239283e572f814b277c718eaf6be7f92abacbb
    Signed-off-by: Liam Mark <lmark@codeaurora.org>

commit 9e5a4100a71a8b5c85ca857ac8b82d0c736f3ff0
Author: Mao Jinlong <c_jmao@codeaurora.org>
Date:   Fri Apr 11 15:42:26 2014 +0800

    alarm : Fix the race conditions in alarm-dev.c

    There will be race conditions between alarm set and alarm clear if
    set_power_on_alarm is out of the lock.But set_power_on_alarm can't
    be put into spin_lock. So add it into mutex_lock.

    CRs-Fixed: 639115
    Change-Id: I4226a95e499211c0d50ff7ce269467a57a410dc7
    Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>

commit dd4c913102343a7aa8940a422ab2eacc58ada928
Author: Chintan Pandya <cpandya@codeaurora.org>
Date:   Tue Feb 18 13:40:01 2014 +0530

    ksm: Provide support to use deferred timers for scanner thread

    KSM thread to scan pages is getting schedule on definite timeout.
    That wakes up CPU from idle state and hence may affect the power
    consumption. Provide an optional support to use deferred timer
    which suites low-power use-cases.

    To enable deferred timers,
    $ echo 1 > /sys/kernel/mm/ksm/deferred_timer

    Change-Id: I07fe199f97fe1f72f9a9e1b0b757a3ac533719e8
    Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>

commit 03a30b410ec0b51c20511f8f2cd62a156910db82
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon May 12 23:49:44 2014 -0400

    Enable some HID stuffs

    Change-Id: I4415791eb31e040ee8da99da507a6404ae8966c4

commit d602d5105123ca7b34c33f81739894ca9431f54d
Author: Gayathri <gramai@codeaurora.org>
Date:   Mon Apr 21 13:26:30 2014 +0530

    msm: cpufreq: Remove cross-calling limitation

    Remove cross-calling limitations imposed by cpufreq.Clock drivers and
    SPM
    driver now allow changing of frequencies from any core.Using
    cpus_allowed
    mask to check for core affinity works well with workqueues but do not
    port
    so well when the core requesting frequency change is a kthread
    with the flag PF_TASK_BOUND not set.

    Change-Id: I031d45299060740372f374805e0d21cac704ce36
    Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
    Signed-off-by: Gayathri <gramai@codeaurora.org>

    Conflicts:
    	arch/arm/mach-msm/cpufreq.c

commit ad6990720bfd1e8dfb02cb4880bece3cba1bf7b0
Author: Srivatsa Vaddagiri <vatsa@codeaurora.org>
Date:   Tue May 21 10:16:19 2013 -0700

    sched: Set MC (multi-core) sched domain's busy_factor attribute to 1

    busy_factor attribute of a scheduler domain causes busy CPUs (CPUs
    that are not idle) to load balance less frequently in that domain,
    which could impact performance by increasing scheduling latency for
    tasks.

    As an example, consider MC scheduler domain's attribute values of
    max_interval = 4ms and busy_factor = 64. Further consider
    max_load_balance_interval = 100 (HZ/10). In this case, a non-idle CPU
    could put off load balance check in MC domain by 100ms. This
    effectively means that a CPU running a single task in its queue could
    fail to notice increased load on another CPU (that is in same MC
    domain) for upto 100ms, before picking up load from the overloaded
    CPU. Needless to say, this leads to increased scheduling latency for
    tasks, affecting performance adversely.

    By setting MC domain's busy_factor value to 1, we limit maximum
    interval that busy CPU can put off load balance checks to 4ms
    (effectively 10ms, given HZ value of 100).

    Change-Id: Id45869d06f5556ea8eec602b65c2ffd2143fe060
    Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>

commit 12b2538cf14dd2ce8402e70a76ba6c1816740e2f
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon May 12 22:57:47 2014 -0400

    Revert "msm: display: Add data stuctures for MSM8974 target support"

    This reverts commit d262b5e923284c66f79d8d7623223250058a5bea.

    Change-Id: Idfc5691d29504bcd8ab1e4a49c3f8ca53e66c03c

commit 7513725a0220013fd627a5c4598e497f022546af
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Sat May 3 07:04:00 2014 -0500

    n_tty: Fix n_tty_write crash when echoing in raw mode

    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST.  And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.

    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;

    so the race of the two can result in something like this:
                  A                                B
    __tty_buffer_request_room
                                      __tty_buffer_request_room
    memcpy(buf(tb->used), ...)
    tb->used += space;
                                      memcpy(buf(tb->used), ...) ->BOOM

    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.

    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes.  This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.

    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.

    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call

    Change-Id: Ie0b03989fa8cfd6ffe40d1f770044fe7447dda05
    References: CVE-2014-0196
    Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.4: output_lock is a member of struct tty_struct]

commit 10e7d0ac7f95548b76ab1a63a0d8baa99d1d2643
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Tue May 6 18:36:36 2014 +0530

    msm: kgsl: Enable protected register mode for A2XX

    Turn on protected register mode for the A2XX GPU family.

    Change-Id: Iecf88d648c9f86faef4fa53e90c2ce81101c58fa
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit f39c8bf9da4f90904787f63abfa138ceae0f5db9
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue May 13 14:11:45 2014 +0200

    Linux 3.4.90

commit 53b67ae8d3d01efbdfd7ae431d8d46cba70084b9
Author: Mike Snitzer <snitzer@redhat.com>
Date:   Fri Mar 28 02:15:02 2014 -0400

    dm thin: fix dangling bio in process_deferred_bios error path

    commit fe76cd88e654124d1431bb662a0fc6e99ca811a5 upstream.

    If unable to ensure_next_mapping() we must add the current bio, which
    was removed from the @bios list via bio_list_pop, back to the
    deferred_bios list before all the remaining @bios.

    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Acked-by: Joe Thornber <ejt@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b4e472edda0a5993ede690aca9a3fa3d8750c5f2
Author: Giacomo Comes <comes@naic.edu>
Date:   Thu Apr 3 14:13:55 2014 -0400

    Skip intel_crt_init for Dell XPS 8700

    commit 10b6ee4a87811a110cb01eaca01eb04da6801baf upstream.

    The Dell XPS 8700 has a onboard Display port and HDMI port and no VGA port.
    The call intel_crt_init freeze the machine, so skip such call.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73559
    Signed-off-by: Giacomo Comes <comes at naic.edu>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9a9269138723e71e87f4adb00c0c2bbdc7bdcd0b
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Dec 5 17:53:50 2013 +0300

    mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

    commit b4c233057771581698a13694ab6f33b48ce837dc upstream.

    We always put a NUL terminator one space past the end of the "vendor"
    buffer.  Walter Harms also pointed out that this should just use
    kstrndup().

    Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c3a47361053bdd9059eec78510de21684f4112c5
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Feb 17 23:03:08 2014 +0300

    mtd: nuc900_nand: NULL dereference in nuc900_nand_enable()

    commit c69dbbf3335a21aae74376d7e5db50a486d52439 upstream.

    Instead of writing to "nand->reg + REG_FMICSR" we write to "REG_FMICSR"
    which is NULL and not a valid register.

    Fixes: 8bff82cbc308 ('mtd: add nand support for w90p910 (v2)')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fd9a5e6cd4d5f923eff026dd288764cf65c001a7
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:43:10 2014 -0500

    tgafb: fix data copying

    commit 6b0df6827bb6fcacb158dff29ad0a62d6418b534 upstream.

    The functions for data copying copyarea_foreward_8bpp and
    copyarea_backward_8bpp are buggy, they produce screen corruption.

    This patch fixes the functions and moves the logic to one function
    "copyarea_8bpp". For simplicity, the function only handles copying that
    is aligned on 8 pixes. If we copy an unaligned area, generic function
    cfb_copyarea is used.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e0dc73524d0e17a6dce2d3cd7ec3d6a785eb6df
Author: Marek Vasut <marex@denx.de>
Date:   Mon Mar 24 03:38:10 2014 +0100

    gpio: mxs: Allow for recursive enable_irq_wake() call

    commit a585f87c863e4e1d496459d382b802bf5ebe3717 upstream.

    The scenario here is that someone calls enable_irq_wake() from somewhere
    in the code. This will result in the lockdep producing a backtrace as can
    be seen below. In my case, this problem is triggered when using the wl1271
    (TI WlCore) driver found in drivers/net/wireless/ti/ .

    The problem cause is rather obvious from the backtrace, but let's outline
    the dependency. enable_irq_wake() grabs the IRQ buslock in irq_set_irq_wake(),
    which in turns calls mxs_gpio_set_wake_irq() . But mxs_gpio_set_wake_irq()
    calls enable_irq_wake() again on the one-level-higher IRQ , thus it tries to
    grab the IRQ buslock again in irq_set_irq_wake() . Because the spinlock in
    irq_set_irq_wake()->irq_get_desc_buslock()->__irq_get_desc_lock() is not
    marked as recursive, lockdep will spew the stuff below.

    We know we can safely re-enter the lock, so use IRQ_GC_INIT_NESTED_LOCK to
    fix the spew.

     =============================================
     [ INFO: possible recursive locking detected ]
     3.10.33-00012-gf06b763-dirty #61 Not tainted
     ---------------------------------------------
     kworker/0:1/18 is trying to acquire lock:
      (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88

     but task is already holding lock:
      (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88

     other info that might help us debug this:
      Possible unsafe locking scenario:

            CPU0
            ----
       lock(&irq_desc_lock_class);
       lock(&irq_desc_lock_class);

      *** DEADLOCK ***

      May be due to missing lock nesting notation

     3 locks held by kworker/0:1/18:
      #0:  (events){.+.+.+}, at: [<c0036308>] process_one_work+0x134/0x4a4
      #1:  ((&fw_work->work)){+.+.+.}, at: [<c0036308>] process_one_work+0x134/0x4a4
      #2:  (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88

     stack backtrace:
     CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 3.10.33-00012-gf06b763-dirty #61
     Workqueue: events request_firmware_work_func
     [<c0013eb4>] (unwind_backtrace+0x0/0xf0) from [<c0011c74>] (show_stack+0x10/0x14)
     [<c0011c74>] (show_stack+0x10/0x14) from [<c005bb08>] (__lock_acquire+0x140c/0x1a64)
     [<c005bb08>] (__lock_acquire+0x140c/0x1a64) from [<c005c6a8>] (lock_acquire+0x9c/0x104)
     [<c005c6a8>] (lock_acquire+0x9c/0x104) from [<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58)
     [<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c00685f0>] (__irq_get_desc_lock+0x48/0x88)
     [<c00685f0>] (__irq_get_desc_lock+0x48/0x88) from [<c0068e78>] (irq_set_irq_wake+0x20/0xf4)
     [<c0068e78>] (irq_set_irq_wake+0x20/0xf4) from [<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24)
     [<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24) from [<c0068cf4>] (set_irq_wake_real+0x30/0x44)
     [<c0068cf4>] (set_irq_wake_real+0x30/0x44) from [<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4)
     [<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4) from [<c0310748>] (wlcore_nvs_cb+0x10c/0x97c)
     [<c0310748>] (wlcore_nvs_cb+0x10c/0x97c) from [<c02be5e8>] (request_firmware_work_func+0x38/0x58)
     [<c02be5e8>] (request_firmware_work_func+0x38/0x58) from [<c0036394>] (process_one_work+0x1c0/0x4a4)
     [<c0036394>] (process_one_work+0x1c0/0x4a4) from [<c0036a4c>] (worker_thread+0x138/0x394)
     [<c0036a4c>] (worker_thread+0x138/0x394) from [<c003cb74>] (kthread+0xa4/0xb0)
     [<c003cb74>] (kthread+0xa4/0xb0) from [<c000ee00>] (ret_from_fork+0x14/0x34)
     wlcore: loaded

    Signed-off-by: Marek Vasut <marex@denx.de>
    Acked-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8f3dc1af7bfe87bafce271fd3f7b65078cd8778
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Tue Mar 4 16:53:51 2014 -0600

    rtlwifi: rtl8192se: Fix too long disable of IRQs

    commit 2610decdd0b3808ba20471a999835cfee5275f98 upstream.

    In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
    rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
    <olivier@trillion01.com> fixed a problem caused by an extra long disabling
    of interrupts. This patch makes the same fix for rtl8192se.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 04dbe2b495485ba9172da476beedbba76bca2bc8
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Tue Mar 4 16:53:50 2014 -0600

    rtlwifi: rtl8192cu: Fix too long disable of IRQs

    commit a53268be0cb9763f11da4f6fe3fb924cbe3a7d4a upstream.

    In commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 entitled "rtlwifi:
    rtl8192ce: Fix too long disable of IRQs", Olivier Langlois
    <olivier@trillion01.com> fixed a problem caused by an extra long disabling
    of interrupts. This patch makes the same fix for rtl8192cu.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08f36d9d2cbe95df935378c220215791fc1dd111
Author: Jeff Layton <jlayton@redhat.com>
Date:   Tue Apr 15 08:44:12 2014 -0400

    locks: allow __break_lease to sleep even when break_time is 0

    commit 4991a628a789dc5954e98e79476d9808812292ec upstream.

    A fl->fl_break_time of 0 has a special meaning to the lease break code
    that basically means "never break the lease". knfsd uses this to ensure
    that leases don't disappear out from under it.

    Unfortunately, the code in __break_lease can end up passing this value
    to wait_event_interruptible as a timeout, which prevents it from going
    to sleep at all. This causes __break_lease to spin in a tight loop and
    causes soft lockups.

    Fix this by ensuring that we pass a minimum value of 1 as a timeout
    instead.

    Cc: J. Bruce Fields <bfields@fieldses.org>
    Reported-by: Terry Barnaby <terry1@beam.ltd.uk>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e45d91ae6e931aec803c5cbbe36b53e64c3e3077
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Thu Apr 17 11:48:21 2014 -0700

    libata/ahci: accommodate tag ordered controllers

    commit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream.

    The AHCI spec allows implementations to issue commands in tag order
    rather than FIFO order:

    	5.3.2.12 P:SelectCmd
    	HBA sets pSlotLoc = (pSlotLoc + 1) mod (CAP.NCS + 1)
    	or HBA selects the command to issue that has had the
    	PxCI bit set to '1' longer than any other command
    	pending to be issued.

    The result is that commands posted sequentially (time-wise) may play out
    of sequence when issued by hardware.

    This behavior has likely been hidden by drives that arrange for commands
    to complete in issue order.  However, it appears recent drives (two from
    different vendors that we have found so far) inflict out-of-order
    completions as a matter of course.  So, we need to take care to maintain
    ordered submission, otherwise we risk triggering a drive to fall out of
    sequential-io automation and back to random-io processing, which incurs
    large latency and degrades throughput.

    This issue was found in simple benchmarks where QD=2 seq-write
    performance was 30-50% *greater* than QD=32 seq-write performance.

    Tagging for -stable and making the change globally since it has a low
    risk-to-reward ratio.  Also, word is that recent versions of an unnamed
    OS also does it this way now.  So, drives in the field are already
    experienced with this tag ordering scheme.

    Cc: Dave Jiang <dave.jiang@intel.com>
    Cc: Ed Ciechanowski <ed.ciechanowski@intel.com>
    Reviewed-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9fbc5762da741f3fa89246193acdce428ce6816
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Sat Apr 5 18:08:25 2014 +0200

    b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR

    commit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream.

    Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b
    functions isn't safe. On my machine it causes delayed (!) CPU exception:

    Disabling lock debugging due to kernel taint
    mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f
    mce: [Hardware Error]: TSC 164083803dc
    mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0
    mce: [Hardware Error]: Run the above through 'mcelog --ascii'
    mce: [Hardware Error]: Machine check: Processor context corrupt
    Kernel panic - not syncing: Fatal machine check on current CPU
    Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)

    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 34dc182bf300e62e830c19ad174dfcb6ea973e6a
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:41:59 2014 -0500

    mach64: fix cursor when character width is not a multiple of 8 pixels

    commit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream.

    This patch fixes the hardware cursor on mach64 when font width is not a
    multiple of 8 pixels.

    If you load such a font, the cursor is expanded to the next 8-byte
    boundary and a part of the next character after the cursor is not
    visible.
    For example, when you load a font with 12-pixel width, the cursor width
    is 16 pixels and when the cursor is displayed, 4 pixels of the next
    character are not visible.

    The reason is this: atyfb_cursor is called with proper parameters to
    load an image that is 12-pixel wide. However, the number is aligned on
    the next 8-pixel boundary on the line
    "unsigned int width = (cursor->image.width + 7) >> 3;" and the whole
    function acts as it is was loading a 16-pixel image.

    This patch fixes it so that the value written to the framebuffer is
    padded with 0xaaaa (the transparent pattern) when the image size it not
    a multiple of 8 pixels. The transparent pattern causes that the cursor
    will not interfere with the next character.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit caf6f52449661bfcc4c5d3f79d65c1cda23f4a89
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:41:09 2014 -0500

    mach64: use unaligned access

    commit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream.

    This patch fixes mach64 to use unaligned access to the font bitmap.

    This fixes unaligned access warning on sparc64 when 14x8 font is loaded.

    On x86(64), unaligned access is handled in hardware, so both functions
    le32_to_cpup and get_unaligned_le32 perform the same operation.

    On RISC machines, unaligned access is not handled in hardware, so we
    better use get_unaligned_le32 to avoid the unaligned trap and warning.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7ea30442913175c11e9e142c45c11bd88570bbad
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:39:04 2014 -0500

    matroxfb: restore the registers M_ACCESS and M_PITCH

    commit a772d4736641ec1b421ad965e13457c17379fc86 upstream.

    When X11 is running and the user switches back to console, the card
    modifies the content of registers M_MACCESS and M_PITCH in periodic
    intervals.

    This patch fixes it by restoring the content of these registers before
    issuing any accelerator command.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8b26a7a7b4abd06f3eca2772317bc7840f6e834a
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:39:29 2014 -0500

    framebuffer: fix cfb_copyarea

    commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.

    The function cfb_copyarea is buggy when the copy operation is not aligned on
    long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).

    How to reproduce:
    - use x86-64 machine
    - use a framebuffer driver without acceleration (for example uvesafb)
    - set the framebuffer to 8-bit depth
    	(for example fbset -a 1024x768-60 -depth 8)
    - load a font with character width that is not a multiple of 8 pixels
    	note: the console-tools package cannot load a font that has
    	width different from 8 pixels. You need to install the packages
    	"kbd" and "console-terminus" and use the program "setfont" to
    	set font width (for example: setfont Uni2-Terminus20x10)
    - move some text left and right on the bash command line and you get a
    	screen corruption

    To expose more bugs, put this line to the end of uvesafb_init_info:
    info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;
    - Now framebuffer console will use cfb_copyarea for console scrolling.
    You get a screen corruption when console is scrolled.

    This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this
    patch, console scrolling in 8-bit depth with a font width that is not a
    multiple of 8 pixels works fine.

    The cfb_copyarea code was very buggy and it looks like it was written
    and never tried with non-8-pixel font.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 89a3abc1fd0dd979929362a2a355d899f4574dab
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Thu Mar 27 18:14:40 2014 +0100

    crypto: ghash-clmulni-intel - use C implementation for setkey()

    commit 8ceee72808d1ae3fb191284afc2257a2be964725 upstream.

    The GHASH setkey() function uses SSE registers but fails to call
    kernel_fpu_begin()/kernel_fpu_end(). Instead of adding these calls, and
    then having to deal with the restriction that they cannot be called from
    interrupt context, move the setkey() implementation to the C domain.

    Note that setkey() does not use any particular SSE features and is not
    expected to become a performance bottleneck.

    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: H. Peter Anvin <hpa@linux.intel.com>
    Fixes: 0e1227d356e9b (crypto: ghash - Add PCLMULQDQ accelerated implementation)
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2295c4263fe35f674f0061fe0419c73238d5b5b
Author: Tyler Stachecki <tstache1@binghamton.edu>
Date:   Fri Apr 25 16:41:04 2014 -0400

    mpt2sas: Don't disable device twice at suspend.

    commit af61e27c3f77c7623b5335590ae24b6a5c323e22 upstream.

    On suspend, _scsih_suspend calls mpt2sas_base_free_resources, which
    in turn calls pci_disable_device if the device is enabled prior to
    suspending. However, _scsih_suspend also calls pci_disable_device
    itself.

    Thus, in the event that the device is enabled prior to suspending,
    pci_disable_device will be called twice. This patch removes the
    duplicate call to pci_disable_device in _scsi_suspend as it is both
    unnecessary and results in a kernel oops.

    Signed-off-by: Tyler Stachecki <tstache1@binghamton.edu>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 983327a48a263bd65fa869a0aad76baaf75fff86
Author: Rusty Russell <rusty@rustcorp.com.au>
Date:   Thu Mar 13 11:23:38 2014 +1030

    virtio_balloon: don't softlockup on huge balloon changes.

    commit 1f74ef0f2d7d692fcd615621e0e734c3e7771413 upstream.

    When adding or removing 100G from a balloon:

        BUG: soft lockup - CPU#0 stuck for 22s! [vballoon:367]

    We have a wait_event_interruptible(), but the condition is always true
    (more ballooning to do) so we don't ever sleep.  We also have a
    wait_event() for the host to ack, but that is also always true as QEMU
    is synchronous for balloon operations.

    Reported-by: Gopesh Kumar Chaudhary <gopchaud@in.ibm.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ef9146785e023ef84cb777aac6deae53c53a2b84
Author: Huacai Chen <chenhc@lemote.com>
Date:   Sat Mar 22 17:21:44 2014 +0800

    MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume()

    commit c14af233fbe279d0e561ecf84f1208b1bae087ef upstream.

    The original MIPS hibernate code flushes cache and TLB entries in
    swsusp_arch_resume(). But they are removed in Commit 44eeab67416711
    (MIPS: Hibernation: Remove SMP TLB and cacheflushing code.). A cross-
    CPU flush is surely unnecessary because all but the local CPU have
    already been disabled. But a local flush (at least the TLB flush) is
    needed. When we do hibernation on Loongson-3 with an E1000E NIC, it is
    very easy to produce a kernel panic (kernel page fault, or unaligned
    access). The root cause is E1000E driver use vzalloc_node() to allocate
    pages, the stale TLB entries of the booting kernel will be misused by
    the resumed target kernel.

    Signed-off-by: Huacai Chen <chenhc@lemote.com>
    Cc: John Crispin <john@phrozen.org>
    Cc: Steven J. Hill <Steven.Hill@imgtec.com>
    Cc: Aurelien Jarno <aurelien@aurel32.net>
    Cc: linux-mips@linux-mips.org
    Cc: Fuxin Zhang <zhangfx@lemote.com>
    Cc: Zhangjin Wu <wuzhangjin@gmail.com>
    Patchwork: https://patchwork.linux-mips.org/patch/6643/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bfa779779247e9421b23155747e1779ce87aa040
Author: Matthew Daley <mattd@bugfuzz.com>
Date:   Mon Apr 28 19:05:21 2014 +1200

    floppy: don't write kernel-only members to FDRAWCMD ioctl output

    commit 2145e15e0557a01b9195d1c7199a1b92cb9be81f upstream.

    Do not leak kernel-only floppy_raw_cmd structure members to userspace.
    This includes the linked-list pointer and the pointer to the allocated
    DMA space.

    Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a04d8ef979b661ce9051d0f22b0b2c25fc94b955
Author: Matthew Daley <mattd@bugfuzz.com>
Date:   Mon Apr 28 19:05:20 2014 +1200

    floppy: ignore kernel-only members in FDRAWCMD ioctl input

    commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.

    Always clear out these floppy_raw_cmd struct members after copying the
    entire structure from userspace so that the in-kernel version is always
    valid and never left in an interdeterminate state.

    Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5c5aeb0ca78c6b9cdca6462bf54f50ac28756cbb
Author: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Date:   Fri May 2 18:58:24 2014 -0400

    drivers/tty/hvc: don't free hvc_console_setup after init

    commit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream.

    When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest,
    hvc console is setup within a kthread. However, that will cause SEGV
    and the boot will fail when the driver is builtin to the kernel,
    because currently hvc_console_setup() is annotated with '__init'. This
    patch removes '__init' to boot the guest successfully with 'console=hvc0'.

    Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7953d0b37845ff1e7fa76e0691f5d7878a81abf8
Author: Nirmal Abraham <nabrah@codeaurora.org>
Date:   Mon May 12 18:52:24 2014 +0530

    msm: msm_fb: Handle out of order msm_fb ioctls

    Handle two cases when ioctls are received when they are not expected.
     - Writeback ioctls received when writeback (FB2) is not active.
     - Writeback ioctls received in random sequence when writeback (FB2)
       is active.

    Change-Id: I54982e1aef09fd9c7df9354a139ac34219017951
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

commit 970b5dd8ea04905a471ea6960bf0eb43c16dc49f
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Thu Apr 17 10:05:21 2014 -0600

    msm: kgsl: Mark the IOMMU setstate memory as read only

    Mark the IOMMU setstate memory as read only in the pagetable.

    Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 3fe88e4e5ca2fee3e03afa0c99f9a0b9db08297d
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Apr 21 15:04:54 2014 -0600

    msm: kgsl: Protect CP_STATE_DEBUG_INDEX

    Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
    to keep it from being written from an IB1. Doing so however opens
    up a subtle "feature" in the microcode: memory read opcodes turn off
    protected mode in the microcode to do the read and then turns it
    back on regardless of the initial state. This is a problem if the
    memory read happens while protected mode is turned off and then we
    try to access a protected register which then complains and goes boom.

    To account for this irregularity explicitly turn back off protected
    mode in all the places where we know this will be a problem.

    Conflicts:
    	drivers/gpu/msm/adreno.c
    	drivers/gpu/msm/adreno_a3xx.c

    Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 4af7f9ad4e5b2c695268153670f70269768c7c72
Merge: bc456b9 a438cd3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 13 00:24:41 2014 -0700

    Merge "SELinux: Fix kernel BUG on empty security contexts."

commit bc456b92b832ccac5357c797938ab2e8b76e5948
Merge: 4c37c8aa 9e4cf16
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 12 22:05:46 2014 -0700

    Merge "audio: Change to set the USB switch state correctly"

commit 97fb6f7296c359fa1b781a175343d33d5315d2a4
Merge: d42ff974 c298af6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 12 09:24:20 2014 -0700

    Merge "msm: camera: Sanity check in ispif release Add BUG_ON for ispif address and check ispif base address validity in ispif release function."

commit c298af660e71b9752b13c5702659756a71b93be9
Author: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Date:   Fri May 9 17:08:05 2014 +0530

    msm: camera: Sanity check in ispif release
    Add BUG_ON for ispif address and check ispif base address
    validity in ispif release function.

    CRs-Fixed: 642603

    Change-Id: Ic4e672cb35fdd6eafe1c9fc081b2f86c570ceeb8
    Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

commit f78810a61b34b439f68fa420ab07787d1c2d78eb
Author: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Date:   Fri May 9 17:08:05 2014 +0530

    msm: camera: Sanity check in ispif release
    Add BUG_ON for ispif address and check ispif base address
    validity in ispif release function.

    CRs-Fixed: 642603

    Change-Id: Ic4e672cb35fdd6eafe1c9fc081b2f86c570ceeb8
    Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

commit 4c37c8aa7649ddffe9aa4f5fc5ac7a1054eb41db
Merge: b9864e8 73989a4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 6 22:06:08 2014 -0700

    Merge "msm: Create shadow files under /sys/kernel/ipv4"

commit 1262e511ff6eff28d294ce6335af4108b832ad19
Merge: edfec01 0b20427
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 6 12:14:12 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.059 on remote branch"

commit 0b20427ff9f6e582158ec56d887236cdf4d2e9ce
Merge: edfec01 00fcc69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue May 6 12:29:30 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.059 on remote branch

    Change-Id: I691dfcf7eb0a035164ee7162ff46ce05823b0490

commit d89a13cf5f83e4f2b6fe98b52530bdab4b773c5c
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue May 6 07:52:14 2014 -0700

    Linux 3.4.89

commit 1361b5386da290994fcbf5399d87e4417bec213d
Author: Aaron Sanders <aaron.sanders@hp.com>
Date:   Mon Mar 31 15:54:21 2014 +0200

    USB: pl2303: add ids for Hewlett-Packard HP POS pole displays

    commit b16c02fbfb963fa2941b7517ebf1f8a21946775e upstream.

    Add device ids to pl2303 for the Hewlett-Packard HP POS pole displays:

    LD960: 03f0:0B39
    LCM220: 03f0:3139
    LCM960: 03f0:3239

    [ Johan: fix indentation and sort PIDs numerically ]

    Signed-off-by: Aaron Sanders <aaron.sanders@hp.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6b2b2314fe03f5dc66d4c9370dfa263e19fda392
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sat Apr 12 12:45:25 2014 -0400

    ext4: use i_size_read in ext4_unaligned_aio()

    commit 6e6358fc3c3c862bfe9a5bc029d3f8ce43dc9765 upstream.

    We haven't taken i_mutex yet, so we need to use i_size_read().

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 982daeb44e46bd2c1d84106f90381184bf2c0ed2
Author: alex chen <alex.chen@huawei.com>
Date:   Thu Apr 3 14:47:05 2014 -0700

    ocfs2: do not put bh when buffer_uptodate failed

    commit f7cf4f5bfe073ad792ab49c04f247626b3e38db6 upstream.

    Do not put bh when buffer_uptodate failed in ocfs2_write_block and
    ocfs2_write_super_or_backup, because it will put bh in b_end_io.
    Otherwise it will hit a warning "VFS: brelse: Trying to free free
    buffer".

    Signed-off-by: Alex Chen <alex.chen@huawei.com>
    Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
    Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Acked-by: Joel Becker <jlbec@evilplan.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8917a40da468d4ffb7accf5eea6e381a123058b1
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Thu Apr 3 14:46:51 2014 -0700

    ocfs2: dlm: fix recovery hung

    commit ded2cf71419b9353060e633b59e446c42a6a2a09 upstream.

    There is a race window in dlm_do_recovery() between dlm_remaster_locks()
    and dlm_reset_recovery() when the recovery master nearly finish the
    recovery process for a dead node.  After the master sends FINALIZE_RECO
    message in dlm_remaster_locks(), another node may become the recovery
    master for another dead node, and then send the BEGIN_RECO message to
    all the nodes included the old master, in the handler of this message
    dlm_begin_reco_handler() of old master, dlm->reco.dead_node and
    dlm->reco.new_master will be set to the second dead node and the new
    master, then in dlm_reset_recovery(), these two variables will be reset
    to default value.  This will cause new recovery master can not finish
    the recovery process and hung, at last the whole cluster will hung for
    recovery.

    old recovery master:                                 new recovery master:
    dlm_remaster_locks()
                                                      become recovery master for
                                                      another dead node.
                                                      dlm_send_begin_reco_message()
    dlm_begin_reco_handler()
    {
     if (dlm->reco.state & DLM_RECO_STATE_FINALIZE) {
      return -EAGAIN;
     }
     dlm_set_reco_master(dlm, br->node_idx);
     dlm_set_reco_dead_node(dlm, br->dead_node);
    }
    dlm_reset_recovery()
    {
     dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);
     dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);
    }
                                                      will hang in dlm_remaster_locks() for
                                                      request dlm locks info

    Before send FINALIZE_RECO message, recovery master should set
    DLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,
    this can break the race windows as the BEGIN_RECO messages will not be
    handled before DLM_RECO_STATE_FINALIZE flag is cleared.

    A similar race may happen between new recovery master and normal node
    which is in dlm_finalize_reco_handler(), also fix it.

    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
    Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09400fe4ff8794b823889c4634afa0c740d29b1c
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Thu Apr 3 14:46:49 2014 -0700

    ocfs2: dlm: fix lock migration crash

    commit 34aa8dac482f1358d59110d5e3a12f4351f6acaa upstream.

    This issue was introduced by commit 800deef3f6f8 ("ocfs2: use
    list_for_each_entry where benefical") in 2007 where it replaced
    list_for_each with list_for_each_entry.  The variable "lock" will point
    to invalid data if "tmpq" list is empty and a panic will be triggered
    due to this.  Sunil advised reverting it back, but the old version was
    also not right.  At the end of the outer for loop, that
    list_for_each_entry will also set "lock" to an invalid data, then in the
    next loop, if the "tmpq" list is empty, "lock" will be an stale invalid
    data and cause the panic.  So reverting the list_for_each back and reset
    "lock" to NULL to fix this issue.

    Another concern is that this seemes can not happen because the "tmpq"
    list should not be empty.  Let me describe how.

    old lock resource owner(node 1):                                  migratation target(node 2):
    image there's lockres with a EX lock from node 2 in
    granted list, a NR lock from node x with convert_type
    EX in converting list.
    dlm_empty_lockres() {
     dlm_pick_migration_target() {
       pick node 2 as target as its lock is the first one
       in granted list.
     }
     dlm_migrate_lockres() {
       dlm_mark_lockres_migrating() {
         res->state |= DLM_LOCK_RES_BLOCK_DIRTY;
         wait_event(dlm->ast_wq, !dlm_lockres_is_dirty(dlm, res));
    	 //after the above code, we can not dirty lockres any more,
         // so dlm_thread shuffle list will not run
                                                                       downconvert lock from EX to NR
                                                                       upconvert lock from NR to EX
    <<< migration may schedule out here, then
    <<< node 2 send down convert request to convert type from EX to
    <<< NR, then send up convert request to convert type from NR to
    <<< EX, at this time, lockres granted list is empty, and two locks
    <<< in the converting list, node x up convert lock followed by
    <<< node 2 up convert lock.

    	 // will set lockres RES_MIGRATING flag, the following
    	 // lock/unlock can not run
         dlm_lockres_release_ast(dlm, res);
       }

       dlm_send_one_lockres()
                                                                     dlm_process_recovery_data()
                                                                       for (i=0; i<mres->num_locks; i++)
                                                                         if (ml->node == dlm->node_num)
                                                                           for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
                                                                            list_for_each_entry(lock, tmpq, list)
                                                                            if (lock) break; <<< lock is invalid as grant list is empty.
                                                                           }
                                                                           if (lock->ml.node != ml->node)
                                                                             BUG() >>> crash here
     }

    I see the above locks status from a vmcore of our internal bug.

    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
    Cc: Sunil Mushran <sunil.mushran@gmail.com>
    Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96f6aea2715b25edfc9b982f9e372bd87db6c04e
Author: Liu Hua <sdu.liu@huawei.com>
Date:   Mon Apr 7 15:38:57 2014 -0700

    hung_task: check the value of "sysctl_hung_task_timeout_sec"

    commit 80df28476505ed4e6701c3448c63c9229a50c655 upstream.

    As sysctl_hung_task_timeout_sec is unsigned long, when this value is
    larger then LONG_MAX/HZ, the function schedule_timeout_interruptible in
    watchdog will return immediately without sleep and with print :

      schedule_timeout: wrong timeout value ffffffffffffff83

    and then the funtion watchdog will call schedule_timeout_interruptible
    again and again.  The screen will be filled with

    	"schedule_timeout: wrong timeout value ffffffffffffff83"

    This patch does some check and correction in sysctl, to let the function
    schedule_timeout_interruptible allways get the valid parameter.

    Signed-off-by: Liu Hua <sdu.liu@huawei.com>
    Tested-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af4acfaf3ca2f1da6e48d67e50f27f5e22fa3308
Author: Mizuma, Masayoshi <m.mizuma@jp.fujitsu.com>
Date:   Mon Apr 7 15:37:54 2014 -0700

    mm: hugetlb: fix softlockup when a large number of hugepages are freed.

    commit 55f67141a8927b2be3e51840da37b8a2320143ed upstream.

    When I decrease the value of nr_hugepage in procfs a lot, softlockup
    happens.  It is because there is no chance of context switch during this
    process.

    On the other hand, when I allocate a large number of hugepages, there is
    some chance of context switch.  Hence softlockup doesn't happen during
    this process.  So it's necessary to add the context switch in the
    freeing process as same as allocating process to avoid softlockup.

    When I freed 12 TB hugapages with kernel-2.6.32-358.el6, the freeing
    process occupied a CPU over 150 seconds and following softlockup message
    appeared twice or more.

    $ echo 6000000 > /proc/sys/vm/nr_hugepages
    $ cat /proc/sys/vm/nr_hugepages
    6000000
    $ grep ^Huge /proc/meminfo
    HugePages_Total:   6000000
    HugePages_Free:    6000000
    HugePages_Rsvd:        0
    HugePages_Surp:        0
    Hugepagesize:       2048 kB
    $ echo 0 > /proc/sys/vm/nr_hugepages

    BUG: soft lockup - CPU#16 stuck for 67s! [sh:12883] ...
    Pid: 12883, comm: sh Not tainted 2.6.32-358.el6.x86_64 #1
    Call Trace:
      free_pool_huge_page+0xb8/0xd0
      set_max_huge_pages+0x128/0x190
      hugetlb_sysctl_handler_common+0x113/0x140
      hugetlb_sysctl_handler+0x1e/0x20
      proc_sys_call_handler+0x97/0xd0
      proc_sys_write+0x14/0x20
      vfs_write+0xb8/0x1a0
      sys_write+0x51/0x90
      __audit_syscall_exit+0x265/0x290
      system_call_fastpath+0x16/0x1b

    I have not confirmed this problem with upstream kernels because I am not
    able to prepare the machine equipped with 12TB memory now.  However I
    confirmed that the amount of decreasing hugepages was directly
    proportional to the amount of required time.

    I measured required times on a smaller machine.  It showed 130-145
    hugepages decreased in a millisecond.

      Amount of decreasing     Required time      Decreasing rate
      hugepages                     (msec)         (pages/msec)
      ------------------------------------------------------------
      10,000 pages == 20GB         70 -  74          135-142
      30,000 pages == 60GB        208 - 229          131-144

    It means decrement of 6TB hugepages will trigger softlockup with the
    default threshold 20sec, in this decreasing rate.

    Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Michal Hocko <mhocko@suse.cz>
    Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
    Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5650bff7fdf4f586d05dad9315d4786eba694149
Author: Matt Fleming <matt.fleming@intel.com>
Date:   Thu Apr 3 14:46:20 2014 -0700

    sh: fix format string bug in stack tracer

    commit a0c32761e73c9999cbf592b702f284221fea8040 upstream.

    Kees reported the following error:

       arch/sh/kernel/dumpstack.c: In function 'print_trace_address':
       arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror=format-security]

    Use the "%s" format so that it's impossible to interpret 'data' as a
    format string.

    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Reported-by: Kees Cook <keescook@chromium.org>
    Acked-by: Kees Cook <keescook@chromium.org>
    Cc: Paul Mundt <lethal@linux-sh.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6f6fc7a2bc99124058b7c4850a9997530589a33
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Mar 12 11:30:38 2014 -0400

    USB: unbind all interfaces before rebinding any

    commit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.

    When a driver doesn't have pre_reset, post_reset, or reset_resume
    methods, the USB core unbinds that driver when its device undergoes a
    reset or a reset-resume, and then rebinds it afterward.

    The existing straightforward implementation can lead to problems,
    because each interface gets unbound and rebound before the next
    interface is handled.  If a driver claims additional interfaces, the
    claim may fail because the old binding instance may still own the
    additional interface when the new instance tries to claim it.

    This patch fixes the problem by first unbinding all the interfaces
    that are marked (i.e., their needs_binding flag is set) and then
    rebinding all of them.

    The patch also makes the helper functions in driver.c a little more
    uniform and adjusts some out-of-date comments.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-and-tested-by: "Poulain, Loic" <loic.poulain@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 216583b5033215cd64468b865c0ee96d265cf546
Author: Paul Gortmaker <paul.gortmaker@windriver.com>
Date:   Tue Jan 14 16:03:37 2014 -0500

    hvc: ensure hvc_init is only ever called once in hvc_console.c

    commit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.

    Commit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 ("Delay creation of
    khcvd thread") moved the call of hvc_init from being a device_initcall
    into hvc_alloc, and used a non-null hvc_driver as indication of whether
    hvc_init had already been called.

    The problem with this is that hvc_driver is only assigned a value
    at the bottom of hvc_init, and so there is a window where multiple
    hvc_alloc calls can be in progress at the same time and hence try
    and call hvc_init multiple times.  Previously the use of device_init
    guaranteed that hvc_init was only called once.

    This manifests itself as sporadic instances of two hvc_init calls
    racing each other, and with the loser of the race getting -EBUSY
    from tty_register_driver() and hence that virtual console fails:

        Couldn't register hvc console driver
        virtio-ports vport0p1: error -16 allocating hvc for port

    Here we add an atomic_t to guarantee we'll never run hvc_init twice.

    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Fixes: 3e6c6f630a52 ("Delay creation of khcvd thread")
    Reported-by: Jim Somerville <Jim.Somerville@windriver.com>
    Tested-by: Jim Somerville <Jim.Somerville@windriver.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f53fd451ade7c197376e9337c0ff4bbadf985dde
Author: Huang Rui <ray.huang@amd.com>
Date:   Tue Jan 7 17:45:50 2014 +0800

    usb: dwc3: fix wrong bit mask in dwc3_event_devt

    commit 06f9b6e59661cee510b04513b13ea7927727d758 upstream.

    Around DWC USB3 2.30a release another bit has been added to the
    Device-Specific Event (DEVT) Event Information (EvtInfo) bitfield.

    Because of that, what used to be 8 bits long, has become 9 bits long.

    Per dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of
    Event Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits
    not 8 bits. And the following reserved field uses [31:25] bits not
    [31:24] bits, and it has 7 bits.

    So in dwc3_event_devt, the bit mask should be:
    event_info	[24:16]		9 bits
    reserved31_25	[31:25]		7 bits

    This patch makes sure that newer core releases will work fine with
    Linux and that we will decode the event information properly on new
    core releases.

    [ balbi@ti.com : improve commit log a bit ]

    Signed-off-by: Huang Rui <ray.huang@amd.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f97f28f902804f7ccc209ff0e560c20dcb32c608
Author: David Cohen <david.a.cohen@linux.intel.com>
Date:   Fri Apr 25 19:20:16 2014 +0300

    usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM

    commit 01bb59ebffdec314da8da66266edf29529372f9b upstream.

    When CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this
    warning:
    drivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined
    but not used [-Wunused-function]

    Instead of creating nested #ifdefs, this patch fixes it by defining the
    xHCI PCI stubs as inline.

    This warning has been in since 3.2 kernel and was
    caused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c
    "usb/xhci: hide MSI code behind PCI bars", but wasn't noticed
    until 3.13 when a configuration with these options was tried

    Signed-off-by: David Cohen <david.a.cohen@linux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8ccd1a5521d0e870ccc5fee1d4bf7ee7ddab66ff
Author: Igor Gnatenko <i.gnatenko.brain@gmail.com>
Date:   Fri Apr 25 19:20:15 2014 +0300

    xhci: extend quirk for Renesas cards

    commit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream.

    After suspend another Renesas PCI-X USB 3.0 card doesn't work.
    [root@fedora-20 ~]# lspci -vmnnd 1912:
    Device:	03:00.0
    Class:	USB controller [0c03]
    Vendor:	Renesas Technology Corp. [1912]
    Device:	uPD720202 USB 3.0 Host Controller [0015]
    SVendor:	Renesas Technology Corp. [1912]
    SDevice:	uPD720202 USB 3.0 Host Controller [0015]
    Rev:	02
    ProgIf:	30

    This patch should be applied to stable kernel 3.14 that contain
    the commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d
    "xhci: Fix resume issues on Renesas chips in Samsung laptops"

    Reported-and-tested-by: Anatoly Kharchenko <rfr-bugs@yandex.ru>
    Reference: http://redmine.russianfedora.pro/issues/1315
    Signed-off-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 41b4a7dfd391b5826492a89c702420b97dc02334
Author: supriya karanth <supriya.karanth@stericsson.com>
Date:   Thu Dec 6 11:12:48 2012 +0530

    usb: musb: set TXMAXP and AUTOSET for full speed bulk in device mode

    commit bb3a2ef2eb8cfaea335dcb3426350df7f3d48069 upstream.

    The TXMAXP register is not set correctly for full speed bulk case
    when the can_bulk_split() is used. Without this PIO transfers will
    not take place correctly

    The "mult" factor needs to be updated correctly for the
    can_bulk_split() case

    The AUTOSET bit in the TXCSR is not being set if the "mult"
    factor is greater than 0 for the High Bandwidth ISO case.
    But the "mult" factor is also greater than 0 in case of Full speed
    bulk transfers with the packet splitting in TXMAXP register

    Without the AUTOSET the DMA transfers will not progress in mode1

    [ balbi@ti.com : add braces to both branches ]

    Signed-off-by: supriya karanth <supriya.karanth@stericsson.com>
    Signed-off-by: Praveena NADAHALLY <praveen.nadahally@stericsson.com>
    Acked-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Cc: ian coolidge <iancoolidge@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 15e5f90c0f1d3f597981ffe18112aae9421f57c0
Author: Jeff Mahoney <jeffm@suse.com>
Date:   Wed Apr 2 14:40:26 2014 -0400

    reiserfs: fix race in readdir

    commit 01d8885785a60ae8f4c37b0ed75bdc96d0fc6a44 upstream.

    jdm-20004 reiserfs_delete_xattrs: Couldn't delete all xattrs (-2)

    The -ENOENT is due to readdir calling dir_emit on the same entry twice.

    If the dir_emit callback sleeps and the tree is changed underneath us,
    we won't be able to trust deh_offset(deh) anymore. We need to save
    next_pos before we might sleep so we can find the next entry.

    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86455b800f7544e239b2fa5a16962ea780a1e9d8
Author: Andy Grover <agrover@redhat.com>
Date:   Fri Apr 4 16:44:37 2014 -0700

    target/tcm_fc: Fix use-after-free of ft_tpg

    commit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.

    ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
    tport when the tpg is being removed. Set this pointer in ft_tport_create,
    or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
    a deleted object.

    This patch sets tpg->tport in ft_tport_create, because that's what
    ft_del_tpg checks, and is the only way to get back to the tport to
    clear tport->tpg.

    The bug was occuring when:

    - lport created, tport (our per-lport, per-provider context) is
      allocated.
      tport->tpg = NULL
    - tpg created
    - a PRLI is received. ft_tport_create is called, tpg is found and
      tport->tpg is set
    - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
      set, tport->tpg is not cleared and points at freed memory
    - Future calls to ft_tport_create return tport via first conditional,
      instead of searching for new tpg by calling ft_lport_find_tpg.
      tport->tpg is still invalid, and will access freed memory.

    see https://bugzilla.redhat.com/show_bug.cgi?id=1071340

    Signed-off-by: Andy Grover <agrover@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d72db3c871f7232448abab9e12fbbe9d80a6606c
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Wed Feb 19 23:32:14 2014 +0000

    iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug

    commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.

    This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
    where during ERL=2 connection recovery, a bogus conn_p pointer could
    end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
    notifying the initiator that cmd->logout_cid has failed.

    The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
    a bogus conn_p pointer in iscsit_build_conn_drop_async_message().

    Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
    Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8ba4bc7680f75ac3294cb3222b21bc2912b24963
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Feb 11 19:06:33 2014 +0300

    SCSI: arcmsr: upper 32 of dma address lost

    commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.

    The original code always set the upper 32 bits to zero because it was
    doing a shift of the wrong variable.

    Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 41d5d291583dedd9fde7dbdad524a604166266c4
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Mon Apr 7 13:58:35 2014 -0400

    ib_srpt: Use correct ib_sg_dma primitives

    commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.

    The code was incorrectly using sg_dma_address() and
    sg_dma_len() instead of ib_sg_dma_address() and
    ib_sg_dma_len().

    This prevents srpt from functioning with the
    Intel HCA and indeed will corrupt memory
    badly.

    Cc: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Tested-by: Vinod Kumar <vinod.kumar@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 794f9950ebd832b8712e32007e0359e5c6e60f55
Author: Yann Droneaud <ydroneaud@opteya.com>
Date:   Mon Mar 10 23:06:25 2014 +0100

    IB/ehca: Returns an error on ib_copy_to_udata() failure

    commit 5bdb0f02add5994b0bc17494f4726925ca5d6ba1 upstream.

    In case of error when writing to userspace, function ehca_create_cq()
    does not set an error code before following its error path.

    This patch sets the error code to -EFAULT when ib_copy_to_udata()
    fails.

    This was caught when using spatch (aka. coccinelle)
    to rewrite call to ib_copy_{from,to}_udata().

    Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
    Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
    Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53b5bc1e97df8c617d6a9e15d0ce33981ee086c9
Author: Yann Droneaud <ydroneaud@opteya.com>
Date:   Mon Mar 10 23:06:26 2014 +0100

    IB/mthca: Return an error on ib_copy_to_udata() failure

    commit 08e74c4b00c30c232d535ff368554959403d0432 upstream.

    In case of error when writing to userspace, the function mthca_create_cq()
    does not set an error code before following its error path.

    This patch sets the error code to -EFAULT when ib_copy_to_udata() fails.

    This was caught when using spatch (aka. coccinelle)
    to rewrite call to ib_copy_{from,to}_udata().

    Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
    Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
    Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64900cd67cf96f8fc40d1db1f4058cbaa2dca7ff
Author: Yann Droneaud <ydroneaud@opteya.com>
Date:   Mon Mar 10 23:06:27 2014 +0100

    IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL

    commit 9d194d1025f463392feafa26ff8c2d8247f71be1 upstream.

    In case of error while accessing to userspace memory, function
    nes_create_qp() returns NULL instead of an error code wrapped through
    ERR_PTR().  But NULL is not expected by ib_uverbs_create_qp(), as it
    check for error with IS_ERR().

    As page 0 is likely not mapped, it is going to trigger an Oops when
    the kernel will try to dereference NULL pointer to access to struct
    ib_qp's fields.

    In some rare cases, page 0 could be mapped by userspace, which could
    turn this bug to a vulnerability that could be exploited: the function
    pointers in struct ib_device will be under userspace total control.

    This was caught when using spatch (aka. coccinelle)
    to rewrite calls to ib_copy_{from,to}_udata().

    Link: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null
    Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
    Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
    Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 066c269f39f667f486d3cb709429dc73ff2f172d
Author: Dennis Dalessandro <dennis.dalessandro@intel.com>
Date:   Thu Feb 20 11:02:53 2014 -0500

    IB/ipath: Fix potential buffer overrun in sending diag packet routine

    commit a2cb0eb8a64adb29a99fd864013de957028f36ae upstream.

    Guard against a potential buffer overrun.  The size to read from the
    user is passed in, and due to the padding that needs to be taken into
    account, as well as the place holder for the ICRC it is possible to
    overflow the 32bit value which would cause more data to be copied from
    user space than is allocated in the buffer.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8992efff2b60c8b360ebef7daa03db6496cc131
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Mon Mar 10 14:17:55 2014 -0400

    nfsd4: fix setclientid encode size

    commit 480efaee085235bb848f1063f959bf144103c342 upstream.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 367bce496469f4a47c717c048116cdb73caefa62
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Mon Feb 24 14:59:47 2014 -0500

    nfsd: notify_change needs elevated write count

    commit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.

    Looks like this bug has been here since these write counts were
    introduced, not sure why it was just noticed now.

    Thanks also to Jan Kara for pointing out the problem.

    Reported-by: Matthew Rahtz <mrahtz@rapitasystems.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2189c7fedb781f3dd14b4df162661e36a85cc02
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Mon Feb 3 16:31:42 2014 -0500

    nfsd4: fix test_stateid error reply encoding

    commit a11fcce1544df08c723d950ff0edef3adac40405 upstream.

    If the entire operation fails then there's nothing to encode.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9acc531f6038cccb95a7bf4d26469196764e6d53
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Jan 28 16:05:15 2014 -0500

    nfsd4: buffer-length check for SUPPATTR_EXCLCREAT

    commit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.

    This was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39
    "nfsd41: SUPPATTR_EXCLCREAT attribute".

    Cc: Benny Halevy <bhalevy@primarydata.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc111bf8f73b9223fd4f8e420b7b76f4e0fed427
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Jan 28 16:01:04 2014 -0500

    nfsd4: session needs room for following op to error out

    commit 4c69d5855a16f7378648c5733632628fa10431db upstream.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5d052fbbd7b0069df1fdeaa7dd5eb16e1345a458
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Apr 14 13:48:47 2014 -0400

    USB: fix crash during hotplug of PCI USB controller card

    commit a2ff864b53eac9a0e9b05bfe9d1781ccd6c2af71 upstream.

    The code in hcd-pci.c that matches up EHCI controllers with their
    companion UHCI or OHCI controllers assumes that the private drvdata
    fields don't get set too early.  However, it turns out that this field
    gets set by usb_create_hcd(), before hcd-pci expects it, and this can
    result in a crash when two controllers are probed in parallel (as can
    happen when a new controller card is hotplugged).

    The companions_rwsem lock was supposed to prevent this sort of thing,
    but usb_create_hcd() is called outside the scope of the rwsem.

    A simple solution is to check that the root-hub pointer has been
    initialized as well as the drvdata field.  This doesn't happen until
    usb_add_hcd() is called; that call and the check are both protected by
    the rwsem.

    This patch should be applied to stable kernels from 3.10 onward.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Stefani Seibold <stefani@seibold.net>
    Tested-by: Stefani Seibold <stefani@seibold.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 632d996e9911371a3b48cec1e8451c7c2761fd69
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Sun Mar 16 15:31:54 2014 -0700

    x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

    commit b3b42ac2cbae1f3cecbb6229964a4d48af31d382 upstream.

    The IRET instruction, when returning to a 16-bit segment, only
    restores the bottom 16 bits of the user space stack pointer.  We have
    a software workaround for that ("espfix") for the 32-bit kernel, but
    it relies on a nonzero stack segment base which is not available in
    32-bit mode.

    Since 16-bit support is somewhat crippled anyway on a 64-bit kernel
    (no V86 mode), and most (if not quite all) 64-bit processors support
    virtualization for the users who really need it, simply reject
    attempts at creating a 16-bit segment when running on top of a 64-bit
    kernel.

    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Link: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d1a5959bc3be5b9aa5886e8736534b96098b215
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Wed Apr 16 14:49:33 2014 -0500

    staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0

    commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.

    Zero-initializing ether_type masked that the ether type would never be
    obtained for 8021x packets and the comparison against eapol_type
    would always fail.

    Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 725f2ba0cbb94c7e8f3499ef57dbd47d85521ef7
Author: Himangi Saraogi <himangi774@gmail.com>
Date:   Wed Mar 5 04:59:57 2014 +0530

    staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer

    commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.

    This patch fixes the following sparse warning :
    drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer

    Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6733ac581418cfd8d7bef57c22fc2e0d673c4272
Author: David Fries <David@Fries.net>
Date:   Wed Jan 15 22:29:12 2014 -0600

    w1: fix w1_send_slave dropping a slave id

    commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.

    Previous logic,
    if (avail > 8) {
    	store slave;
    	return;
    }
    send data; clear;

    The logic error is, if there isn't space send the buffer and clear,
    but the slave wasn't added to the now empty buffer loosing that slave
    id.  It also should have been "if (avail >= 8)" because when it is 8,
    there is space.

    Instead, if there isn't space send and clear the buffer, then there is
    always space for the slave id.

    Signed-off-by: David Fries <David@Fries.net>
    Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b015ff0243274791bb5d9357f517e43babcf705
Author: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Date:   Tue Feb 11 11:03:34 2014 +0100

    mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error

    commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream.

    During probe the driver allocates dummy I2C devices for RTC, haptic and
    MUIC with i2c_new_dummy() but it does not check the return value of this
    calls.

    In case of error (i2c_new_device(): memory allocation failure or I2C
    address cannot be used) this function returns NULL which is later used
    by i2c_unregister_device().

    If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
    probe for main MFD driver.

    Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4efaf4210b1a995cf39f29425259fbbd87194661
Author: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Date:   Tue Feb 11 11:03:35 2014 +0100

    mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error

    commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream.

    During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.

    In case of error (i2c_new_device(): memory allocation failure or I2C
    address cannot be used) this function returns NULL which is later used
    by i2c_unregister_device().

    If i2c_new_dummy() fails for RTC device, fail also the probe for
    main MFD driver.

    Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9546b807f1a47ba98760246df1c3f1cb6d05306
Author: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Date:   Tue Feb 11 11:03:33 2014 +0100

    mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error

    commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream.

    During probe the driver allocates dummy I2C devices for RTC and ADC
    with i2c_new_dummy() but it does not check the return value of this
    calls.

    In case of error (i2c_new_device(): memory allocation failure or I2C
    address cannot be used) this function returns NULL which is later used
    by i2c_unregister_device().

    If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
    for main MFD driver.

    Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4a8f6c0d3970daa2634475ce43d04310127272d
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Apr 8 16:58:34 2014 +0200

    ALSA: ice1712: Fix boundary checks in PCM pointer ops

    commit 4f8e940095536bc002a81666a4107a581c84e9b9 upstream.

    PCM pointer callbacks in ice1712 driver check the buffer size boundary
    wrongly between bytes and frames.  This leads to PCM core warnings
    like:
       snd_pcm_update_hw_ptr0: 105 callbacks suppressed
       ALSA pcm_lib.c:352 BUG: pcmC3D0c:0, pos = 5461, buffer size = 5461, period size = 2730

    This patch fixes these checks to be placed after the proper unit
    conversions.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b7b38eb3f20b2cd88c41f6b05aa2e3f2f1b3b878
Author: W. Trevor King <wking@tremily.us>
Date:   Sat Mar 29 17:47:24 2014 -0700

    ALSA: hda - Enable beep for ASUS 1015E

    commit a4b7f21d7b42b33609df3f86992a8deff80abfaf upstream.

    The `lspci -nnvv` output contains (wrapped for line length):

      00:1b.0 Audio device [0403]:
        Intel Corporation 7 Series/C210 Series Chipset Family
        High Definition Audio Controller [8086:1e20] (rev 04)
            Subsystem: ASUSTeK Computer Inc. Device [1043:115d]

    Signed-off-by: W. Trevor King <wking@tremily.us>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61d0294719523889c7ce32d33a2ab7cc73fbb814
Author: Liu Hua <sdu.liu@huawei.com>
Date:   Fri Apr 18 07:45:36 2014 +0100

    ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo

    commit 56b700fd6f1e49149880fb1b6ffee0dca5be45fb upstream.

    For vmcore generated by LPAE enabled kernel, user space
    utility such as crash needs additional infomation to
    parse.

    So this patch add arch_crash_save_vmcoreinfo as what PAE enabled
    i386 linux does.

    Reviewed-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Liu Hua <sdu.liu@huawei.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76ff67ac5a2585634709abc41a0a9f3f3b28c90f
Author: Xiangyu Lu <luxiangyu@huawei.com>
Date:   Tue Apr 15 09:38:17 2014 +0100

    ARM: 8027/1: fix do_div() bug in big-endian systems

    commit 80bb3ef109ff40a7593d9481c17de9bbc4d7c0e2 upstream.

    In big-endian systems, "%1" get the most significant part of the value, cause the instruction to get the wrong result.

    When viewing ftrace record in big-endian ARM systems, we found that
    the timestamp errors:

    swapper-0   [001] 1325.970000:   0:120:R ==> [001]    16:120:R events/1
    events/1-16 [001] 1325.970000:   16:120:S ==> [001]    0:120:R swapper
    swapper-0   [000] 1325.1000000:  0:120:R   + [000]    15:120:R events/0
    swapper-0   [000] 1325.1000000:  0:120:R ==> [000]    15:120:R events/0
    swapper-0   [000] 1326.030000:   0:120:R   + [000]  1150:120:R sshd
    swapper-0   [000] 1326.030000:   0:120:R ==> [000]  1150:120:R sshd

    When viewed ftrace records, it will call the do_div(n, base) function, which achieved arch/arm/include/asm/div64.h in. When n = 10000000, base = 1000000, in do_div(n, base) will execute "umull %Q0, %R0, %1, %Q2".

    Reviewed-by: Dave Martin <Dave.Martin@arm.com>
    Reviewed-by: Nicolas Pitre <nico@linaro.org>
    Signed-off-by: Alex Wu <wuquanming@huawei.com>
    Signed-off-by: Xiangyu Lu <luxiangyu@huawei.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 375f0dfa0c993b38ca4cd6f5859cc2a35ee10157
Author: Roger Quadros <rogerq@ti.com>
Date:   Thu Apr 10 10:18:17 2014 +0300

    ARM: OMAP3: hwmod data: Correct clock domains for USB modules

    commit c6c56697ae4bf1226263c19e8353343d7083f40e upstream.

    OMAP3 doesn't contain "l3_init_clkdm" clock domain. Use the
    proper clock domains for USB Host and USB TLL modules.

    Gets rid of the following warnings during boot
     omap_hwmod: usb_host_hs: could not associate to clkdm l3_init_clkdm
     omap_hwmod: usb_tll_hs: could not associate to clkdm l3_init_clkdm

    Reported-by: Nishanth Menon <nm@ti.com>
    Cc: Paul Walmsley <paul@pwsan.com>
    Signed-off-by: Roger Quadros <rogerq@ti.com>
    Fixes: de231388cb80a8ef3e779bbfa0564ba0157b7377 ("ARM: OMAP: USB: EHCI and OHCI hwmod structures for OMAP3")
    Cc: Keshava Munegowda <keshava_mgowda@ti.com>
    Cc: Partha Basak <parthab@india.ti.com>
    Signed-off-by: Paul Walmsley <paul@pwsan.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 05b81311eb29058600b458393cf577b4d40a0b14
Author: Stefan Sørensen <stefan.sorensen@spectralink.com>
Date:   Thu Mar 6 16:27:15 2014 +0100

    ARM: OMAP2+: INTC: Acknowledge stuck active interrupts

    commit 698b48532539484b012fb7c4176b959d32a17d00 upstream.

    When an interrupt has become active on the INTC it will stay active
    until it is acked, even if masked or de-asserted. The
    INTC_PENDING_IRQn registers are however updated and since these are
    used by omap_intc_handle_irq to determine which interrupt to handle,
    it will never see the active interrupt. This will result in a storm of
    useless interrupts that is only stopped when another higher priority
    interrupt is asserted.

    Fix by sending the INTC an acknowledge if we find no interrupts to
    handle.

    Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 62f29567f2e87357413ec534d7ecde5763e83239
Author: Brian Austin <brian.austin@cirrus.com>
Date:   Tue Mar 18 13:56:21 2014 -0500

    ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE

    commit 1555b652970e541fa1cb80c61ffc696bbfb92bb7 upstream.

    The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the mono mix controls.

    Reported-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Brian Austin <brian.austin@cirrus.com>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dce015d07e9d0ae9ef8bd1ee55eb9fd59e5ad1b1
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Oct 7 16:51:03 2013 -0600

    msm: kgsl: Print the register that causes a protected mode error

    When we get a protected mode error print out the register information
    that caused the exception.

    Change-Id: Ic0dedbad4f586c5715669226619b51665ef9681f
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 5d70f8bc0493b3ff5cad81fb7e3dae06b15278b7
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Feb 3 10:48:33 2014 -0700

    msm: kgsl: Protect SMMU registers from being written by the GPU

    Put the SMMU register range in protected mode to shield them from
    IB1/IB2 writes from userspace.

    CRs-Fixed: 599971
    Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 3897a1bc3ec95a972636349a541375bacdb25b29
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Sep 30 09:51:26 2013 -0600

    msm: kgsl: Enable protected register mode for A3XX

    Turn on protected register mode for the A3XX GPU family and add 0x63
    (RBBM_INT_0_MASK) to the list of protected registers.

    Conflicts:
    	drivers/gpu/msm/adreno.h
    	drivers/gpu/msm/adreno_a3xx.c
    	drivers/gpu/msm/adreno_ringbuffer.c

    Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 441bd29ae55dea1531555819858f02ede6c7e587
Author: Shubhraprakash Das <sadas@codeaurora.org>
Date:   Mon Apr 29 12:25:42 2013 -0700

    msm: kgsl: Setup a3xx protection in its start function

    Setup the protection registers for a3xx towards the end of its
    start function instead of doing it in generic ringbuffer start

    Conflicts:
    	drivers/gpu/msm/adreno_ringbuffer.c

    Change-Id: I66df496afa5d1fdf7dea790306f5358c2098674d
    Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 7e78959eef7ce6771cb87835f475e22dc6672162
Author: Mihir Shete <smihir@codeaurora.org>
Date:   Thu Mar 13 18:50:49 2014 +0530

    wcnss: add API to check if wcnss is undergoing an SSR

    Wlan driver should not read registers from wcnss or
    try to communicate with the chip when it is undergoing
    a subsystem-restart. Added an API with the wcnss platform
    driver to check if ssr is in progress, this API will be
    used by the wlan driver to protect register access and
    other prohibited operations.

    Change-Id: Ia0d93e774af126d84dbaabf5c36a2c90fdbd58be
    CRs-Fixed: 621974
    Signed-off-by: Mihir Shete <smihir@codeaurora.org>

commit ed80534e15836294bb3bbb8d8afa4904520e7aa6
Author: Yue Ma <yuem@codeaurora.org>
Date:   Thu Dec 19 16:59:27 2013 -0800

    wcnss: Log debug registers when receives certain notification

    If powering on a subsystem during restart fails, SSR framework will send
    a "powerup failure" notification to the subsystem. Add support that
    WCNSS platform driver will register to listen the notifications and if
    receives "powerup failure" notification, it will log the debug registers.

    Change-Id: I0ae8a5ee96122d71c7a86711044f6b07e400b62c
    Signed-off-by: Yue Ma <yuem@codeaurora.org>
    [smihir@codeaurora.org: removed powerup failure notification for riva]
    Signed-off-by: Mihir Shete <smihir@codeaurora.org>

commit 73989a4b345bba0efca96cc86b0258e83884ff63
Author: Ravi Joshi <ravij@codeaurora.org>
Date:   Mon May 5 15:25:39 2014 -0700

    msm: Create shadow files under /sys/kernel/ipv4

    The TCP delayed ack parameters can be configured from user space
    application which runs with non-root credentials and does not have
    direct write access to /proc entries. This commit creates shadow
    files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

    CRs-Fixed: 628139
    Change-Id: If9f5e8f1f5f31c39090555b7b0c40efcdf6ccd08
    Signed-off-by: Ravi Joshi <ravij@codeaurora.org>

commit edfec016ea36e3beed4e9bb14156e3d6532930f1
Merge: 0299d70 f20bafb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 5 13:52:57 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit c4737d0602be5f28e420cd3f47af30cc3f88da6c
Author: Zhen Kong <zkong@codeaurora.org>
Date:   Thu Mar 27 12:44:15 2014 -0700

    qseecom: Validate pointer offset in qseecom_send_modfd_cmd

    Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
    make sure cmd buffer address to be within shared bufffer.

    Signed-off-by: Zhen Kong <zkong@codeaurora.org>

    Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
    Signed-off-by: Zhen Kong <zkong@codeaurora.org>
    Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>

commit f20bafbbf50f366f6c624f41b921844fa2a4cc46
Merge: 0299d70 b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 5 09:50:23 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 0299d7063a93b5f4dc9657facdb3d9d942e7ab8a
Merge: 3fa6c8e b08781a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 5 09:40:56 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit b08781a447a02bb96c37ac48ae18a9a8944db7ec
Merge: 3fa6c8e b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 5 05:21:08 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 3fa6c8ee9693053ebebc4595a788b46b5c914402
Merge: 60d1e02 a041988b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon May 5 02:58:08 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit a041988be29556cf34b2ef678a389164e87d69d0
Merge: 60d1e02 b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun May 4 22:58:54 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 60d1e0267f5b1900b855483e33ed2b973584e6af
Merge: 0c448b4 518b26e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 2 11:15:24 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit a6da7837dec19fffb0251fc7b0c92fb32208d7c5
Author: Dave Daynard <nardholio@gmail.com>
Date:   Fri May 2 11:58:21 2014 -0400

    Sync prima with caf

    Still no version bump

    Change-Id: I80f882bd30d9b157f588e8009bf1eeb5e7741276

commit 518b26ef414bc2769d1e55255e3651569e47ff92
Merge: 0c448b4 b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri May 2 06:54:41 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 0c448b499e6511016b1a158144f63a97f39843a8
Merge: e46f191 70a1a6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 1 17:15:13 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit 70a1a6fbf8e0a17be613c2418dc4f1e3f58f9052
Merge: e46f191 b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 1 13:14:19 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit e46f19131ba92f3bc54e060642822bbf00e31b50
Merge: 828c26f 6fa844d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 1 13:04:01 2014 -0700

    Merge "Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."""

commit 6fa844d76d826a2c0e640d88c774f1e60be684a1
Merge: 828c26f b9864e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu May 1 08:40:27 2014 -0700

    Merge "Merge "msm: camera: Enable interrupts before returning during Invalid Image mode.""

commit 23bd41bb4e2bdd5f337e7ca2953feb8c3bde4003
Author: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Date:   Tue Apr 29 11:44:45 2014 +0530

    cfg80211: fix possible circular lock on reg_regdb_search()

    When call_crda() is called we kick off a witch hunt search
    for the same regulatory domain on our internal regulatory
    database and that work gets kicked off on a workqueue, this
    is done while the cfg80211_mutex is held. If that workqueue
    kicks off it will first lock reg_regdb_search_mutex and
    later cfg80211_mutex but to ensure two CPUs will not contend
    against cfg80211_mutex the right thing to do is to have the
    reg_regdb_search() wait until the cfg80211_mutex is let go.

    Change-Id: Ibb44a5325876d77f1549d3938d56d8fbd051b9ba
    CRs-Fixed: 655287
    Signed-off-by: Santhosh Kumar Padma <skpadma@codeaurora.org>

commit 828c26fa9955f6ca537061354b5c093b0c3f7820
Merge: 4cdf328 5df0d52
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 30 11:08:56 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit b9864e8080e9243ece7bd1eab17f8043ebe032ed
Merge: 9a8e3b8 2c07a93
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 30 07:27:06 2014 -0700

    Merge "msm: camera: Enable interrupts before returning during Invalid Image mode."

commit 5df0d52def219b1e1fe2383668b966b05a2946d1
Merge: 4cdf328 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 30 07:15:14 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 4cdf3281ff751cab3d418c51b73cfef49da13164
Merge: 70e0f15 8a0f27b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 30 04:50:55 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 8a0f27b9b50f0b75cb1a9ff941592a34470627a3
Merge: 70e0f15 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 30 00:51:45 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 70e0f1548dde6ee99601c32706791ba92b7d2241
Merge: 8a692ab 1b649ca
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 18:01:24 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 1b649cae255f7fd7dc13e986ed6e3dc6d156989b
Merge: 8a692ab 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 13:54:53 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 8a692ab4268b27c30353b48cc40898eeffc653d1
Merge: 759c3c8 f4b6066
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 13:44:11 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit f4b6066f1205f863e983f57de7940ff76080746f
Merge: 759c3c8 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 09:35:29 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 759c3c8933142ae65841751e82f3f6b42e398386
Merge: 6886afb b9e5d8d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 09:24:44 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 00fcc691ed4a13522e01cfc1575cb7b984485b0a
Merge: 1e897f2 32bbb4c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 06:26:44 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.058 on remote branch"

commit 32bbb4c8a2adae68760614f92f7e32a7a68ca723
Merge: 1e897f2 1d326d4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 05:09:11 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.058 on remote branch

    Change-Id: I18209ef21d286248210d222c33ad761c532c4ee5

commit b9e5d8da6d9620902ee675d0258beee34c27e8a3
Merge: 6886afb 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 03:32:16 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 6886afb3129192c83d41a00204ce0a30a52887ef
Merge: 13cc3be5 56382a5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 29 03:18:04 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 56382a505ed692d632b83d7900dccba0a1f10da0
Merge: 13cc3be5 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 23:04:26 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 13cc3be51dbfa76a86ca1222dddb603822b12f4e
Merge: 1e897f2 bb73b79
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 22:53:49 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit bb73b79f30016b020d4db478c981af7ef13cc165
Merge: 1e897f2 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 18:46:02 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 1e897f2b5b28ede62a4801dd2bbebc2210b5cfbb
Merge: 7ce36fc 8083007
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 18:34:40 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 8083007b37ce2daa0fa17aa440e271259f90f2db
Merge: 7ce36fc 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 14:23:55 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 7ce36fcdb43c8ef42c9772330eef96c899dbc1c6
Merge: 8ad5408 6a5b426
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 14:13:44 2014 -0700

    Merge "Merge "Merge "msm: qdsp6v2: Increase max ports in APR"""

commit 6a5b42683119cea3f7559eae341427a09de1b24f
Merge: 8ad5408 9a8e3b8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 10:09:31 2014 -0700

    Merge "Merge "msm: qdsp6v2: Increase max ports in APR""

commit 8ad5408bf560047dad11608d089f8bb8b56e94eb
Merge: 90a1f03 f9c1dbc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 09:58:33 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit f9c1dbc3d0e2c9a4fef99d45a3d22172268c9988
Merge: 90a1f03 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 05:28:36 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit 9a8e3b854eb6dcc044f08ca2294bd1c9ae84c90f
Merge: d930140 826b14a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 04:54:04 2014 -0700

    Merge "msm: qdsp6v2: Increase max ports in APR"

commit d9301406b9f829010abdd5f6d2de128fa681cdc2
Merge: d433e6f 9089ad9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 28 04:54:02 2014 -0700

    Merge "diag: Remove error message"

commit 4166edf312e84417a3b859b32e96c49f7a350164
Merge: 0698aed 5c5994f
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Apr 27 01:18:47 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	net/bluetooth/hci_event.c

    Change-Id: I466723b4dc0387a97b2083cd8363ff86a12e30ec

commit 5c5994f5a166379c5b8e719f17d466e9276ee581
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Apr 26 17:13:46 2014 -0700

    Linux 3.4.88

commit d66d2078181ddf2d26585c6737ea43ea8a6f52e6
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Mon Apr 7 15:38:41 2014 -0700

    wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race

    commit dfccbb5e49a621c1b21a62527d61fc4305617aca upstream.

    wait_task_zombie() first does EXIT_ZOMBIE->EXIT_DEAD transition and
    drops tasklist_lock.  If this task is not the natural child and it is
    traced, we change its state back to EXIT_ZOMBIE for ->real_parent.

    The last transition is racy, this is even documented in 50b8d257486a
    "ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE
    race".  wait_consider_task() tries to detect this transition and clear
    ->notask_error but we can't rely on ptrace_reparented(), debugger can
    exit and do ptrace_unlink() before its sub-thread sets EXIT_ZOMBIE.

    And there is another problem which were missed before: this transition
    can also race with reparent_leader() which doesn't reset >exit_signal if
    EXIT_DEAD, assuming that this task must be reaped by someone else.  So
    the tracee can be re-parented with ->exit_signal != SIGCHLD, and if
    /sbin/init doesn't use __WALL it becomes unreapable.

    Change reparent_leader() to update ->exit_signal even if EXIT_DEAD.
    Note: this is the simple temporary hack for -stable, it doesn't try to
    solve all problems, it will be reverted by the next changes.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reported-by: Jan Kratochvil <jan.kratochvil@redhat.com>
    Reported-by: Michal Schmidt <mschmidt@redhat.com>
    Tested-by: Michal Schmidt <mschmidt@redhat.com>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Cc: Lennart Poettering <lpoetter@redhat.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Tejun Heo <tj@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 371d9bb7dab6293e79aafb5481b842629a60aa5e
Author: Li Zefan <lizefan@huawei.com>
Date:   Wed Feb 12 12:44:57 2014 -0800

    jffs2: remove from wait queue after schedule()

    commit 3ead9578443b66ddb3d50ed4f53af8a0c0298ec5 upstream.

    @wait is a local variable, so if we don't remove it from the wait queue
    list, later wake_up() may end up accessing invalid memory.

    This was spotted by eyes.

    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5c8e8e1378bb5be5600f8ed23d8bc61cc466b6eb
Author: Li Zefan <lizefan@huawei.com>
Date:   Wed Feb 12 12:44:56 2014 -0800

    jffs2: avoid soft-lockup in jffs2_reserve_space_gc()

    commit 13b546d96207c131eeae15dc7b26c6e7d0f1cad7 upstream.

    We triggered soft-lockup under stress test on 2.6.34 kernel.

    BUG: soft lockup - CPU#1 stuck for 60009ms! [lockf2.test:14488]
    ...
    [<bf09a4d4>] (jffs2_do_reserve_space+0x420/0x440 [jffs2])
    [<bf09a528>] (jffs2_reserve_space_gc+0x34/0x78 [jffs2])
    [<bf0a1350>] (jffs2_garbage_collect_dnode.isra.3+0x264/0x478 [jffs2])
    [<bf0a2078>] (jffs2_garbage_collect_pass+0x9c0/0xe4c [jffs2])
    [<bf09a670>] (jffs2_reserve_space+0x104/0x2a8 [jffs2])
    [<bf09dc48>] (jffs2_write_inode_range+0x5c/0x4d4 [jffs2])
    [<bf097d8c>] (jffs2_write_end+0x198/0x2c0 [jffs2])
    [<c00e00a4>] (generic_file_buffered_write+0x158/0x200)
    [<c00e14f4>] (__generic_file_aio_write+0x3a4/0x414)
    [<c00e15c0>] (generic_file_aio_write+0x5c/0xbc)
    [<c012334c>] (do_sync_write+0x98/0xd4)
    [<c0123a84>] (vfs_write+0xa8/0x150)
    [<c0123d74>] (sys_write+0x3c/0xc0)]

    Fix this by adding a cond_resched() in the while loop.

    [akpm@linux-foundation.org: don't initialize `ret']
    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b49c0b860779db3f81d88a1ba4edc9b2f2d27b96
Author: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
Date:   Mon Jan 6 19:06:55 2014 +0530

    jffs2: Fix crash due to truncation of csize

    commit 41bf1a24c1001f4d0d41a78e1ac575d2f14789d7 upstream.

    mounting JFFS2 partition sometimes crashes with this call trace:

    [ 1322.240000] Kernel bug detected[#1]:
    [ 1322.244000] Cpu 2
    [ 1322.244000] $ 0   : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001
    [ 1322.252000] $ 4   : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000
    [ 1322.260000] $ 8   : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8
    [ 1322.268000] $12   : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e
    [ 1322.276000] $16   : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000
    [ 1322.284000] $20   : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0
    [ 1322.292000] $24   : 0000000000000004 0000000000000000
    [ 1322.300000] $28   : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0
    [ 1322.308000] Hi    : 000000000000023c
    [ 1322.312000] Lo    : 000000000003f802
    [ 1322.316000] epc   : ffffffffc039a9f8 check_tn_node+0x88/0x3b0
    [ 1322.320000]     Not tainted
    [ 1322.324000] ra    : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48
    [ 1322.332000] Status: 5400f8e3    KX SX UX KERNEL EXL IE
    [ 1322.336000] Cause : 00800034
    [ 1322.340000] PrId  : 000c1004 (Netlogic XLP)
    [ 1322.344000] Modules linked in:
    [ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000)
    [ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000
            c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc
            c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000
            0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180
            0000008600000000 0000000000000000 0000000000000000 0000000000000000
            0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000
            0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00
            c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0
            0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90
            0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c
            ...
    [ 1322.424000] Call Trace:
    [ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0
    [ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48
    [ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0
    [ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870
    [ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0
    [ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0
    [ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18
    [ 1322.472000]
    [ 1322.472000]
    Code: 67bd0050  94a4002c  2c830001 <00038036> de050218  2403fffc  0080a82d  00431824  24630044
    [ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---

    The variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it
    is used to hold the compressed data length(csize) which is declared as uint32_t.
    So, when the value of csize exceeds 16bits, it gets truncated when assigned to
    tn->csize. This is causing a kernel BUG.
    Changing the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.

    Signed-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
    Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3dba9e3a42493e2c6453f3863a999778ad3dd3b0
Author: Kamlakant Patel <kamlakant.patel@broadcom.com>
Date:   Mon Jan 6 19:06:54 2014 +0530

    jffs2: Fix segmentation fault found in stress test

    commit 3367da5610c50e6b83f86d366d72b41b350b06a2 upstream.

    Creating a large file on a JFFS2 partition sometimes crashes with this call
    trace:

    [  306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc == ffffffffc03a80a8, ra == ffffffffc03a8044
    [  306.488000] Oops[#1]:
    [  306.488000] Cpu 13
    [  306.492000] $ 0   : 0000000000000000 0000000000000000 0000000000008008 0000000000008007
    [  306.500000] $ 4   : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58
    [  306.508000] $ 8   : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002
    [  306.516000] $12   : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb
    [  306.524000] $16   : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70
    [  306.532000] $20   : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000
    [  306.540000] $24   : 0000000000000000 0000000000000004
    [  306.548000] $28   : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044
    [  306.556000] Hi    : 00000000000574a5
    [  306.560000] Lo    : 6193b7a7e903d8c9
    [  306.564000] epc   : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198
    [  306.568000]     Tainted: G        W
    [  306.572000] ra    : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198
    [  306.580000] Status: 5000f8e3    KX SX UX KERNEL EXL IE
    [  306.584000] Cause : 00800008
    [  306.588000] BadVA : c0000000dfff8002
    [  306.592000] PrId  : 000c1100 (Netlogic XLP)
    [  306.596000] Modules linked in:
    [  306.596000] Process dd (pid: 170, threadinfo=c0000000ee950000, task=c0000000ee6e0858, tls=0000000000c47490)
    [  306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f
            7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7
            7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb
            7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93
            7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64
            7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53
            7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80
            7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3
            7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6
            7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9
            ...
    [  306.676000] Call Trace:
    [  306.680000] [<ffffffffc03a80a8>] jffs2_rtime_compress+0x98/0x198
    [  306.684000] [<ffffffffc0394f10>] jffs2_selected_compress+0x110/0x230
    [  306.692000] [<ffffffffc039508c>] jffs2_compress+0x5c/0x388
    [  306.696000] [<ffffffffc039dc58>] jffs2_write_inode_range+0xd8/0x388
    [  306.704000] [<ffffffffc03971bc>] jffs2_write_end+0x16c/0x2d0
    [  306.708000] [<ffffffffc01d3d90>] generic_file_buffered_write+0xf8/0x2b8
    [  306.716000] [<ffffffffc01d4e7c>] __generic_file_aio_write+0x1ac/0x350
    [  306.720000] [<ffffffffc01d50a0>] generic_file_aio_write+0x80/0x168
    [  306.728000] [<ffffffffc021f7dc>] do_sync_write+0x94/0xf8
    [  306.732000] [<ffffffffc021ff6c>] vfs_write+0xa4/0x1a0
    [  306.736000] [<ffffffffc02202e8>] SyS_write+0x50/0x90
    [  306.744000] [<ffffffffc0116cc0>] handle_sys+0x180/0x1a0
    [  306.748000]
    [  306.748000]
    Code: 020b202d  0205282d  90a50000 <90840000> 14a40038  00000000  0060602d  0000282d  016c5823
    [  306.760000] ---[ end trace 79dd088435be02d0 ]---
    Segmentation fault

    This crash is caused because the 'positions' is declared as an array of signed
    short. The value of position is in the range 0..65535, and will be converted
    to a negative number when the position is greater than 32767 and causes a
    corruption and crash. Changing the definition to 'unsigned short' fixes this
    issue

    Signed-off-by: Jayachandran C <jchandra@broadcom.com>
    Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>
    Signed-off-by: Brian Norris <computersforpeace@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dfb81e8ae6f25dcca2c93d1f6cdaaf89ef5dd047
Author: Claudio Takahasi <claudio.takahasi@openbossa.org>
Date:   Thu Jul 25 16:34:24 2013 -0300

    Bluetooth: Fix removing Long Term Key

    commit 5981a8821b774ada0be512fd9bad7c241e17657e upstream.

    This patch fixes authentication failure on LE link re-connection when
    BlueZ acts as slave (peripheral). LTK is removed from the internal list
    after its first use causing PIN or Key missing reply when re-connecting
    the link. The LE Long Term Key Request event indicates that the master
    is attempting to encrypt or re-encrypt the link.

    Pre-condition: BlueZ host paired and running as slave.
    How to reproduce(master):

      1) Establish an ACL LE encrypted link
      2) Disconnect the link
      3) Try to re-establish the ACL LE encrypted link (fails)

    > HCI Event: LE Meta Event (0x3e) plen 19
          LE Connection Complete (0x01)
            Status: Success (0x00)
            Handle: 64
            Role: Slave (0x01)
    ...
    @ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
    > HCI Event: LE Meta Event (0x3e) plen 13
          LE Long Term Key Request (0x05)
            Handle: 64
            Random number: 875be18439d9aa37
            Encryption diversifier: 0x76ed
    < HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18
            Handle: 64
            Long term key: 2aa531db2fce9f00a0569c7d23d17409
    > HCI Event: Command Complete (0x0e) plen 6
          LE Long Term Key Request Reply (0x08|0x001a) ncmd 1
            Status: Success (0x00)
            Handle: 64
    > HCI Event: Encryption Change (0x08) plen 4
            Status: Success (0x00)
            Handle: 64
            Encryption: Enabled with AES-CCM (0x01)
    ...
    @ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3
    < HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1
            Advertising: Enabled (0x01)
    > HCI Event: Command Complete (0x0e) plen 4
          LE Set Advertise Enable (0x08|0x000a) ncmd 1
            Status: Success (0x00)
    > HCI Event: LE Meta Event (0x3e) plen 19
          LE Connection Complete (0x01)
            Status: Success (0x00)
            Handle: 64
            Role: Slave (0x01)
    ...
    @ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
    > HCI Event: LE Meta Event (0x3e) plen 13
          LE Long Term Key Request (0x05)
            Handle: 64
            Random number: 875be18439d9aa37
            Encryption diversifier: 0x76ed
    < HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2
            Handle: 64
    > HCI Event: Command Complete (0x0e) plen 6
          LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1
            Status: Success (0x00)
            Handle: 64
    > HCI Event: Disconnect Complete (0x05) plen 4
            Status: Success (0x00)
            Handle: 64
            Reason: Authentication Failure (0x05)
    @ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0

    Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eea7ead860ea8622d2d4b1cfbd63649beed91a9b
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Mon Apr 14 09:46:50 2014 -0500

    Char: ipmi_bt_sm, fix infinite loop

    commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.

    In read_all_bytes, we do

      unsigned char i;
      ...
      bt->read_data[0] = BMC2HOST;
      bt->read_count = bt->read_data[0];
      ...
      for (i = 1; i <= bt->read_count; i++)
        bt->read_data[i] = BMC2HOST;

    If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the
    'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the
    overflow and finish the loop after 255 iterations every time.

    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Reported-and-debugged-by: Rui Hui Dian <rhdian@novell.com>
    Cc: Tomas Cech <tcech@suse.cz>
    Cc: Corey Minyard <minyard@acm.org>
    Cc: <openipmi-developer@lists.sourceforge.net>
    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 036132b3be6073ecdeec7f1f3ad3606269ebf9c9
Author: Dave Kleikamp <dave.kleikamp@oracle.com>
Date:   Fri Mar 14 10:42:01 2014 -0500

    sparc64: don't treat 64-bit syscall return codes as 32-bit

    [ Upstream commit 1535bd8adbdedd60a0ee62e28fd5225d66434371 ]

    When checking a system call return code for an error,
    linux_sparc_syscall was sign-extending the lower 32-bit value and
    comparing it to -ERESTART_RESTARTBLOCK. lseek can return valid return
    codes whose lower 32-bits alone would indicate a failure (such as 4G-1).
    Use the whole 64-bit value to check for errors. Only the 32-bit path
    should sign extend the lower 32-bit value.

    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Acked-by: Bob Picco <bob.picco@oracle.com>
    Acked-by: Allen Pais <allen.pais@oracle.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5097041dde828e4dec67f1f9df7034dd42aafdc
Author: Paul Gortmaker <paul.gortmaker@windriver.com>
Date:   Thu Feb 13 13:57:44 2014 -0500

    sparc32: fix build failure for arch_jump_label_transform

    [ Upstream commit 4f6500fff5f7644a03c46728fd7ef0f62fa6940b ]

    In arch/sparc/Kernel/Makefile, we see:

       obj-$(CONFIG_SPARC64)   += jump_label.o

    However, the Kconfig selects HAVE_ARCH_JUMP_LABEL unconditionally
    for all SPARC.  This in turn leads to the following failure when
    doing allmodconfig coverage builds:

    kernel/built-in.o: In function `__jump_label_update':
    jump_label.c:(.text+0x8560c): undefined reference to `arch_jump_label_transform'
    kernel/built-in.o: In function `arch_jump_label_transform_static':
    (.text+0x85cf4): undefined reference to `arch_jump_label_transform'
    make: *** [vmlinux] Error 1

    Change HAVE_ARCH_JUMP_LABEL to be conditional on SPARC64 so that it
    matches the Makefile.

    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53c93feee59ac7884329013b243dcb218a4ad47b
Author: Dave Kleikamp <dave.kleikamp@oracle.com>
Date:   Mon Dec 16 15:01:00 2013 -0600

    Revert "sparc64: Fix __copy_{to,from}_user_inatomic defines."

    [ Upstream commit 16932237f2978a2265662f8de4af743b1f55a209 ]

    This reverts commit 145e1c0023585e0e8f6df22316308ec61c5066b2.

    This commit broke the behavior of __copy_from_user_inatomic when
    it is only partially successful. Instead of returning the number
    of bytes not copied, it now returns 1. This translates to the
    wrong value being returned by iov_iter_copy_from_user_atomic.

    xfstests generic/246 and LTP writev01 both fail on btrfs and nfs
    because of this.

    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 10d52681f0d0d0b93aaf8efdaadac468e1bd872f
Author: oftedal <oftedal@gmail.com>
Date:   Fri Oct 18 22:28:29 2013 +0200

    sparc: PCI: Fix incorrect address calculation of PCI Bridge windows on Simba-bridges

    [ Upstream commit 557fc5873ef178c4b3e1e36a42db547ecdc43f9b ]

    The SIMBA APB Bridges lacks the 'ranges' of-property describing the
    PCI I/O and memory areas located beneath the bridge. Faking this
    information has been performed by reading range registers in the
    APB bridge, and calculating the corresponding areas.

    In commit 01f94c4a6ced476ce69b895426fc29bfc48c69bd
    ("Fix sabre pci controllers with new probing scheme.") a bug was
    introduced into this calculation, causing the PCI memory areas
    to be calculated incorrectly: The shift size was set to be
    identical for I/O and MEM ranges, which is incorrect.

    This patch set the shift size of the MEM range back to the
    value used before 01f94c4a6ced476ce69b895426fc29bfc48c69bd.

    Signed-off-by: Kjetil Oftedal <oftedal@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 04477075793234a9cd5411b3fe359f8506b0734e
Author: Sasha Levin <sasha.levin@oracle.com>
Date:   Sat Mar 29 20:39:35 2014 -0400

    rds: prevent dereference of a NULL device in rds_iw_laddr_check

    [ Upstream commit bf39b4247b8799935ea91d90db250ab608a58e50 ]

    Binding might result in a NULL device which is later dereferenced
    without checking.

    Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8c3911a71ede8ec4c29329c7a5a80c37b3aeb83e
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Apr 8 12:23:09 2014 +0300

    isdnloop: several buffer overflows

    [ Upstream commit 7563487cbf865284dcd35e9ef5a95380da046737 ]

    There are three buffer overflows addressed in this patch.

    1) In isdnloop_fake_err() we add an 'E' to a 60 character string and
    then copy it into a 60 character buffer.  I have made the destination
    buffer 64 characters and I'm changed the sprintf() to a snprintf().

    2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60
    character buffer so we have 54 characters.  The ->eazlist[] is 11
    characters long.  I have modified the code to return if the source
    buffer is too long.

    3) In isdnloop_command() the cbuf[] array was 60 characters long but the
    max length of the string then can be up to 79 characters.  I made the
    cbuf array 80 characters long and changed the sprintf() to snprintf().
    I also removed the temporary "dial" buffer and changed it to use "p"
    directly.

    Unfortunately, we pass the "cbuf" string from isdnloop_command() to
    isdnloop_writecmd() which truncates anything over 60 characters to make
    it fit in card->omsg[].  (It can accept values up to 255 characters so
    long as there is a '\n' character every 60 characters).  For now I have
    just fixed the memory corruption bug and left the other problems in this
    driver alone.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 495d659f2c1057de1529d98733c6f1e7de275107
Author: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date:   Wed Apr 2 12:48:42 2014 +0900

    isdnloop: Validate NUL-terminated strings from user.

    [ Upstream commit 77bc6bed7121936bb2e019a8c336075f4c8eef62 ]

    Return -EINVAL unless all of user-given strings are correctly
    NUL-terminated.

    Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99df85bdef3515827e40fa019e0ecdda74f817ab
Author: Pablo Neira <pablo@netfilter.org>
Date:   Tue Apr 1 19:38:44 2014 +0200

    netlink: don't compare the nul-termination in nla_strcmp

    [ Upstream commit 8b7b932434f5eee495b91a2804f5b64ebb2bc835 ]

    nla_strcmp compares the string length plus one, so it's implicitly
    including the nul-termination in the comparison.

     int nla_strcmp(const struct nlattr *nla, const char *str)
     {
            int len = strlen(str) + 1;
            ...
                    d = memcmp(nla_data(nla), str, len);

    However, if NLA_STRING is used, userspace can send us a string without
    the nul-termination. This is a problem since the string
    comparison will not match as the last byte may be not the
    nul-termination.

    Fix this by skipping the comparison of the nul-termination if the
    attribute data is nul-terminated. Suggested by Thomas Graf.

    Cc: Florian Westphal <fw@strlen.de>
    Cc: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4230a2aaaa1b7df2f8127cf5e697dc4e2772ce1b
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Mon Mar 31 20:14:10 2014 +0200

    ipv6: some ipv6 statistic counters failed to disable bh

    [ Upstream commit 43a43b6040165f7b40b5b489fe61a4cb7f8c4980 ]

    After commit c15b1ccadb323ea ("ipv6: move DAD and addrconf_verify
    processing to workqueue") some counters are now updated in process context
    and thus need to disable bh before doing so, otherwise deadlocks can
    happen on 32-bit archs. Fabio Estevam noticed this while while mounting
    a NFS volume on an ARM board.

    As a compensation for missing this I looked after the other *_STATS_BH
    and found three other calls which need updating:

    1) icmp6_send: ip6_fragment -> icmpv6_send -> icmp6_send (error handling)
    2) ip6_push_pending_frames: rawv6_sendmsg -> rawv6_push_pending_frames -> ...
       (only in case of icmp protocol with raw sockets in error handling)
    3) ping6_v6_sendmsg (error handling)

    Fixes: c15b1ccadb323ea ("ipv6: move DAD and addrconf_verify processing to workqueue")
    Reported-by: Fabio Estevam <festevam@gmail.com>
    Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fec7e11a8fe3a3bd13429916872b08cc58f215da
Author: Paul Durrant <Paul.Durrant@citrix.com>
Date:   Fri Mar 28 11:39:05 2014 +0000

    xen-netback: remove pointless clause from if statement

    [ Upstream commit 0576eddf24df716d8570ef8ca11452a9f98eaab2 ]

    This patch removes a test in start_new_rx_buffer() that checks whether
    a copy operation is less than MAX_BUFFER_OFFSET in length, since
    MAX_BUFFER_OFFSET is defined to be PAGE_SIZE and the only caller of
    start_new_rx_buffer() already limits copy operations to PAGE_SIZE or less.

    Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
    Cc: Ian Campbell <ian.campbell@citrix.com>
    Cc: Wei Liu <wei.liu2@citrix.com>
    Cc: Sander Eikelenboom <linux@eikelenboom.it>
    Reported-By: Sander Eikelenboom <linux@eikelenboom.it>
    Tested-By: Sander Eikelenboom <linux@eikelenboom.it>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bc0f3b76f86de85baa45a5e64cf5970095d2925
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Thu Mar 27 12:53:37 2014 +0200

    vhost: validate vhost_get_vq_desc return value

    [ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]

    vhost fails to validate negative error code
    from vhost_get_vq_desc causing
    a crash: we are using -EFAULT which is 0xfffffff2
    as vector size, which exceeds the allocated size.

    The code in question was introduced in commit
    8dd014adfea6f173c1ef6378f7e5e7924866c923
        vhost-net: mergeable buffers support

    CVE-2014-0055

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20a51abb07a34a3af96b4fffac08022763f74c93
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Thu Mar 27 12:00:26 2014 +0200

    vhost: fix total length when packets are too short

    [ Upstream commit d8316f3991d207fe32881a9ac20241be8fa2bad0 ]

    When mergeable buffers are disabled, and the
    incoming packet is too large for the rx buffer,
    get_rx_bufs returns success.

    This was intentional in order for make recvmsg
    truncate the packet and then handle_rx would
    detect err != sock_len and drop it.

    Unfortunately we pass the original sock_len to
    recvmsg - which means we use parts of iov not fully
    validated.

    Fix this up by detecting this overrun and doing packet drop
    immediately.

    CVE-2014-0077

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b6da9193692acfe4889cb0a6050239cc613f756
Author: lucien <lucien.xin@gmail.com>
Date:   Mon Mar 17 12:51:01 2014 +0800

    ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly

    [ Upstream commit e367c2d03dba4c9bcafad24688fadb79dd95b218 ]

    In ip6_append_data_mtu(), when the xfrm mode is not tunnel(such as
    transport),the ipsec header need to be added in the first fragment, so the mtu
    will decrease to reserve space for it, then the second fragment come, the mtu
    should be turn back, as the commit 0c1833797a5a6ec23ea9261d979aa18078720b74
    said.  however, in the commit a493e60ac4bbe2e977e7129d6d8cbb0dd236be, it use
    *mtu = min(*mtu, ...) to change the mtu, which lead to the new mtu is alway
    equal with the first fragment's. and cannot turn back.

    when I test through  ping6 -c1 -s5000 $ip (mtu=1280):
    ...frag (0|1232) ESP(spi=0x00002000,seq=0xb), length 1232
    ...frag (1232|1216)
    ...frag (2448|1216)
    ...frag (3664|1216)
    ...frag (4880|164)

    which should be:
    ...frag (0|1232) ESP(spi=0x00001000,seq=0x1), length 1232
    ...frag (1232|1232)
    ...frag (2464|1232)
    ...frag (3696|1232)
    ...frag (4928|116)

    so delete the min() when change back the mtu.

    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Fixes: 75a493e60ac4bb ("ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size")
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4800c471ea65fba8d6fc105b51f8b1f43afbd91a
Author: Heiner Kallweit <heiner.kallweit@web.de>
Date:   Wed Mar 12 22:13:19 2014 +0100

    ipv6: Avoid unnecessary temporary addresses being generated

    [ Upstream commit ecab67015ef6e3f3635551dcc9971cf363cc1cd5 ]

    tmp_prefered_lft is an offset to ifp->tstamp, not now. Therefore
    age needs to be added to the condition.

    Age calculation in ipv6_create_tempaddr is different from the one
    in addrconf_verify and doesn't consider ADDRCONF_TIMER_FUZZ_MINUS.
    This can cause age in ipv6_create_tempaddr to be less than the one
    in addrconf_verify and therefore unnecessary temporary address to
    be generated.
    Use age calculation as in addrconf_modify to avoid this.

    Signed-off-by: Heiner Kallweit <heiner.kallweit@web.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d82c152b565849a5290abc8e7e0c181257457c05
Author: Matthew Leach <matthew.leach@arm.com>
Date:   Tue Mar 11 11:58:27 2014 +0000

    net: socket: error on a negative msg_namelen

    [ Upstream commit dbb490b96584d4e958533fb637f08b557f505657 ]

    When copying in a struct msghdr from the user, if the user has set the
    msg_namelen parameter to a negative value it gets clamped to a valid
    size due to a comparison between signed and unsigned values.

    Ensure the syscall errors when the user passes in a negative value.

    Signed-off-by: Matthew Leach <matthew.leach@arm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 711d9170450f00ac8e5c3467948900d124993fe0
Author: Peter Boström <peter.bostrom@netrounds.com>
Date:   Mon Mar 10 16:17:15 2014 +0100

    vlan: Set correct source MAC address with TX VLAN offload enabled

    [ Upstream commit dd38743b4cc2f86be250eaf156cf113ba3dd531a ]

    With TX VLAN offload enabled the source MAC address for frames sent using the
    VLAN interface is currently set to the address of the real interface. This is
    wrong since the VLAN interface may be configured with a different address.

    The bug was introduced in commit 2205369a314e12fcec4781cc73ac9c08fc2b47de
    ("vlan: Fix header ops passthru when doing TX VLAN offload.").

    This patch sets the source address before calling the create function of the
    real interface.

    Signed-off-by: Peter Boström <peter.bostrom@netrounds.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c3363b2d9eb62338b918426a080fa554c5323c7f
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Thu Mar 6 17:51:57 2014 +0100

    ipv6: don't set DST_NOCOUNT for remotely added routes

    [ Upstream commit c88507fbad8055297c1d1e21e599f46960cbee39 ]

    DST_NOCOUNT should only be used if an authorized user adds routes
    locally. In case of routes which are added on behalf of router
    advertisments this flag must not get used as it allows an unlimited
    number of routes getting added remotely.

    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7fc329bf09d772a91a774fdedb039a0f8cf583d
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Mar 25 18:42:27 2014 -0700

    net: unix: non blocking recvmsg() should not return -EINTR

    [ Upstream commit de1443916791d75fdd26becb116898277bb0273f ]

    Some applications didn't expect recvmsg() on a non blocking socket
    could return -EINTR. This possibility was added as a side effect
    of commit b3ca9b02b00704 ("net: fix multithreaded signal handling in
    unix recv routines").

    To hit this bug, you need to be a bit unlucky, as the u->readlock
    mutex is usually held for very small periods.

    Fixes: b3ca9b02b00704 ("net: fix multithreaded signal handling in unix recv routines")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Rainer Weikusat <rweikusat@mobileactivedefense.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 098c9960de5f0c682f1cdddfe51648d4232a952d
Author: Linus Lüssing <linus.luessing@web.de>
Date:   Tue Mar 4 03:57:35 2014 +0100

    bridge: multicast: add sanity check for query source addresses

    [ Upstream commit 6565b9eeef194afbb3beec80d6dd2447f4091f8c ]

    MLD queries are supposed to have an IPv6 link-local source address
    according to RFC2710, section 4 and RFC3810, section 5.1.14. This patch
    adds a sanity check to ignore such broken MLD queries.

    Without this check, such malformed MLD queries can result in a
    denial of service: The queries are ignored by any MLD listener
    therefore they will not respond with an MLD report. However,
    without this patch these malformed MLD queries would enable the
    snooping part in the bridge code, potentially shutting down the
    according ports towards these hosts for multicast traffic as the
    bridge did not learn about these listeners.

    Reported-by: Jan Stancek <jstancek@redhat.com>
    Signed-off-by: Linus Lüssing <linus.luessing@web.de>
    Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 978a9b75b98d918e757eac01d0008fd30252e3bf
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Tue Mar 4 16:35:51 2014 +0100

    net: sctp: fix skb leakage in COOKIE ECHO path of chunk->auth_chunk

    [ Upstream commit c485658bae87faccd7aed540fd2ca3ab37992310 ]

    While working on ec0223ec48a9 ("net: sctp: fix sctp_sf_do_5_1D_ce to
    verify if we/peer is AUTH capable"), we noticed that there's a skb
    memory leakage in the error path.

    Running the same reproducer as in ec0223ec48a9 and by unconditionally
    jumping to the error label (to simulate an error condition) in
    sctp_sf_do_5_1D_ce() receive path lets kmemleak detector bark about
    the unfreed chunk->auth_chunk skb clone:

    Unreferenced object 0xffff8800b8f3a000 (size 256):
      comm "softirq", pid 0, jiffies 4294769856 (age 110.757s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        89 ab 75 5e d4 01 58 13 00 00 00 00 00 00 00 00  ..u^..X.........
      backtrace:
        [<ffffffff816660be>] kmemleak_alloc+0x4e/0xb0
        [<ffffffff8119f328>] kmem_cache_alloc+0xc8/0x210
        [<ffffffff81566929>] skb_clone+0x49/0xb0
        [<ffffffffa0467459>] sctp_endpoint_bh_rcv+0x1d9/0x230 [sctp]
        [<ffffffffa046fdbc>] sctp_inq_push+0x4c/0x70 [sctp]
        [<ffffffffa047e8de>] sctp_rcv+0x82e/0x9a0 [sctp]
        [<ffffffff815abd38>] ip_local_deliver_finish+0xa8/0x210
        [<ffffffff815a64af>] nf_reinject+0xbf/0x180
        [<ffffffffa04b4762>] nfqnl_recv_verdict+0x1d2/0x2b0 [nfnetlink_queue]
        [<ffffffffa04aa40b>] nfnetlink_rcv_msg+0x14b/0x250 [nfnetlink]
        [<ffffffff815a3269>] netlink_rcv_skb+0xa9/0xc0
        [<ffffffffa04aa7cf>] nfnetlink_rcv+0x23f/0x408 [nfnetlink]
        [<ffffffff815a2bd8>] netlink_unicast+0x168/0x250
        [<ffffffff815a2fa1>] netlink_sendmsg+0x2e1/0x3f0
        [<ffffffff8155cc6b>] sock_sendmsg+0x8b/0xc0
        [<ffffffff8155d449>] ___sys_sendmsg+0x369/0x380

    What happens is that commit bbd0d59809f9 clones the skb containing
    the AUTH chunk in sctp_endpoint_bh_rcv() when having the edge case
    that an endpoint requires COOKIE-ECHO chunks to be authenticated:

      ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
      <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
      ------------------ AUTH; COOKIE-ECHO ---------------->
      <-------------------- COOKIE-ACK ---------------------

    When we enter sctp_sf_do_5_1D_ce() and before we actually get to
    the point where we process (and subsequently free) a non-NULL
    chunk->auth_chunk, we could hit the "goto nomem_init" path from
    an error condition and thus leave the cloned skb around w/o
    freeing it.

    The fix is to centrally free such clones in sctp_chunk_destroy()
    handler that is invoked from sctp_chunk_free() after all refs have
    dropped; and also move both kfree_skb(chunk->auth_chunk) there,
    so that chunk->auth_chunk is either NULL (since sctp_chunkify()
    allocs new chunks through kmem_cache_zalloc()) or non-NULL with
    a valid skb pointer. chunk->skb and chunk->auth_chunk are the
    only skbs in the sctp_chunk structure that need to be handeled.

    While at it, we should use consume_skb() for both. It is the same
    as dev_kfree_skb() but more appropriately named as we are not
    a device but a protocol. Also, this effectively replaces the
    kfree_skb() from both invocations into consume_skb(). Functions
    are the same only that kfree_skb() assumes that the frame was
    being dropped after a failure (e.g. for tools like drop monitor),
    usage of consume_skb() seems more appropriate in function
    sctp_chunk_destroy() though.

    Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Cc: Vlad Yasevich <yasevich@gmail.com>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90a1f03242a7540860ae2ce0df2f6d69a9cb3af0
Merge: b58fb8e 43af48a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Apr 26 02:36:19 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 43af48aaadb5c3fd3b3e1f9b232ff0c770d4c184
Merge: b58fb8e d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 25 22:32:53 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit 0698aed248a82ced8528baa2332bcbb89fceb1eb
Author: jt1134 <jt1134@gmail.com>
Date:   Fri Apr 25 17:25:45 2014 -0500

    board-apexq-camera: enable high brightness mode for expressatt

    Change-Id: I07de8173f358e07f9d19df45361b55561eb6f8bc

commit b58fb8e56c30fcb06dad306770ed0b97f32ef108
Merge: b1d8de8 fdddd5f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 25 13:27:20 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 2dc5493cbbbdb3176a5cf76cd41532bafd9b953f
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Apr 24 02:28:50 2014 -0400

    Resync bluetooth with caf

    Change-Id: Ib3e56d7c41c02e6e0a5645b403178ca84c9cf76d

commit 2b9d459a2be276d7cc17a2f759506543a75952c6
Author: JP Abgrall <jpa@google.com>
Date:   Thu Apr 24 15:50:33 2014 -0700

    net: ipv4: current group_info should be put after using.

    Plug a group_info refcount leak in ping_init.
    group_info is only needed during initialization and
    the code failed to release the reference on exit.
    While here move grabbing the reference to a place
    where it is actually needed.

    Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
    Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
    Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

    Conflicts:
    	net/ipv4/ping.c

    Change-Id: I51931e439cce7f19b4179f5828d7355bb3b1dcfa

commit 5c5f2e0d276e9dc926b3b415db49f477d102119a
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Thu Apr 24 14:11:08 2014 -0700

    nf: Remove compilation error caused by
    e254d2c28c880da28626af6d53b7add5f7d6afee

    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit fdddd5fc2ace28ac4f5cd4290c4a82f67d366eb2
Merge: b1d8de8 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 25 08:29:52 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit b1d8de85221be87876c9c927c39bfaca71d18ed8
Merge: a190b5a 45ac048
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 25 01:42:21 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 45ac0483c27fe8bf87fbdd819b6badcea7849366
Merge: a190b5a d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 20:14:27 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit a190b5aaed6569e4479d7d6e53cf6fe866da03e0
Merge: e3f9bfa 3936b04
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 20:03:14 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 3936b0417710b0eb045bdc178e8949a2503b8e77
Merge: e3f9bfa d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 15:53:42 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit e3f9bfa51d15cbca66654f2c94060f61b135d433
Merge: 2cbabb8 89355e4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 15:42:29 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 89355e4d56198be9647388735ea0a14e42a4a3c2
Merge: 2cbabb8 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 11:36:36 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit 2cbabb8e77cefc4e580edf318ac56c2408fc2121
Merge: b981569 653322a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 11:25:24 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 653322ad708752b62c8dde729e0afe2ed0de19f7
Merge: b981569 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 24 06:45:27 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit b981569778223a2f6566895cf0e1f57acfd2998e
Merge: b1e1df5 c5c750b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 21:32:05 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 6d7647f764621e68c3b63d80803764a3ca01cb28
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Apr 23 21:15:50 2014 -0400

    staging: prima: squash update from caf

    No version bump????

    Change-Id: I7449b62f55dd76f832bcce8a5290a3303644ae7c

commit 98572c0283dd8c2c8497e12a364201bdb9bf5068
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Tue Mar 25 16:43:28 2014 -0700

    nf: IDLETIMER: time-stamp and suspend/resume handling.

    Message notifications contains an additional timestamp field in nano seconds.
    The expiry time for the timers are modified during suspend/resume.
    If timer was supposed to expire while the system is suspended then a
    notification is sent when it resumes with the timestamp of the scheduled expiry.

    Removes the race condition for multiple work scheduled.

    Bug: 13247811

    Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff
    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit 00118e082614511453f89289b515a305fe8c6fb0
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Fri Apr 18 14:07:28 2014 -0700

    prctl: adds PR_SET_TIMERSLACK_PID for setting timer slack of an arbitrary thread.

    Second argument is similar to PR_SET_TIMERSLACK, if non-zero then the
    slack is set to that value otherwise sets it to the default for the thread.

    Takes PID of the thread as the third argument.

    This allows power/performance management software to set timer slack for
    other threads according to its policy for the thread (such as when the
    thread is designated foreground vs. background activity)

    Change-Id: I744d451ff4e60dae69f38f53948ff36c51c14a3f
    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit e60819af028594bbd4ffe13e1ef6c6408c9f88c5
Merge: 71ce544 9660cc5
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Apr 23 21:06:10 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	arch/arm/boot/compressed/Makefile
    	arch/arm/boot/compressed/head.S
    	drivers/media/dvb/dvb-core/dmxdev.c
    	drivers/usb/core/driver.c
    	drivers/usb/host/xhci-hub.c
    	drivers/usb/serial/qcserial.c

    Change-Id: Ic7250924ba45d65ed0622a55b1206aaed658c820

commit 71ce5444e10de8c24f472f945b63141e7fa6b361
Merge: 3cf72c9 28dc39e
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Apr 23 20:26:46 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Change-Id: I09e4d5531c810c1609ef82bc808cf25146ffa3c9

commit c5c750b44ba4000a77f74c4b0434dfe0edf9ed23
Merge: b1e1df5 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 17:19:51 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit b1e1df5b3f16123d4fb5b754f57f235176c511e2
Merge: 8d9c6b9 0a88748
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 17:07:21 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix GPU hang recovery logic"""

commit 0a88748c864944485ea7ccae5cc99da11d4cd8fb
Merge: 8d9c6b9 d433e6f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 12:56:40 2014 -0700

    Merge "Merge "msm: kgsl: Fix GPU hang recovery logic""

commit 8d9c6b9c0b4885b62f92efcd86a2382e53d6f9ee
Merge: 7b939d4 876970e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 12:46:03 2014 -0700

    Merge "Merge "Merge "genalloc: stop crashing the system when destroying a pool"""

commit 876970e7b7663d921f41dd471e3bea483269e48c
Merge: 7b939d4 7571f18
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 06:51:06 2014 -0700

    Merge "Merge "genalloc: stop crashing the system when destroying a pool""

commit d433e6fd564b3096092c3cf9029c6afb56edd923
Merge: 7571f18 de4c7ac
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 06:25:01 2014 -0700

    Merge "msm: kgsl: Fix GPU hang recovery logic"

commit 7571f18e0a1a01e6b6cf8485956c51e0ffa224c1
Merge: 04ca133 54541df
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 04:53:41 2014 -0700

    Merge "genalloc: stop crashing the system when destroying a pool"

commit 04ca133348d1d68beaecdcba6747fee78698906a
Merge: a2d7a17 7fa8415
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 04:53:39 2014 -0700

    Merge "genalloc: Correct nbytes calculation on long boundary"

commit a2d7a1720b9882c34ae57fac6451c9937da67e55
Merge: 77ed1c7 25b261a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 04:53:38 2014 -0700

    Merge "msm: kgsl: Reset VSC control registers"

commit 77ed1c71ba0815acb9e373ebba22176405bcb0ec
Merge: 0a81e91 b80da24
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 04:53:37 2014 -0700

    Merge "msm: kgsl: Increase IDLE_TIMEOUT for 2D core to 20secs"

commit 0a81e9189a4fdbacf0887608002aa12d740b2ac7
Merge: c63b779 d29899b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 04:53:35 2014 -0700

    Merge "msm: kgsl: Fix for panic in z180 postmortem dumps"

commit 7b939d42800ca60b1d9192931478b9f68d638782
Merge: 28dc39e f499490
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 23 02:03:59 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 9e4cf16350113547d1753772b5e28d1515010117
Author: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
Date:   Mon Apr 14 16:12:43 2014 +0530

    audio: Change to set the USB switch state correctly

     - Changes to set the USB switch after the stream is added and
    the card is registered with the sound core.

    Change-Id: I5ee4df25408f809051ac49c25662cebf283902b3
    Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>

commit 3cf72c9c7fc24ca289bc7837a40c64a356f6f07d
Author: Todd Poynor <toddpoynor@google.com>
Date:   Tue Jun 4 17:29:38 2013 -0700

    ashmem: avoid deadlock between read and mmap calls

    Avoid holding ashmem_mutex across code that can page fault.  Page faults
    grab the mmap_sem for the process, which are also held by mmap calls
    prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
    order of locking between the two can deadlock.

    The calls that can page fault are read() and the ASHMEM_SET_NAME and
    ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
    outside the ashmem_mutex.

    Bug: 9261835

    Conflicts:
    	drivers/staging/android/ashmem.c

    Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
    Signed-off-by: Todd Poynor <toddpoynor@google.com>
    Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

commit 95a100213e6021a9846dac136f51b3cd620d1bcd
Author: Shankar Brahadeeswaran <shankoo77@gmail.com>
Date:   Wed Feb 20 23:41:26 2013 +0530

    staging: android: ashmem: get_name,set_name not to hold ashmem_mutex

    Problem:
    There exists a path in ashmem driver that could lead to acquistion
    of mm->mmap_sem, ashmem_mutex in reverse order. This could lead
    to deadlock in the system.
    For Example, assume that mmap is called on a ashmem region
    in the context of a thread say T1.
     sys_mmap_pgoff (1. acquires mm->mmap_sem)
      |
       --> mmap_region
     	|
             ----> ashmem_mmap (2. acquires asmem_mutex)
     Now if there is a context switch after 1 and before 2,
     and if another thread T2 (that shares the mm struct) invokes an
     ioctl say ASHMEM_GET_NAME, this can lead to the following path

    ashmem_ioctl
      |
      -->get_name (3. acquires ashmem_mutex)
    	|
    	---> copy_to_user (4. acquires the mm->mmap_sem)
    Note that the copy_to_user could lead to a valid fault if no
    physical page is allocated yet for the user address passed.
    Now T1 has mmap_sem and is waiting for ashmem_mutex.
    and T2 has the ashmem_mutex and is waiting for mmap_sem
    Thus leading to deadlock.

    Solution:
    Do not call copy_to_user or copy_from_user while holding the
    ahsmem_mutex. Instead copy this to a local buffer that lives
    in the stack while holding this lock. This will maintain data
    integrity as well never reverse the lock order.

    Testing:
    Created a unit test case to reproduce the problem.
    Used the same to test this fix on kernel version 3.4.0
    Ported the same patch to 3.8

    Change-Id: Ia0f883e90107665981de485b41040a68db9a686e
    Signed-off-by: Shankar Brahadeeswaran <shankoo77@gmail.com>
    Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

commit 703009124578e74e8f6a0cfa19f67dbe54345d57
Author: Shankar Brahadeeswaran <shankoo77@gmail.com>
Date:   Wed Feb 20 23:41:26 2013 +0530

    Revert "ashmem: avoid deadlock between read and mmap calls"

    This reverts commit cd9c067039e5f1acf8cb2442e96ecac9ddd25c66.

commit f499490c52801f6770b594d290539831d516e827
Merge: 28dc39e c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 18:22:00 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 28dc39eff578c5b339b7da36ff0424795f4176a2
Merge: 1c0cfd1 5229cc2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 10:17:52 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 1d326d4a8458e655713dfa492455a283d3e05875
Merge: 8e82b87 7af37a2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 06:35:16 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.057 on remote branch"

commit 5229cc24f831b859b81c9ef9462af0bcba818f99
Merge: 1c0cfd1 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 05:48:13 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 1c0cfd16b348a2833f9c6300d1bbbd9ec5c2dcc6
Merge: b42665c cfd5418
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 05:32:29 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 7af37a26dfb8a3db4db4aa4c1fa881d961995e11
Merge: 8e82b87 fb64dab
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 05:36:26 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.057 on remote branch

    Change-Id: I586a8e1767f4c0ed4f0d92a83d95cc485fe3224f

commit cfd54182b8209b47c6d6614bbfffa5b63ba2f75f
Merge: b42665c c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 22 01:14:06 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit b42665c4677ea77e6aa97309f2466a3e283b7593
Merge: 8e82b87 86c5041
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 22:39:07 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit d42ff974604bf9c93caeb6dbe138ced93fd77298
Merge: d9e07b2 837aa9f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 21:11:36 2014 -0700

    Merge "msm: qdsp6v2: Increase max ports in APR"

commit af0c7abaa4a74756b5cfa41e84583ed893294cd0
Author: Arne Coucheron <arco68@gmail.com>
Date:   Mon Apr 21 23:34:30 2014 -0400

    msm: kgsl: cleanup mismerge

    Change-Id: I25a204ad2478b9bac698934ea667f51867876bbf

commit 6520c3f883890013f36de3576746380aef065f70
Author: Alok Chauhan <alokc@codeaurora.org>
Date:   Wed Sep 11 16:39:20 2013 +0530

    msm: msm_bus: send correct value to bw division function

    While calculating bw for existing client request
    sometimes it can go to negative if client unregisters
    or send request with lesser ab/ib values. Bus driver
    will divide bandwidth if interleaving enabled.

    Added a macro wrapper to handle negative bw values
    since the division utility function can't handle
    negative values

    CRs-Fixed: 521940
    Change-Id: Ic3a216b8efb535593fe02ad3228d71808d2e0f98
    Signed-off-by: Alok Chauhan <alokc@codeaurora.org>

commit 86c5041b92a19bb78de9f11591091e4af3319c22
Merge: 8e82b87 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 18:32:09 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 8e82b875a1ff521c831ff9089d476ebaacb0a50e
Merge: 3ef3cff 10c9e56
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 18:20:49 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 10c9e56f261da022355fb8ca051adf6683f1141e
Merge: 3ef3cff c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 14:14:59 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 3ef3cff022288daa62a54c35e3f02d0df81d148c
Merge: ad82a90 8919222
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 11:49:33 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 891922263e67b434317cd09cd4fd14f2e35fdd38
Merge: ad82a90 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 07:42:18 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit ad82a90fdf649254f6879bebcd1637b17b7b498a
Merge: 9d483c0 d65a2ae
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 05:17:48 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit d65a2aeb2c9f8a19bf99aacbb75ae7c92c40aaaf
Merge: 9d483c0 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 21 01:05:10 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 9d483c033da5bc3b96ae3cf05f4743babb42bf72
Merge: 4cc02d0 fd7a58f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 20 16:05:20 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit fd7a58f63df5352b1c6cfe5827f39a6480dfc3b3
Merge: 4cc02d0 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 20 11:48:17 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 4cc02d066fd90e27137cf2cfe29cee5ae2d22b25
Merge: 24404b2 e471fdc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 20 09:25:33 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit e471fdce4d9f6979931fbbb229fbbb26df18eb15
Merge: 24404b2 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 20 02:48:37 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 24404b290d1786e014ac3e4b03c12cb610dcbd56
Merge: aed429e 2285fc7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 20:28:06 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 2285fc7eb057b8b33808f603dfe4d6d78b3e133b
Merge: aed429e c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 16:14:09 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit aed429e788103edbceb0081f9b659294c1e1acec
Merge: a91aad9 a54ed2d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 16:03:15 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit a54ed2d0250c5b872ddc3a0a8b3997ebdcfda21c
Merge: a91aad9 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 11:32:54 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit a91aad96dd5321e925bb3ae3ab0973fd389cf87c
Merge: 685d4bd fb5e388
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 11:21:14 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit fb5e3882b0cb5ced6db0c204ecad721f0ab00f14
Merge: 685d4bd c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 18 06:44:55 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit c45d2ad4b85d127036e1998ca244da4935c6d629
Author: Tejun Heo <tj@kernel.org>
Date:   Fri Jul 13 22:16:45 2012 -0700

    workqueue: reimplement WQ_HIGHPRI using a separate worker_pool

    WQ_HIGHPRI was implemented by queueing highpri work items at the head
    of the global worklist.  Other than queueing at the head, they weren't
    handled differently; unfortunately, this could lead to execution
    latency of a few seconds on heavily loaded systems.

    Now that workqueue code has been updated to deal with multiple
    worker_pools per global_cwq, this patch reimplements WQ_HIGHPRI using
    a separate worker_pool.  NR_WORKER_POOLS is bumped to two and
    gcwq->pools[0] is used for normal pri work items and ->pools[1] for
    highpri.  Highpri workers get -20 nice level and has 'H' suffix in
    their names.  Note that this change increases the number of kworkers
    per cpu.

    POOL_HIGHPRI_PENDING, pool_determine_ins_pos() and highpri chain
    wakeup code in process_one_work() are no longer used and removed.

    This allows proper prioritization of highpri work items and removes
    high execution latency of highpri work items.

    v2: nr_running indexing bug in get_pool_nr_running() fixed.

    v3: Refreshed for the get_pool_nr_running() update in the previous
        patch.

    Change-Id: Id843c0a425f51f84083786fbf413d999d35771b7
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Josh Hunt <joshhunt00@gmail.com>
    LKML-Reference: <CAKA=qzaHqwZ8eqpLNFjxnO2fX-tgAOjmpvxgBFjv6dJeQaOW1w@mail.gmail.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: Fengguang Wu <fengguang.wu@intel.com>
    Git-commit: 3270476a6c0ce322354df8679652f060d66526dc
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit e87d14935c0b860993738ff17bc7cc0b41a9eb34
Author: Tejun Heo <tj@kernel.org>
Date:   Fri Jul 13 22:16:44 2012 -0700

    workqueue: introduce NR_WORKER_POOLS and for_each_worker_pool()

    Introduce NR_WORKER_POOLS and for_each_worker_pool() and convert code
    paths which need to manipulate all pools in a gcwq to use them.
    NR_WORKER_POOLS is currently one and for_each_worker_pool() iterates
    over only @gcwq->pool.

    Note that nr_running is per-pool property and converted to an array
    with NR_WORKER_POOLS elements and renamed to pool_nr_running.  Note
    that get_pool_nr_running() currently assumes 0 index.  The next patch
    will make use of non-zero index.

    The changes in this patch are mechanical and don't caues any
    functional difference.  This is to prepare for multiple pools per
    gcwq.

    v2: nr_running indexing bug in get_pool_nr_running() fixed.

    v3: Pointer to array is stupid.  Don't use it in get_pool_nr_running()
        as suggested by Linus.

    Change-Id: I46e9488601d764d25e4a6c707de129ab68f7064c
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: Fengguang Wu <fengguang.wu@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Git-commit: 4ce62e9e30cacc26885cab133ad1de358dd79f21
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit de4637a1c4059b04dab667ac3b9f1277b960584a
Author: Tejun Heo <tj@kernel.org>
Date:   Thu Jul 12 14:46:37 2012 -0700

    workqueue: separate out worker_pool flags

    GCWQ_MANAGE_WORKERS, GCWQ_MANAGING_WORKERS and GCWQ_HIGHPRI_PENDING
    are per-pool properties.  Add worker_pool->flags and make the above
    three flags per-pool flags.

    The changes in this patch are mechanical and don't caues any
    functional difference.  This is to prepare for multiple pools per
    gcwq.

    Change-Id: I1824fd1c509d8ac6b0619536621a22b15b316256
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Git-commit: 11ebea50dbc1ade5994b2c838a096078d4c02399
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 43370c6b1f8d12f59cf5787415f02a6ad838d046
Author: Tejun Heo <tj@kernel.org>
Date:   Thu Jul 12 14:46:37 2012 -0700

    workqueue: use @pool instead of @gcwq or @cpu where applicable

    Modify all functions which deal with per-pool properties to pass
    around @pool instead of @gcwq or @cpu.

    The changes in this patch are mechanical and don't caues any
    functional difference.  This is to prepare for multiple pools per
    gcwq.

    Change-Id: I4be6727e1cce6f9aa2a0057b96bdc725c84f1ea8
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Git-commit: 63d95a9150ee3bbd4117fcd609dee40313b454d9
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 32089f190ae5ee600cfb3e016bcf29e5b46ef714
Author: Tejun Heo <tj@kernel.org>
Date:   Thu Jul 12 14:46:37 2012 -0700

    workqueue: factor out worker_pool from global_cwq

    Move worklist and all worker management fields from global_cwq into
    the new struct worker_pool.  worker_pool points back to the containing
    gcwq.  worker and cpu_workqueue_struct are updated to point to
    worker_pool instead of gcwq too.

    This change is mechanical and doesn't introduce any functional
    difference other than rearranging of fields and an added level of
    indirection in some places.  This is to prepare for multiple pools per
    gcwq.

    v2: Comment typo fixes as suggested by Namhyung.

    Change-Id: Iefae84798c2af580f425b92ed79117935d99f21f
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Git-commit: bd7bdd43dcb81bb08240b9401b36a104f77dc135
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 546b99b80c08d08e6fd95d487f5d1ef996adcb04
Author: Tejun Heo <tj@kernel.org>
Date:   Thu Jul 12 14:46:37 2012 -0700

    workqueue: don't use WQ_HIGHPRI for unbound workqueues

    Unbound wqs aren't concurrency-managed and try to execute work items
    as soon as possible.  This is currently achieved by implicitly setting
    %WQ_HIGHPRI on all unbound workqueues; however, WQ_HIGHPRI
    implementation is about to be restructured and this usage won't be
    valid anymore.

    Add an explicit chain-wakeup path for unbound workqueues in
    process_one_work() instead of piggy backing on %WQ_HIGHPRI.

    Change-Id: Iecd17a9935ee28f856d8b726bb4c296762922bed
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Git-commit: 974271c485a4d8bb801decc616748f90aafb07ec
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit 2b4a0a0e11a2656146867f4c23ef7c0c263be30d
Author: Ruchi Kandoi <kandoiruchi@google.com>
Date:   Thu Apr 3 15:39:23 2014 -0700

    cpufreq: interactive: turn boost_pulse off on boost off

    Change-Id: I36fe217fa047d68ea90e78b12c7db4537ea8010b
    Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

commit ea8acfaace700ff850d774da8e296f02a64c02fc
Author: Badhri Jagan Sridharan <Badhri@google.com>
Date:   Fri Apr 4 19:41:59 2014 -0700

    cpufreq: interactive: restructure CPUFREQ_GOV_LIMITS

    The cpufreq_interactive_timer gets cancelled and rescheduled
    whenever the cpufreq_policy is changed. When the cpufreq policy is
    changed at a rate faster than the sampling_rate of the interactive
    governor, then the governor misses to change the target frequency
    for long duration. The patch removes the need of cancelling the
    timers when policy->min is changed.

    Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
    Change-Id: I7862f1c8022a3b98a890e7537f93d02010e86764

commit 8e7ff66a86920d06db760b77a64056964fa2c932
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Thu Jul 5 13:11:31 2012 +0100

    ARM: fix warning caused by wrongly typed arm_dma_limit

    arch/arm/mm/init.c: In function 'arm_memblock_init':
    arch/arm/mm/init.c:380: warning: comparison of distinct pointer types lacks a cast

    by fixing the typecast in its definition when DMA_ZONE is disabled.
    This was missed in 4986e5c7c (ARM: mm: fix type of the arm_dma_limit
    global variable).

    Change-Id: Id076f2bebe307609265afdd4229181d2004c5f9c
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>

commit 709596688d41c764800997ff0e4f9c1881712876
Author: Liam Mark <lmark@codeaurora.org>
Date:   Mon Mar 10 16:06:39 2014 -0700

    lowmemorykiller: Account for highmem during kswapd reclaim

    Currenlty most memory reclaim is done through kswapd.
    Since kswapd uses a gfp mask of GFP_KERNEL, and because
    the lowmemorykiller is zone aware, the lowmemorykiller will
    ignore highmem most of the time.
    This results in the lowmemorykiller being overly aggressive.

    The fix to this issue is to allow the lowmemorykiller to
    count highmem when being called by the kswapd if the lowmem
    watermarks are satisfied.

    Change-Id: I938644584f374763d10d429d835e74daa4854a38
    Signed-off-by: Liam Mark <lmark@codeaurora.org>

commit 191466269f6862d4c030ff369c9f6722ef2eb42d
Author: Mel Gorman <mgorman@suse.de>
Date:   Fri May 13 15:03:24 2011 +0100

    mm: vmscan: If kswapd has been running too long, allow it to sleep

    Under constant allocation pressure, kswapd can be in the situation where
    sleeping_prematurely() will always return true even if kswapd has been
    running a long time. Check if kswapd needs to be scheduled.

    Signed-off-by: Mel Gorman <mgorman@suse.de>

commit 705071b1b96d2aadc492ada34eaf75bc54a068bb
Author: Mel Gorman <mgorman@suse.de>
Date:   Wed May 11 16:29:33 2011 +0100

    mm: slub: Default slub_max_order to 0

    To avoid locking and per-cpu overhead, SLUB optimisically uses
    high-order allocations up to order-3 by default and falls back to
    lower allocations if they fail. While care is taken that the caller
    and kswapd take no unusual steps in response to this, there are
    further consequences like shrinkers who have to free more objects to
    release any memory. There is anecdotal evidence that significant time
    is being spent looping in shrinkers with insufficient progress being
    made (https://lkml.org/lkml/2011/4/28/361) and keeping kswapd awake.

    SLUB is now the default allocator and some bug reports have been
    pinned down to SLUB using high orders during operations like
    copying large amounts of data. SLUBs use of high-orders benefits
    applications that are sized to memory appropriately but this does not
    necessarily apply to large file servers or desktops.  This patch
    causes SLUB to use order-0 pages like SLAB does by default.
    There is further evidence that this keeps kswapd's usage lower
    (https://lkml.org/lkml/2011/5/10/383).

    Signed-off-by: Mel Gorman <mgorman@suse.de>

commit 1907f112035e93c1ce92a6722150c6289f5a74b6
Author: xiaobing tu <xiaobing.tu@intel.com>
Date:   Sun Dec 9 19:19:23 2012 +0100

    deadline: Allow 0ms deadline latency, increase the read speed

    Change a timer compare from after to after-equals, thus allowing
    0 timeout and making deadline schedule FIFO.

    Signed-off-by: xiaobing tu <xiaobing.tu@intel.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

commit 02f7e82529df22a2c82adc2b58fe44f29c0ad9a1
Author: Mike Galbraith <bitbucket@online.de>
Date:   Mon Jan 28 11:19:25 2013 +0000

    sched: Fix select_idle_sibling() bouncing cow syndrome

    If the previous CPU is cache affine and idle, select it.

    The current implementation simply traverses the sd_llc domain,
    taking the first idle CPU encountered, which walks buddy pairs
    hand in hand over the package, inflicting excruciating pain.

    1 tbench pair (worst case) in a 10 core + SMT package:

      pre   15.22 MB/sec 1 procs
      post 252.01 MB/sec 1 procs

    Signed-off-by: Mike Galbraith <bitbucket@online.de>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/r/1359371965.5783.127.camel@marge.simpson.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>

commit 685d4bd5b2dcf56e9433e3f2122b22199f74f910
Merge: b480686 1150ede
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 17:13:03 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 1150ede5881d16b31bcd43cdafd100fa28e0e4c1
Merge: b480686 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 13:17:23 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit b48068635cbe735b51a11a0de5c9d1fd3af19675
Merge: 913eb41 1c2ff44
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 13:05:43 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 1c2ff447a30e7a7b50b005a7458870158ea0e758
Merge: 913eb41 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 07:30:17 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 913eb418d3ccaf14dabc6a1295fe2854530621d6
Merge: ee65f36 f8632e5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 07:19:12 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit d9e07b2615455b938da3d30ab7d64d7643d04b6b
Merge: 356a836 1a608c2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 03:52:13 2014 -0700

    Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"

commit f8632e5c2b5c33cd7a9fcacd8b66a40697f285d8
Merge: ee65f36 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 02:43:34 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit ee65f361b6789aabef7c95e2a672a88f7634273e
Merge: 62d1511 d7fb8b3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 02:32:02 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 356a836d91f80ed5af7498c4c19417fae0d326ed
Merge: a26ee7b b787f2c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 17 01:18:51 2014 -0700

    Merge "ARM: fix executability of CMA mappings"

commit b787f2c20af08ea5e21d337453ac64eff5410277
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Mon Nov 25 12:01:03 2013 +0000

    ARM: fix executability of CMA mappings

    The CMA region was being marked executable:

    0xdc04e000-0xdc050000           8K     RW x      MEM/CACHED/WBRA
    0xdc060000-0xdc100000         640K     RW x      MEM/CACHED/WBRA
    0xdc4f5000-0xdc500000          44K     RW x      MEM/CACHED/WBRA
    0xdcce9000-0xe0000000       52316K     RW x      MEM/CACHED/WBRA

    This is mainly due to the badly worded MT_MEMORY_DMA_READY symbol, but
    there are also a few other places in dma-mapping which should be
    corrected to use the right constant.  Fix all these places:

    0xdc04e000-0xdc050000           8K     RW NX     MEM/CACHED/WBRA
    0xdc060000-0xdc100000         640K     RW NX     MEM/CACHED/WBRA
    0xdc280000-0xdc300000         512K     RW NX     MEM/CACHED/WBRA
    0xdc6fc000-0xe0000000       58384K     RW NX     MEM/CACHED/WBRA

    Change-Id: I044360a8f08b1a4ae3e3e9e623fb77af2b427c51
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Git-commit: 71b55663c5d0a6f8473045db1c8b376803780191
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [lauraa@codeaurora.org: Context fixups due to __dma_remap signature change]
    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

commit 1a608c2ec60fa964985d171ef1df3d6c50889efa
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Wed Oct 23 16:14:59 2013 +0100

    ARM: dma-mapping: don't allow DMA mappings to be marked executable

    DMA mapping permissions were being derived from pgprot_kernel directly
    without using PAGE_KERNEL.  This causes them to be marked with executable
    permission, which is not what we want.  Fix this.

    Change-Id: Ib40f59f3c569f82409943cf8f9a86a9869d922cc
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Git-commit: 0ea1ec713f04bdfac343c9702b21cd3a7c711826
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [lauraa@codeaurora.org: dropped functions not in older builds]
    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

commit d7fb8b32614b7118ac9900cc5dee4e868db62916
Merge: 62d1511 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 19:14:23 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 62d15113b97f55039bb0d3ae6677b7aec22d3a49
Merge: e85609d 48f1668
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 19:03:57 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 48f1668fd1f12d698c8116a369fc3c21b799da10
Merge: e85609d c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 14:37:05 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit e85609d57a17031b19d0573167fc75d7e0b45914
Merge: 3cb8fc5 abc494e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 14:26:08 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit abc494e5964d920d135b1c2c1cdc37c8fc3abbd7
Merge: 3cb8fc5 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 10:03:56 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit 3cb8fc563a98242d9a12b32218d1a0d7bb197f0f
Merge: cbe2b25 029b478
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 09:53:45 2014 -0700

    Merge "Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover"""

commit 029b4788f27ac808181f75b9795a61c204ed6ed6
Merge: cbe2b25 c63b779
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 04:47:50 2014 -0700

    Merge "Merge "ARM: mm: remove IPI broadcasting on ASID rollover""

commit c63b7792e4691a9f3e0d12fb216665bec103f410
Merge: 9899d92 1924763
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 16 00:28:18 2014 -0700

    Merge "ARM: mm: remove IPI broadcasting on ASID rollover"

commit cbe2b252e938d5200182f932bc9187a6a397f20c
Merge: 9b7c8d2 f55dbef
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 21:51:02 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit f55dbefeefa44d3ab98383fb32c6043ff198ee1d
Merge: 9b7c8d2 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 17:38:24 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 9b7c8d2c6d487b8a9be626a3f7c03a75cfb2bb9e
Merge: 39d39ba c51d0c4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 17:26:39 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit c51d0c4f25f6a2524cd6f309b3205d017b6ae804
Merge: 39d39ba 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 13:05:46 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 39d39ba5c6dd62d9baea910f1d99bc52c1c8ce13
Merge: 5bd66c7 3dc60e8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 11:00:47 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit 2c07a937f80e3a753326ecc8214c08dc2396aa3c
Author: Vijaya Kumar T M <vtmuni@codeaurora.org>
Date:   Tue Apr 15 18:12:45 2014 +0530

    msm: camera: Enable interrupts before returning during Invalid Image mode.

    Trinity fuzzling test node " /dev/msm_camera/config0 " detected this bug.
    Steps to reproduce:
    trinity -c ioctl -C 1 --dangerous -V /dev/msm_camera/config0
    trinity -c ioctl -C 1 --dangerous -V /dev/msm_camera/config1

    CRs-Fixed:649474
    Change-Id: I7bcc460a51d76f74e1b95044aae50817d0a08529
    Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>

commit 3dc60e8bb5f61d90638f59bd3df25f9c3339b5e4
Merge: 5bd66c7 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 05:05:40 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 5bd66c74ddc4f28ba03a257bc64faa8fbf6c5da4
Merge: 1df6081 78be7d9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 04:54:07 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit fb64dab5353a244d1a6043ce78d91ebff6d6c5db
Merge: 74c1594 3bd4ead
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 04:33:01 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.055 on remote branch"

commit 3bd4ead7c40ebe4c553cc152c9cf1d282933c25b
Merge: 74c1594 56aa751
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 04:29:41 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.055 on remote branch

    Change-Id: I20ff6bec5fd8093de519094f2fd4e28d00292fac

commit 78be7d9e53d82d0441ce6da6b7e2cf72a8bb228a
Merge: 1df6081 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 15 00:02:26 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 1df6081f2b05980a5bd203006e95589cc543bb62
Merge: 74c1594 d2bf14b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 23:50:29 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit d2bf14bbf2ef4f08b4d9ecbd35a3c1a048ccf6db
Merge: 74c1594 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 18:02:34 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 74c15946e6f62ff0ed61d9c26a87afd972096536
Merge: 6e38f66 a59e5ef
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 17:51:52 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit a59e5ef45df05a6b84aaf3cbe678bc492e72ec09
Merge: 6e38f66 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 10:45:16 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 6e38f66f8f1fbd6ec3a7e8588bc9fd8c56dbeb7e
Merge: af156c5 01657f8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 10:28:44 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit d29899b9fba6ef960ca9bb71f7e1f0e4cc7af0e4
Author: Gaurav Gagrani <ggagrani@codeaurora.org>
Date:   Tue Mar 25 19:37:37 2014 +0530

    msm: kgsl: Fix for panic in z180 postmortem dumps

    We were accessing z180 registers without holding
    device mutex. This change ensures that we hold the
    mutex before accessing z180's registers

    CRs-Fixed: 644283
    Change-Id: Ib6496c427fc6c9a3f97a6720adb80a390fe21b0d
    Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 9660cc51f80ab16b415b311f5f0ee8cdea496a7c
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Apr 14 06:45:17 2014 -0700

    Linux 3.4.87

commit 1436b3314b5582b5d370d276afacdfed9b8fbe99
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Wed Dec 11 19:39:19 2013 -0500

    powernow-k6: reorder frequencies

    commit 22c73795b101597051924556dce019385a1e2fa0 upstream.

    This patch reorders reported frequencies from the highest to the lowest,
    just like in other frequency drivers.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1acb634a8af5443c41141a02d710baa91d8ec82d
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Wed Dec 11 19:38:53 2013 -0500

    powernow-k6: correctly initialize default parameters

    commit d82b922a4acc1781d368aceac2f9da43b038cab2 upstream.

    The powernow-k6 driver used to read the initial multiplier from the
    powernow register. However, there is a problem with this:

    * If there was a frequency transition before, the multiplier read from the
      register corresponds to the current multiplier.
    * If there was no frequency transition since reset, the field in the
      register always reads as zero, regardless of the current multiplier that
      is set using switches on the mainboard and that the CPU is running at.

    The zero value corresponds to multiplier 4.5, so as a consequence, the
    powernow-k6 driver always assumes multiplier 4.5.

    For example, if we have 550MHz CPU with bus frequency 100MHz and
    multiplier 5.5, the powernow-k6 driver thinks that the multiplier is 4.5
    and bus frequency is 122MHz. The powernow-k6 driver then sets the
    multiplier to 4.5, underclocking the CPU to 450MHz, but reports the
    current frequency as 550MHz.

    There is no reliable way how to read the initial multiplier. I modified
    the driver so that it contains a table of known frequencies (based on
    parameters of existing CPUs and some common overclocking schemes) and sets
    the multiplier according to the frequency. If the frequency is unknown
    (because of unusual overclocking or underclocking), the user must supply
    the bus speed and maximum multiplier as module parameters.

    This patch should be backported to all stable kernels. If it doesn't
    apply cleanly, change it, or ask me to change it.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cccd0fd759fa4e1306173f5740cc4ba8566e1d65
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Wed Dec 11 19:38:32 2013 -0500

    powernow-k6: disable cache when changing frequency

    commit e20e1d0ac02308e2211306fc67abcd0b2668fb8b upstream.

    I found out that a system with k6-3+ processor is unstable during network
    server load. The system locks up or the network card stops receiving. The
    reason for the instability is the CPU frequency scaling.

    During frequency transition the processor is in "EPM Stop Grant" state.
    The documentation says that the processor doesn't respond to inquiry
    requests in this state. Consequently, coherency of processor caches and
    bus master devices is not maintained, causing the system instability.

    This patch flushes the cache during frequency transition. It fixes the
    instability.

    Other minor changes:
    * u64 invalue changed to unsigned long because the variable is 32-bit
    * move the logic to set the multiplier to a separate function
      powernow_k6_set_cpu_multiplier
    * preserve lower 5 bits of the powernow port instead of 4 (the voltage
      field has 5 bits)
    * mask interrupts when reading the multiplier, so that the port is not
      open during other activity (running other kernel code with the port open
      shouldn't cause any misbehavior, but we should better be safe and keep
      the port closed)

    This patch should be backported to all stable kernels. If it doesn't
    apply cleanly, change it, or ask me to change it.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c34cad873ff38096f8710ab318b486d4e40d4293
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Fri Oct 25 06:34:03 2013 -0300

    media: saa7164: fix return value check in saa7164_initdev()

    commit 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 upstream.

    In case of error, the function kthread_run() returns ERR_PTR()
    and never returns NULL. The NULL test in the return value check
    should be replaced with IS_ERR().

    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96ca9726343c0166dbdbe85c0d80a95c44a0c90a
Author: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date:   Wed Jul 3 16:17:34 2013 -0300

    media: hdpvr: fix iteration over uninitialized lists in hdpvr_probe()

    commit 2e923a0527ac439e135b9961e58d3acd876bba10 upstream.

    free_buff_list and rec_buff_list are initialized in the middle of hdpvr_probe(),
    but if something bad happens before that, error handling code calls hdpvr_delete(),
    which contains iteration over the lists (via hdpvr_free_buffers()).
    The patch moves the lists initialization to the beginning and by the way fixes
    goto label in error handling of registering videodev.
    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 092bc21ef043d7fb4515f54ccbd17d98a20e76fb
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Tue Mar 19 09:34:58 2013 -0300

    media: hdpvr: register the video node at the end of probe

    commit 280847b532433ffe7a22795f926327805a127162 upstream.

    Video nodes can be used at once after registration, so make sure the full
    initialization is done before registering them.

    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ef2f22482a5a89c8ddac55c79d81b26292e59bf
Author: Soeren Moch <smoch@web.de>
Date:   Wed Jun 5 21:26:23 2013 -0300

    media: dmxdev: remove dvb_ringbuffer_flush() on writer side

    commit 414abbd2cd4c2618895f02ed3a76ec6647281436 upstream.

    In dvb_ringbuffer lock-less synchronizationof reader and writer threads is done
    with separateread and write pointers. Sincedvb_ringbuffer_flush() modifies the
    read pointer, this function must not be called from the writer thread.
    This patch removes the dvb_ringbuffer_flush() calls in the dmxdev ringbuffer
    write functions, this fixes Oopses "Unable to handle kernel paging request"
    I could observe for the call chaindvb_demux_read ->dvb_dmxdev_buffer_read ->
    dvb_ringbuffer_read_user -> __copy_to_user (the reader side of the ringbuffer).
    The flush calls at the write side are not necessary anyway since ringbuffer_flush
    is also called in dvb_dmxdev_buffer_read() when an error condition is set in the
    ringbuffer.
    This patch should also be applied to stable kernels.

    Signed-off-by: Soeren Moch <smoch@web.de>
    Reviewed-by: Sakari Ailus <sakari.ailus@iki.fi>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 915b4b0510b5f483fd46db9154c8dc1ee9e38ddf
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Sun Dec 16 16:04:46 2012 -0300

    media: omap_vout: find_vma() needs ->mmap_sem held

    commit 55ee64b30a38d688232e5eb2860467dddc493573 upstream.

    Walking rbtree while it's modified is a Bad Idea(tm); besides,
    the result of find_vma() can be freed just as it's getting returned
    to caller.  Fortunately, it's easy to fix - just take ->mmap_sem a bit
    earlier (and don't bother with find_vma() at all if virtp >= PAGE_OFFSET -
    in that case we don't even look at its result).

    While we are at it, what prevents VIDIOC_PREPARE_BUF calling
    v4l_prepare_buf() -> (e.g) vb2_ioctl_prepare_buf() -> vb2_prepare_buf() ->
    __buf_prepare() -> __qbuf_userptr() -> vb2_vmalloc_get_userptr() -> find_vma(),
    AFAICS without having taken ->mmap_sem anywhere in process?  The code flow
    is bloody convoluted and depends on a bunch of things done by initialization,
    so I certainly might've missed something...

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Sakari Ailus <sakari.ailus@iki.fi>
    Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Cc: Archit Taneja <archit@ti.com>
    Cc: Prabhakar Lad <prabhakar.lad@ti.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ac871a8a93556bb96e6d11931c4568f60546c50f
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date:   Sat Nov 24 21:35:48 2012 -0300

    media: v4l: Reset subdev v4l2_dev field to NULL if registration fails

    commit 317efce991620adc589b3005b9baed433dcb2a56 upstream.

    When subdev registration fails the subdev v4l2_dev field is left to a
    non-NULL value. Later calls to v4l2_device_unregister_subdev() will
    consider the subdev as registered and will module_put() the subdev
    module without any matching module_get().
    Fix this by setting the subdev v4l2_dev field to NULL in
    v4l2_device_register_subdev() when the function fails.

    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2: adjust context, filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b8904da5aa472afbc86ba1a1c297c9bad21eb47
Author: Jacob Schloss <jacob.schloss@unlimitedautomata.com>
Date:   Sun Dec 9 20:18:25 2012 -0300

    media: gspca_kinect: add Kinect for Windows USB id

    commit 98fd485795db064d0885150e2c0c7f296d8fe06e upstream.

    Add the USB ID for the Kinect for Windows RGB camera so it can be used
    with the gspca_kinect driver.

    Signed-off-by: Jacob Schloss <jacob.schloss@unlimitedautomata.com>
    Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d4787e99c05d0084a3a7644d8e5c04711f28970
Author: Nithin Sujir <nsujir@broadcom.com>
Date:   Mon Jun 3 09:19:34 2013 +0000

    tg3: Add read dma workaround for 5720

    commit 9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 upstream.

    Commit 091f0ea30074bc43f9250961b3247af713024bc6 "tg3: Add New 5719 Read
    DMA workaround" added a workaround for TX DMA stall on the 5719. This
    workaround needs to be applied to the 5720 as well.

    Reported-by: Roland Dreier <roland@purestorage.com>
    Tested-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2: use GET_ASIC_REV() instead of tg3_asic_rev()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backproted to 3.4: Adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e6f42f742cb5973960a89c4e94197c6f95a238b
Author: Nithin Sujir <nsujir@broadcom.com>
Date:   Mon May 13 11:04:15 2013 +0000

    tg3: Skip powering down function 0 on certain serdes devices

    commit 44f3b503c16425c8e9db4bbaa2fc9cd0c9d0ba91 upstream.

    On the 5718, 5719 and 5720 serdes devices, powering down function 0
    results in all the other ports being powered down. Add code to skip
    function 0 power down.

    v2:
     - Modify tg3_phy_power_bug() function to use a switch instead of a
       complicated if statement. Suggested by Joe Perches.

    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2:
     s/tg3_asic_rev\(tp\)/GET_ASIC_REV(tp->pci_chip_rev_id)/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: Adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14a7213e5390cd3f2c0cc00bf4d8caf663479b8b
Author: Mauro Carvalho Chehab <mchehab@redhat.com>
Date:   Thu Sep 20 12:09:30 2012 -0300

    sb_edac: Avoid overflow errors at memory size calculation

    commit deb09ddaff1435f72dd598d38f9b58354c68a5ec upstream.

    Sandy bridge EDAC is calculating the memory size with overflow.
    Basically, the size field and the integer calculation is using 32 bits.
    More bits are needed, when the DIMM memories have high density.

    The net result is that memories are improperly reported there, when
    high-density DIMMs are used:

    EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 0, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800
    EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 1, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800

    As the number of pages value is handled at the EDAC core as unsigned
    ints, the driver shows the 16 GB memories at sysfs interface as 16760832
    MB! The fix is simple: calculate the number of pages as unsigned 64-bits
    integer.

    After the patch, the memory size (16 GB) is properly detected:

    EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 0, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800
    EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 1, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800

    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Debug log function is debugf0(), not edac_dbg()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 82d16b39266179ca80f6b81b4084631ade240219
Author: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Date:   Tue Jul 17 17:16:10 2012 +0300

    mmc: mxs-mmc: fix deadlock caused by recursion loop

    commit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream.

    Release the lock before mmc_signal_sdio_irq is called by
    mxs_mmc_enable_sdio_irq.

    Backtrace:
    [   65.470000] =============================================
    [   65.470000] [ INFO: possible recursive locking detected ]
    [   65.470000] 3.5.0-rc5 #2 Not tainted
    [   65.470000] ---------------------------------------------
    [   65.470000] ksdioirqd/mmc0/73 is trying to acquire lock:
    [   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
    [   65.470000]
    [   65.470000] but task is already holding lock:
    [   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
    [   65.470000]
    [   65.470000] other info that might help us debug this:
    [   65.470000]  Possible unsafe locking scenario:
    [   65.470000]
    [   65.470000]        CPU0
    [   65.470000]        ----
    [   65.470000]   lock(&(&host->lock)->rlock#2);
    [   65.470000]   lock(&(&host->lock)->rlock#2);
    [   65.470000]
    [   65.470000]  *** DEADLOCK ***
    [   65.470000]
    [   65.470000]  May be due to missing lock nesting notation
    [   65.470000]
    [   65.470000] 1 lock held by ksdioirqd/mmc0/73:
    [   65.470000]  #0:  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
    [   65.470000]
    [   65.470000] stack backtrace:
    [   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98)
    [   65.470000] [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98) from [<c005d3f8>] (lock_acquire+0xa0/0x108)
    [   65.470000] [<c005d3f8>] (lock_acquire+0xa0/0x108) from [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c)
    [   65.470000] [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
    [   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
    [   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
    [   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
    [   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
    [   65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73
    [   65.470000]  lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0
    [   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c01b46b0>] (do_raw_spin_lock+0x100/0x144)
    [   65.470000] [<c01b46b0>] (do_raw_spin_lock+0x100/0x144) from [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c)
    [   65.470000] [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
    [   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
    [   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
    [   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
    [   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)

    Reported-by: Attila Kinali <attila@kinali.ch>
    Signed-off-by: Lauri Hintsala <lauri.hintsala@bluegiga.com>
    Acked-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - HW_SSP_STATUS is a simple rather than function-like macro]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit faf100389a5479de77294b8ebe98ec4e775d6927
Author: Grazvydas Ignotas <notasas@gmail.com>
Date:   Tue Aug 21 09:09:48 2012 +0300

    OMAPFB: fix framebuffer console colors

    commit c1c52848cef52e157468b8879fc3cae23b6f3a99 upstream.

    omapfb does not currently set pseudo palette correctly for color depths
    above 16bpp, making red text invisible, command like
      echo -e '\e[0;31mRED' > /dev/tty1
    will display nothing on framebuffer console in 24bpp mode.
    This is because temporary variable is declared incorrectly, fix it.

    Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c81c26ff163b5ea3b5f9bb7d6314b263f52fdcd0
Author: Nithin Sujir <nsujir@broadcom.com>
Date:   Wed Jun 12 11:08:59 2013 -0700

    tg3: Wait for boot code to finish after power on

    commit df465abfe06f7dc4f33f4a96d17f096e9e8ac917 upstream.

    Some systems that don't need wake-on-lan may choose to power down the
    chip on system standby. Upon resume, the power on causes the boot code
    to startup and initialize the hardware. On one new platform, this is
    causing the device to go into a bad state due to a race between the
    driver and boot code, once every several hundred resumes. The same race
    exists on open since we come up from a power on.

    This patch adds a wait for boot code signature at the beginning of
    tg3_init_hw() which is common to both cases. If there has not been a
    power-off or the boot code has already completed, the signature will be
    present and poll_fw() returns immediately. Also return immediately if
    the device does not have firmware.

    Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 29632805c3970db57874ed668d95f7233add49ca
Author: Michael Chan <mchan@broadcom.com>
Date:   Sun Jul 29 19:15:43 2012 +0000

    tg3: Add New 5719 Read DMA workaround

    commit 091f0ea30074bc43f9250961b3247af713024bc6 upstream.

    After Power-on-reset, the 5719's TX DMA length registers may contain
    uninitialized values and cause TX DMA to stall.  Check for invalid
    values and set a register bit to flush the TX channels.  The bit
    needs to be turned off after the DMA channels have been flushed.

    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 57591712825e050d0c70cd0526492de4d5ad2905
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Dec 12 08:05:33 2013 +0100

    hwmon: Prevent some divide by zeros in FAN_TO_REG()

    commit 3806b45ba4655147a011df03242cc197ab986c43 upstream.

    The "rpm * div" operations can overflow here, so this patch adds an
    upper limit to rpm to prevent that.  Jean Delvare helped me with this
    patch.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Roger Lucas <vt8231@hiddenengine.co.uk>
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4b2585a85e92c43e7eba3eef30bc59ccadfe158
Author: Henrik Rydberg <rydberg@euromail.se>
Date:   Wed Oct 2 19:15:03 2013 +0200

    hwmon: (applesmc) Always read until end of data

    commit 25f2bd7f5add608c1d1405938f39c96927b275ca upstream.

    The crash reported and investigated in commit 5f4513 turned out to be
    caused by a change to the read interface on newer (2012) SMCs.

    Tests by Chris show that simply reading the data valid line is enough
    for the problem to go away. Additional tests show that the newer SMCs
    no longer wait for the number of requested bytes, but start sending
    data right away.  Apparently the number of bytes to read is no longer
    specified as before, but instead found out by reading until end of
    data. Failure to read until end of data confuses the state machine,
    which eventually causes the crash.

    As a remedy, assuming bit0 is the read valid line, make sure there is
    nothing more to read before leaving the read function.

    Tested to resolve the original problem, and runtested on MBA3,1,
    MBP4,1, MBP8,2, MBP10,1, MBP10,2. The patch seems to have no effect on
    machines before 2012.

    Tested-by: Chris Murphy <chris@cmurf.com>
    Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7aa8c170472be4ca4ac0ed65efb78fe758594cec
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Tue Oct 9 13:23:57 2012 -0700

    hwmon: (coretemp) Add support for Atom CE4110/4150/4170

    commit 1102dcab849313bd5a340b299b5cf61b518fbc0f upstream.

    TjMax for the CE4100 series of Atom CPUs was previously reported to be
    110 degrees C.

    cpuinfo logs on the web show existing CPU types CE4110, CE4150, and CE4170,
    reported as "model name : Intel(R) Atom(TM) CPU CE41{1|5|7}0 @ 1.{2|6}0GHz"
    with model 28 (0x1c) and stepping 10 (0x0a). Add the three known variants
    to the tjmax table.

    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Acked-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b428b89b7efdda0d073e9aad7f685a126bb3472d
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Sun Jun 17 18:05:05 2012 +0200

    hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs

    commit 41e58a1f2b90c88d94b4bd84beb9927a4c2704e9 upstream.

    Atom CPUs don't have a register to retrieve TjMax. Detection so far was
    incomplete. Use the X86 model ID to improve it.

    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2a3c5038975c58343fd199d6795e462818726350
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Sun Jun 17 18:05:05 2012 +0200

    hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU models

    commit 5592906f8b01282ea3c2acaf641fd067ad4bb3dc upstream.

    Document the Atom series D2000 and N2000 (Cedar Trail) as being supported.
    List and set TjMax for those series.

    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: "R, Durgadoss" <durgadoss.r@intel.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b32e4b1ae1207eb590e9dec2ace693b2577a9c68
Author: Jean Delvare <khali@linux-fr.org>
Date:   Sun Jun 17 18:05:05 2012 +0200

    hwmon: (coretemp) Improve support of recent Atom CPU models

    commit fcc14ac1a86931f38da047cf8fb634c6db7b58bc upstream.

    Document the new Atom series (Tunnel Creek and Medfield) as being
    supported, and list TjMax for the Atom E600 series.

    Also enable the Atom tjmax heuristic for these Atom CPU models.

    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Reviewed-by: Guenter Roeck <guenter.roeck@ericsson.com>
    Cc: Alexander Stein <alexander.stein@systec-electronic.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: "R, Durgadoss" <durgadoss.r@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d454e9e10c6445c1b653309627260cbf7d8e86aa
Author: Kailang Yang <kailang@realtek.com>
Date:   Tue Nov 26 15:17:50 2013 +0800

    ALSA: hda/realtek - Add support of ALC231 codec

    commit ba4c4d0a9021ab034554d532a98133d668b87599 upstream.

    It's compatible with ALC269.

    Signed-off-by: Kailang Yang <kailang@realtek.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 296d59e61f0da68c408a47d48d61bfcc6dbfe8c4
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Nov 14 15:45:12 2013 +0100

    ALSA: pcsp: Fix the order of input device unregistration

    commit 6408eac2665955343cd0e4bcd7d6237ce39611ed upstream.

    The current code may access to the already freed object.  The input
    device must be accessed and unregistered before freeing the top level
    sound object.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a8d5c053a4082f3681f2e3d509e90ac95a973f9c
Author: Anssi Hannula <anssi.hannula@iki.fi>
Date:   Sun Sep 1 14:36:47 2013 +0300

    ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA

    commit 18e391862cceaf43ddb8eb5cca05e1a83abdebaa upstream.

    hdmi_channel_allocation() tries to find a HDMI channel allocation that
    matches the number channels in the playback stream and contains only
    speakers that the HDMI sink has reported as available via EDID. If no
    such allocation is found, 0 (stereo audio) is used.

    Using CA 0 causes the audio causes the sink to discard everything except
    the first two channels (front left and front right).

    However, the sink may be capable of receiving more channels than it has
    speakers (and then perform downmix or discard the extra channels), in
    which case it is preferable to use a CA that contains extra channels
    than to use CA 0 which discards all the non-stereo channels.

    Additionally, it seems that HBR (HD) passthrough output does not work on
    Intel HDMI codecs when CA is set to 0 (possibly the codec zeroes
    channels not present in CA). This happens with all receivers that report
    a 5.1 speaker mask since a HBR stream is carried on 8 channels to the
    codec.

    Add a fallback in the CA selection so that the CA channel count at least
    matches the stream channel count, even if the stream contains channels
    not present in the sink speaker descriptor.

    Thanks to GrimGriefer at OpenELEC forums for discovering that changing
    the sink speaker mask allowed HBR output.

    Reported-by: GrimGriefer
    Reported-by: Ashecrow
    Reported-by: Frank Zafka <kafkaesque1978@gmail.com>
    Reported-by: Peter Frühberger <fritsch@xbmc.org>
    Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03017e73a1923f780be4033c73ab0377ab1f5447
Author: Torsten Schenk <torsten.schenk@zoho.com>
Date:   Sun Aug 11 11:11:35 2013 +0200

    ALSA: 6fire: make buffers DMA-able (midi)

    commit 4c2aee0032b70083dafebd733ed9c774633b2fa3 upstream.

    Patch makes midi output buffer DMA-able by allocating it separately.

    Signed-off-by: Torsten Schenk <torsten.schenk@zoho.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 825ca11070d84eba7fb0386996f9ce1e62b2e52e
Author: Torsten Schenk <torsten.schenk@zoho.com>
Date:   Sun Aug 11 11:11:19 2013 +0200

    ALSA: 6fire: make buffers DMA-able (pcm)

    commit 5ece263f1d93fba8d992e67e3ab8a71acf674db9 upstream.

    Patch makes pcm buffers DMA-able by allocating each one separately.

    Signed-off-by: Torsten Schenk <torsten.schenk@zoho.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a204372b13b39d840c95e5f7cc32a27a4f31b722
Author: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Date:   Tue Aug 6 14:53:24 2013 +0300

    ALSA: 6fire: fix DMA issues with URB transfer_buffer usage

    commit ddb6b5a964371e8e52e696b2b258bda144c8bd3f upstream.

    Patch fixes 6fire not to use stack as URB transfer_buffer. URB buffers need to
    be DMA-able, which stack is not. Furthermore, transfer_buffer should not be
    allocated as part of larger device structure because DMA coherency issues and
    patch fixes this issue too.

    Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
    Tested-by: Torsten Schenk <torsten.schenk@zoho.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c97105259b2691d182e53c854d9024e3740e75db
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Jun 26 10:52:20 2013 +0300

    ALSA: ak4xx-adda: info leak in ak4xxx_capture_source_info()

    commit bd5fe738e388ceaa32e5171481e0d3ec59f0ccfe upstream.

    "idx" is controled by the user and can be a negative offset into the
    input_names[] array.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 775a5ddce6018428fd8143d519b9114a86fa4b60
Author: Torstein Hegge <hegge@resisty.net>
Date:   Tue Mar 19 17:12:14 2013 +0100

    ALSA: usb: Parse UAC2 extension unit like for UAC1

    commit 61ac51301e6c6d4ed977d7674ce2b8e713619a9b upstream.

    UAC2_EXTENSION_UNIT_V2 differs from UAC1_EXTENSION_UNIT, but can be handled in
    the same way when parsing the unit. Otherwise parse_audio_unit() fails when it
    sees an extension unit on a UAC2 device.

    UAC2_EXTENSION_UNIT_V2 is outside the range allocated by UAC1.

    Signed-off-by: Torstein Hegge <hegge@resisty.net>
    Acked-by: Daniel Mack <zonque@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d47b372591bb5e87f6534b3d66cf7d029eed237f
Author: Eldad Zack <eldad@fogrefinery.com>
Date:   Wed Nov 28 23:55:36 2012 +0100

    ALSA: usb-audio: skip UAC2 EFFECT_UNIT

    commit 5dae5fd24071319bb67d3375217d5b0b6d16cb0b upstream.

    Current code mishandles the case where the device is a UAC2
    and the bDescriptorSubtype is a UAC2 Effect Unit (0x07).
    It tries to parse it as a Processing Unit (which is similar to two
    other UAC1 units with overlapping subtypes), but since the structure
    is different (See: 4.7.2.10, 4.7.2.11 in UAC2 standard), the parsing
    is done incorrectly and prevents the device from initializing.
    For now, just ignore the unit.

    Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff15138a16c56ff43adeea27f90d46f59b69dcfd
Author: Aaron Plattner <aplattner@nvidia.com>
Date:   Fri Jul 12 11:01:37 2013 -0700

    ALSA: hda - Add another GPU codec ID to snd-hda

    commit d52392b1a80458c0510810789c7db4a39b88022a upstream.

    Vendor ID 0x10de0060 is used by a yet-to-be-named GPU chip.

    Reviewed-by: Andy Ritger <aritger@nvidia.com>
    Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6f06d395828bbb4e27c4840368ff90956f2b5a42
Author: Aaron Plattner <aplattner@nvidia.com>
Date:   Mon Jul 16 17:10:04 2012 -0700

    ALSA: hda - Add new GPU codec ID to snd-hda

    commit 7ae48b56f8d9c836259bc02f3e2ea4962d6b5d1b upstream.

    Vendor ID 0x10de0051 is used by a yet-to-be-named GPU chip.

    Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
    Acked-by: Andy Ritger <aritger@nvidia.com>
    Reviewed-by: Daniel Dadap <ddadap@nvidia.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea76e8cc60034f984bedadb36d739a5f74b176a2
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Jun 18 16:14:22 2013 +0200

    ALSA: hda - Cache the MUX selection for generic HDMI

    commit bddee96b5d0db869f47b195fe48c614ca824203c upstream.

    When a selection to a converter MUX is changed in hdmi_pcm_open(), it
    should be cached so that the given connection can be restored properly
    at PM resume.  We need just to replace the corresponding
    snd_hda_codec_write() call with snd_hda_codec_write_cache().

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ace626985cb753d998f92d872df4b6d8573ab368
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 9 14:53:36 2013 +0100

    xhci: Limit the spurious wakeup fix only to HP machines

    commit 6962d914f317b119e0db7189199b21ec77a4b3e0 upstream.

    We've got regression reports that my previous fix for spurious wakeups
    after S5 on HP Haswell machines leads to the automatic reboot at
    shutdown on some machines.  It turned out that the fix for one side
    triggers another BIOS bug in other side.  So, it's exclusive.

    Since the original S5 wakeups have been confirmed only on HP machines,
    it'd be safer to apply it only to limited machines.  As a wild guess,
    limiting to machines with HP PCI SSID should suffice.

    This patch should be backported to kernels as old as 3.12, that
    contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016 "xhci: Fix
    spurious wakeups after S5 on Haswell".

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Tested-by: <dashing.meng@gmail.com>
    Reported-by: Niklas Schnelle <niklas@komani.de>
    Reported-by: Giorgos <ganastasiouGR@gmail.com>
    Reported-by: <art1@vhex.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 630b5e0d7bb7f50234b82ab88f7a8427aae64bed
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Sep 12 08:11:06 2013 +0200

    xhci: Fix spurious wakeups after S5 on Haswell

    commit 638298dc66ea36623dbc2757a24fc2c4ab41b016 upstream.

    Haswell LynxPoint and LynxPoint-LP with the recent Intel BIOS show
    mysterious wakeups after shutdown occasionally.  After discussing with
    BIOS engineers, they explained that the new BIOS expects that the
    wakeup sources are cleared and set to D3 for all wakeup devices when
    the system is going to sleep or power off, but the current xhci driver
    doesn't do this properly (partly intentionally).

    This patch introduces a new quirk, XHCI_SPURIOUS_WAKEUP, for
    fixing the spurious wakeups at S5 by calling xhci_reset() in the xhci
    shutdown ops as done in xhci_stop(), and setting the device to PCI D3
    at shutdown and remove ops.

    The PCI D3 call is based on the initial fix patch by Oliver Neukum.

    [Note: Sarah changed the quirk name from XHCI_HSW_SPURIOUS_WAKEUP to
    XHCI_SPURIOUS_WAKEUP, since none of the other quirks have system names
    in them.  Sarah also fixed a collision with a quirk submitted around the
    same time, by changing the xhci->quirks bit from 17 to 18.]

    This patch should be backported to kernels as old as 3.0, that
    contain the commit 1c12443ab8eba71a658fae4572147e56d1f84f66 "xhci: Add
    Lynx Point to list of Intel switchable hosts."

    Cc: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4330c73f4e2cb8bf2755ea850f4a34569535a9a
Author: Oliver Neukum <oneukum@suse.de>
Date:   Mon Sep 30 15:50:54 2013 +0200

    xhci: quirk for extra long delay for S4

    commit 455f58925247e8a1a1941e159f3636ad6ee4c90b upstream.

    It has been reported that this chipset really cannot
    sleep without this extraordinary delay.

    This patch should be backported, in order to ensure this host functions
    under stable kernels.  The last quirk for Fresco Logic hosts (commit
    bba18e33f25072ebf70fd8f7f0cdbf8cdb59a746 "xhci: Extend Fresco Logic MSI
    quirk.") was backported to stable kernels as old as 2.6.36.

    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Use xhci_dbg() instead of xhci_dbg_trace()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yangyl: Backported to 3.4: Adjust context]
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da02a12066a280b546c71a492f47a7776e2b1d10
Author: Julius Werner <jwerner@chromium.org>
Date:   Tue Oct 15 17:45:00 2013 -0700

    usb: hub: Clear Port Reset Change during init/resume

    commit e92aee330837e4911553761490a8fb843f2053a6 upstream.

    This patch adds the Port Reset Change flag to the set of bits that are
    preemptively cleared on init/resume of a hub. In theory this bit should
    never be set unexpectedly... in practice it can still happen if BIOS,
    SMM or ACPI code plays around with USB devices without cleaning up
    correctly. This is especially dangerous for XHCI root hubs, which don't
    generate any more Port Status Change Events until all change bits are
    cleared, so this is a good precaution to have (similar to how it's
    already done for the Warm Port Reset Change flag).

    Signed-off-by: Julius Werner <jwerner@chromium.org>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - s/usb_clear_port_feature/clear_port_feature/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yangyl: Backported to 3.4: Adjust context]
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fd2b471b5f13822cfcd3138f292a23962418a87
Author: James Ralston <james.d.ralston@intel.com>
Date:   Mon Nov 4 09:24:58 2013 -0800

    ahci: Add Device IDs for Intel Wildcat Point-LP

    commit 9f961a5f6efc87a79571d7166257b36af28ffcfe upstream.

    This patch adds the AHCI-mode SATA Device IDs for the Intel Wildcat Point-LP PCH.

    Signed-off-by: James Ralston <james.d.ralston@intel.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4af001a0d18b0f336e1d16b1bdb2c3f46d3d124f
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Mon Aug 5 13:36:00 2013 -0700

    xhci: Don't enable/disable RWE on bus suspend/resume.

    commit f217c980ca980e3a645b7485ea5eae9a747f4945 upstream.

    The RWE bit of the USB 2.0 PORTPMSC register is supposed to enable
    remote wakeup for devices in the lower power link state L1.  It has
    nothing to do with the device suspend remote wakeup from L2.  The RWE
    bit is designed to be set once (when USB 2.0 LPM is enabled for the
    port) and cleared only when USB 2.0 LPM is disabled for the port.

    The xHCI bus suspend method was setting the RWE bit erroneously, and the
    bus resume method was clearing it.  The xHCI 1.0 specification with
    errata up to Aug 12, 2012 says in section 4.23.5.1.1.1 "Hardware
    Controlled LPM":

    "While Hardware USB2 LPM is enabled, software shall not modify the
    HIRDBESL or RWE fields of the USB2 PORTPMSC register..."

    If we have previously enabled USB 2.0 LPM for a device, that means when
    the USB 2.0 bus is resumed, we violate the xHCI specification by
    clearing RWE.  It also means that after a bus resume, the host would
    think remote wakeup is disabled from L1 for ports with USB 2.0 Link PM
    enabled, which is not what we want.

    This patch should be backported to kernels as old as 3.2, that
    contain the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set
    USB2 hardware LPM".  That was the first kernel that supported USB 2.0
    Link PM.

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    [bwh: Backported to 3.2: deleted code was cosmetically different]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86726b075298b4fe4874017d65e801b7b0735438
Author: Seth Heasley <seth.heasley@intel.com>
Date:   Wed Jun 19 16:36:45 2013 -0700

    ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs

    commit 1cfc7df3de10c40ed459e13cce6de616023bf41c upstream.

    This patch adds the AHCI-mode SATA DeviceIDs for the Intel Coleto Creek PCH.

    Signed-off-by: Seth Heasley <seth.heasley@intel.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 72c84d5151850dd71dc9fb867b87d84b48c0da0d
Author: James Ralston <james.d.ralston@intel.com>
Date:   Fri Feb 8 17:34:47 2013 -0800

    ahci: Add Device IDs for Intel Wellsburg PCH

    commit 151743fd8dfb02956c5184b5f4f0f42677eb75bc upstream.

    This patch adds the AHCI-mode SATA Device IDs for the Intel Wellsburg PCH

    Signed-off-by: James Ralston <james.d.ralston@intel.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5b22446b082b697d75bda3453e7b3db7820be80
Author: Colin Leitner <colin.leitner@googlemail.com>
Date:   Tue Nov 5 18:02:34 2013 +0100

    USB: ftdi_sio: fixed handling of unsupported CSIZE setting

    commit 8704211f65a2106ba01b6ac9727cdaf9ca11594c upstream.

    FTDI UARTs support only 7 or 8 data bits. Until now the ftdi_sio driver would
    only report this limitation for CS6 to dmesg and fail to reflect this fact to
    tcgetattr.

    This patch reverts the unsupported CSIZE setting and reports the fact with less
    severance to dmesg for both CS5 and CS6.

    To test the patch it's sufficient to call

        stty -F /dev/ttyUSB0 cs5

    which will succeed without the patch and report an error with the patch
    applied.

    As an additional fix this patch ensures that the control request will always
    include a data bit size.

    Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2:
     - Old code is cosmetically different
     - s/ddev/\&port->dev/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e157f561e1c1bcf61768b5a57195539d2d549e46
Author: Thomas Pugliese <thomas.pugliese@gmail.com>
Date:   Wed Oct 23 14:44:29 2013 -0500

    usb: wusbcore: change WA_SEGS_MAX to a legal value

    commit f74b75e7f920c700636cccca669c7d16d12e9202 upstream.

    change WA_SEGS_MAX to a number that is legal according to the WUSB
    spec.

    Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bec174d1d20ae54ab697b7b8623e2d6f4fd934e4
Author: Thomas Pugliese <thomas.pugliese@gmail.com>
Date:   Wed Oct 23 14:44:26 2013 -0500

    usb: wusbcore: set the RPIPE wMaxPacketSize value correctly

    commit 7b6bc07ab554e929c85d51b3d5b26cf7f12c6a3b upstream.

    For isochronous endpoints, set the RPIPE wMaxPacketSize value using
    wOverTheAirPacketSize from the endpoint companion descriptor instead of
    wMaxPacketSize from the normal endpoint descriptor.

    Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 080d2258d7ebdb0c8fee29e543d1f5a268879bc6
Author: David Cohen <david.a.cohen@linux.intel.com>
Date:   Thu Sep 26 13:01:44 2013 -0700

    usb: dwc3: add support for Merrifield

    commit 85601f8cf67c56a561a6dd5e130e65fdc179047d upstream.

    Add PCI id for Intel Merrifield

    Signed-off-by: David Cohen <david.a.cohen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36269ba86beca84ee770f9de7622fa25791d23fa
Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Date:   Tue Sep 17 10:38:13 2013 +0300

    usb: dwc3: pci: add support for BayTrail

    commit b62cd96de3161dfb125a769030eec35a4cab3d3a upstream.

    Add PCI id for Intel BayTrail.

    Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e5f97bb07a4048d388d81e8c26b2e6d15973bf3
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Mon Sep 30 17:26:29 2013 +0300

    usb: Disable USB 2.0 Link PM before device reset.

    commit dcc01c0864823f91c3bf3ffca6613e2351702b87 upstream.

    Before the USB core resets a device, we need to disable the L1 timeout
    for the roothub, if USB 2.0 Link PM is enabled.  Otherwise the port may
    transition into L1 in between descriptor fetches, before we know if the
    USB device descriptors changed.  LPM will be re-enabled after the
    full device descriptors are fetched, and we can confirm the device still
    supports USB 2.0 LPM after the reset.

    We don't need to wait for the USB device to exit L1 before resetting the
    device, since the xHCI roothub port diagrams show a transition to the
    Reset state from any of the Ux states (see Figure 34 in the 2012-08-14
    xHCI specification update).

    This patch should be backported to kernels as old as 3.2, that contain
    the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set USB2
    hardware LPM".  That was the first commit to enable USB 2.0
    hardware-driven Link Power Management.

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5077a93421ec087d51b6666bcbbaf51b7c2c05b6
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Sep 24 15:45:25 2013 -0400

    USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd

    commit f875fdbf344b9fde207f66b392c40845dd7e5aa6 upstream.

    Since uhci-hcd, ehci-hcd, and xhci-hcd support runtime PM, the .pm
    field in their pci_driver structures should be protected by CONFIG_PM
    rather than CONFIG_PM_SLEEP.  The corresponding change has already
    been made for ohci-hcd.

    Without this change, controllers won't do runtime suspend if system
    suspend or hibernation isn't enabled.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 701a7a17dfdb34700fd3c5fa58249f16bb628f83
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Fri Aug 30 10:46:00 2013 -0400

    USB: fix build error when CONFIG_PM_SLEEP isn't enabled

    commit 9d8924297cd9c256c23c02abae40202563452453 upstream.

    This patch fixes a build error that occurs when CONFIG_PM is enabled
    and CONFIG_PM_SLEEP isn't:

    >> drivers/usb/host/ohci-pci.c:294:10: error: 'usb_hcd_pci_pm_ops' undeclared here (not in a function)
          .pm = &usb_hcd_pci_pm_ops

    Since the usb_hcd_pci_pm_ops structure is defined and used when
    CONFIG_PM is enabled, its declaration should not be protected by
    CONFIG_PM_SLEEP.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: kbuild test robot <fengguang.wu@intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b50bbe0c033b3ba2ea880da64dbd3771d008cf8d
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Aug 26 15:01:40 2013 -0400

    USB: OHCI: Allow runtime PM without system sleep

    commit 69820e01aa756b8d228143d997f71523c1e97984 upstream.

    Since ohci-hcd supports runtime PM, the .pm field in its pci_driver
    structure should be protected by CONFIG_PM rather than
    CONFIG_PM_SLEEP.

    Without this change, OHCI controllers won't do runtime suspend if
    system suspend or hibernation isn't enabled.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 26693c1730687729f2ba5b849442382688aa7cec
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Aug 13 13:27:35 2013 +0200

    USB: keyspan: fix null-deref at disconnect and release

    commit ff8a43c10f1440f07a5faca0c1556921259f7f76 upstream.

    Make sure to fail properly if the device is not accepted during attach
    in order to avoid null-pointer derefs (of missing interface private
    data) at disconnect or release.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b51317e897a02c617b4ea446e62cbb807924fbdd
Author: Johan Hovold <jhovold@gmail.com>
Date:   Sun Aug 11 16:49:23 2013 +0200

    USB: ti_usb_3410_5052: fix big-endian firmware handling

    commit e877dd2f2581628b7119df707d4cf03d940cff49 upstream.

    Fix endianess bugs in firmware handling introduced by commits cb7a7c6a
    ("ti_usb_3410_5052: add Multi-Tech modem support") and 05a3d905
    ("ti_usb_3410_5052: support alternate firmware") which made the driver
    use the wrong firmware for certain devices on big-endian machines.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7890e19c24abea4cd412e260c2c7c6eeb18ea8a3
Author: Johan Hovold <jhovold@gmail.com>
Date:   Sun Aug 11 16:49:22 2013 +0200

    USB: adutux: fix big-endian device-type reporting

    commit d482b9d558602a9cacab063b1c8779f9b5214da7 upstream.

    Make sure the reported device-type on big-endian machines is the same as
    on little-endian ones.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6d2de9c1ea7cbac8944de86f1d5d8f7cd0415eb
Author: Johan Hovold <jhovold@gmail.com>
Date:   Fri Jul 26 11:55:17 2013 +0200

    USB: mos7840: fix race in register handling

    commit d8a083cc746664916d9d36ed9e4d08a29525f245 upstream.

    Fix race in mos7840_get_reg which unconditionally manipulated the
    control urb (which may already be in use) by adding a control-urb busy
    flag.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ff428d609c9840354d12e51961e965ec087a04e
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon Jul 1 14:03:33 2013 +0200

    USB: mos7840: fix memory leak in open

    commit 5f8a2e68b679b41cc8e9b642f2f5aa45dd678641 upstream.

    Allocated urbs and buffers were never freed on errors in open.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8dc18301f5182ff47a3d2be364ca4d068efb575f
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon Jun 10 18:29:38 2013 +0200

    USB: pl2303: fix device initialisation at open

    commit 2d8f4447b58bba5f8cb895c07690434c02307eaf upstream.

    Do not use uninitialised termios data to determine when to configure the
    device at open.

    This also prevents stack data from leaking to userspace in the OOM error
    path.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: tty_struct::termios is a pointer, not a struct]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b5627d834131ed6c047bf7d9dc5e0aeeb769a86
Author: Johan Hovold <jhovold@gmail.com>
Date:   Mon Jun 10 18:29:39 2013 +0200

    USB: spcp8x5: fix device initialisation at open

    commit 5e4211f1c47560c36a8b3d4544dfd866dcf7ccd0 upstream.

    Do not use uninitialised termios data to determine when to configure the
    device at open.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: tty_struct::termios is a pointer, not a struct]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e63aec99ab0022cb5e469b387a912225a548bc97
Author: Richard Weinberger <richard@nod.at>
Date:   Fri May 24 12:01:51 2013 +0200

    USB: serial: Add Option GTM681W to qcserial device table.

    commit 8a2f132a01c2dd4c3905fa560f92019761ed72b1 upstream.

    The Option GTM681W uses a qualcomm chip and can be
    served by the qcserial device driver.

    Signed-off-by: Richard Weinberger <richard@nod.at>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fba59fb18395c16c923f19d38c61c8afe3d30ccf
Author: George Cherian <george.cherian@ti.com>
Date:   Mon May 27 14:35:49 2013 +0530

    usb: dwc3: gadget: free trb pool only from epnum 2

    commit 5bf8fae33d14cc5c3c53a926f9079f92c8b082b0 upstream.

    we never allocate a TRB pool for physical endpoints
    0 and 1 so trying to free it (a invalid TRB pool pointer)
    will lead us in a warning while removing dwc3.ko module.

    In order to fix the situation, all we have to do is skip
    dwc3_free_trb_pool() for physical endpoints 0 and 1 just
    as we while deleting endpoints from the endpoints list.

    Signed-off-by: George Cherian <george.cherian@ti.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5dc179c6c808df1e7fd86a6472064af824fc9d58
Author: Adrian Thomasset <adrian.thomasset@st.com>
Date:   Wed Apr 24 11:37:35 2013 +0100

    USB: ftdi_sio: enable two UART ports on ST Microconnect Lite

    commit 71d9a2b95fc9c9474d46d764336efd7a5a805555 upstream.

    The FT4232H used in the ST Micro Connect Lite has four hi-speed UART ports.
    The first two ports are reserved for the JTAG interface.

    We enable by default ports 2 and 3 as UARTs (where port 2 is a
    conventional RS-232 UART)

    Signed-off-by: Adrian Thomasset <adrian.thomasset@st.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cebd154bd43fee9cc7f1a20757119c5be2a99043
Author: Ming Lei <tom.leiming@gmail.com>
Date:   Tue Mar 26 10:49:55 2013 +0800

    USB: serial: fix hang when opening port

    commit eba0e3c3a0ba7b96f01cbe997680f6a4401a0bfc upstream.

    Johan's 'fix use-after-free in TIOCMIWAIT' patchset[1] introduces
    one bug which can cause kernel hang when opening port.

    This patch initialized the 'port->delta_msr_wait' waitqueue head
    to fix the bug which is introduced in 3.9-rc4.

    [1], http://marc.info/?l=linux-usb&m=136368139627876&w=2

    Signed-off-by: Ming Lei <tom.leiming@gmail.com>
    Acked-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98458abe19dc414cddd1c5fb0b5b1b1095de3240
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:26 2013 +0100

    USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT

    commit 3668b9c17765cacf411effc4fc6e44099ac30800 upstream.

    commit fc98ab873aa3dbe783ce56a2ffdbbe7c7609521a upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e0aa06045823f4bf350a4efc40c387a53bab661b
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:25 2013 +0100

    USB: ssu100: fix use-after-free in TIOCMIWAIT

    commit 43a66b4c417ad15f6d2f632ce67ad195bdf999e8 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c53e9784c85caf596b0c4a48b011d2b025eff290
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:24 2013 +0100

    USB: spcp8x5: fix use-after-free in TIOCMIWAIT

    commit d1baabc8006fd238ad8da4d734dc815a8de02362 upstream.

    commit dbcea7615d8d7d58f6ff49d2c5568113f70effe9 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context, indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit efa1c86aa7224628127a97876fcb16a5a00b3a0d
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:22 2013 +0100

    USB: pl2303: fix use-after-free in TIOCMIWAIT

    commit 40509ca982c00c4b70fc00be887509feca0bff15 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ae5c6018de3aeba4d359c3c5d3624dca03a76a8
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:21 2013 +0100

    USB: oti6858: fix use-after-free in TIOCMIWAIT

    commit 8edfdab37157d2683e51b8be5d3d5697f66a9f7b upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context, indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ced638acd331f22d6015b318d9059aea4c1b4306
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:20 2013 +0100

    USB: mos7840: fix use-after-free in TIOCMIWAIT

    commit a14430db686b8e459e1cf070a6ecf391515c9ab9 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee2470d27c32373a514c6eccb63ec5589bcffd5c
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:19 2013 +0100

    USB: mos7840: fix broken TIOCMIWAIT

    commit e670c6af12517d08a403487b1122eecf506021cf upstream.

    Make sure waiting processes are woken on modem-status changes.

    Currently processes are only woken on termios changes regardless of
    whether the modem status has changed.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23a88561251edc6ef7f72b32f360be84397ec566
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:18 2013 +0100

    USB: mct_u232: fix use-after-free in TIOCMIWAIT

    commit cf1d24443677a0758cfa88ca40f24858b89261c0 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fad70e4c2dd6bc7c8cb9c3a61cb1dafad96a359e
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:17 2013 +0100

    USB: io_ti: fix use-after-free in TIOCMIWAIT

    commit 7b2459690584f239650a365f3411ba2ec1c6d1e0 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 25b6e4637943d52412c14093726e3c750e403514
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:16 2013 +0100

    USB: io_edgeport: fix use-after-free in TIOCMIWAIT

    commit 333576255d4cfc53efd056aad438568184b36af6 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6929b79f07d57ddb86cb9083a5aac6c5f2c7ee0b
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:15 2013 +0100

    USB: ftdi_sio: fix use-after-free in TIOCMIWAIT

    commit 71ccb9b01981fabae27d3c98260ea4613207618e upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    When switching to tty ports, some lifetime assumptions were changed.
    Specifically, close can now be called before the final tty reference is
    dropped as part of hangup at device disconnect. Even with the ftdi
    private-data refcounting this means that the port private data can be
    freed while a process is sleeping on modem-status changes and thus
    cannot be relied on to detect disconnects when woken up.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee49ee869ce7af67ba38a1e989dd4d7670393d0c
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:13 2013 +0100

    USB: cypress_m8: fix use-after-free in TIOCMIWAIT

    commit 356050d8b1e526db093e9d2c78daf49d6bf418e3 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Also remove bogus test for private data pointer being NULL as it is
    never assigned in the loop.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7bb322e3170a179899823b5e63d434d4324b486
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:12 2013 +0100

    USB: ch341: fix use-after-free in TIOCMIWAIT

    commit fa1e11d5231c001c80a479160b5832933c5d35fb upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ffc687e350fa607e42c8c7b44e198f39265c6ad9
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:11 2013 +0100

    USB: ark3116: fix use-after-free in TIOCMIWAIT

    commit 5018860321dc7a9e50a75d5f319bc981298fb5b7 upstream.

    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.

    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 017f42518a72858f4332572a963be4212e0ee795
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Mar 19 09:21:10 2013 +0100

    USB: serial: add modem-status-change wait queue

    commit e5b33dc9d16053c2ae4c2c669cf008829530364b upstream.

    Add modem-status-change wait queue to struct usb_serial_port that
    subdrivers can use to implement TIOCMIWAIT.

    Currently subdrivers use a private wait queue which may have been
    released when waking up after device disconnected.

    Note that we're adding a new wait queue rather than reusing the tty-port
    one as we do not want to get woken up at hangup (yet).

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cae4d9a21738dce33a18f533c703b42f59e55244
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Mon Apr 2 15:40:27 2012 +0200

    ALSA: hda - Fix internal mic for Lenovo Ideapad U300s

    commit 18dcd3044e4c4b3ab6341c98e8d0e81e0d58d5e3 upstream.

    The internal mic input is phase inverted on one channel.
    To avoid people in userspace summing the channels together
    and get zero result, use a separate mixer control for the
    inverted channel.

    BugLink: https://bugs.launchpad.net/bugs/903853
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [wml: Backported to 3.4:
     - Adjust context
     - one more enum value CXT_PINCFG_LENOVO_TP410
     - Change both invocations of apply_pin_fixup()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>

commit 88e7e71df070e9d863f9378a0c00be70e821708a
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Dec 14 10:22:35 2012 +0100

    ALSA: hda - Always turn on pins for HDMI/DP

    commit 6169b673618bf0b2518ce413b54925782a603f06 upstream.

    We've seen the broken HDMI *video* output on some machines with GM965,
    and the debugging session pointed that the culprit is the disabled
    audio output pins.  Toggling these pins dynamically on demand caused
    flickering of HDMI TV.

    This patch changes the behavior to keep the pin ON constantly.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=51421

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98a50ba04e6c85474af0c6b34b74659afdfdfda4
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Wed Dec 19 09:44:47 2012 +0100

    Revert "ALSA: hda - Shut up pins at power-saving mode with Conexnat codecs"

    commit 7ed4165e2d01bdbbb4c1086eb73eadf0f64cbbf0 upstream.

    This reverts commit 697c373e34613609cb5450f98b91fefb6e910588.

    The original patch was meant to remove clicking, but in fact caused even
    more clicking instead.

    Thanks to c4pp4 for doing most of the work with this bug.

    BugLink: https://bugs.launchpad.net/bugs/886975
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4aab66f1da53a7bf5edb4b245ee20db40424d909
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu May 10 08:54:23 2012 +0200

    ALSA: hda - Add Conexant CX20751/2/3/4 codec support

    commit 61d648fb4726f8a89c07cd1904f9c2e11bf26df5 upstream.

    These are almost compatible with the older Conexant codecs.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6f812bef6cd1102d9edc473062d924d8d7c54219
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Jan 29 18:07:22 2013 +0100

    ALSA: hda - Fix non-snoop page handling

    commit 9ddf1aeb2134e72275c97a2c6ff2e3eb04f2f27a upstream.

    For non-snoop mode, we fiddle with the page attributes of CORB/RIRB
    and the position buffer, but also the ring buffers.  The problem is
    that the current code blindly assumes that the buffer is contiguous.
    However, the ring buffers may be SG-buffers, thus a wrong vmapped
    address is passed there, leading to Oops.

    This patch fixes the handling for SG-buffers.

    Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=800701

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: open-code snd_pcm_get_dma_buf()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 760ae1d191c247b1e0c837b9701dd3da5db69f11
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Feb 4 10:28:15 2013 +0100

    ALSA: aloop: Fix Oops while PM resume

    commit edac894389f9c9de2a1368c78809c824b343f3a5 upstream.

    snd-aloop driver has no proper PM implementation, thus the PM resume
    may trigger Oops due to leftover timer instance.  This patch adds the
    missing suspend/resume implementation.

    Reported-and-tested-by: El boulangero <elboulangero@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd25cf8987bc5a34b70056c2c3e2a54accd34bb7
Author: Calvin Owens <jcalvinowens@gmail.com>
Date:   Fri Apr 12 22:33:59 2013 -0500

    ALSA: usb: Add quirk for 192KHz recording on E-Mu devices

    commit 1539d4f82ad534431cc67935e8e442ccf107d17d upstream.

    When recording at 176.2KHz or 192Khz, the device adds a 32-bit length
    header to the capture packets, which obviously needs to be ignored for
    recording to work properly.

    Userspace expected:  L0 L1 L2 R0 R1 R2
    ...but actually got: R2 L0 L1 L2 R0 R1

    Also, the last byte of the length header being interpreted as L0 of
    the first sample caused spikes every 0.5ms, resulting in a loud 16KHz
    tone (about the highest 'B' on a piano) being present throughout
    captures.

    Tested at all sample rates on an E-Mu 0404USB, and tested for
    regressions on a generic USB headset.

    Signed-off-by: Calvin Owens <jcalvinowens@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [bwh: Backported to 3.2: adjust filenames, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8cb6708d75c2999d99d245dc6a42375ae602f8ce
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date:   Thu Jul 19 12:39:14 2012 +0200

    usb: Add USB_QUIRK_RESET_RESUME for all Logitech UVC webcams

    commit e387ef5c47ddeaeaa3cbdc54424cdb7a28dae2c0 upstream.

    Most Logitech UVC webcams (both early models that don't advertise UVC
    compatibility and newer UVC-advertised devices) require the RESET_RESUME
    quirk. Instead of listing each and every model, match the devices based
    on the UVC interface information.

    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    [bwh: Adjust context to apply after 3.2.38]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a85e474e00d762b1a20d912c003daa64c42cc74e
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date:   Thu Jul 19 12:39:13 2012 +0200

    usb: Add quirk detection based on interface information

    commit 80da2e0df5af700518611b7d1cc4fc9945bcaf95 upstream.

    When a whole class of devices (possibly from a specific vendor, or
    across multiple vendors) require a quirk, explictly listing all devices
    in the class make the quirks table unnecessarily large. Fix this by
    allowing matching devices based on interface information.

    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96ff7eff36f9f756726dbde657b020cd4469de8d
Author: Andreas Fleig <andreasfleig@gmail.com>
Date:   Wed Dec 5 16:17:49 2012 +0100

    USB: Add device quirk for Microsoft VX700 webcam

    commit bc009eca8d539162f7271c2daf0ab5e9e3bb90a0 upstream.

    Add device quirk for Microsoft Lifecam VX700 v2.0 webcams.
    Fixes squeaking noise of the microphone.

    Signed-off-by: Andreas Fleig <andreasfleig@gmail.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d19046a87a3888f9a3a542337cda0f3a07b40fdd
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Nov 8 10:17:01 2012 -0500

    USB: EHCI: bugfix: urb->hcpriv should not be NULL

    commit 2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e upstream.

    This patch (as1632b) fixes a bug in ehci-hcd.  The USB core uses
    urb->hcpriv to determine whether or not an URB is active; host
    controller drivers are supposed to set this pointer to a non-NULL
    value when an URB is queued.  However ehci-hcd sets it to NULL for
    isochronous URBs, which defeats the check in usbcore.

    In itself this isn't a big deal.  But people have recently found that
    certain sequences of actions will cause the snd-usb-audio driver to
    reuse URBs without waiting for them to complete.  In the absence of
    proper checking by usbcore, the URBs get added to their endpoint list
    twice.  This leads to list corruption and a system freeze.

    The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for
    isochronous URBs.  Improving robustness always helps.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Artem S. Tashkinov <t.artem@lycos.com>
    Reported-by: Christof Meerwald <cmeerw@cmeerw.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - Also use usb_pipetype() to work out whether we should call qh_put()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c2e0026cb5ab9d87c6b8a57fcf3d15ada8ed043
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Thu Oct 25 17:11:31 2012 +0530

    ath9k_hw: Enable hw PLL power save for AR9462

    commit 1680260226a8fd2aab590319da83ad8e610da9bd upstream.

    This reduced the power consumption to half in full and network sleep.

    Cc: Paul Stewart <pstew@chromium.org>
    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2:
     - INIT_INI_ARRAY macro requires an explicit size argument
     - Remove the now-redundant macro PCIE_PLL_ON_CREQ_DIS_L1_2P0]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2fcb3316cf2b3c242ac6ec0706454d50eb4c9240
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Wed Dec 26 12:27:39 2012 +0530

    ath9k_hw: Fix RX gain initvals for AR9485

    commit a796a1dd5da9645ad77aa687d1a890ecd63ab5a6 upstream.

    Populate iniModesRxGain with the correct initvals
    array for AR9485 v1.1

    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - INIT_INI_ARRAY takes additional size and columns arguments]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bea8bffc581dfbcac065bffafdcab96bb28bd1bb
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Sun Jan 20 21:55:21 2013 +0100

    ath9k_hw: fix chain swap setting when setting rx chainmask to 5

    commit 959f049dfb62b517cbb3dd48ed2fb7d9c713ce16 upstream.

    commit 24171dd92096fc370b195f3f6bdc0798855dc3f9 upstream.

    Chain swapping should only be enabled when the EEPROM chainmask is set to 5,
    regardless of what the runtime chainmask is.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2: keep the special case for AR_SREV_9462 here]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa7640d05305a2cbdd93dcfcd3d7cd54e59a803f
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Fri Feb 22 21:37:25 2013 +0100

    ath9k_htc: fix signal strength handling issues

    commit 838f427955dcfd16858b0108ce29029da0d56a4e upstream.

    The ath9k commit 2ef167557c0a26c88162ecffb017bfcc51eb7b29
    (ath9k: fix signal strength reporting issues) fixed an issue where the
    reported per-frame signal strength reported to mac80211 was being
    overwritten with an internal average. The same issue is also present
    in ath9k_htc.
    In addition to preventing the driver from overwriting the value, this
    commit also ensures that the internal average (which is used for ANI)
    only tracks beacons of the AP that we're connected to.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2: use compare_ether_addr() instead of
     ether_addr_equal(), with opposite sense]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8daeba03c4cfeaa8bc482bdfed044bc387d838fe
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Mon Jun 10 13:49:38 2013 +0530

    ath9k_hw: Assign default xlna config for AR9485

    commit 30d5b709da23f4ab9836c7f66d2d2e780a69cf12 upstream.

    For AR9485 boards with XLNA, the default gpio config
    is not set correctly, fix this.

    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e6fe08c10419a609bc9a64ab5818ea522debad6
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Fri Oct 12 14:07:24 2012 +0530

    ath9k: fill channel mode in caldata

    commit 77d848372875d2e4cbdbf07030f0e08cab5e7f4d upstream.

    It is useful to have channel mode in caldata to find out
    whether operaing channel is in HT40/20 when we are currently
    on offchannel. It will be used by BTCOEX to enable/disable
    concurrent tx mechanism later.

    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eceee0ba4e042a0f27bbbd82b0dc4c5b0959880a
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Mon Jun 10 13:49:39 2013 +0530

    ath9k: Fix noisefloor calibration

    commit 696df78509d1f81b651dd98ecdc1aecab616db6b upstream.

    The commits,

    "ath9k: Fix regression in channelwidth switch at the same channel"
    "ath9k: Fix invalid noisefloor reading due to channel update"

    attempted to fix noisefloor calibration when a channel switch
    happens due to HT20/HT40 bandwidth change. This is causing invalid
    readings resulting in messages like:

    "ath: phy16: NF[0] (-45) > MAX (-95), correcting to MAX".

    This results in an incorrect noise being used initially for reporting
    the signal level of received packets, until NF calibration is done
    and the history buffer is updated via the ANI timer, which happens
    much later.

    When a bandwidth change happens, it is appropriate to reset
    the internal history data for the channel. Do this correctly in the
    reset() routine by checking the "chanmode" variable.

    Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2: adjust context, indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 562c41b16c74779615db9c8cbbf01339f3a73fac
Author: Will Deacon <will.deacon@arm.com>
Date:   Thu Jul 25 11:44:48 2013 +0100

    ARM: 7791/1: a.out: remove partial a.out support

    commit acfdd4b1f7590d02e9bae3b73bdbbc4a31b05d38 upstream.

    a.out support on ARM requires that argc, argv and envp are passed in
    r0-r2 respectively, which requires hacking load_aout_binary to
    prevent argc being clobbered by the return code. Whilst mainline kernels
    do set the registers up in start_thread, the aout loader has never
    carried the hack in mainline.

    Initialising the registers in this way actually goes against the libc
    expectations for ELF binaries, where argc, argv and envp are passed on
    the stack, with r0 being used to hold a pointer to an exit function for
    cleaning up after the dynamic linker if required. If the pointer is
    NULL, then it is ignored. When execing an ELF binary, Linux currently
    zeroes r0, then sets it to argc and then finally clobbers it with the
    return value of the execve syscall, so we actually end up with:

    	r0 = 0
    	stack[0] = argc
    	r1 = stack[1] = argv
    	r2 = stack[2] = envp

    libc treats r1 and r2 as undefined. The clobbering of r0 by sys_execve
    works for user-spawned threads, but when executing an ELF binary from a
    kernel thread (via call_usermodehelper), the execve is performed on the
    ret_from_fork path, which restores r0 from the saved pt_regs, resulting
    in argc being presented to the C library. This has horrible consequences
    when the application exits, since we have an exit function registered
    using argc, resulting in a jump to hyperspace.

    This patch solves the problem by removing the partial a.out support from
    arch/arm/ altogether.

    Cc: Ashish Sangwan <ashishsangwan2@gmail.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    [bwh: Backported to 3.2:
     - Adjust context
     - Adjust uapi filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yangyl: Backported to 3.4: Adjust context]
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3e650df41db32aeb319d4531cc9df6fba4e3c9a
Author: Nicolas Pitre <nicolas.pitre@linaro.org>
Date:   Tue Jan 15 18:51:32 2013 +0100

    ARM: 7628/1: head.S: map one extra section for the ATAG/DTB area

    commit 6f16f4998f98e42e3f2dedf663cfb691ff0324af upstream.

    We currently use a temporary 1MB section aligned to a 1MB boundary for
    mapping the provided device tree until the final page table is created.
    However, if the device tree happens to cross that 1MB boundary, the end
    of it remains unmapped and the kernel crashes when it attempts to access
    it.  Given no restriction on the location of that DTB, it could end up
    with only a few bytes mapped at the end of a section.

    Solve this issue by mapping two consecutive sections.

    Signed-off-by: Nicolas Pitre <nico@linaro.org>
    Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
    Tested-by: Tomasz Figa <t.figa@samsung.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    [bwh: Backported to 3.2:
     - Adjust context
     - The mapping is not conditional; drop the 'ne' suffixes]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yangyl: Backported to 3.4: Adjust context]
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f993888a1a433264656aad615d17d37e8474dad0
Author: Arnaud Patard (Rtp) <arnaud.patard@rtp-net.org>
Date:   Thu Jul 26 12:15:46 2012 +0200

    ARM: Orion: Set eth packet size csum offload limit

    commit 58569aee5a1a5dcc25c34a0a2ed9a377874e6b05 upstream.

    The mv643xx ethernet controller limits the packet size for the TX
    checksum offloading. This patch sets this limits for Kirkwood and
    Dove which have smaller limits that the default.

    As a side note, this patch is an updated version of a patch sent some years
    ago: http://lists.infradead.org/pipermail/linux-arm-kernel/2010-June/017320.html
    which seems to have been lost.

    Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    [bwh: Backported to 3.2: adjust for the extra two parameters of
     orion_ge0{0,1}_init()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yangyl: Backported to 3.4: Adjust context]
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e1d3e024ab67c29b1602d9d05310a215b35066e7
Author: Sergei Ianovich <ynvich@gmail.com>
Date:   Tue Dec 10 08:39:15 2013 +0400

    ARM: pxa: prevent PXA270 occasional reboot freezes

    commit ff88b4724fde18056a4c539f7327389aec0f4c2d upstream.

    Erratum 71 of PXA270M Processor Family Specification Update
    (April 19, 2010) explains that watchdog reset time is just
    8us insead of 10ms in EMTS.

    If SDRAM is not reset, it causes memory bus congestion and
    the device hangs. We put SDRAM in selfresh mode before watchdog
    reset, removing potential freezes.

    Without this patch PXA270-based ICP DAS LP-8x4x hangs after up to 40
    reboots. With this patch it has successfully rebooted 500 times.

    Signed-off-by: Sergei Ianovich <ynvich@gmail.com>
    Tested-by: Marek Vasut <marex@denx.de>
    Signed-off-by: Haojian Zhuang <haojian.zhuang@gmail.com>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0045ba111325a68bf287b68956e9716cc797f4fd
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Thu Nov 28 21:55:41 2013 +0000

    ARM: footbridge: fix VGA initialisation

    commit 43659222e7a0113912ed02f6b2231550b3e471ac upstream.

    It's no good setting vga_base after the VGA console has been
    initialised, because if we do that we get this:

    Unable to handle kernel paging request at virtual address 000b8000
    pgd = c0004000
    [000b8000] *pgd=07ffc831, *pte=00000000, *ppte=00000000
    0Internal error: Oops: 5017 [#1] ARM
    Modules linked in:
    CPU: 0 PID: 0 Comm: swapper Not tainted 3.12.0+ #49
    task: c03e2974 ti: c03d8000 task.ti: c03d8000
    PC is at vgacon_startup+0x258/0x39c
    LR is at request_resource+0x10/0x1c
    pc : [<c01725d0>]    lr : [<c0022b50>]    psr: 60000053
    sp : c03d9f68  ip : 000b8000  fp : c03d9f8c
    r10: 000055aa  r9 : 4401a103  r8 : ffffaa55
    r7 : c03e357c  r6 : c051b460  r5 : 000000ff  r4 : 000c0000
    r3 : 000b8000  r2 : c03e0514  r1 : 00000000  r0 : c0304971
    Flags: nZCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel

    which is an access to the 0xb8000 without the PCI offset required to
    make it work.

    Fixes: cc22b4c18540 ("ARM: set vga memory base at run-time")
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cbac9bda67f107ec39383d936380ffe9f5f67cdc
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Fri May 31 22:50:47 2013 +0100

    ARM: 7743/1: compressed/head.S: work around new binutils warning

    commit da94a829305f1c217cfdf6771cb1faca0917e3b9 upstream.

    In August 2012, Matthew Gretton-Dann checked a change into binutils
    labelled "Error on obsolete & warn on deprecated registers", apparently as
    part of ARMv8 support. Apparently, this was supposed to emit the message
    "Warning: This coprocessor register access is deprecated in ARMv8" when
    using certain mcr/mrc instructions and building for ARMv8. Unfortunately,
    the message that is actually emitted appears to be '(null)', which is
    less helpful in comparison.

    Even more unfortunately, this is biting us on every single kernel
    build with a new gas, because arch/arm/boot/compressed/head.S and some
    other files in that directory are built with -march=all since kernel
    commit 80cec14a8 "[ARM] Add -march=all to assembly file build in
    arch/arm/boot/compressed" back in v2.6.28.

    This patch reverts Russell's nice solution and instead marks the head.S
    file to be built for armv7-a, which fortunately lets us build all
    instructions in that file without warnings even on the broken binutils.

    Without this patch, building anything results in:

    arch/arm/boot/compressed/head.S: Assembler messages:
    arch/arm/boot/compressed/head.S:565: Warning: (null)
    arch/arm/boot/compressed/head.S:676: Warning: (null)
    arch/arm/boot/compressed/head.S:698: Warning: (null)
    arch/arm/boot/compressed/head.S:722: Warning: (null)
    arch/arm/boot/compressed/head.S:726: Warning: (null)
    arch/arm/boot/compressed/head.S:957: Warning: (null)
    arch/arm/boot/compressed/head.S:996: Warning: (null)
    arch/arm/boot/compressed/head.S:997: Warning: (null)
    arch/arm/boot/compressed/head.S:1027: Warning: (null)
    arch/arm/boot/compressed/head.S:1035: Warning: (null)
    arch/arm/boot/compressed/head.S:1046: Warning: (null)
    arch/arm/boot/compressed/head.S:1060: Warning: (null)
    arch/arm/boot/compressed/head.S:1092: Warning: (null)
    arch/arm/boot/compressed/head.S:1094: Warning: (null)
    arch/arm/boot/compressed/head.S:1095: Warning: (null)
    arch/arm/boot/compressed/head.S:1102: Warning: (null)
    arch/arm/boot/compressed/head.S:1134: Warning: (null)

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Cc: Matthew Gretton-Dann <matthew.gretton-dann@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    [bwh: Backported to 3.2:
     - Adjust context
     - Remove definition of asflags-y as it is now empty]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c9925863935ad8bb5f575224849b2d5d173c4dd1
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Fri May 31 22:49:22 2013 +0100

    ARM: 7742/1: topology: export cpu_topology

    commit 92bdd3f5eba299b33c2f4407977d6fa2e2a6a0da upstream.

    The cpu_topology symbol is required by any driver using the topology
    interfaces, which leads to a couple of build errors:

    ERROR: "cpu_topology" [drivers/net/ethernet/sfc/sfc.ko] undefined!
    ERROR: "cpu_topology" [drivers/cpufreq/arm_big_little.ko] undefined!
    ERROR: "cpu_topology" [drivers/block/mtip32xx/mtip32xx.ko] undefined!

    The obvious solution is to export this symbol.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: Will Deacon <will.deacon@arm.com>
    Cc: Nicolas Pitre <nico@linaro.org>
    Cc: Vincent Guittot <vincent.guittot@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e07754a3e9402b539de79ecb0587978b1423230
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Fri Apr 26 15:29:55 2013 +0200

    ARM: u300: fix ages old copy/paste bug

    commit 0259d9eb30d003af305626db2d8332805696e60d upstream.

    The UART1 is on the fast AHB bridge, not on the slow bus.

    Acked-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b39ebf7795a101d3159fdca519994a42f8b1ee71
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Jan 14 12:49:02 2013 +0000

    ARM: w90x900: fix legacy assembly syntax

    commit fa5ce5f94c0f2bfa41ba68d2d2524298e1fc405e upstream.

    New ARM binutils don't allow extraneous whitespace inside
    of brackets, which causes this error on all mach-w90x900
    defconfigs:

    arch/arm/kernel/entry-armv.S: Assembler messages:
    arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r0,[ r6,#(0x10C)]'
    arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r0,[ r6,#(0x110)]'
    arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r0,[ r6,#(0x10C)]'
    arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r0,[ r6,#(0x110)]'

    This removes the whitespace in order to build the kernel
    again.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Cc: Wan ZongShun <mcuos.com@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 26b9386b0228d0760b0c9649bd9c952ebcee3fa0
Author: Shawn Guo <shawn.guo@linaro.org>
Date:   Wed Aug 22 21:46:39 2012 +0800

    ARM: dts: imx51-babbage: fix esdhc cd/wp properties

    commit a46d2619d7180bda12bad2bf15bbd0731dfc2dcf upstream.

    The binding doc and dts use properties "fsl,{cd,wp}-internal" while
    esdhc driver uses "fsl,{cd,wp}-controller".  Fix binding doc and dts
    to get them match driver code.

    Reported-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
    Acked-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c5b2352dbd302fa2940973af841ba9be39502f6
Author: Manoj Chourasia <mchourasia@nvidia.com>
Date:   Mon Jul 22 15:33:13 2013 +0530

    HID: hidraw: correctly deallocate memory on device disconnect

    commit 212a871a3934beccf43431608c27ed2e05a476ec upstream.

    This changes puts the commit 4fe9f8e203f back in place
    with the fixes for slab corruption because of the commit.

    When a device is unplugged, wait for all processes that
    have opened the device to close before deallocating the device.

    This commit was solving kernel crash because of the corruption in
    rb tree of vmalloc. The rootcause was the device data pointer was
    geting excessed after the memory associated with hidraw was freed.

    The commit 4fe9f8e203f was buggy as it was also freeing the hidraw
    first and then calling delete operation on the list associated with
    that hidraw leading to slab corruption.

    Signed-off-by: Manoj Chourasia <mchourasia@nvidia.com>
    Tested-by: Peter Wu <lekensteyn@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30817a87476f44c2d4fe499b300b6ff0b703d527
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Mon Mar 18 15:50:10 2013 +0100

    HID: usbhid: fix build problem

    commit 570637dc8eeb2faba06228d497ff40bb019bcc93 upstream.

    Fix build problem caused by typo introduced by 620ae90ed8
    ("HID: usbhid: quirk for MSI GX680R led panel").

    Reported-by: fengguang.wu@intel.com
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec6cd0f6f485d5d7330c965fb39e0692247b2f89
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Mon Mar 18 09:47:02 2013 -0400

    HID: usbhid: quirk for MSI GX680R led panel

    commit 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 upstream.

    This keyboard backlight device causes a 10 second delay to boot.  Add it
    to the quirk list with HID_QUIRK_NO_INIT_REPORTS.

    This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=907221

    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7d02a653f15789bc32043bab3edf90b2a5210b26
Author: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
Date:   Tue Jan 22 15:20:38 2013 +0900

    HID: clean up quirk for Sony RF receivers

    commit 99d249021abd4341771523ed8dd7946276103432 upstream.

    Document what the fix-up is does and make it more robust by ensuring
    that it is only applied to the USB interface that corresponds to the
    mouse (sony_report_fixup() is called once per interface during probing).

    Cc: linux-input@vger.kernel.org
    Cc: linux-usb@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d49f9035ffc7c256626cb05441571ad730e9663
Author: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
Date:   Tue Jan 15 19:40:48 2013 +0900

    HID: add support for Sony RF receiver with USB product id 0x0374

    commit a464918419f94a0043d2f549d6defb4c3f69f68a upstream.

    Some Vaio desktop computers, among them the VGC-LN51JGB multimedia PC, have
    a RF receiver, multi-interface USB device 054c:0374, that is used to connect
    a wireless keyboard and a wireless mouse.

    The keyboard works flawlessly, but the mouse (VGP-WMS3 in my case) does not
    seem to be generating any pointer events. The problem is that the mouse pointer
    is wrongly declared as a constant non-data variable in the report descriptor
    (see lsusb and usbhid-dump output below), with the consequence that it is
    ignored by the HID code.

    Add this device to the have-special-driver list and fix up the report
    descriptor in the Sony-specific driver which happens to already have a fixup
    for a similar firmware bug.

    # lsusb -vd 054C:0374
    Bus 003 Device 002: ID 054c:0374 Sony Corp.
    Device Descriptor:
      bLength                18
      bDescriptorType         1
      bcdUSB               2.00
      bDeviceClass            0 (Defined at Interface level)
      bDeviceSubClass         0
      bDeviceProtocol         0
      bMaxPacketSize0         8
      idVendor           0x054c Sony Corp.
      idProduct          0x0374
      iSerial                 0
    [...]
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        1
          bAlternateSetting       0
          bNumEndpoints           1
          bInterfaceClass         3 Human Interface Device
          bInterfaceSubClass      1 Boot Interface Subclass
          bInterfaceProtocol      2 Mouse
          iInterface              2 RF Receiver
    [...]
              Report Descriptor: (length is 100)
    [...]
                Item(Global): Usage Page, data= [ 0x01 ] 1
                                Generic Desktop Controls
                Item(Local ): Usage, data= [ 0x30 ] 48
                                Direction-X
                Item(Local ): Usage, data= [ 0x31 ] 49
                                Direction-Y
                Item(Global): Report Count, data= [ 0x02 ] 2
                Item(Global): Report Size, data= [ 0x08 ] 8
                Item(Global): Logical Minimum, data= [ 0x81 ] 129
                Item(Global): Logical Maximum, data= [ 0x7f ] 127
                Item(Main  ): Input, data= [ 0x07 ] 7
                                Constant Variable Relative No_Wrap Linear
                                Preferred_State No_Null_Position Non_Volatile Bitfield

    # usbhid-dump
    003:002:001:DESCRIPTOR         1357910009.758544
     05 01 09 02 A1 01 05 01 09 02 A1 02 85 01 09 01
     A1 00 05 09 19 01 29 05 95 05 75 01 15 00 25 01
     81 02 75 03 95 01 81 01 05 01 09 30 09 31 95 02
     75 08 15 81 25 7F 81 07 A1 02 85 01 09 38 35 00
     45 00 15 81 25 7F 95 01 75 08 81 06 C0 A1 02 85
     01 05 0C 15 81 25 7F 95 01 75 08 0A 38 02 81 06
     C0 C0 C0 C0

    Cc: linux-input@vger.kernel.org
    Cc: linux-usb@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1daa6fc04f1bf8b5573eb9d29d5e9791d15172f7
Author: Alexey Kaminsky <me@akaminsky.net>
Date:   Mon Apr 23 18:02:18 2012 +0200

    HID: apple: Add Apple wireless keyboard 2011 ANSI PID

    commit 0a97e1e9f9a6765e6243030ac42b04694f3f3647 upstream.

    Signed-off-by: Alexey Kaminsky <me@akaminsky.net>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2: add the device ID to hid-ids.h]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7fc19240123296c99b003806fe75cfb19c0ad54a
Author: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date:   Wed Aug 15 23:31:45 2012 +0400

    HID: hidraw: improve error handling in hidraw_init()

    commit bcb4a75bde3821cecb17a71d287abfd6ef9bd68d upstream.

    Several improvements in error handling:
    - do not report success if alloc_chrdev_region() failed
    - check for error code of cdev_add()
    - use unregister_chrdev_region() instead of unregister_chrdev()
      if class_create() failed

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6cec16f2227453df9143e47ac008301d6966e93
Author: Matthieu CASTET <matthieu.castet@parrot.com>
Date:   Thu Jun 28 16:51:56 2012 +0200

    HID: hidraw: fix list->buffer memleak

    commit 4c7b417ecb756e85dfc955b0e7a04fd45585533e upstream.

    If we don't read fast enough hidraw device, hidraw_report_event
    will cycle and we will leak list->buffer.
    Also list->buffer are not free on release.
    After this patch, kmemleak report nothing.

    Signed-off-by: Matthieu CASTET <matthieu.castet@parrot.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32bb39f80ffb6b63c78b418bec35a2ce1fc0abe1
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Mon Apr 30 10:39:17 2012 +0200

    HID: fix return value of hidraw_report_event() when !CONFIG_HIDRAW

    commit d6d7c873529abd622897cad5e36f1fd7d82f5110 upstream.

    Commit b6787242f327 ("HID: hidraw: add proper error handling to raw event
    reporting") forgot to update the static inline version of
    hidraw_report_event() for the case when CONFIG_HIDRAW is unset. Fix that
    up.

    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 588256df90f26647828489e45d82b72e97d624e9
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Fri Apr 27 00:56:08 2012 +0200

    HID: hidraw: add proper error handling to raw event reporting

    commit b6787242f32700377d3da3b8d788ab3928bab849 upstream.

    If kmemdup() in hidraw_report_event() fails, we are not propagating
    this fact properly.

    Let hidraw_report_event() and hid_report_raw_event() return an error
    value to the caller.

    Reported-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f11c6f07cb7d33abb503e87909aba80c8605d141
Author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date:   Wed Sep 11 21:56:58 2013 +0200

    HID: multitouch: validate indexes details

    commit 8821f5dc187bdf16cfb32ef5aa8c3035273fa79a upstream.

    When working on report indexes, always validate that they are in bounds.
    Without this, a HID device could report a malicious feature report that
    could trick the driver into a heap overflow:

    [  634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
    ...
    [  676.469629] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

    Note that we need to change the indexes from s8 to s16 as they can
    be between -1 and 255.

    CVE-2013-2897

    Cc: stable@vger.kernel.org
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Acked-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2: mt_device::{cc,cc_value,inputmode}_index do not
     exist and the corresponding indices do not need to be validated.
     mt_device::maxcontact_report_id does not exist either.  So all we need
     to do is to widen mt_device::inputmode.]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yjw: Backport to 3.4: maxcontact_report_id exists,
     need to be validated]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9588aaee5106ef803958fcd1bb72395d71b2f88b
Author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date:   Wed Sep 11 21:56:57 2013 +0200

    HID: validate feature and input report details

    commit cc6b54aa54bf40b762cab45a9fc8aa81653146eb upstream.

    When dealing with usage_index, be sure to properly use unsigned instead of
    int to avoid overflows.

    When working on report fields, always validate that their report_counts are
    in bounds.
    Without this, a HID device could report a malicious feature report that
    could trick the driver into a heap overflow:

    [  634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
    ...
    [  676.469629] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

    CVE-2013-2897

    Cc: stable@vger.kernel.org
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Acked-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2:
     - Drop inapplicable changes to hid_usage::usage_index initialisation and
       to hid_report_raw_event()
     - Adjust context in report_features()
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yijingwang: Backported to 3.4: context adjust]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 474363f4e49812cda182af925cfeb43c4619369d
Author: Nicholas Santos <nicholas.santos@gmail.com>
Date:   Fri Dec 28 22:07:02 2012 -0500

    HID: usbhid: quirk for Formosa IR receiver

    commit 320cde19a4e8f122b19d2df7a5c00636e11ca3fb upstream.

    Patch to add the Formosa Industrial Computing, Inc. Infrared Receiver
    [IR605A/Q] to hid-ids.h and hid-quirks.c.  This IR receiver causes about a 10
    second timeout when the usbhid driver attempts to initialze the device.  Adding
    this device to the quirks list with HID_QUIRK_NO_INIT_REPORTS removes the
    delay.

    Signed-off-by: Nicholas Santos <nicholas.santos@gmail.com>
    [jkosina@suse.cz: fix ordering]
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Nicholas Santos <nicholas.santos@gmail.com>
    [jkosina@suse.cz: fix ordering]
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yjw: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d601687bfc8c0dc9ef7fa242c91a18b9a0fee25
Author: Marek Vasut <marex@denx.de>
Date:   Sun Aug 5 23:57:15 2012 +0200

    HID: add quirk for Freescale i.MX28 ROM recovery

    commit 2843b673d03421e0e73cf061820d1db328f7c8eb upstream.

    The USB recovery mode present in i.MX28 ROM emulates USB HID.
    It needs this quirk to behave properly.

    Signed-off-by: Marek Vasut <marex@denx.de>
    Cc: Chen Peter <B29397@freescale.com>
    Cc: Greg KH <greg@kroah.com>
    Cc: Jiri Kosina <jkosina@suse.cz>
    [jkosina@suse.cz: fix alphabetical ordering]
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [yjw: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6535fb1535c0053ac22c2ed5c20b9465f30a523e
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Thu Aug 16 22:06:55 2012 +0200

    intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing it.

    commit 3735d524da64b70b41c764359da36f88aded3610 upstream.

    If the machine is booted without any cpu_idle driver set
    (b/c disable_cpuidle() has been called) we should follow
    other users of cpu_idle API and check the return value
    for NULL before using it.

    Reported-and-tested-by: Mark van Dijk <mark@internecto.net>
    Suggested-by: Jan Beulich <JBeulich@suse.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Cc: Daniel Kiper <daniel.kiper@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23a5a7a2dafd877ec853b4c7debf6d726d10f9b9
Author: Paul Moore <pmoore@redhat.com>
Date:   Wed Mar 19 16:46:18 2014 -0400

    selinux: correctly label /proc inodes in use before the policy is loaded

    commit f64410ec665479d7b4b77b7519e814253ed0f686 upstream.

    This patch is based on an earlier patch by Eric Paris, he describes
    the problem below:

      "If an inode is accessed before policy load it will get placed on a
       list of inodes to be initialized after policy load.  After policy
       load we call inode_doinit() which calls inode_doinit_with_dentry()
       on all inodes accessed before policy load.  In the case of inodes
       in procfs that means we'll end up at the bottom where it does:

         /* Default to the fs superblock SID. */
         isec->sid = sbsec->sid;

         if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
                 if (opt_dentry) {
                         isec->sclass = inode_mode_to_security_class(...)
                         rc = selinux_proc_get_sid(opt_dentry,
                                                   isec->sclass,
                                                   &sid);
                         if (rc)
                                 goto out_unlock;
                         isec->sid = sid;
                 }
         }

       Since opt_dentry is null, we'll never call selinux_proc_get_sid()
       and will leave the inode labeled with the label on the superblock.
       I believe a fix would be to mimic the behavior of xattrs.  Look
       for an alias of the inode.  If it can't be found, just leave the
       inode uninitialized (and pick it up later) if it can be found, we
       should be able to call selinux_proc_get_sid() ..."

    On a system exhibiting this problem, you will notice a lot of files in
    /proc with the generic "proc_t" type (at least the ones that were
    accessed early in the boot), for example:

       # ls -Z /proc/sys/kernel/shmmax | awk '{ print $4 " " $5 }'
       system_u:object_r:proc_t:s0 /proc/sys/kernel/shmmax

    However, with this patch in place we see the expected result:

       # ls -Z /proc/sys/kernel/shmmax | awk '{ print $4 " " $5 }'
       system_u:object_r:sysctl_kernel_t:s0 /proc/sys/kernel/shmmax

    Cc: Eric Paris <eparis@redhat.com>
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Acked-by: Eric Paris <eparis@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd59fb14918a6b20c1ac8be121fa6397b97b00cb
Author: George Spelvin <linux@horizon.com>
Date:   Tue Feb 12 02:27:20 2013 -0500

    pps: Fix a use-after free bug when unregistering a source.

    commit d953e0e837e65ecc1ddaa4f9560f7925878a0de6 upstream.

    Remove the cdev from the system (with cdev_del) *before* deallocating it
    (in pps_device_destruct, called via kobject_put from device_destroy).

    Also prevent deallocating a device with open file handles.

    A better long-term fix is probably to remove the cdev from the pps_device
    entirely, and instead have all devices reference one global cdev.  Then
    the deallocation ordering becomes simpler.

    But that's more complex and invasive change, so we leave that
    for later.

    Signed-off-by: George Spelvin <linux@horizon.com>
    Acked-by: Rodolfo Giometti <giometti@enneenne.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0965dca06d3659d7cdab7a7e40694affc21be3c9
Author: George Spelvin <linux@horizon.com>
Date:   Sun Feb 10 04:41:56 2013 -0500

    pps: Use pps_lookup_dev to reduce ldisc coupling

    commit 03a7ffe4e542310838bac70ef85acc17536b6d7c upstream.

    Now that N_TTY uses tty->disc_data for its private data,
    'subclass' ldiscs cannot use ->disc_data for their own private data.
    (This is a regression is v3.8-rc1)

    Use pps_lookup_dev to associate the tty with the pps source instead.

    This fixes a crashing regression in 3.8-rc1.

    Signed-off-by: George Spelvin <linux@horizon.com>
    Acked-by: Rodolfo Giometti <giometti@enneenne.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71a521898740fc57b062dddd9cff51c9e835cd43
Author: George Spelvin <linux@horizon.com>
Date:   Sun Feb 10 04:08:32 2013 -0500

    pps: Add pps_lookup_dev() function

    commit 513b032c98b4b9414aa4e9b4a315cb1bf0380101 upstream.

    The PPS serial line discipline wants to attach a PPS device to a tty
    without changing the tty code to add a struct pps_device * pointer.

    Since the number of PPS devices in a typical system is generally very low
    (n=1 is by far the most common), it's practical to search the entire list
    of allocated pps devices.  (We capture the timestamp before the lookup,
    so the timing isn't affected.)

    It is a bit ugly that this function, which is part of the in-kernel
    PPS API, has to be in pps.c as opposed to kapi,c, but that's not
    something that affects users.

    Signed-off-by: George Spelvin <linux@horizon.com>
    Acked-by: Rodolfo Giometti <giometti@enneenne.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee164499c5f538f1cd8e5cf31e157aff32ea0546
Author: Philipp Reisner <philipp.reisner@linbit.com>
Date:   Wed Jul 20 14:59:37 2011 +0200

    idr: idr_for_each_entry() macro

    commit 9749f30f1a387070e6e8351f35aeb829eacc3ab6 upstream.

    Inspired by the list_for_each_entry() macro

    Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a27d6987454a169a4f3362e1a14c77ad1aca193
Author: Mathias Krause <minipli@googlemail.com>
Date:   Tue Nov 12 15:11:47 2013 -0800

    ipc, msg: fix message length check for negative values

    commit 4e9b45a19241354daec281d7a785739829b52359 upstream.

    On 64 bit systems the test for negative message sizes is bogus as the
    size, which may be positive when evaluated as a long, will get truncated
    to an int when passed to load_msg().  So a long might very well contain a
    positive value but when truncated to an int it would become negative.

    That in combination with a small negative value of msg_ctlmax (which will
    be promoted to an unsigned type for the comparison against msgsz, making
    it a big positive value and therefore make it pass the check) will lead to
    two problems: 1/ The kmalloc() call in alloc_msg() will allocate a too
    small buffer as the addition of alen is effectively a subtraction.  2/ The
    copy_from_user() call in load_msg() will first overflow the buffer with
    userland data and then, when the userland access generates an access
    violation, the fixup handler copy_user_handle_tail() will try to fill the
    remainder with zeros -- roughly 4GB.  That almost instantly results in a
    system crash or reset.

      ,-[ Reproducer (needs to be run as root) ]--
      | #include <sys/stat.h>
      | #include <sys/msg.h>
      | #include <unistd.h>
      | #include <fcntl.h>
      |
      | int main(void) {
      |     long msg = 1;
      |     int fd;
      |
      |     fd = open("/proc/sys/kernel/msgmax", O_WRONLY);
      |     write(fd, "-1", 2);
      |     close(fd);
      |
      |     msgsnd(0, &msg, 0xfffffff0, IPC_NOWAIT);
      |
      |     return 0;
      | }
      '---

    Fix the issue by preventing msgsz from getting truncated by consistently
    using size_t for the message length.  This way the size checks in
    do_msgsnd() could still be passed with a negative value for msg_ctlmax but
    we would fail on the buffer allocation in that case and error out.

    Also change the type of m_ts from int to size_t to avoid similar nastiness
    in other code paths -- it is used in similar constructs, i.e.  signed vs.
    unsigned checks.  It should never become negative under normal
    circumstances, though.

    Setting msg_ctlmax to a negative value is an odd configuration and should
    be prevented.  As that might break existing userland, it will be handled
    in a separate commit so it could easily be reverted and reworked without
    reintroducing the above described bug.

    Hardening mechanisms for user copy operations would have catched that bug
    early -- e.g.  checking slab object sizes on user copy operations as the
    usercopy feature of the PaX patch does.  Or, for that matter, detect the
    long vs.  int sign change due to truncation, as the size overflow plugin
    of the very same patch does.

    [akpm@linux-foundation.org: fix i386 min() warnings]
    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Pax Team <pageexec@freemail.hu>
    Cc: Davidlohr Bueso <davidlohr@hp.com>
    Cc: Brad Spengler <spender@grsecurity.net>
    Cc: Manfred Spraul <manfred@colorfullife.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - Drop changes to alloc_msg() and copy_msg(), which don't exist]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d19157519c9d76828df39cae34cc0d824356f7db
Author: Ingo Molnar <mingo@kernel.org>
Date:   Thu Oct 10 10:16:30 2013 +0200

    compiler/gcc4: Add quirk for 'asm goto' miscompilation bug

    commit 3f0116c3238a96bc18ad4b4acefe4e7be32fa861 upstream.

    Fengguang Wu, Oleg Nesterov and Peter Zijlstra tracked down
    a kernel crash to a GCC bug: GCC miscompiles certain 'asm goto'
    constructs, as outlined here:

      http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670

    Implement a workaround suggested by Jakub Jelinek.

    Reported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>
    Reported-by: Oleg Nesterov <oleg@redhat.com>
    Reported-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Suggested-by: Jakub Jelinek <jakub@redhat.com>
    Reviewed-by: Richard Henderson <rth@twiddle.net>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [hq: Backported to 3.4: Adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 460207adba76ac1279f4b72e54196b17d5d18cc2
Author: Daniel Santos <daniel.santos@pobox.com>
Date:   Thu Feb 21 16:41:39 2013 -0800

    compiler-gcc.h: Add gcc-recommended GCC_VERSION macro

    commit 3f3f8d2f48acfd8ed3b8e6b7377935da57b27b16 upstream.

    Throughout compiler*.h, many version checks are made.  These can be
    simplified by using the macro that gcc's documentation recommends.
    However, my primary reason for adding this is that I need bug-check
    macros that are enabled at certain gcc versions and it's cleaner to use
    this macro than the tradition method:

      #if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ => 2)

    If you add patch level, it gets this ugly:

      #if __GNUC__ > 4 || (__GNUC__ == 4 && (__GNUC_MINOR__ > 2 || \
          __GNUC_MINOR__ == 2 __GNUC_PATCHLEVEL__ >= 1))

    As opposed to:

      #if GCC_VERSION >= 40201

    While having separate headers for gcc 3 & 4 eliminates some of this
    verbosity, they can still be cleaned up by this.

    See also:

      http://gcc.gnu.org/onlinedocs/cpp/Common-Predefined-Macros.html

    Signed-off-by: Daniel Santos <daniel.santos@pobox.com>
    Acked-by: Borislav Petkov <bp@alien8.de>
    Acked-by: David Rientjes <rientjes@google.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    Cc: Joe Perches <joe@perches.com>
    Cc: Josh Triplett <josh@joshtriplett.org>
    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 00cef7a5e0766f0f4bedc9da1c80fbe992cf68ef
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Aug 28 17:33:37 2013 -0400

    workqueue: cond_resched() after processing each work item

    commit b22ce2785d97423846206cceec4efee0c4afd980 upstream.

    If !PREEMPT, a kworker running work items back to back can hog CPU.
    This becomes dangerous when a self-requeueing work item which is
    waiting for something to happen races against stop_machine.  Such
    self-requeueing work item would requeue itself indefinitely hogging
    the kworker and CPU it's running on while stop_machine would wait for
    that CPU to enter stop_machine while preventing anything else from
    happening on all other CPUs.  The two would deadlock.

    Jamie Liu reports that this deadlock scenario exists around
    scsi_requeue_run_queue() and libata port multiplier support, where one
    port may exclude command processing from other ports.  With the right
    timing, scsi_requeue_run_queue() can end up requeueing itself trying
    to execute an IO which is asked to be retried while another device has
    an exclusive access, which in turn can't make forward progress due to
    stop_machine.

    Fix it by invoking cond_resched() after executing each work item.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Jamie Liu <jamieliu@google.com>
    References: http://thread.gmane.org/gmane.linux.kernel/1552567
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa34e62c2f0d4a105606971a1eb666f22338993b
Author: Bu, Yitian <ybu@qti.qualcomm.com>
Date:   Mon Feb 18 12:53:37 2013 +0000

    printk: Fix rq->lock vs logbuf_lock unlock lock inversion

    commit dbda92d16f8655044e082930e4e9d244b87fde77 upstream.

    commit 07354eb1a74d1 ("locking printk: Annotate logbuf_lock as raw")
    reintroduced a lock inversion problem which was fixed in commit
    0b5e1c5255 ("printk: Release console_sem after logbuf_lock"). This
    happened probably when fixing up patch rejects.

    Restore the ordering and unlock logbuf_lock before releasing
    console_sem.

    Signed-off-by: ybu <ybu@qti.qualcomm.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/r/E807E903FE6CBE4D95E420FBFCC273B827413C@nasanexd01h.na.qualcomm.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0df19efa7549d47aa906b8316665e46366b56061
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Wed Jun 12 14:04:46 2013 -0700

    audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE

    commit f000cfdde5de4fc15dead5ccf524359c07eadf2b upstream.

    audit_log_start() does wait_for_auditd() in a loop until
    audit_backlog_wait_time passes or audit_skb_queue has a room.

    If signal_pending() is true this becomes a busy-wait loop, schedule() in
    TASK_INTERRUPTIBLE won't block.

    Thanks to Guy for fully investigating and explaining the problem.

    (akpm: that'll cause the system to lock up on a non-preemptible
    uniprocessor kernel)

    (Guy: "Our customer was in fact running a uniprocessor machine, and they
    reported a system hang.")

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reported-by: Guy Streeter <streeter@redhat.com>
    Cc: Eric Paris <eparis@redhat.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context, indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c45821f729ca087f87aa9ea08ffe964584a0d605
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Feb 27 17:05:02 2013 -0800

    idr: fix top layer handling

    commit 326cf0f0f308933c10236280a322031f0097205d upstream.

    Most functions in idr fail to deal with the high bits when the idr
    tree grows to the maximum height.

    * idr_get_empty_slot() stops growing idr tree once the depth reaches
      MAX_IDR_LEVEL - 1, which is one depth shallower than necessary to
      cover the whole range.  The function doesn't even notice that it
      didn't grow the tree enough and ends up allocating the wrong ID
      given sufficiently high @starting_id.

      For example, on 64 bit, if the starting id is 0x7fffff01,
      idr_get_empty_slot() will grow the tree 5 layer deep, which only
      covers the 30 bits and then proceed to allocate as if the bit 30
      wasn't specified.  It ends up allocating 0x3fffff01 without the bit
      30 but still returns 0x7fffff01.

    * __idr_remove_all() will not remove anything if the tree is fully
      grown.

    * idr_find() can't find anything if the tree is fully grown.

    * idr_for_each() and idr_get_next() can't iterate anything if the tree
      is fully grown.

    Fix it by introducing idr_max() which returns the maximum possible ID
    given the depth of tree and replacing the id limit checks in all
    affected places.

    As the idr_layer pointer array pa[] needs to be 1 larger than the
    maximum depth, enlarge pa[] arrays by one.

    While this plugs the discovered issues, the whole code base is
    horrible and in desparate need of rewrite.  It's fragile like hell,

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2:
     - Adjust context
     - s/MAX_IDR_LEVEL/MAX_LEVEL/; s/MAX_IDR_SHIFT/MAX_ID_SHIFT/
     - Drop change to idr_alloc()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ca2cf4abaae2bda2feea8ec5eb0d18723a43553
Author: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Date:   Mon Dec 17 16:03:17 2012 -0800

    proc: pid/status: show all supplementary groups

    commit 8d238027b87e654be552eabdf492042a34c5c300 upstream.

    We display a list of supplementary group for each process in
    /proc/<pid>/status.  However, we show only the first 32 groups, not all of
    them.

    Although this is rare, but sometimes processes do have more than 32
    supplementary groups, and this kernel limitation breaks user-space apps
    that rely on the group list in /proc/<pid>/status.

    Number 32 comes from the internal NGROUPS_SMALL macro which defines the
    length for the internal kernel "small" groups buffer.  There is no
    apparent reason to limit to this value.

    This patch removes the 32 groups printing limit.

    The Linux kernel limits the amount of supplementary groups by NGROUPS_MAX,
    which is currently set to 65536.  And this is the maximum count of groups
    we may possibly print.

    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
    Acked-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 01657f8ae5f5e07d2881849ca1e8295032f227e5
Merge: af156c5 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 14 05:37:10 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 25b261ad5d19e0379d33e9f5820de15189de3b28
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Sat Apr 12 03:10:33 2014 +0530

    msm: kgsl: Reset VSC control registers

    Configure the A2xx VSC register in context switch,
    which helps GPU to recover from the bad state.

    CRs-Fixed: 637288
    Change-Id: I2000a579614c491a015c618a52808500541329c5
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit af156c51e56ab672204b42a2f05d6b8ffe906b49
Merge: 1ff147c 4b2affd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 13 11:46:11 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit 4b2affd0c7d5bf2821255a0a883c8b9987ae3d84
Merge: 1ff147c 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 13 06:11:35 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 1ff147cac44fcb6a0ef62c1240ce6dcb82e541a9
Merge: 2341e29 faf8170
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 13 06:01:17 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit faf8170bc6f3fc4e6360cc3d9ac61b6d8e58e014
Merge: 2341e29 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 13 01:52:51 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 2341e2906d010ed3aae9e9dfc0644d9054afa13c
Merge: 4c12898 3dae2d0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 18:46:14 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"""

commit 3dae2d0d45db4c9a8300d1ffc52ecc1fce924abb
Merge: 4c12898 9899d92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 12:05:40 2014 -0700

    Merge "Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock""

commit 4c128983a7df1f69363dea1e23a155138f52f02f
Merge: f76c107 3d0fac6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 04:33:14 2014 -0700

    Merge "Merge "Merge "msm: display: clear sec_active when the pipe is not for secure"""

commit 9899d929e0d94b1850ddad82f4da000d2ce49b77
Merge: 6407aa4 757f3d0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 04:26:45 2014 -0700

    Merge "msm: kgsl: Release process mutex appropriately to avoid deadlock"

commit a26ee7b10012666824e6f08d9c52bfd02cdd0ac3
Merge: c2b8ab6 735c810
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 00:36:01 2014 -0700

    Merge "lib/scatterlist: error handling in __sg_alloc_table()"

commit 3d0fac6720de0d59466970e829468710464c4920
Merge: f76c107 6407aa4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 11 00:12:15 2014 -0700

    Merge "Merge "msm: display: clear sec_active when the pipe is not for secure""

commit f76c1079b5e5825a8571120b016cb668699c9008
Merge: 96c6bf0 ff19f81
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 10 15:29:18 2014 -0700

    Merge "Merge "Merge "msm: display: clear sec_active when the pipe is not for secure"""

commit ff19f81f5f695c12cb6a9ae6ed8aec242b79e0de
Merge: 96c6bf0 6407aa4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 10 09:58:50 2014 -0700

    Merge "Merge "msm: display: clear sec_active when the pipe is not for secure""

commit 96c6bf0062c0b472c19fb8614c49d2155c5eba59
Merge: 0822ed8 96c2b03
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 10 09:48:07 2014 -0700

    Merge "Merge "Merge "lib/scatterlist: error handling in __sg_alloc_table()"""

commit 96c2b03842268efbab3f07d0943a34de28506c0c
Merge: 0822ed8 02723d1
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 10 04:51:20 2014 -0700

    Merge "Merge "lib/scatterlist: error handling in __sg_alloc_table()""

commit 6407aa4c22cb5b3ffaec6161b03cf3f004b6e2c8
Merge: 02723d1 ee13905
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 10 03:59:23 2014 -0700

    Merge "msm: display: clear sec_active when the pipe is not for secure"

commit 735c810563a6f74f68d514c0f1a5a856618a4d05
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Jul 8 16:01:58 2013 -0700

    lib/scatterlist: error handling in __sg_alloc_table()

    I was reviewing code which I suspected might allocate a zero size SG
    table.  That will cause memory corruption.  Also we can't return before
    doing the memset or we could end up using uninitialized memory in the
    cleanup path.

    Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
    CRs-Fixed: 611562
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Akinobu Mita <akinobu.mita@gmail.com>
    Cc: Imre Deak <imre.deak@intel.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Maxim Levitsky <maximlevitsky@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 02723d1762c9f0008b42c12b195e9dafb3c52f0b
Merge: 322bd50 29a6e80
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 21:21:35 2014 -0700

    Merge "lib/scatterlist: error handling in __sg_alloc_table()"

commit 0822ed8cd1dd3ff1267a79f4ffa09ae6b618407a
Merge: 2ea7147 13ad2eb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 15:12:59 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit 29a6e80b583ea3945494ae66b15f9f81488c2c60
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Jul 8 16:01:58 2013 -0700

    lib/scatterlist: error handling in __sg_alloc_table()

    I was reviewing code which I suspected might allocate a zero size SG
    table.  That will cause memory corruption.  Also we can't return before
    doing the memset or we could end up using uninitialized memory in the
    cleanup path.

    Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
    CRs-Fixed: 611562
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Akinobu Mita <akinobu.mita@gmail.com>
    Cc: Imre Deak <imre.deak@intel.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Maxim Levitsky <maximlevitsky@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 13ad2eb823e43cb7b2a0116e4bc4e7755b6d1165
Merge: 2ea7147 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 10:47:18 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit 2ea7147bb8dfc879af94a8dd8bf5d0f7b7388333
Merge: 2b29170 ab814a7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 10:36:54 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit ee1390591f8283e642da6aae38a8d4ab32dbe401
Author: Ken Zhang <kenz@codeaurora.org>
Date:   Wed Jul 17 17:38:18 2013 -0400

    msm: display: clear sec_active when the pipe is not for secure

    Make sure secure memory is unmapped properly

    Change-Id: Ie0f2bc586ab4de45ceaaa6834db64ba7b94b2c0b
    Signed-off-by: Ken Zhang <kenz@codeaurora.org>
    Signed-off-by: c_hharis <hharis@codeaurora.org>
    Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

commit ab814a7b7b55e5b8ba73451a8ad0ae3420107e1b
Merge: 2b29170 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 03:52:37 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit 2b291702fd20a04d0ebf80f6369bfb5fb0627bf9
Merge: 14425c0 3b2d6c7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 9 03:40:59 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit 3b2d6c7f869d2bfb3ee27b91f1d77c1d64c7d84f
Merge: 14425c0 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 8 22:39:39 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit 56aa7518159d3534c44abdfc792ab38d9cf1662d
Merge: b5dcced 6dc167c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 8 08:31:47 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.054 on remote branch"

commit 6dc167c55e62235e41e1de84715cf926dc3a8b5c
Merge: b5dcced 68500aa
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 8 07:20:08 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.054 on remote branch

    Change-Id: I58c28118fb40d9a8992135b6532c8a65ea16d9b7

commit 14425c0be60da2473d5c04aa1b65d3efa52cdfab
Merge: ce0f409 be1b0c6
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 8 04:12:48 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit de4c7ac43ed181acdac25b5944c0fc19d74fb7a1
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Wed Feb 26 11:34:15 2014 +0530

    msm: kgsl: Fix GPU hang recovery logic

    During new commands submission, if the write pointer
    is ahead of read pointer fill ringbuffer data with
    KGSL_NOP_DATA_FILLER after NOP command. This will
    avoids getting incorrect context ID from the ringbuffer
    extraction logic during GPU recovery.

    CRs-Fixed: 620533
    Change-Id: If4d25770b7288bc6fb618611c150e3876cc87c6f
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 837aa9f06c427b2da9b80388ea5f562fdcb79a87
Author: Aravind Kumar <akumark@codeaurora.org>
Date:   Tue Apr 1 20:17:43 2014 +0530

    msm: qdsp6v2: Increase max ports in APR

    Increase the maximum ports in APR. Some Apps may support
    multiple clients which exceeds the number of clients
    supported in APR. This change increases number of ports
    used in APR upto 8 sessions.

    CRs-Fixed: 634388
    Change-Id: I06624330845681b4414dd470ab7aed669d690ba0
    Signed-off-by: Aravind Kumar <akumark@codeaurora.org>

commit 826b14a49cd4c936840aeb78da3583e67ee9816b
Author: Aravind Kumar <akumark@codeaurora.org>
Date:   Tue Apr 1 20:17:43 2014 +0530

    msm: qdsp6v2: Increase max ports in APR

    Increase the maximum ports in APR. Some Apps may support
    multiple clients which exceeds the number of clients
    supported in APR. This change increases number of ports
    used in APR upto 8 sessions.

    CRs-Fixed: 634388
    Change-Id: I06624330845681b4414dd470ab7aed669d690ba0
    Signed-off-by: Aravind Kumar <akumark@codeaurora.org>

commit 54541dfb9a1276b9d698d2f0c858fc6b7b7a395f
Author: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Date:   Thu Oct 25 13:37:51 2012 -0700

    genalloc: stop crashing the system when destroying a pool

    The genalloc code uses the bitmap API from include/linux/bitmap.h and
    lib/bitmap.c, which is based on long values.  Both bitmap_set from
    lib/bitmap.c and bitmap_set_ll, which is the lockless version from
    genalloc.c, use BITMAP_LAST_WORD_MASK to set the first bits in a long in
    the bitmap.

    That one uses (1 << bits) - 1, 0b111, if you are setting the first three
    bits.  This means that the API counts from the least significant bits
    (LSB from now on) to the MSB.  The LSB in the first long is bit 0, then.
    The same works for the lookup functions.

    The genalloc code uses longs for the bitmap, as it should.  In
    include/linux/genalloc.h, struct gen_pool_chunk has unsigned long
    bits[0] as its last member.  When allocating the struct, genalloc should
    reserve enough space for the bitmap.  This should be a proper number of
    longs that can fit the amount of bits in the bitmap.

    However, genalloc allocates an integer number of bytes that fit the
    amount of bits, but may not be an integer amount of longs.  9 bytes, for
    example, could be allocated for 70 bits.

    This is a problem in itself if the Least Significat Bit in a long is in
    the byte with the largest address, which happens in Big Endian machines.
    This means genalloc is not allocating the byte in which it will try to
    set or check for a bit.

    This may end up in memory corruption, where genalloc will try to set the
    bits it has not allocated.  In fact, genalloc may not set these bits
    because it may find them already set, because they were not zeroed since
    they were not allocated.  And that's what causes a BUG when
    gen_pool_destroy is called and check for any set bits.

    What really happens is that genalloc uses kmalloc_node with __GFP_ZERO
    on gen_pool_add_virt.  With SLAB and SLUB, this means the whole slab
    will be cleared, not only the requested bytes.  Since struct
    gen_pool_chunk has a size that is a multiple of 8, and slab sizes are
    multiples of 8, we get lucky and allocate and clear the right amount of
    bytes.

    Hower, this is not the case with SLOB or with older code that did memset
    after allocating instead of using __GFP_ZERO.

    So, a simple module as this (running 3.6.0), will cause a crash when
    rmmod'ed.

      [root@phantom-lp2 foo]# cat foo.c
      #include <linux/kernel.h>
      #include <linux/module.h>
      #include <linux/init.h>
      #include <linux/genalloc.h>

      MODULE_LICENSE("GPL");
      MODULE_VERSION("0.1");

      static struct gen_pool *foo_pool;

      static __init int foo_init(void)
      {
              int ret;
              foo_pool = gen_pool_create(10, -1);
              if (!foo_pool)
                      return -ENOMEM;
              ret = gen_pool_add(foo_pool, 0xa0000000, 32 << 10, -1);
              if (ret) {
                      gen_pool_destroy(foo_pool);
                      return ret;
              }
              return 0;
      }

      static __exit void foo_exit(void)
      {
              gen_pool_destroy(foo_pool);
      }

      module_init(foo_init);
      module_exit(foo_exit);
      [root@phantom-lp2 foo]# zcat /proc/config.gz | grep SLOB
      CONFIG_SLOB=y
      [root@phantom-lp2 foo]# insmod ./foo.ko
      [root@phantom-lp2 foo]# rmmod foo
      ------------[ cut here ]------------
      kernel BUG at lib/genalloc.c:243!
      cpu 0x4: Vector: 700 (Program Check) at [c0000000bb0e7960]
          pc: c0000000003cb50c: .gen_pool_destroy+0xac/0x110
          lr: c0000000003cb4fc: .gen_pool_destroy+0x9c/0x110
          sp: c0000000bb0e7be0
         msr: 8000000000029032
        current = 0xc0000000bb0e0000
        paca    = 0xc000000006d30e00   softe: 0        irq_happened: 0x01
          pid   = 13044, comm = rmmod
      kernel BUG at lib/genalloc.c:243!
      [c0000000bb0e7ca0] d000000004b00020 .foo_exit+0x20/0x38 [foo]
      [c0000000bb0e7d20] c0000000000dff98 .SyS_delete_module+0x1a8/0x290
      [c0000000bb0e7e30] c0000000000097d4 syscall_exit+0x0/0x94
      --- Exception: c00 (System Call) at 000000800753d1a0
      SP (fffd0b0e640) is in userspace

    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Benjamin Gaignard <benjamin.gaignard@stericsson.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Git-commit: eedce141cd2dad8d0cefc5468ef41898949a7031
    Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
    Change-Id: Ic8a8a2d05ee16d59af61d0cc79c88e6e7ab442ae
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit be1b0c6ae69ca614dffd4cd40ee80c7391748667
Merge: ce0f409 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 23:45:21 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit ce0f4097634451cb02a157ce653bdc3397a8dd72
Merge: b5dcced 39947e2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 23:32:11 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit 39947e225c5e019939b20599b9b91de0f988f456
Merge: b5dcced 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 19:01:31 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit b5dccede9c3980158520e7efa567be9fd1a58c58
Merge: ea9f2f6 374986d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 18:50:44 2014 -0700

    Merge "Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"""

commit 374986d7834ce6720acf6f74b1d39c5157f608a6
Merge: ea9f2f6 322bd50
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 13:55:23 2014 -0700

    Merge "Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable""

commit ea9f2f609dd0aff989a0fe6df32e0dbaf6cdd506
Merge: 9d9b01b 1b0abc2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 11:31:30 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit 322bd50e2c79208cbe34fe9f4aeafa605a5193e0
Merge: 61f9d8d 2aaebd0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 10:31:05 2014 -0700

    Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"

commit 61f9d8d1db8833a70c64416b15719160797ac765
Merge: 1c0ed69 4f90882
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 10:31:04 2014 -0700

    Merge "ARM: fix executability of CMA mappings"

commit 1b0abc2e057a9abf9fef039c906afa61a7b8f785
Merge: 9d9b01b 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Apr 7 07:24:41 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit b80da24305280cb5031ba98a1f50ac77170ba5ab
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Mon Apr 7 14:48:44 2014 +0530

    msm: kgsl: Increase IDLE_TIMEOUT for 2D core to 20secs

    Increasing the hang detection time for 2D core from
    10 secs to 20 secs to avoid False GPU Hangs.
    Some c2d test cases are taking more than 10 secs
    to process which results in a False GPU Hang.

    CRs-Fixed: 454439, 644283
    Change-Id: Ice5e4b719adb44cd13fb8164bafedce1049416f7
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit a438cd3227e0a42ad7ab6e6bd45b9006b7108eea
Author: Stephen Smalley <sds@tycho.nsa.gov>
Date:   Thu Jan 30 11:26:59 2014 -0500

    SELinux: Fix kernel BUG on empty security contexts.

    Setting an empty security context (length=0) on a file will
    lead to incorrectly dereferencing the type and other fields
    of the security context structure, yielding a kernel BUG.
    As a zero-length security context is never valid, just reject
    all such security contexts whether coming from userspace
    via setxattr or coming from the filesystem upon a getxattr
    request by SELinux.

    Setting a security context value (empty or otherwise) unknown to
    SELinux in the first place is only possible for a root process
    (CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only
    if the corresponding SELinux mac_admin permission is also granted
    to the domain by policy.  In Fedora policies, this is only allowed for
    specific domains such as livecd for setting down security contexts
    that are not defined in the build host policy.

    [On Android, this can only be set by root/CAP_MAC_ADMIN processes,
    and if running SELinux in enforcing mode, only if mac_admin permission
    is granted in policy.  In Android 4.4, this would only be allowed for
    root/CAP_MAC_ADMIN processes that are also in unconfined domains. In current
    AOSP master, mac_admin is not allowed for any domains except the recovery
    console which has a legitimate need for it.  The other potential vector
    is mounting a maliciously crafted filesystem for which SELinux fetches
    xattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is
    only a local denial-of-service (DOS) due to kernel BUG.  This fix is
    queued for 3.14.]

    Reproducer:
    su
    setenforce 0
    touch foo
    setfattr -n security.selinux foo

    Caveat:
    Relabeling or removing foo after doing the above may not be possible
    without booting with SELinux disabled.  Any subsequent access to foo
    after doing the above will also trigger the BUG.

    BUG output from Matthew Thode:
    [  473.893141] ------------[ cut here ]------------
    [  473.962110] kernel BUG at security/selinux/ss/services.c:654!
    [  473.995314] invalid opcode: 0000 [#6] SMP
    [  474.027196] Modules linked in:
    [  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I
    3.13.0-grsec #1
    [  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0
    07/29/10
    [  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:
    ffff8805f50cd488
    [  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]
    context_struct_compute_av+0xce/0x308
    [  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246
    [  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:
    0000000000000100
    [  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:
    ffff8805e8aaa000
    [  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:
    0000000000000006
    [  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:
    0000000000000006
    [  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:
    0000000000000000
    [  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)
    knlGS:0000000000000000
    [  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:
    00000000000207f0
    [  474.556058] Stack:
    [  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98
    ffff8805f1190a40
    [  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990
    ffff8805e8aac860
    [  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060
    ffff8805c0ac3d94
    [  474.690461] Call Trace:
    [  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a
    [  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b
    [  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179
    [  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4
    [  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31
    [  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e
    [  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22
    [  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d
    [  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91
    [  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b
    [  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30
    [  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3
    [  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b
    [  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48
    8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7
    75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8
    [  475.255884] RIP  [<ffffffff814681c7>]
    context_struct_compute_av+0xce/0x308
    [  475.296120]  RSP <ffff8805c0ac3c38>
    [  475.328734] ---[ end trace f076482e9d754adc ]---

    [sds:  commit message edited to note Android implications and
    to generate a unique Change-Id for gerrit]

    Change-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413
    Reported-by:  Matthew Thode <mthode@mthode.org>
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: stable@vger.kernel.org
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>

commit c2b8ab60c3e017ce9649a05feca43ebdfe3d4ad1
Merge: 6773407 290fa68
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Apr 6 13:25:35 2014 -0700

    Merge "ASoc: msm: qdsp6v2: Fix for NULL check"

commit 9d9b01be18aad71580105f5980290481fc5df88f
Merge: 7ba984a f246376
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 4 12:18:26 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit f246376339fef67ced1ba7d9a00da621d55a1fe3
Merge: 7ba984a 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 4 06:20:34 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit 7ba984a8eddf231f2a0eaf3f33e619dd73b6b132
Merge: c983023 931b3fc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 4 05:47:27 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit 7fa84150b9bff8f848b6b233d25cdadf7ba7572c
Author: Sunil Khatri <sunilkh@codeaurora.org>
Date:   Thu Feb 13 19:52:09 2014 +0530

    genalloc: Correct nbytes calculation on long boundary

    In existing code we calculate nbytes based on the byte
    boundary, but genalloc uses bitmap for maintaining the
    memory allocation aligned to long. So while calculating
    nbytes we end up getting wrong nbytes.
    example: lets say nbytes comes to 9 bytes for 70 bits when
    bytes aligned,but if long aligned we will have 3 long words
    i.e 12 bytes. This difference may lead to choosing the
    wrong api for freeing the memory i.e Between kfree() and
    vfree().
    Fix was inspired by an upstream commit
    eedce141cd2dad8d0cefc5468ef41898949a7031, bringing same fix
    into the gen_pool_detroy path.

    Change-Id: I942caf59e25515c780896b328b912604df9e10bf
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit 931b3fc78b334c6907b44cab5b4cbb767e0b4760
Merge: c983023 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Apr 4 01:10:26 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit c9830237f2abd7dcd6c3ddf0855c5331793e75ce
Merge: 8afef43 ba2cb89
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 3 15:57:03 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit 2aaebd0ad50d0de0e8a6776906a8cd3e42a00ddf
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Wed Oct 23 16:14:59 2013 +0100

    ARM: dma-mapping: don't allow DMA mappings to be marked executable

    DMA mapping permissions were being derived from pgprot_kernel directly
    without using PAGE_KERNEL.  This causes them to be marked with executable
    permission, which is not what we want.  Fix this.

    Change-Id: Ib40f59f3c569f82409943cf8f9a86a9869d922cc
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Git-commit: 0ea1ec713f04bdfac343c9702b21cd3a7c711826
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [lauraa@codeaurora.org: dropped functions not in older builds]
    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

commit 4f90882f2be1f64a4b166fade655f092ee6af544
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Mon Nov 25 12:01:03 2013 +0000

    ARM: fix executability of CMA mappings

    The CMA region was being marked executable:

    0xdc04e000-0xdc050000           8K     RW x      MEM/CACHED/WBRA
    0xdc060000-0xdc100000         640K     RW x      MEM/CACHED/WBRA
    0xdc4f5000-0xdc500000          44K     RW x      MEM/CACHED/WBRA
    0xdcce9000-0xe0000000       52316K     RW x      MEM/CACHED/WBRA

    This is mainly due to the badly worded MT_MEMORY_DMA_READY symbol, but
    there are also a few other places in dma-mapping which should be
    corrected to use the right constant.  Fix all these places:

    0xdc04e000-0xdc050000           8K     RW NX     MEM/CACHED/WBRA
    0xdc060000-0xdc100000         640K     RW NX     MEM/CACHED/WBRA
    0xdc280000-0xdc300000         512K     RW NX     MEM/CACHED/WBRA
    0xdc6fc000-0xe0000000       58384K     RW NX     MEM/CACHED/WBRA

    Change-Id: I044360a8f08b1a4ae3e3e9e623fb77af2b427c51
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Git-commit: 71b55663c5d0a6f8473045db1c8b376803780191
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [lauraa@codeaurora.org: Context fixups due to __dma_remap signature change]
    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

commit 7ae240637ab3477a59d062412f5cf4f84f5de2f9
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Apr 3 11:59:21 2014 -0700

    Linux 3.4.86

commit 8b0da794d8fb4cc4ba410d4bb66fcd0feea0c7d1
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Mon Jan 6 00:57:54 2014 +0100

    netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages

    commit b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 upstream.

    Some occurences in the netfilter tree use skb_header_pointer() in
    the following way ...

      struct dccp_hdr _dh, *dh;
      ...
      skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);

    ... where dh itself is a pointer that is being passed as the copy
    buffer. Instead, we need to use &_dh as the forth argument so that
    we're copying the data into an actual buffer that sits on the stack.

    Currently, we probably could overwrite memory on the stack (e.g.
    with a possibly mal-formed DCCP packet), but unintentionally, as
    we only want the buffer to be placed into _dh variable.

    Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b681ef527f15d5c8995fcf87084fca69473ab946
Author: Artem Fetishev <artem_fetishev@epam.com>
Date:   Fri Mar 28 13:33:39 2014 -0700

    x86: fix boot on uniprocessor systems

    commit 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 upstream.

    On x86 uniprocessor systems topology_physical_package_id() returns -1
    which causes rapl_cpu_prepare() to leave rapl_pmu variable uninitialized
    which leads to GPF in rapl_pmu_init().

    See arch/x86/kernel/cpu/perf_event_intel_rapl.c.

    It turns out that physical_package_id and core_id can actually be
    retreived for uniprocessor systems too.  Enabling them also fixes
    rapl_pmu code.

    Signed-off-by: Artem Fetishev <artem_fetishev@epam.com>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3fcaab061bf7be1419da581e8b0200fcd4ffe751
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Fri Mar 28 01:01:38 2014 -0700

    Input: synaptics - add manual min/max quirk for ThinkPad X240

    commit 8a0435d958fb36d93b8df610124a0e91e5675c82 upstream.

    This extends Benjamin Tissoires manual min/max quirk table with support for
    the ThinkPad X240.

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 969ba04278bdb82e3444a66ead67606430832db0
Author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date:   Fri Mar 28 00:43:00 2014 -0700

    Input: synaptics - add manual min/max quirk

    commit 421e08c41fda1f0c2ff6af81a67b491389b653a5 upstream.

    The new Lenovo Haswell series (-40's) contains a new Synaptics touchpad.
    However, these new Synaptics devices report bad axis ranges.
    Under Windows, it is not a problem because the Windows driver uses RMI4
    over SMBus to talk to the device. Under Linux, we are using the PS/2
    fallback interface and it occurs the reported ranges are wrong.

    Of course, it would be too easy to have only one range for the whole
    series, each touchpad seems to be calibrated in a different way.

    We can not use SMBus to get the actual range because I suspect the firmware
    will switch into the SMBus mode and stop talking through PS/2 (this is the
    case for hybrid HID over I2C / PS/2 Synaptics touchpads).

    So as a temporary solution (until RMI4 land into upstream), start a new
    list of quirks with the min/max manually set.

    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff624a813eef9f51a8d4f3dd8e4f12db9286433d
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sun Mar 30 10:20:01 2014 -0400

    ext4: atomically set inode->i_flags in ext4_set_inode_flags()

    commit 00a1a053ebe5febcfc2ec498bd894f035ad2aa06 upstream.

    Use cmpxchg() to atomically set i_flags instead of clearing out the
    S_IMMUTABLE, S_APPEND, etc. flags and then setting them from the
    EXT4_IMMUTABLE_FL, EXT4_APPEND_FL flags, since this opens up a race
    where an immutable file has the immutable flag cleared for a brief
    window of time.

    Reported-by: John Sullivan <jsrhbz@kanargh.force9.co.uk>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3876a0de0e42e33a0008d4f245474f789eae8499
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Wed Jan 2 02:37:40 2013 +0100

    staging: speakup: Prefix externally-visible symbols

    commit ca2beaf84d9678c12b17d92623f0e90829d6ca13 upstream.

    This prefixes all externally-visible symbols of speakup with "spk_".

    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Cc: Kamal Mostafa <kamal@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ba2cb890a9b37b279720c6827bc34d7298869e9a
Merge: 8afef43 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 3 10:19:33 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit 8afef43aa303af03f908640b17ccbb5e625b0c01
Merge: ba9e6a6 266e86b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 3 10:01:51 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit 266e86bff99d7a80e3674a3a6801ad6b3b696963
Merge: ba9e6a6 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Apr 3 03:48:34 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit ba9e6a6432bf5ba39f1ae2c72654a23783d421b0
Merge: f9c599e 199ad5c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 19:47:00 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit 199ad5c26e119d3a2f4634d36af301d929840acf
Merge: f9c599e 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 13:49:36 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit f9c599e9621f33f541baa629c2d9c992be104f23
Merge: a8e5e41 f1bb35f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 13:32:46 2014 -0700

    Merge "Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check"""

commit f1bb35f8510ef02a3cb30d194549f47b65dba39b
Merge: a8e5e41 1c0ed69
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 06:42:36 2014 -0700

    Merge "Merge "ASoc: msm: qdsp6v2: Fix for NULL check""

commit 290fa68aee65b311e3f5145c0ae2a9d7fa7137d1
Author: Mohammad Johny Shaik <mjshai@codeaurora.org>
Date:   Mon Feb 3 16:59:49 2014 +0530

    ASoc: msm: qdsp6v2: Fix for NULL check

    - Required check added for NULL pointer

    Change-Id: I204dddb37048ba410381e46c0e906d0390951dd9
    CRs-fixed: 583939
    Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>

commit 757f3d01154be8753cf288d277c60e5554dc8f66
Author: Sunil Khatri <sunilkh@codeaurora.org>
Date:   Tue Apr 1 17:56:31 2014 +0530

    msm: kgsl: Release process mutex appropriately to avoid deadlock

    There is a deadlock situation between
    msm_iommu_lock mutex and process_mutex.

    In irq context iommu_fault_handler get into
    a deadlock by aquiring msm_iommu_lock and waiting
    for process mutex. The other thread in
    destroy_process_private is waiting for
    msm_iommu_lock while holding process mutex leading
    to a deadlock. With this change we release the
    process mutex well before we call the function
    in which msm_iommu_lock is taken.

    Change-Id: I674a7512dcd3e7fe202e39b57539cb6c1e29ae0e
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit 1c0ed6984ebf784b3d26fa4ac3aba3ba417abe21
Merge: c6b244d 5e3d1c4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 02:55:09 2014 -0700

    Merge "ASoc: msm: qdsp6v2: Fix for NULL check"

commit c6b244d98b149c5b0464a3a10c9e1560f184921c
Merge: 33d598c 9d06f92
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 02:55:06 2014 -0700

    Merge "defconfig: msm8960: Enable CONFIG_NL80211_TESTMODE in perf config"

commit a8e5e4153bb09ae2d112ceb368d38b2c712f6d70
Merge: e10d7e2 70626e0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Apr 2 01:24:28 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 70626e0e9f75867dcc6ebad682c0abeaac5a2a7e
Merge: e10d7e2 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 1 15:29:03 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit e10d7e29e2f0eb4e80e045635212dc696a363d4f
Merge: 23f0245 5d43cf8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 1 14:59:21 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 68500aab9e213d92ed1dda5d80bff555171bbce1
Merge: 23f0245 d27e346
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 1 09:06:56 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.053 on remote branch"

commit 2d0c1014a617eecfdbcb173b444d687db47b7480
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Apr 1 11:21:58 2014 -0400

    Revert "msm: vidc: cache-invalidate encoder output buffers after alloc"

    This reverts commit c0a1072b7b8004e63d6d961718f70b6ae2a5bd8a.

    Change-Id: I49ee5648ca38b2b5229347f510fe6a8e1372f621

commit 5d43cf8534f5ab0e82c75eb45bd319cf98eeefae
Merge: 23f0245 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 1 07:50:26 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit d27e346dbc7ba8dd9ed1370a522d0c17a1725e3d
Merge: 23f0245 fd3d45e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Apr 1 07:32:12 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.053 on remote branch

    Change-Id: Ic7a332335eedc189d466c8466b30c5cf6c2ace13

commit fcc4b08df00bbf747f43717faacaedf0cd8ede85
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Mon Mar 31 19:39:57 2014 -0400

    Fix borked ifdef logic.

    Change-Id: I23cd2f0b7ef8f67d669fe51aeb3567ba10700725

commit 10725f872f781df08fd3f867e41a4f6c61b02e6d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Mar 31 18:53:51 2014 -0400

    Prima 3.2.7.47

    Change-Id: I724b276f3796fda312f2c6ede92b3414593e8315

commit f1a281719c4ea10489da83480df46a4b497493ae
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Mar 27 23:37:44 2014 -0400

    apexq: tweak torch high brightness

    This change does 2 things. First, it restores the previous behavior for
    Express that any value above 0 will turn the torch on. Second, it turns
    on torch low brightness before turning on high brightness for Apex,
    similar to how the flash works when taking a picture. Otherwise there is
    a risk of stuck gpio if the phone previously was rebooted with the torch
    on.

    Change-Id: I9f5c8800dbdd02ca2c21349a6fad9e3f3a7b0042

commit bb8c68b46f3f94bafb179af0464727aba7b5b14d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Mar 27 23:18:12 2014 -0400

    Revert "remove extraneous loop in apexq camera driver"

    This reverts commit 3af1e420707ebf62ee8e1f9b077038a531cf5364.

    Change-Id: Ie50173b9d36e1806fd8ae1a765a60fd3386544c8

commit 8d8548b1affb96ce4ca03589b1ae76941691f980
Author: John Kirk <jkirk777@gmail.com>
Date:   Fri Mar 28 22:06:21 2014 -0600

    d2dcm uses the same volume settings as its cousins

    Change-Id: Ia47adb4e77ee3a34c78aac77c83be8383f71ce1d

commit b743df3f53291fee2e6a8f366daaacf2df9cdc25
Author: Laura Abbott <lauraa@codeaurora.org>
Date:   Fri Jan 24 15:19:49 2014 -0800

    staging: android: ashmem: Avoid deadlock with mmap/shrink

    Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
    be possible for ashmem_mmap to invoke ashmem_shrink:

    -000|mutex_lock(lock = 0x0)
    -001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
    -002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
    -002|=
    -002|124)
    -003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
    -004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
    -004|0xC11D0940,
    -005|new_slab(s = 0xE4841E80, ?, node = -1)
    -006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
    -006|2148925462, ad
    -007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
    -008|shmem_alloc_inode(?)
    -009|alloc_inode(sb = 0xE480E800)
    -010|new_inode_pseudo(?)
    -011|new_inode(?)
    -012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
    -012|187)
    -013|shmem_file_setup(?, ?, flags = 187)
    -014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
    -015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
    -015|flags = 57,
    -016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
    -016|157, pgoff
    -017|ret_fast_syscall(asm)
    -->|exception
    -018|NUR:0x40097508(asm)
    ---|end of frame

    Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
    is already held, do not attempt to shrink.

    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
    Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>

    Change-Id: I26933f4cc7f5668cb6713e56acb9f895257ddc6b

commit f6623e377649672f392d06f3ce7650e46dfce415
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Feb 12 13:16:00 2014 -0600

    max17040: Stop fuelgauge from raising sporadically

    If the next soc to be applied is greater than the previous, do
    not update capacity. Fixes inconsistent battery stats while
    unplugged (draining), where our battery capacity can show random
    increases in value on occasion.

    Borrowed some code from nvidia's max17048 driver.

    Change-Id: Ia24bdfecb3ba2c3c7c36b29444be7427f8703370
    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 1bab2f1710a947da67e0120e9ffe1d98fd71efb4
Author: Dan Pasanen <dan.pasanen@gmail.com>
Date:   Sat Mar 29 10:26:50 2014 -0500

    bcmdhd: fix build for ENABLE_INSMOD_NO_FW_LOAD

    * WTF is ENABLE_CRAP? At least be SOMEWHAT descriptive.
    * Protip: if it says ENABLE_CRAP in it, you probably don't want it

    Change-Id: I84c3f79ab2b2d24424e7839ad01de9084ec49201

commit 67427b839909b05d938623382a17d2a809855dd6
Author: Ravi Shankar Upadrasta <raviupadrasta@codeaurora.org>
Date:   Mon Dec 9 16:29:42 2013 +0530

    msm: vidc: Enable Video Core command response time

    Change-Id: Iaebd1ea179b647f1a5b26b3dd3c8035040212c35
    Signed-off-by: Ravi Shankar Upadrasta <raviupadrasta@codeaurora.org>

commit 9fc313ab52f828e505ff82c64f19eef340024cb2
Author: Ravi Shankar Upadrasta <raviupadrasta@codeaurora.org>
Date:   Mon Aug 5 20:05:42 2013 +0530

    msm: vidc: Data corrupt flag notification

    send data corrupt flag notification to dvb node only
    when video driver receive decode not correct frame from
    core. In case of approximate decode correct frame reset
    this flag.

    Change-Id: I3b626f7bf54c5e1ff1278595dd9684bf3079480c
    Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
    Signed-off-by: Ravi Shankar Upadrasta <raviupadrasta@codeaurora.org>

commit 7fa2a0b90d06405720678234fb191b75806a51f6
Author: Deepak Verma <dverma@codeaurora.org>
Date:   Thu Dec 19 17:45:05 2013 +0530

    msm: vidc: Add property for setting minimum DPB

    In smooth streaming, number of DPB is obtained
    from device file using resource tracker. But the
    kernel client DVB requires lesser number of DVB.
    In that case, this property can be used by DVB
    to overwrite minimum DPB count with 11.

    Change-Id: Ib4c9c2ac6c4894f47bf7f155b97be23aea82b77a
    Signed-off-by: Deepak Verma <dverma@codeaurora.org>

commit c0a1072b7b8004e63d6d961718f70b6ae2a5bd8a
Author: Praveen Chavan <pchavan@codeaurora.org>
Date:   Mon Oct 28 00:44:14 2013 -0700

    msm: vidc: cache-invalidate encoder output buffers after alloc

    Invalidate output buffers explcitly once, during registration.
    This ensures any pending CPU writes (eg. memset 0 after allocation)
    are not flushed _after_the hardware has written bitstream.

    b/ 11149679

    Change-Id: I958466011e7d96c7b5e2691403c8386309997429
    Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
    Signed-off-by: Ed Tam <etam@google.com>

commit 123725c5ac8308665a6fc60a931cec64ea7edaac
Merge: f5f002a 34a014b
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Mar 31 17:58:28 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

commit f5f002a9edd9eb1f980894e33286b7f6c05dbb62
Merge: a69085b 72cb2a7
Author: Dave Daynard <nardholio@gmail.com>
Date:   Mon Mar 31 17:58:07 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

commit 72cb2a7f426ad822758cb2560f0522f6412f578e
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Mar 30 21:40:45 2014 -0700

    Linux 3.4.85

commit 79dd68bfe15ac3da7e76d2db7fdbccc74026e97f
Author: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
Date:   Wed Mar 26 14:12:19 2014 +0400

    ipc/msg: fix race around refcount

    [fixed differently in 6062a8dc0517bce23e3c2f7d2fea5e22411269a3 upstream.]

    In older kernels (before v3.10) ipc_rcu_hdr->refcount was non-atomic int.
    There was possuble double-free bug: do_msgsnd() calls ipc_rcu_putref() under
    msq->q_perm->lock and RCU, while freequeue() calls it while it holds only
    'rw_mutex', so there is no sinchronization between them. Two function
    decrements '2' non-atomically, they both can get '0' as result.

    do_msgsnd()					freequeue()

    msq = msg_lock_check(ns, msqid);
    ...
    ipc_rcu_getref(msq);
    msg_unlock(msq);
    schedule();
    						(caller locks spinlock)
    						expunge_all(msq, -EIDRM);
    						ss_wakeup(&msq->q_senders, 1);
    						msg_rmid(ns, msq);
    						msg_unlock(msq);
    ipc_lock_by_ptr(&msq->q_perm);
    ipc_rcu_putref(msq);				ipc_rcu_putref(msq);
    < both may get get --(...)->refcount == 0 >

    This patch locks ipc_lock and RCU around ipc_rcu_putref in freequeue.
    ( RCU protects memory for spin_unlock() )

    Similar bugs might be in other users of ipc_rcu_putref().

    In the mainline this has been fixed in v3.10 indirectly in commmit
    6062a8dc0517bce23e3c2f7d2fea5e22411269a3
    ("ipc,sem: fine grained locking for semtimedop") by Rik van Riel.
    That commit optimized locking and converted refcount into atomic.

    I'm not sure that anybody should care about this bug: it's very-very unlikely
    and no longer exists in actual mainline. I've found this just by looking into
    the code, probably this never happens in real life.

    Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>

commit ebaacf5c50f552d1bab829451d9bda5eb55fe337
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Fri Jan 17 15:38:12 2014 -0800

    xhci: Fix resume issues on Renesas chips in Samsung laptops

    commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d upstream.

    Don Zickus <dzickus@redhat.com> writes:

    Some co-workers of mine bought Samsung laptops that had mostly usb3 ports.
    Those ports did not resume correctly (the driver would timeout communicating
    and fail).  This led to frustration as suspend/resume is a common use for
    laptops.

    Poking around, I applied the reset on resume quirk to this chipset and the
    resume started working.  Reloading the xhci_hcd module had been the temporary
    workaround.

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Reported-by: Don Zickus <dzickus@redhat.com>
    Tested-by: Prarit Bhargava <prarit@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit edc36cf320fc69bdf8906cd2de6aef5fe62e77b2
Author: Marcelo Tosatti <mtosatti@redhat.com>
Date:   Fri Jan 3 17:00:51 2014 -0200

    KVM: VMX: fix use after free of vmx->loaded_vmcs

    commit 26a865f4aa8e66a6d94958de7656f7f1b03c6c56 upstream.

    After free_loaded_vmcs executes, the "loaded_vmcs" structure
    is kfreed, and now vmx->loaded_vmcs points to a kfreed area.
    Subsequent free_loaded_vmcs then attempts to manipulate
    vmx->loaded_vmcs.

    Switch the order to avoid the problem.

    https://bugzilla.redhat.com/show_bug.cgi?id=1047892

    Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Cc: Josh Boyer <jwboyer@fedoraproject.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86bbe6ac6eab65ac4346882cb26d91e8ca6c975d
Author: Marcelo Tosatti <mtosatti@redhat.com>
Date:   Thu Dec 19 15:28:51 2013 -0200

    KVM: MMU: handle invalid root_hpa at __direct_map

    commit 989c6b34f6a9480e397b170cc62237e89bf4fdb9 upstream.

    It is possible for __direct_map to be called on invalid root_hpa
    (-1), two examples:

    1) try_async_pf -> can_do_async_pf
        -> vmx_interrupt_allowed -> nested_vmx_vmexit
    2) vmx_handle_exit -> vmx_interrupt_allowed -> nested_vmx_vmexit

    Then to load_vmcs12_host_state and kvm_mmu_reset_context.

    Check for this possibility, let fault exception be regenerated.

    BZ: https://bugzilla.redhat.com/show_bug.cgi?id=924916

    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Josh Boyer <jwboyer@fedoraproject.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 037a05761d3ad2e7cbd417b421031a82de7f5c9f
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon Dec 16 07:09:25 2013 -0800

    Input: elantech - improve clickpad detection

    commit c15bdfd5b9831e4cab8cfc118243956e267dd30e upstream.

    The current assumption in the elantech driver that hw version 3 touchpads
    are never clickpads and hw version 4 touchpads are always clickpads is
    wrong.

    There are several bug reports for this, ie:
    https://bugzilla.redhat.com/show_bug.cgi?id=1030802
    http://superuser.com/questions/619582/right-elantech-touchpad-button-not-working-in-linux

    I've spend a couple of hours wading through various bugzillas, launchpads
    and forum posts to create a list of fw-versions and capabilities for
    different laptop models to find a good method to differentiate between
    clickpads and versions with separate hardware buttons.

    Which shows that a device being a clickpad is reliable indicated by bit 12
    being set in the fw_version. I've included the gathered list inside the
    driver, so that we've this info at hand if we need to revisit this later.

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Josh Boyer <jwboyer@fedoraproject.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a4d65b8421e38d420fcdaeb50feced86f3f6a5c5
Author: Rob Herring <rob.herring@calxeda.com>
Date:   Sat Aug 17 20:12:57 2013 -0500

    ARM: move outer_cache declaration out of ifdef

    commit 0b53c11d533a8f6688d73fad0baf67dd08ec1b90 upstream.

    Move the outer_cache declaration of the CONFIG_OUTER_CACHE ifdef so that
    outer_cache can be used inside IS_ENABLED condition.

    Signed-off-by: Rob Herring <rob.herring@calxeda.com>
    Cc: Russell King <linux@arm.linux.org.uk>
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 714c034f82f17dd89b8b112375038d91bde4e129
Author: Jean Delvare <jdelvare@suse.de>
Date:   Tue Feb 25 09:43:13 2014 +0100

    i7300_edac: Fix device reference count

    commit 75135da0d68419ef8a925f4c1d5f63d8046e314d upstream.

    pci_get_device() decrements the reference count of "from" (last
    argument) so when we break off the loop successfully we have only one
    device reference - and we don't know which device we have. If we want
    a reference to each device, we must take them explicitly and let
    the pci_get_device() walk complete to avoid duplicate references.

    This is serious, as over-putting device references will cause
    the device to eventually disappear. Without this fix, the kernel
    crashes after a few insmod/rmmod cycles.

    Tested on an Intel S7000FC4UR system with a 7300 chipset.

    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Link: http://lkml.kernel.org/r/20140224111656.09bbb7ed@endymion.delvare
    Cc: Mauro Carvalho Chehab <m.chehab@samsung.com>
    Cc: Doug Thompson <dougthompson@xmission.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e78970f0d78cd83382381a6876534424f1d95da4
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Jan 13 22:05:23 2014 +0300

    p54: clamp properly instead of just truncating

    commit 608cfbe4abaf76e9d732efd7ed1cfa3998163d91 upstream.

    The call to clamp_t() first truncates the variable signed 8 bit and as a
    result, the actual clamp is a no-op.

    Fixes: 0d78156eef1d ('p54: improve site survey')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c502e92f7cd92bd80ac0e754842d68fe3c2601f6
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Thu Dec 5 14:37:35 2013 +0000

    deb-pkg: Fix cross-building linux-headers package

    commit f8ce239dfc7ba9add41d9ecdc5e7810738f839fa upstream.

    builddeb generates a control file that says the linux-headers package
    can only be built for the build system primary architecture.  This
    breaks cross-building configurations.  We should use $debarch for this
    instead.

    Since $debarch is not yet set when generating the control file, set
    Architecture: any and use control file variables to fill in the
    description.

    Fixes: cd8d60a20a45 ('kbuild: create linux-headers package in deb-pkg')
    Reported-and-tested-by: "Niew, Sh." <shniew@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5f0a3f764bd1905f8579d781aff4c757d5d0978b
Author: Alexei Starovoitov <ast@plumgrid.com>
Date:   Mon Mar 10 15:56:51 2014 -0700

    x86: bpf_jit: support negative offsets

    commit fdfaf64e75397567257e1051931f9a3377360665 upstream.

    Commit a998d4342337 claimed to introduce negative offset support to x86 jit,
    but it couldn't be working, since at the time of the execution
    of LD+ABS or LD+IND instructions via call into
    bpf_internal_load_pointer_neg_helper() the %edx (3rd argument of this func)
    had junk value instead of access size in bytes (1 or 2 or 4).

    Store size into %edx instead of %ecx (what original commit intended to do)

    Fixes: a998d4342337 ("bpf jit: Let the x86 jit handle negative offsets")
    Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
    Cc: Jan Seiffert <kaffeemonster@googlemail.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 904855a5c90e491a1700e7e6a9268ee00d9bdf39
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Tue Mar 25 17:28:22 2014 +0000

    iwlwifi: Complete backport of "iwlwifi: always copy first 16 bytes of commands"

    Linux 3.4.83 included an incomplete backport of commit
    8a964f44e01ad3bbc208c3e80d931ba91b9ea786 ('iwlwifi: always copy first
    16 bytes of commands') which causes a regression for this driver.
    This is the missing piece.

    Reported-by: Andreas Sturmlechner <andreas.sturmlechner@gmail.com>
    Cc: Johannes Berg <johannes.berg@intel.com>
    Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Cc: Andres Bertens <abertensu@yahoo.com>
    Tested-by: Andreas Sturmlechner <andreas.sturmlechner@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

commit 542a39ac9dd4586a3b74958cadacb47aea3444b0
Author: Josh Durgin <josh.durgin@inktank.com>
Date:   Tue Dec 10 09:35:13 2013 -0800

    libceph: resend all writes after the osdmap loses the full flag

    commit 9a1ea2dbff11547a8e664f143c1ffefc586a577a upstream.

    With the current full handling, there is a race between osds and
    clients getting the first map marked full. If the osd wins, it will
    return -ENOSPC to any writes, but the client may already have writes
    in flight. This results in the client getting the error and
    propagating it up the stack. For rbd, the block layer turns this into
    EIO, which can cause corruption in filesystems above it.

    To avoid this race, osds are being changed to drop writes that came
    from clients with an osdmap older than the last osdmap marked full.
    In order for this to work, clients must resend all writes after they
    encounter a full -> not full transition in the osdmap. osds will wait
    for an updated map instead of processing a request from a client with
    a newer map, so resent writes will not be dropped by the osd unless
    there is another not full -> full transition.

    This approach requires both osds and clients to be fixed to avoid the
    race. Old clients talking to osds with this fix may hang instead of
    returning EIO and potentially corrupting an fs. New clients talking to
    old osds have the same behavior as before if they encounter this race.

    Fixes: http://tracker.ceph.com/issues/6938

    Reviewed-by: Sage Weil <sage@inktank.com>
    Signed-off-by: Josh Durgin <josh.durgin@inktank.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40dea3bd3714383856a1bf90a4c91d4cc2ef44d4
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Wed Mar 19 12:59:39 2014 +0000

    ALSA: compress: Pass through return value of open ops callback

    commit 749d32237bf39e6576dd95bfdf24e4378e51716c upstream.

    The snd_compr_open function would always return 0 even if the compressed
    ops open function failed, obviously this is incorrect. Looks like this
    was introduced by a small typo in:

    commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85
    ALSA: Add a reference counter to card instance

    This patch returns the value from the compressed op as it should.

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23f024561541c8042088b902e8d18542c9daacd6
Merge: 0714f066 ee21f5b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 29 10:09:44 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit ee21f5b33094c68f49abfb64b432992e85c2a205
Merge: 0714f066 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 29 05:34:55 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit 0714f06670ece026daa8cf7ca537b7784fbece4a
Merge: c0dccd5 fb2d82c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 29 05:22:34 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit fb2d82c6fb8a9a0a696c11785354beeed95a55b3
Merge: c0dccd5 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 29 01:03:56 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit c0dccd5ca1c591311c29b488010feb2e7faac0a6
Merge: ecfd1f9 6e0b881
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 29 00:50:36 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit a69085b5a10348ce12bc23356d58df96e139a9fc
Author: Tom Tartaro <tomtartaro@gmail.com>
Date:   Fri Mar 28 21:56:15 2014 -0700

    Revert "input: touchscreen: d2_fw: Update firmware"

    Change-Id: Ic1c336a1044adc0cc155b37e0c7397c1c4f0d1c7

    This reverts commit c2e189edf64901d15359c281889e0500448514d1.

    For some reason this causes either:
    -No boot past splash screen
    -Boot to lockscreen but unresponsive to touch

    This is only the case for some users, most users have no issue using this updated firmware. Revert until we figure out what the issue is.

    Change-Id: I65c8acacbfc847b71730bf18bea8eecc8f57c44c

commit 6e0b88140e26e585ccb91c2b70efc9cb056ed253
Merge: ecfd1f9 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 19:29:47 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit ecfd1f923e0632145a930f29d9db85acefe6e4cd
Merge: 05e241f 9a95179
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 19:15:39 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 9a951793602096b4edc77d5abd1e676ea427a77a
Merge: 05e241f 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 14:41:55 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit 05e241f6e51592b196678f3bbbad56b668c9a157
Merge: 8d55e5a 8afb145
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 14:25:15 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 8afb1459c407d2644f90a1f53074bec2e38cb1cc
Merge: 8d55e5a 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 09:56:46 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit 8d55e5ab33c70d6534f510143a93ad6d4fac3fd4
Merge: bc260ed a0f3db3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 09:28:08 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 0ae467d261cbb8d4c132f5587cd48be90d77ec69
Author: John Kirk <jkirk777@gmail.com>
Date:   Fri Mar 28 09:55:30 2014 -0600

    Allow d2dcm access to charging data table

    Change-Id: I67d599724868d9eeb710dc5d8750ecc5f1fbda49

commit a0f3db3b30cff679cab7d63189150e11619acefa
Merge: bc260ed 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 04:58:30 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit 1924763fa509aaa151eec85367336c9b0c61b313
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Jun 15 13:47:31 2012 +0000

    ARM: mm: remove IPI broadcasting on ASID rollover

    ASIDs are allocated to MMU contexts based on a rolling counter. This
    means that after 255 allocations we must invalidate all existing ASIDs
    via an expensive IPI mechanism to synchronise all of the online CPUs and
    ensure that all tasks execute with an ASID from the new generation.

    This patch changes the rollover behaviour so that we rely instead on the
    hardware broadcasting of the TLB invalidation to avoid the IPI calls.
    This works by keeping track of the active ASID on each core, which is
    then reserved in the case of a rollover so that currently scheduled
    tasks can continue to run. For cores without hardware TLB broadcasting,
    we keep track of pending flushes in a cpumask, so cores can flush their
    local TLB before scheduling a new mm.

    CRs-Fixed: 623919

    Change-Id: I2ed0f2ab6635bf900bcb81e29efbd01991da8e86
    Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
    Tested-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Git-commit: b5466f8728527a05a493cc4abe9e6f034a1bbaab
    Git-repo: https://android.googlesource.com/kernel/common/
    [spathi@codeaurora.org: removed unused function set_asid().
    The function cpu_set_reserved_ttbr0() is not available since patch
    "ARM: Use TTBR1 instead of reserved context ID" is not merged
    so used old functionlity by calling cpu_set_asid(0)]
    Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

commit bc260ed1b4ed1c42939e858e1e6da071cd83aec3
Merge: 4b67747 bac70b4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 04:41:31 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit bac70b43017e5dba1ccfda7059ae45936ce8c061
Merge: 4b67747 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 28 00:15:10 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit 4b67747e12d4d7326d2e065b5b8c8e89d65e3615
Merge: b6aeb09 0243212
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 23:47:08 2014 -0700

    Merge "Merge "Merge "msm: kgsl: fix a race condition when calling kref_put"""

commit 7540d19d8f24fb9f86ee34325f2cb2c1c1688a96
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Wed Feb 5 15:06:37 2014 -0600

    input: mms_ts: Increase touchscreen sensitivity

    With the updated d2 firmware, the previous sensitivity was
    just too much. Since 0xlab used the value of 0xFFFF on their
    development board, let's keep the pattern and use the value
    of 0x0FFF [0xFFF]

    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

    Conflicts:
    	drivers/input/touchscreen/mms_ts_144.c

    Conflicts:
    	drivers/input/touchscreen/mms_ts_144.c

commit 18a17007551493c71b3edfcd1e64985a2e964b3b
Author: Limei Wang <e12499@motorola.com>
Date:   Mon Nov 26 17:44:53 2012 -0600

     (CR) msm_fb: display: reduce turn-on display time.

        When turning on panel, increase its priority and restore it
        after panel has been turned on to reduce Turn-on display
        time when press power key.

        cherry pick commit:c43ca6a4 from main-jb-qc branch.

    Change-Id: Ie0e8e55fc7498a6b2d43ad9e1995fa96c609c81e
    Reviewed-on: http://gerrit.pcs.mot.com/500101
    Tested-by: Jira Key <JIRAKEY@motorola.com>
    Reviewed-by: Bang Nguyen <BNGUYEN1@motorola.com>
    Reviewed-by: Jason Hrycay <jason.hrycay@motorola.com>

    Conflicts:

    	drivers/video/msm/mipi_dsi.c

    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit 02432120c9391f17b51406a885b60dc3da5b8568
Merge: b6aeb09 33d598c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 17:03:11 2014 -0700

    Merge "Merge "msm: kgsl: fix a race condition when calling kref_put""

commit b6aeb090ed14c9e5f67b931b14bf8c595cf17473
Merge: 34a014b d526b4d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 16:47:42 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Fix Z180 memory leak"""

commit 8127c4bd5d096cb2cfff27d217cc41d38a8884ea
Author: Puneet Kumar <puneetster@chromium.org>
Date:   Wed Nov 7 23:47:01 2012 -0800

    CHROMIUM: mm: Fix calculation of dirtyable memory

    The system uses global_dirtyable_memory() to calculate
    number of dirtyable pages/pages that can be allocated
    to the page cache.  A bug causes an underflow thus making
    the page count look like a big unsigned number.  This in turn
    confuses the dirty writeback throttling to aggressively write
    back pages as they become dirty (usually 1 page at a time).

    Fix is to ensure there is no underflow while doing the math.

    Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
    Signed-off-by: Puneet Kumar <puneetster@chromium.org>

    BUG=chrome-os-partner:16011
    TEST=Manual; boot kernel, powerwash, login with testaccount and
    make sure no jank occurs on sync of applications

    Change-Id: I614e7c3156e014f0f28a4ef9bdd8cb8a2cd07b2a
    Reviewed-on: https://gerrit.chromium.org/gerrit/37612
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Olof Johansson <olofj@chromium.org>
    Commit-Ready: Puneet Kumar <puneetster@chromium.org>
    Reviewed-by: Puneet Kumar <puneetster@chromium.org>
    Tested-by: Puneet Kumar <puneetster@chromium.org>

commit 1efa22e0e305e02d89280a839a12c4f117ef40b3
Author: Blackburn <blackburn2929@gmail.com>
Date:   Thu Mar 6 18:14:30 2014 -0600

    More compiler fixes

commit c2e189edf64901d15359c281889e0500448514d1
Author: Luis Cruz <ljc2491@gmail.com>
Date:   Mon Feb 3 01:11:19 2014 -0600

    input: touchscreen: d2_fw: Update firmware

    Update the d2 melfas (mms_ts) binary.

    From the latest Samsung VZW kernel update.

    Signed-off-by: Luis Cruz <ljc2491@gmail.com>

commit a6ccc53b0c2269da6208a274eef4062c304ed871
Author: Shridhar Rasal <srasal@nvidia.com>
Date:   Mon Sep 9 19:17:14 2013 +0530

    cpufreq: interactive: delete timers for GOV_START

    Make sure that timers cpu_timer and cpu_slack_timer
    deactivated before addition of new.

    Change-Id: If31c4049606871df6f00efdc24b1d713c86a6f69
    Signed-off-by: Shridhar Rasal <srasal@nvidia.com>
    Signed-off-by: Bharat Nihalani <bnihalani@nvidia.com>
    Git-commit: b430123367e78a6557bac3cf1558bcb85193fb12
    Git-repo: https://android.googlesource.com/kernel/common/
    [mattw@codeaurora.org: resolved trivial context conflict]
    Signed-off-by: Matt Wagantall <mattw@codeaurora.org>

commit a775df1c94a55d09f115a9c5ef1c8f3c528a3736
Author: Dave Daynard <nardholio@gmail.com>
Date:   Thu Mar 27 16:16:18 2014 -0400

    d2: camera: Finish fixing video enable/disable sequence

    Change-Id: Id03a18aec8acafc78d018b09f23b7f924ff5083e

commit d526b4d7b6ac8bf63a7fadccdd64f2158f5abbe8
Merge: 34a014b 3635bc8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 09:22:28 2014 -0700

    Merge "Merge "msm: kgsl: Fix Z180 memory leak""

commit 33d598cacc9195f5247aa98baa926f283e6d464d
Merge: 3635bc8 97c7dae
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 08:01:51 2014 -0700

    Merge "msm: kgsl: fix a race condition when calling kref_put"

commit 9d06f92aaa261e1442c522814715df5cccb505a3
Author: Dasari Srinivas <dasaris@codeaurora.org>
Date:   Thu Mar 27 16:06:19 2014 +0530

    defconfig: msm8960: Enable CONFIG_NL80211_TESTMODE in perf config

    Enable parameter CONFIG_NL80211_TESTMODE in the perf configuration
    file to enable test mode.

    Change-Id: Ib395f5e7ab2250dd48794e89d327098edfb4653d
    CRs-fixed: 639658
    Signed-off-by: Dasari Srinivas <dasaris@codeaurora.org>

commit 3635bc882bda70f5e8a8ccb1dbb7648300c01186
Merge: 4fce4d7 95e3e3c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 27 05:56:55 2014 -0700

    Merge "msm: kgsl: Fix Z180 memory leak"

commit 97c7dae87a35c4936d532c97d770fea3864a29e9
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Thu Mar 27 11:51:52 2014 +0530

    msm: kgsl: fix a race condition when calling kref_put

    Fix a race condition which can occur if a thread tries to acquire
    a reference to a mem_entry or context while another thread has
    already decremented the refcount to 0 and is in the process of
    destroying said mem_entry or context.

    CRs-Fixed: 635747
    Change-Id: I6be64ca75f9cb12b03e870b9ca83588197c64e5e
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 95e3e3c0e9273218852c5877a9801d1c2dd63f65
Author: Hareesh Gundu <hareeshg@codeaurora.org>
Date:   Wed Mar 26 19:43:57 2014 +0530

    msm: kgsl: Fix Z180 memory leak

    Decerement entry refcount, which incremented
    in kgsl_sharedmem_find_region.

    CRs-Fixed: 635747
    Change-Id: I621ba8f8e119a9ab8ba5455b28a565e3cae2f7cd
    Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

commit 81e4c1401e84d1bdc1957b8f7993c78a556de20a
Author: André Hentschel <nerv@dawncrow.de>
Date:   Tue Jun 18 23:23:26 2013 +0100

    ARM: 7735/2: Preserve the user r/w register TPIDRURW on context switch and fork

    Since commit 6a1c53124aa1 the user writeable TLS register was zeroed to
    prevent it from being used as a covert channel between two tasks.

    There are more and more applications coming to Windows RT,
    Wine could support them, but mostly they expect to have
    the thread environment block (TEB) in TPIDRURW.

    This patch preserves that register per thread instead of clearing it.
    Unlike the TPIDRURO, which is already switched, the TPIDRURW
    can be updated from userspace so needs careful treatment in the case that we
    modify TPIDRURW and call fork(). To avoid this we must always read
    TPIDRURW in copy_thread.

    Change-Id: Ib1e25be7b9faa846ba5335aad2574e21a1246066
    Signed-off-by: André Hentschel <nerv@dawncrow.de>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Git-commit: a4780adeefd042482f624f5e0d577bf9cdcbb760
    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    [joonwoop@codeaurora.org: fixed merge conflict]
    CRs-fixed: 561044
    Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>

commit 34a014be7f533722a2d5ad0bf6b31d439bd9199e
Merge: e0acd62 38f2ae4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 18:28:13 2014 -0700

    Merge "Merge "Merge "kernel:Dont set stop_issued flag in stop recording"""

commit 38f2ae4ca587b72bcf2b1f7630b3929c5c6b241f
Merge: e0acd62 4fce4d7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 13:51:30 2014 -0700

    Merge "Merge "kernel:Dont set stop_issued flag in stop recording""

commit e0acd62b69e2343edea2365c07926afddd923711
Merge: 7e51456e a32df55
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 13:32:37 2014 -0700

    Merge "Merge "Merge "kernel:Dont set stop_issued flag in stop recording"""

commit 811f4b08edfa8cadce3aa879b49057cab546c59f
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Tue Jul 23 10:54:06 2013 -0400

    msm: perf: Add L2 support for tracecounters

    Add L2 counter output to the tracecounters implementation.
    This enables collection of L2 PMU counter values upon context switch.
    Set up filtering based on number of L2 counters and number of cores.
    Read L2 counter values and display them along with L1 counter values.

    Change-Id: I8bbbd251ee52c66505d22ccf037c601013a916f0
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit 12f2d6eba763cd312902cae8ab64c7be10ee6fe4
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Wed Jul 10 12:18:59 2013 -0400

    Perf: Make per-process counters configurable

    Add feature to enable/disable per-process tracecounters at run-time.

    Change-Id: Id6a4c7a0ecd1f5add85464c6ed260860e15c4e3b
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit d0080dd9c2d8cca3f9f8e86d0b4d5d389447ee4c
Author: Sheetal Sahasrabudhe <sheetals@codeaurora.org>
Date:   Tue Jun 18 15:42:41 2013 -0400

    Perf: Fix counts across power collapse

    After entry and exit from power collapse, the perf pm_notifier was
    calling perf_pmu_disable/enable functions from perf core. Perf core
    maintains a counter that it uses to match disable and enable calls but
    since pm_notifier is invoked asynchronously, the counter was getting a
    non-zero value which prevented the pmu from being enabled. As a result of
    this, we were seeing zero counts for some cores across power collapse.

    Make the architecture specific calls directly from pm_notifier.

    Change-Id: I744e190906a20e70e1e4798235215c385018b121
    Signed-off-by: Sheetal Sahasrabudhe <sheetals@codeaurora.org>

commit dbeaf18ef779d7db045d2fe2dd65a53ee54a429b
Author: Ashwin Chaugule <ashwinc@codeaurora.org>
Date:   Thu Mar 14 18:37:49 2013 -0400

    Perf: Add L1 counters to tracepoints

    Create a new tracepoint to get L1 PMU counter
    information at every context switch. Counters
    are captured only when the tracepoint is enabled
    via perf or ftrace.

    Change-Id: If05527b29e04c700170cfdf9f88d300b2f558ffa
    Signed-off-by: Ashwin Chaugule <ashwinc@codeaurora.org>

commit 4bacd56dcdab4c42825c9d3c47280a033b150768
Author: Ashwin Chaugule <ashwinc@codeaurora.org>
Date:   Wed Feb 20 19:12:56 2013 -0500

    Perf: Check perf activity on correct CPU

    The CPU hotplug notifier is not always preempt safe.
    So relying on smp_processor_id() is not correct.

    Use the cpu id from the notifier as the target
    CPU to check for perf activity before hotplug or power
    collapse.

    Change-Id: I1a96b236904a2c8ae2f82bbceab4ca8a195395d1
    Signed-off-by: Ashwin Chaugule <ashwinc@codeaurora.org>

commit a32df55e507a6b07ab9668a87acbc8445680e130
Merge: 7e51456e 4fce4d7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 08:59:39 2014 -0700

    Merge "Merge "kernel:Dont set stop_issued flag in stop recording""

commit 7e51456e0c9bdecf83484e89d5adc9cad3072d9a
Merge: a16cfb9 87f6688
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 08:42:19 2014 -0700

    Merge "Merge "Merge "misc: qfpfuse: validate ioctl input parameters"""

commit fd3d45e2de4218f1fb34714ba7ece8f80108e042
Merge: 0943ae0 544fb4f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 05:04:04 2014 -0700

    Merge "kernel:Dont set stop_issued flag in stop recording"

commit 544fb4f09014af733fbcd213b4bba6c97695d399
Author: Raghu DP <dp.raghu@codeaurora.org>
Date:   Wed Mar 19 11:36:24 2014 +0530

    kernel:Dont set stop_issued flag in stop recording

    stop_issued flag should not be set
    to TRUE during stop recording and liveshot.

    CRs-Fixed: 629368

    Change-Id: Ibf57a4e72e48ad1ce9821415ebf6de01fd881e64
    Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>

commit 87f66884caddd290b8d06fd9951636b0ebca671f
Merge: a16cfb9 90874e2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 04:18:22 2014 -0700

    Merge "Merge "misc: qfpfuse: validate ioctl input parameters""

commit a17a17498d312e04a1371225526b688a51abe8b3
Author: Sunid Wilson <sunidw@codeaurora.org>
Date:   Mon Apr 22 17:58:53 2013 -0700

    msm: gemini: Reset the core incase of overflow error

    Reset the gemini core for the overflow usecases.

    Change-Id: I64b4283806d67615b2963e0d6a42f04a40d6a892
    Signed-off-by: Sunid Wilson <sunidw@codeaurora.org>

commit 4fce4d7de8962aa73c8c949e946d6089dda3f12e
Merge: 08f3bb5 655261c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 02:14:59 2014 -0700

    Merge "kernel:Dont set stop_issued flag in stop recording"

commit 08f3bb5521d7214338d31ea0099d2a949c3feff5
Merge: 2bde224 6c0c6ca
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 02:14:56 2014 -0700

    Merge "msm_fb: Register frame buffer device for device shutdown"

commit 2bde2246e0a0328ea390e24b207db4eca312c14d
Merge: 90874e2 aa9f375
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 26 02:14:53 2014 -0700

    Merge "msm: wfd: Free ion memory properly during a ion failure"

commit 9d95019106f50ad8e8cc85659fa0a50ebf840271
Merge: a8c7f73 b1cee75
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Mar 26 01:06:02 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Change-Id: I1c8cefd404c0cba611c5c4cb4700f6c68bd130af

commit a8c7f739b35c3c05e2cc331ed6ff535d4b875037
Merge: eaf0679 c2877a4
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Mar 26 01:04:57 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Change-Id: I68f8be3caa4a3162ef6760f7057b9fbabdf7de55

commit a16cfb9808bf49fe443b47d0941391603d9e96d4
Merge: 5d45f46 7b11dd4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 15:39:16 2014 -0700

    Merge "Merge "Merge "misc: qfpfuse: validate ioctl input parameters"""

commit 0943ae0d925eb49537dd941986946c2788d75def
Merge: 364477f 16fcc8f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 13:23:17 2014 -0700

    Merge "misc: qfpfuse: validate ioctl input parameters"

commit 364477fa3c2545362ae87cbfc0f87ddf8144f7e8
Merge: 88ad17d 6d36c94
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 13:23:16 2014 -0700

    Merge "misc: qfpfuse: Fix overflow condition"

commit 16fcc8f5c9cefebdba39363d253936d8dcac4750
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Thu Mar 6 18:42:05 2014 +0530

    misc: qfpfuse: validate ioctl input parameters

    validate input parameters for ioctl command request

    CRs-Fixed: 550574,550575
    Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
    Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 6d36c94516a3c0e8ce59f2e40cb1b1616e9c68f2
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Mon Feb 17 16:48:33 2014 +0530

    misc: qfpfuse: Fix overflow condition

    Fix potential integer overflow for ioctl command to avoid incorrect
    buffer allocation. Use the stack for data buffering to avoid the
    small buffer allocation for improved performance. Increase the fuse
    blow timeout in the driver to cover all QFPROM implementations

    CRs-Fixed: 550574,550575

    Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
    Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 7b11dd4df786c29652f1c3388ee3b29ec3a7e1b7
Merge: 5d45f46 90874e2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 11:06:47 2014 -0700

    Merge "Merge "misc: qfpfuse: validate ioctl input parameters""

commit 5d45f46028e2cd361336354f36366db5320be2d3
Merge: ea5d507 63640a1
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 10:45:04 2014 -0700

    Merge "Merge "Merge "misc: qfpfuse: validate ioctl input parameters"""

commit 88ad17d0a947f7d4b8ea3dd4239e973837827481
Merge: c2877a4 1106eb8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 09:25:59 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.050 on remote branch"

commit 9089ad98b0169a80b660be8b27010ae06172886b
Author: Katish Paran <kparan@codeaurora.org>
Date:   Tue Feb 11 23:02:42 2014 +0530

    diag: Remove error message

    Some diag messages are marked as error messages which should
    be marked as debug. This patch fixes that issue.

    Change-Id: If24b6cfdfca40321ff403826d8c149e8a3032803
    Signed-off-by: Katish Paran <kparan@codeaurora.org>

commit eaf06791fafacfa9d87e565f830d6a8ff96c4746
Author: myfluxi <linflux@arcor.de>
Date:   Sat Mar 22 00:04:58 2014 +0100

    cpufreq: Fix broken uevents for cpufreq governor and cpu devices

    cyanogens uevent commit when the governor changes was rendered
    non-working since kitkat (or so) as the uevent filter function
    caused events to be dropped. Now hook into cpufreq_core_init()
    and cpufreq_add_dev_interface() to create our basic ksets for
    cpufreq and cpu devices. Also, we don't need to set environmental
    data, so clean it up a bit.

    This commit requires a change in ueventd.rc that add rules for
    several files of interest.

    Change-Id: I3aafa0d4e18363e1d68535f513099ecd27024007

commit 1106eb80cdd672e9f523cdc592de5f63fcfa1d9d
Merge: c2877a4 e1926e0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 08:20:30 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.050 on remote branch

    Change-Id: I18517e189b57ce14b9924017db713c3e20acfc58

commit 63640a10f70e746ddd3f306128fef92d75b900a6
Merge: ea5d507 90874e2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 06:12:09 2014 -0700

    Merge "Merge "misc: qfpfuse: validate ioctl input parameters""

commit 677340793539edd0f0587de2cc2090c74590a7b2
Merge: e88ce68 4ce3a62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 06:01:57 2014 -0700

    Merge "misc: qfpfuse: validate ioctl input parameters"

commit e88ce68f4042ee51c2e44790e234c69ba6ca0666
Merge: dfc0494 29f9d9f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 06:01:53 2014 -0700

    Merge "misc: qfpfuse: Fix overflow condition"

commit dfc0494ee26ddf1a9c35a0cbb4f6de4c51fa5747
Merge: e1926e0 a7226cf
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 06:01:49 2014 -0700

    Merge "ASoC: msm: Null dereference check added"

commit ea5d50797e08664c4ef4d46757cedb5a12c9dafc
Merge: 2d7bc7b feb99be
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 04:45:37 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit 4ce3a62067542f773fe24e651e05ce12d9713148
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Thu Mar 6 18:42:05 2014 +0530

    misc: qfpfuse: validate ioctl input parameters

    validate input parameters for ioctl command request

    CRs-Fixed: 550574,550575

    Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
    Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 29f9d9f30b141a5a36b027dbd212a5ebe45064c6
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Mon Feb 17 16:48:33 2014 +0530

    misc: qfpfuse: Fix overflow condition

    Fix potential integer overflow for ioctl command to avoid incorrect
    buffer allocation. Use the stack for data buffering to avoid the
    small buffer allocation for improved performance. Increase the fuse
    blow timeout in the driver to cover all QFPROM implementations.

    CRs-Fixed: 550574,550575

    Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
    Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit a7226cffa9dcaca7e03429c1bd379a423418a611
Author: Anish Kumar <kanish@codeaurora.org>
Date:   Thu Mar 13 19:43:48 2014 +0530

    ASoC: msm: Null dereference check added

    In asm_read function we should check buffer pointer
    before it is dererferenced.

    CRs-Fixed: 612682
    Change-Id: I1968c038e1d35381bf174000287d542441e41092
    Signed-off-by: Anish Kumar <kanish@codeaurora.org>

commit feb99bec37aaf4b7f345835c923f8798ed1f4936
Merge: 2d7bc7b 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 00:02:13 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit 90874e2539466662f669932df25765f0b256c26b
Merge: c327bcf 8986ab4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 00:01:16 2014 -0700

    Merge "misc: qfpfuse: validate ioctl input parameters"

commit c327bcf6a57c0f2ef715833aa5abebbf944694b7
Merge: 9eb22a9 3fcaeb0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 25 00:01:13 2014 -0700

    Merge "misc: qfpfuse: Fix overflow condition"

commit 2d7bc7b4c1dc1d2a91c586c9798609f9448811b1
Merge: c2877a4 2d23917
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 24 21:06:16 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit 2d2391772ff9516dbf92a3492de89d17799ded64
Merge: c2877a4 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 24 15:35:01 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit c2877a4e8b4a9ab72c98273b1153331d3c108b08
Merge: cfefc53 97fb1a5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 24 15:11:57 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit 97fb1a5a59ac2cc0018594068bb0afb9bef1e3b1
Merge: cfefc53 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 24 10:35:05 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit 8986ab4de9c08ed67aa12f69d2b47b339fdddb0f
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Thu Mar 6 18:42:05 2014 +0530

    misc: qfpfuse: validate ioctl input parameters

    validate input parameters for ioctl command request

    CRs-Fixed: 550574,550575
    Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
    Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 3fcaeb082ccf008d76975c255a1b945edad3e376
Author: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Date:   Mon Feb 17 16:48:33 2014 +0530

    misc: qfpfuse: Fix overflow condition

    Fix potential integer overflow for ioctl command to avoid incorrect
    buffer allocation. Use the stack for data buffering to avoid the
    small buffer allocation for improved performance. Increase the fuse
    blow timeout in the driver to cover all QFPROM implementations

    CRs-Fixed: 550574,550575

    Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
    Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
    Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit b1cee752ee0c04f424cb71ba0c8013c793008296
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Mar 23 21:38:33 2014 -0700

    Linux 3.4.84

commit 7c0a02e992288885502a4795d42c99e3a2ee7141
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Sat Jul 27 03:53:54 2013 -0700

    jiffies: Avoid undefined behavior from signed overflow

    commit 5a581b367b5df0531265311fc681c2abd377e5e6 upstream.

    According to the C standard 3.4.3p3, overflow of a signed integer results
    in undefined behavior.  This commit therefore changes the definitions
    of time_after(), time_after_eq(), time_after64(), and time_after_eq64()
    to avoid this undefined behavior.  The trick is that the subtraction
    is done using unsigned arithmetic, which according to 6.2.5p9 cannot
    overflow because it is defined as modulo arithmetic.  This has the added
    (though admittedly quite small) benefit of shortening four lines of code
    by four characters each.

    Note that the C standard considers the cast from unsigned to
    signed to be implementation-defined, see 6.3.1.3p3.  However, on a
    two's-complement system, an implementation that defines anything other
    than a reinterpretation of the bits is free to come to me, and I will be
    happy to act as a witness for its being committed to an insane asylum.
    (Although I have nothing against saturating arithmetic or signals in some
    cases, these things really should not be the default when compiling an
    operating-system kernel.)

    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: John Stultz <john.stultz@linaro.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Kevin Easton <kevin@guarana.org>
    [ paulmck: Included time_after64() and time_after_eq64(), as suggested
      by Eric Dumazet, also fixed commit message.]
    Reviewed-by: Josh Triplett <josh@joshtriplett.org>
    Ruchi Kandoi <kandoiruchi@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 212b46549b387fb63b81d0209c3d4db9df4c985f
Author: Roman Volkov <v1ron@mail.ru>
Date:   Fri Jan 24 16:18:11 2014 +0400

    ALSA: oxygen: modify adjust_dg_dac_routing function

    commit 1f91ecc14deea9461aca93273d78871ec4d98fcd upstream.

    When selecting the audio output destinations (headphones,
    FP headphones, multichannel output), the channel routing
    should be changed depending on what destination selected.
    Also unnecessary I2S channels are digitally muted. This
    function called when the user selects the destination
    in the ALSA mixer.

    Signed-off-by: Roman Volkov <v1ron@mail.ru>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dba79490e526dbca167e41b46745f168c356ffe5
Author: Filipe David Borba Manana <fdmanana@gmail.com>
Date:   Sat Feb 8 15:47:46 2014 +0000

    Btrfs: fix data corruption when reading/updating compressed extents

    commit a2aa75e18a21b21952dc6daa9bac7c9f4426f81f upstream.

    When using a mix of compressed file extents and prealloc extents, it
    is possible to fill a page of a file with random, garbage data from
    some unrelated previous use of the page, instead of a sequence of zeroes.

    A simple sequence of steps to get into such case, taken from the test
    case I made for xfstests, is:

       _scratch_mkfs
       _scratch_mount "-o compress-force=lzo"
       $XFS_IO_PROG -f -c "pwrite -S 0x06 -b 18670 266978 18670" $SCRATCH_MNT/foobar
       $XFS_IO_PROG -c "falloc 26450 665194" $SCRATCH_MNT/foobar
       $XFS_IO_PROG -c "truncate 542872" $SCRATCH_MNT/foobar
       $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/foobar

    This results in the following file items in the fs tree:

       item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160
           inode generation 6 transid 6 size 542872 block group 0 mode 100600
       item 5 key (257 INODE_REF 256) itemoff 15863 itemsize 16
           inode ref index 2 namelen 6 name: foobar
       item 6 key (257 EXTENT_DATA 0) itemoff 15810 itemsize 53
           extent data disk byte 0 nr 0 gen 6
           extent data offset 0 nr 24576 ram 266240
           extent compression 0
       item 7 key (257 EXTENT_DATA 24576) itemoff 15757 itemsize 53
           prealloc data disk byte 12849152 nr 241664 gen 6
           prealloc data offset 0 nr 241664
       item 8 key (257 EXTENT_DATA 266240) itemoff 15704 itemsize 53
           extent data disk byte 12845056 nr 4096 gen 6
           extent data offset 0 nr 20480 ram 20480
           extent compression 2
       item 9 key (257 EXTENT_DATA 286720) itemoff 15651 itemsize 53
           prealloc data disk byte 13090816 nr 405504 gen 6
           prealloc data offset 0 nr 258048

    The on disk extent at offset 266240 (which corresponds to 1 single disk block),
    contains 5 compressed chunks of file data. Each of the first 4 compress 4096
    bytes of file data, while the last one only compresses 3024 bytes of file data.
    Therefore a read into the file region [285648 ; 286720[ (length = 4096 - 3024 =
    1072 bytes) should always return zeroes (our next extent is a prealloc one).

    The solution here is the compression code path to zero the remaining (untouched)
    bytes of the last page it uncompressed data into, as the information about how
    much space the file data consumes in the last page is not known in the upper layer
    fs/btrfs/extent_io.c:__do_readpage(). In __do_readpage we were correctly zeroing
    the remainder of the page but only if it corresponds to the last page of the inode
    and if the inode's size is not a multiple of the page size.

    This would cause not only returning random data on reads, but also permanently
    storing random data when updating parts of the region that should be zeroed.
    For the example above, it means updating a single byte in the region [285648 ; 286720[
    would store that byte correctly but also store random data on disk.

    A test case for xfstests follows soon.

    Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com>
    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c1de3509ed50e5091ee1344689e6c0552943787
Author: Ales Novak <alnovak@suse.cz>
Date:   Thu Feb 27 11:03:30 2014 +0100

    SCSI: storvsc: NULL pointer dereference fix

    commit b12bb60d6c350b348a4e1460cd68f97ccae9822e upstream.

    If the initialization of storvsc fails, the storvsc_device_destroy()
    causes NULL pointer dereference.

    storvsc_bus_scan()
      scsi_scan_target()
        __scsi_scan_target()
          scsi_probe_and_add_lun(hostdata=NULL)
            scsi_alloc_sdev(hostdata=NULL)

    	  sdev->hostdata = hostdata

    	  now the host allocation fails

              __scsi_remove_device(sdev)

    	  calls sdev->host->hostt->slave_destroy() ==
    	  storvsc_device_destroy(sdev)
    	    access of sdev->hostdata->request_mempool

    Signed-off-by: Ales Novak <alnovak@suse.cz>
    Signed-off-by: Thomas Abraham <tabraham@suse.com>
    Reviewed-by: Jiri Kosina <jkosina@suse.cz>
    Acked-by: K. Y. Srinivasan <kys@microsoft.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3ce68dc6e9d3126c33a52879f9d0d45da670bfc0
Author: Giridhar Malavali <giridhar.malavali@qlogic.com>
Date:   Wed Feb 26 04:15:12 2014 -0500

    SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx

    commit b77ed25c9f8402e8b3e49e220edb4ef09ecfbb53 upstream.

    Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
    Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d9e8942e554ef56cdfb4166fac2245f40faa1299
Author: Lukasz Dorau <lukasz.dorau@intel.com>
Date:   Thu Feb 6 12:23:20 2014 -0800

    SCSI: isci: correct erroneous for_each_isci_host macro

    commit c59053a23d586675c25d789a7494adfdc02fba57 upstream.

    In the first place, the loop 'for' in the macro 'for_each_isci_host'
    (drivers/scsi/isci/host.h:314) is incorrect, because it accesses
    the 3rd element of 2 element array. After the 2nd iteration it executes
    the instruction:
            ihost = to_pci_info(pdev)->hosts[2]
    (while the size of the 'hosts' array equals 2) and reads an
    out of range element.

    In the second place, this loop is incorrectly optimized by GCC v4.8
    (see http://marc.info/?l=linux-kernel&m=138998871911336&w=2).
    As a result, on platforms with two SCU controllers,
    the loop is executed more times than it can be (for i=0,1 and 2).
    It causes kernel panic during entering the S3 state
    and the following oops after 'rmmod isci':

    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [<ffffffff8131360b>] __list_add+0x1b/0xc0
    Oops: 0000 [#1] SMP
    RIP: 0010:[<ffffffff8131360b>]  [<ffffffff8131360b>] __list_add+0x1b/0xc0
    Call Trace:
      [<ffffffff81661b84>] __mutex_lock_slowpath+0x114/0x1b0
      [<ffffffff81661c3f>] mutex_lock+0x1f/0x30
      [<ffffffffa03e97cb>] sas_disable_events+0x1b/0x50 [libsas]
      [<ffffffffa03e9818>] sas_unregister_ha+0x18/0x60 [libsas]
      [<ffffffffa040316e>] isci_unregister+0x1e/0x40 [isci]
      [<ffffffffa0403efd>] isci_pci_remove+0x5d/0x100 [isci]
      [<ffffffff813391cb>] pci_device_remove+0x3b/0xb0
      [<ffffffff813fbf7f>] __device_release_driver+0x7f/0xf0
      [<ffffffff813fc8f8>] driver_detach+0xa8/0xb0
      [<ffffffff813fbb8b>] bus_remove_driver+0x9b/0x120
      [<ffffffff813fcf2c>] driver_unregister+0x2c/0x50
      [<ffffffff813381f3>] pci_unregister_driver+0x23/0x80
      [<ffffffffa04152f8>] isci_exit+0x10/0x1e [isci]
      [<ffffffff810d199b>] SyS_delete_module+0x16b/0x2d0
      [<ffffffff81012a21>] ? do_notify_resume+0x61/0xa0
      [<ffffffff8166ce29>] system_call_fastpath+0x16/0x1b

    The loop has been corrected.
    This patch fixes kernel panic during entering the S3 state
    and the above oops.

    Signed-off-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com>
    Tested-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff441dfac9b76ec26200b999c34ff09ecfe05672
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Thu Feb 6 12:23:01 2014 -0800

    SCSI: isci: fix reset timeout handling

    commit ddfadd7736b677de2d4ca2cd5b4b655368c85a7a upstream.

    Remove an erroneous BUG_ON() in the case of a hard reset timeout.  The
    reset timeout handler puts the port into the "awaiting link-up" state.
    The timeout causes the device to be disconnected and we need to be in
    the awaiting link-up state to re-connect the port.  The BUG_ON() made
    the incorrect assumption that resets never timeout and we always
    complete the reset in the "resetting" state.

    Testing this patch also uncovered that libata continues to attempt to
    reset the port long after the driver has torn down the context.  Once
    the driver has committed to abandoning the link it must indicate to
    libata that recovery ends by returning -ENODEV from
    ->lldd_I_T_nexus_reset().

    Acked-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Reported-by: David Milburn <dmilburn@redhat.com>
    Reported-by: Xun Ni <xun.ni@intel.com>
    Tested-by: Xun Ni <xun.ni@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8d17b6ff32a85be53f8055af5b35dc0cb96f62a
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Fri Feb 28 14:52:01 2014 +0100

    can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails

    commit 7e9e148af01ef388efb6e2490805970be4622792 upstream.

    If flexcan_chip_start() in flexcan_open() fails, the interrupt is not freed,
    this patch adds the missing cleanup.

    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e764c599eb843a09e8c1f3aa6d4d86acd59c31c
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Mar 13 10:44:34 2014 +0100

    vmxnet3: fix building without CONFIG_PCI_MSI

    commit 0a8d8c446b5429d15ff2d48f46e00d8a08552303 upstream.

    Since commit d25f06ea466e "vmxnet3: fix netpoll race condition",
    the vmxnet3 driver fails to build when CONFIG_PCI_MSI is disabled,
    because it unconditionally references the vmxnet3_msix_rx()
    function.

    To fix this, use the same #ifdef in the caller that exists around
    the function definition.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Cc: Shreyas Bhatewara <sbhatewara@vmware.com>
    Cc: "VMware, Inc." <pv-drivers@vmware.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6b4741d6d9a5347e4bff4eaad1bb68621d841592
Author: Neil Horman <nhorman@tuxdriver.com>
Date:   Mon Mar 10 06:55:55 2014 -0400

    vmxnet3: fix netpoll race condition

    commit d25f06ea466ea521b563b76661180b4e44714ae6 upstream.

    vmxnet3's netpoll driver is incorrectly coded.  It directly calls
    vmxnet3_do_poll, which is the driver internal napi poll routine.  As the netpoll
    controller method doesn't block real napi polls in any way, there is a potential
    for race conditions in which the netpoll controller method and the napi poll
    method run concurrently.  The result is data corruption causing panics such as this
    one recently observed:
    PID: 1371   TASK: ffff88023762caa0  CPU: 1   COMMAND: "rs:main Q:Reg"
     #0 [ffff88023abd5780] machine_kexec at ffffffff81038f3b
     #1 [ffff88023abd57e0] crash_kexec at ffffffff810c5d92
     #2 [ffff88023abd58b0] oops_end at ffffffff8152b570
     #3 [ffff88023abd58e0] die at ffffffff81010e0b
     #4 [ffff88023abd5910] do_trap at ffffffff8152add4
     #5 [ffff88023abd5970] do_invalid_op at ffffffff8100cf95
     #6 [ffff88023abd5a10] invalid_op at ffffffff8100bf9b
        [exception RIP: vmxnet3_rq_rx_complete+1968]
        RIP: ffffffffa00f1e80  RSP: ffff88023abd5ac8  RFLAGS: 00010086
        RAX: 0000000000000000  RBX: ffff88023b5dcee0  RCX: 00000000000000c0
        RDX: 0000000000000000  RSI: 00000000000005f2  RDI: ffff88023b5dcee0
        RBP: ffff88023abd5b48   R8: 0000000000000000   R9: ffff88023a3b6048
        R10: 0000000000000000  R11: 0000000000000002  R12: ffff8802398d4cd8
        R13: ffff88023af35140  R14: ffff88023b60c890  R15: 0000000000000000
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
     #7 [ffff88023abd5b50] vmxnet3_do_poll at ffffffffa00f204a [vmxnet3]
     #8 [ffff88023abd5b80] vmxnet3_netpoll at ffffffffa00f209c [vmxnet3]
     #9 [ffff88023abd5ba0] netpoll_poll_dev at ffffffff81472bb7

    The fix is to do as other drivers do, and have the poll controller call the top
    half interrupt handler, which schedules a napi poll properly to recieve frames

    Tested by myself, successfully.

    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    CC: Shreyas Bhatewara <sbhatewara@vmware.com>
    CC: "VMware, Inc." <pv-drivers@vmware.com>
    CC: "David S. Miller" <davem@davemloft.net>
    Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18bd55f61fa9f46082820741d753b3b919244d8a
Author: Radim Krčmář <rkrcmar@redhat.com>
Date:   Tue Mar 11 19:11:18 2014 +0100

    KVM: SVM: fix cr8 intercept window

    commit 596f3142d2b7be307a1652d59e7b93adab918437 upstream.

    We always disable cr8 intercept in its handler, but only re-enable it
    if handling KVM_REQ_EVENT, so there can be a window where we do not
    intercept cr8 writes, which allows an interrupt to disrupt a higher
    priority task.

    Fix this by disabling intercepts in the same function that re-enables
    them when needed. This fixes BSOD in Windows 2008.

    Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
    Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dab50632efb9ed42ee352c3588a3e107dff66bb
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Mar 6 18:09:52 2014 -0500

    drm/radeon/atom: select the proper number of lanes in transmitter setup

    commit d03874c881a049a50e12f285077ab1f9fc2686e1 upstream.

    We need to check for DVI vs. HDMI when setting up duallink since
    HDMI is single link only.  Fixes 4k modes on newer asics.

    bug:
    https://bugs.freedesktop.org/show_bug.cgi?id=75223

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bfe635e52ede4c72819099b0fce72e28eec6e6c6
Author: Artem Fetishev <artem_fetishev@epam.com>
Date:   Mon Mar 10 15:49:45 2014 -0700

    fs/proc/base.c: fix GPF in /proc/$PID/map_files

    commit 70335abb2689c8cd5df91bf2d95a65649addf50b upstream.

    The expected logic of proc_map_files_get_link() is either to return 0
    and initialize 'path' or return an error and leave 'path' uninitialized.

    By the time dname_to_vma_addr() returns 0 the corresponding vma may have
    already be gone.  In this case the path is not initialized but the
    return value is still 0.  This results in 'general protection fault'
    inside d_path().

    Steps to reproduce:

      CONFIG_CHECKPOINT_RESTORE=y

        fd = open(...);
        while (1) {
            mmap(fd, ...);
            munmap(fd, ...);
        }

      ls -la /proc/$PID/map_files

    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=68991

    Signed-off-by: Artem Fetishev <artem_fetishev@epam.com>
    Signed-off-by: Aleksandr Terekhov <aleksandr_terekhov@epam.com>
    Reported-by: <wiebittewas@gmail.com>
    Acked-by: Pavel Emelyanov <xemul@parallels.com>
    Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
    Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e877d416818ff7439d01f88bf6d70131a27f730e
Author: Trond Myklebust <trond.myklebust@primarydata.com>
Date:   Sun Mar 2 22:03:12 2014 -0500

    NFS: Fix a delegation callback race

    commit 755a48a7a4eb05b9c8424e3017d947b2961a60e0 upstream.

    The clean-up in commit 36281caa839f ended up removing a NULL pointer check
    that is needed in order to prevent an Oops in
    nfs_async_inode_return_delegation().

    Reported-by: "Yan, Zheng" <zheng.z.yan@intel.com>
    Link: http://lkml.kernel.org/r/5313E9F6.2020405@intel.com
    Fixes: 36281caa839f (NFSv4: Further clean-ups of delegation stateid validation)
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02a4ed4a5b0febad6f129e65ab9ae4794b51a61b
Author: Michele Baldessari <michele@acksyn.org>
Date:   Fri Mar 7 16:34:29 2014 +0000

    libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8 (2BA30001)

    commit b28a613e9138e4b3a64649bd60b13436f4b4b49b upstream.

    Via commit 87809942d3fa "libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk
    for Seagate Momentus SpinPoint M8" we added a quirk for disks named
    "ST1000LM024 HN-M101MBB" with firmware revision "2AR10001".

    As reported on https://bugzilla.redhat.com/show_bug.cgi?id=1073901,
    we need to also add firmware revision 2BA30001 as it is broken as well.

    Reported-by: Nicholas <arealityfarbetween@googlemail.com>
    Signed-off-by: Michele Baldessari <michele@acksyn.org>
    Tested-by: Guilherme Amadio <guilherme.amadio@gmail.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8637162b3632012f6d418076e84701086fb83b5
Author: Tejun Heo <tj@kernel.org>
Date:   Fri Mar 7 10:19:57 2014 -0500

    firewire: don't use PREPARE_DELAYED_WORK

    commit 70044d71d31d6973665ced5be04ef39ac1c09a48 upstream.

    PREPARE_[DELAYED_]WORK() are being phased out.  They have few users
    and a nasty surprise in terms of reentrancy guarantee as workqueue
    considers work items to be different if they don't have the same work
    function.

    firewire core-device and sbp2 have been been multiplexing work items
    with multiple work functions.  Introduce fw_device_workfn() and
    sbp2_lu_workfn() which invoke fw_device->workfn and
    sbp2_logical_unit->workfn respectively and always use the two
    functions as the work functions and update the users to set the
    ->workfn fields instead of overriding work functions using
    PREPARE_DELAYED_WORK().

    This fixes a variety of possible regressions since a2c1c57be8d9
    "workqueue: consider work function when searching for busy work items"
    due to which fw_workqueue lost its required non-reentrancy property.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Cc: linux1394-devel@lists.sourceforge.net
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f37058b88772ed4de812d1716634649ee1e6480e
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Tue Feb 18 22:25:15 2014 +0100

    firewire: net: fix use after free

    commit 8987583366ae9e03c306c2b7d73bdb952df1d08d upstream.

    Commit 8408dc1c14c1 "firewire: net: use dev_printk API" introduced a
    use-after-free in a failure path.  fwnet_transmit_packet_failed(ptask)
    may free ptask, then the dev_err() call dereferenced it.  The fix is
    straightforward; simply reorder the two calls.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a299804140325db7b93173419b0724056b60f34d
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Feb 26 13:37:38 2014 -0500

    tracing: Do not add event files for modules that fail tracepoints

    commit 45ab2813d40d88fc575e753c38478de242d03f88 upstream.

    If a module fails to add its tracepoints due to module tainting, do not
    create the module event infrastructure in the debugfs directory. As the events
    will not work and worse yet, they will silently fail, making the user wonder
    why the events they enable do not display anything.

    Having a warning on module load and the events not visible to the users
    will make the cause of the problem much clearer.

    Link: http://lkml.kernel.org/r/20140227154923.265882695@goodmis.org

    Fixes: 6d723736e472 "tracing/events: add support for modules to TRACE_EVENT"
    Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c5ad4fdec0ae15d197508185643c68470868121d
Author: Li Zefan <lizefan@huawei.com>
Date:   Thu Feb 27 18:19:36 2014 +0800

    cpuset: fix a race condition in __cpuset_node_allowed_softwall()

    commit 99afb0fd5f05aac467ffa85c36778fec4396209b upstream.

    It's not safe to access task's cpuset after releasing task_lock().
    Holding callback_mutex won't help.

    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b46741f24d1c0d0d8dcfb3c63439338d2dc0337e
Author: Chuansheng Liu <chuansheng.liu@intel.com>
Date:   Mon Feb 24 11:29:50 2014 +0800

    genirq: Remove racy waitqueue_active check

    commit c685689fd24d310343ac33942e9a54a974ae9c43 upstream.

    We hit one rare case below:

    T1 calling disable_irq(), but hanging at synchronize_irq()
    always;
    The corresponding irq thread is in sleeping state;
    And all CPUs are in idle state;

    After analysis, we found there is one possible scenerio which
    causes T1 is waiting there forever:
    CPU0                                       CPU1
     synchronize_irq()
      wait_event()
        spin_lock()
                                               atomic_dec_and_test(&threads_active)
          insert the __wait into queue
        spin_unlock()
                                               if(waitqueue_active)
        atomic_read(&threads_active)
                                                 wake_up()

    Here after inserted the __wait into queue on CPU0, and before
    test if queue is empty on CPU1, there is no barrier, it maybe
    cause it is not visible for CPU1 immediately, although CPU0 has
    updated the queue list.
    It is similar for CPU0 atomic_read() threads_active also.

    So we'd need one smp_mb() before waitqueue_active.that, but removing
    the waitqueue_active() check solves it as wel l and it makes
    things simple and clear.

    Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
    Cc: Xiaoming Wang <xiaoming.wang@intel.com>
    Link: http://lkml.kernel.org/r/1393212590-32543-1-git-send-email-chuansheng.liu@intel.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb7d79fc8250eaa01ac6f82f9001ffcec0e7ca36
Author: Daniel J Blueman <daniel@numascale.com>
Date:   Thu Mar 13 19:43:01 2014 +0800

    x86/amd/numa: Fix northbridge quirk to assign correct NUMA node

    commit 847d7970defb45540735b3fb4e88471c27cacd85 upstream.

    For systems with multiple servers and routed fabric, all
    northbridges get assigned to the first server. Fix this by also
    using the node reported from the PCI bus. For single-fabric
    systems, the northbriges are on PCI bus 0 by definition, which
    are on NUMA node 0 by definition, so this is invarient on most
    systems.

    Tested on fam10h and fam15h single and multi-fabric systems and
    candidate for stable.

    Signed-off-by: Daniel J Blueman <daniel@numascale.com>
    Acked-by: Steffen Persvold <sp@numascale.com>
    Acked-by: Borislav Petkov <bp@suse.de>
    Link: http://lkml.kernel.org/r/1394710981-3596-1-git-send-email-daniel@numascale.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8271b4d83a6f070ba1cd3a6e4fab36dcf7c2207a
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Tue Feb 25 22:41:41 2014 +0100

    ARM: 7991/1: sa1100: fix compile problem on Collie

    commit 052450fdc55894a39fbae93d9bbe43947956f663 upstream.

    Due to a problem in the MFD Kconfig it was not possible to
    compile the UCB battery driver for the Collie SA1100 system,
    in turn making it impossible to compile in the battery driver.
    (See patch "mfd: include all drivers in subsystem menu".)

    After fixing the MFD Kconfig (separate patch) a compile error
    appears in the Collie battery driver due to the <mach/collie.h>
    implicitly requiring <mach/hardware.h> through <linux/gpio.h>
    via <mach/gpio.h> prior to commit
    40ca061b "ARM: 7841/1: sa1100: remove complex GPIO interface".

    Fix this up by including the required header into
    <mach/collie.h>.

    Cc: Andrea Adami <andrea.adami@gmail.com>
    Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec012303c26a1d4d6251d74401ee290a063154ac
Author: Anton Blanchard <anton@samba.org>
Date:   Tue Mar 4 08:31:24 2014 +1100

    powerpc: Align p_dyn, p_rela and p_st symbols

    commit a5b2cf5b1af424ee3dd9e3ce6d5cea18cb927e67 upstream.

    The 64bit relocation code places a few symbols in the text segment.
    These symbols are only 4 byte aligned where they need to be 8 byte
    aligned. Add an explicit alignment.

    Signed-off-by: Anton Blanchard <anton@samba.org>
    Tested-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 377f8ac2e07858b912ca791e6a80c3290986ffc1
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Mar 5 12:34:39 2014 +0100

    ALSA: usb-audio: Add quirk for Logitech Webcam C500

    commit e805ca8b0a9b6c91099c0eaa4b160a1196a4ae25 upstream.

    Logitech C500 (046d:0807) needs the same workaround like other
    Logitech Webcams.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99792c01fe46e0c8d9ccdf6cdefa2061a7ea7f36
Author: Roman Volkov <v1ron@mail.ru>
Date:   Fri Jan 24 16:18:14 2014 +0400

    ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2

    commit 3dd77654fb1d7f68b9739f3039bad8dbbc0739f8 upstream.

    Actually CS4245 connected to the I2S channel 1 for
    capture, not channel 2. Otherwise capturing and
    playback does not work for CS4245.

    Signed-off-by: Roman Volkov <v1ron@mail.ru>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cf828d9fed64eda7a0b3aefd90d1eb2fada2b544
Author: Rob Clark <rclark@redhat.com>
Date:   Wed Mar 12 10:59:37 2014 -0400

    drm/ttm: don't oops if no invalidate_caches()

    commit 9ef7506f7eff3fc42724269f62e30164c141661f upstream.

    A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement
    this function.  Yet can end up somehow with an evicted bo:

      BUG: unable to handle kernel NULL pointer dereference at           (null)
      IP: [<          (null)>]           (null)
      PGD 16e761067 PUD 16e6cf067 PMD 0
      Oops: 0010 [#1] SMP
      Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom
       sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod
      CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1
      Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009
      task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000
      RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
      RSP: 0018:ffff88016c885ad8  EFLAGS: 00010202
      RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00
      RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0
      R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30
      R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400
      FS:  00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Stack:
       ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001
       ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700
       ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400
      Call Trace:
       [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm]
       [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm]
       [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm]
       [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220
       [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm]
       [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200]
       [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200]
       [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0
       [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f
       [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm]
       [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm]
       [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm]
       [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510
       [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0
       [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0
       [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0
       [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0
       [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b
      Code:  Bad RIP value.
      RIP  [<          (null)>]           (null)
       RSP <ffff88016c885ad8>
      CR2: 0000000000000000

    Signed-off-by: Rob Clark <rclark@redhat.com>
    Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
    Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7fc368e0c6b01aef43d00fcfd59159f0acdf0cd
Author: Amitkumar Karwar <akarwar@marvell.com>
Date:   Tue Mar 4 18:43:13 2014 -0800

    mwifiex: copy AP's HT capability info correctly

    commit c99b1861c232e1f641f13b8645e0febb3712cc71 upstream.

    While preparing association request, intersection of device's HT
    capability information and corresponding fields advertised by AP
    is used.

    This patch fixes an error while copying this field from AP's
    beacon.

    Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
    Signed-off-by: Bing Zhao <bzhao@marvell.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8509583a3094c4dfc1448e0b2fbadfb5b436378f
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Fri Feb 14 08:15:20 2014 +0530

    ath9k: Fix ETSI compliance for AR9462 2.0

    commit b3050248c167871ca52cfdb2ce78aa2460249346 upstream.

    The minimum CCA power threshold values have to be adjusted
    for existing cards to be in compliance with new regulations.
    Newer cards will make use of the values obtained from EEPROM,
    support for this was added earlier. To make sure that cards
    that are already in use and don't have proper values in EEPROM,
    do not violate regulations, use the initvals instead.

    Reported-by: Jeang Daniel <dyjeong@qca.qualcomm.com>
    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 46a5a5493360f995b834eb3b828eb59da4604509
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Feb 20 09:22:11 2014 +0200

    mac80211: fix AP powersave TX vs. wakeup race

    commit 1d147bfa64293b2723c4fec50922168658e613ba upstream.

    There is a race between the TX path and the STA wakeup: while
    a station is sleeping, mac80211 buffers frames until it wakes
    up, then the frames are transmitted. However, the RX and TX
    path are concurrent, so the packet indicating wakeup can be
    processed while a packet is being transmitted.

    This can lead to a situation where the buffered frames list
    is emptied on the one side, while a frame is being added on
    the other side, as the station is still seen as sleeping in
    the TX path.

    As a result, the newly added frame will not be send anytime
    soon. It might be sent much later (and out of order) when the
    station goes to sleep and wakes up the next time.

    Additionally, it can lead to the crash below.

    Fix all this by synchronising both paths with a new lock.
    Both path are not fastpath since they handle PS situations.

    In a later patch we'll remove the extra skb queue locks to
    reduce locking overhead.

    BUG: unable to handle kernel
    NULL pointer dereference at 000000b0
    IP: [<ff6f1791>] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
    *pde = 00000000
    Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
    EIP: 0060:[<ff6f1791>] EFLAGS: 00210282 CPU: 1
    EIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
    EAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000
    ESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0
     DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
    CR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0
    DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    DR6: ffff0ff0 DR7: 00000400
    Process iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)
    iwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9
    Stack:
     e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0
     ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210
     ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002
    Call Trace:
     [<ff6f1b75>] ieee80211_free_txskb+0x15/0x20 [mac80211]
     [<ff723dc1>] invoke_tx_handlers+0x1661/0x1780 [mac80211]
     [<ff7248a5>] ieee80211_tx+0x75/0x100 [mac80211]
     [<ff7249bf>] ieee80211_xmit+0x8f/0xc0 [mac80211]
     [<ff72550e>] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]
     [<c149ef70>] dev_hard_start_xmit+0x450/0x950
     [<c14b9aa9>] sch_direct_xmit+0xa9/0x250
     [<c14b9c9b>] __qdisc_run+0x4b/0x150
     [<c149f732>] dev_queue_xmit+0x2c2/0xca0

    Reported-by: Yaara Rozenblum <yaara.rozenblum@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
    [reword commit log, use a separate lock]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18684dfb8483c9bbd3cc4ecefc1d9784d8158608
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Mon Mar 3 17:23:04 2014 +0100

    net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable

    [ Upstream commit ec0223ec48a90cb605244b45f7c62de856403729 ]

    RFC4895 introduced AUTH chunks for SCTP; during the SCTP
    handshake RANDOM; CHUNKS; HMAC-ALGO are negotiated (CHUNKS
    being optional though):

      ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
      <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
      -------------------- COOKIE-ECHO -------------------->
      <-------------------- COOKIE-ACK ---------------------

    A special case is when an endpoint requires COOKIE-ECHO
    chunks to be authenticated:

      ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->
      <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------
      ------------------ AUTH; COOKIE-ECHO ---------------->
      <-------------------- COOKIE-ACK ---------------------

    RFC4895, section 6.3. Receiving Authenticated Chunks says:

      The receiver MUST use the HMAC algorithm indicated in
      the HMAC Identifier field. If this algorithm was not
      specified by the receiver in the HMAC-ALGO parameter in
      the INIT or INIT-ACK chunk during association setup, the
      AUTH chunk and all the chunks after it MUST be discarded
      and an ERROR chunk SHOULD be sent with the error cause
      defined in Section 4.1. [...] If no endpoint pair shared
      key has been configured for that Shared Key Identifier,
      all authenticated chunks MUST be silently discarded. [...]

      When an endpoint requires COOKIE-ECHO chunks to be
      authenticated, some special procedures have to be followed
      because the reception of a COOKIE-ECHO chunk might result
      in the creation of an SCTP association. If a packet arrives
      containing an AUTH chunk as a first chunk, a COOKIE-ECHO
      chunk as the second chunk, and possibly more chunks after
      them, and the receiver does not have an STCB for that
      packet, then authentication is based on the contents of
      the COOKIE-ECHO chunk. In this situation, the receiver MUST
      authenticate the chunks in the packet by using the RANDOM
      parameters, CHUNKS parameters and HMAC_ALGO parameters
      obtained from the COOKIE-ECHO chunk, and possibly a local
      shared secret as inputs to the authentication procedure
      specified in Section 6.3. If authentication fails, then
      the packet is discarded. If the authentication is successful,
      the COOKIE-ECHO and all the chunks after the COOKIE-ECHO
      MUST be processed. If the receiver has an STCB, it MUST
      process the AUTH chunk as described above using the STCB
      from the existing association to authenticate the
      COOKIE-ECHO chunk and all the chunks after it. [...]

    Commit bbd0d59809f9 introduced the possibility to receive
    and verification of AUTH chunk, including the edge case for
    authenticated COOKIE-ECHO. On reception of COOKIE-ECHO,
    the function sctp_sf_do_5_1D_ce() handles processing,
    unpacks and creates a new association if it passed sanity
    checks and also tests for authentication chunks being
    present. After a new association has been processed, it
    invokes sctp_process_init() on the new association and
    walks through the parameter list it received from the INIT
    chunk. It checks SCTP_PARAM_RANDOM, SCTP_PARAM_HMAC_ALGO
    and SCTP_PARAM_CHUNKS, and copies them into asoc->peer
    meta data (peer_random, peer_hmacs, peer_chunks) in case
    sysctl -w net.sctp.auth_enable=1 is set. If in INIT's
    SCTP_PARAM_SUPPORTED_EXT parameter SCTP_CID_AUTH is set,
    peer_random != NULL and peer_hmacs != NULL the peer is to be
    assumed asoc->peer.auth_capable=1, in any other case
    asoc->peer.auth_capable=0.

    Now, if in sctp_sf_do_5_1D_ce() chunk->auth_chunk is
    available, we set up a fake auth chunk and pass that on to
    sctp_sf_authenticate(), which at latest in
    sctp_auth_calculate_hmac() reliably dereferences a NULL pointer
    at position 0..0008 when setting up the crypto key in
    crypto_hash_setkey() by using asoc->asoc_shared_key that is
    NULL as condition key_id == asoc->active_key_id is true if
    the AUTH chunk was injected correctly from remote. This
    happens no matter what net.sctp.auth_enable sysctl says.

    The fix is to check for net->sctp.auth_enable and for
    asoc->peer.auth_capable before doing any operations like
    sctp_sf_authenticate() as no key is activated in
    sctp_auth_asoc_init_active_key() for each case.

    Now as RFC4895 section 6.3 states that if the used HMAC-ALGO
    passed from the INIT chunk was not used in the AUTH chunk, we
    SHOULD send an error; however in this case it would be better
    to just silently discard such a maliciously prepared handshake
    as we didn't even receive a parameter at all. Also, as our
    endpoint has no shared key configured, section 6.3 says that
    MUST silently discard, which we are doing from now onwards.

    Before calling sctp_sf_pdiscard(), we need not only to free
    the association, but also the chunk->auth_chunk skb, as
    commit bbd0d59809f9 created a skb clone in that case.

    I have tested this locally by using netfilter's nfqueue and
    re-injecting packets into the local stack after maliciously
    modifying the INIT chunk (removing RANDOM; HMAC-ALGO param)
    and the SCTP packet containing the COOKIE_ECHO (injecting
    AUTH chunk before COOKIE_ECHO). Fixed with this patch applied.

    Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Cc: Vlad Yasevich <yasevich@gmail.com>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc8927f2d373d522e85ca497e9f6755f564b42ce
Author: Michael Chan <mchan@broadcom.com>
Date:   Fri Feb 28 15:05:10 2014 -0800

    tg3: Don't check undefined error bits in RXBD

    [ Upstream commit d7b95315cc7f441418845a165ee56df723941487 ]

    Redefine the RXD_ERR_MASK to include only relevant error bits. This fixes
    a customer reported issue of randomly dropping packets on the 5719.

    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73c64222444db00a7f3b3cf933f76f2a2a866fb6
Author: Jason Wang <jasowang@redhat.com>
Date:   Fri Feb 21 13:08:04 2014 +0800

    virtio-net: alloc big buffers also when guest can receive UFO

    [ Upstream commit 0e7ede80d929ff0f830c44a543daa1acd590c749 ]

    We should alloc big buffers also when guest can receive UFO
    packets to let the big packets fit into guest rx buffer.

    Fixes 5c5167515d80f78f6bb538492c423adcae31ad65
    (virtio-net: Allow UFO feature to be set and advertised.)

    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Michael S. Tsirkin <mst@redhat.com>
    Cc: Sridhar Samudrala <sri@us.ibm.com>
    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ba4d1d9112b3f6bf0f634870bb950b5b59fa86f
Author: George McCollister <george.mccollister@gmail.com>
Date:   Tue Feb 18 17:56:51 2014 -0600

    sched: Fix double normalization of vruntime

    commit 791c9e0292671a3bfa95286bb5c08129d8605618 upstream.

    dequeue_entity() is called when p->on_rq and sets se->on_rq = 0
    which appears to guarentee that the !se->on_rq condition is met.
    If the task has done set_current_state(TASK_INTERRUPTIBLE) without
    schedule() the second condition will be met and vruntime will be
    incorrectly adjusted twice.

    In certain cases this can result in the task's vruntime never increasing
    past the vruntime of other tasks on the CFS' run queue, starving them of
    CPU time.

    This patch changes switched_from_fair() to use !p->on_rq instead of
    !se->on_rq.

    I'm able to cause a task with a priority of 120 to starve all other
    tasks with the same priority on an ARM platform running 3.2.51-rt72
    PREEMPT RT by writing one character at time to a serial tty (16550 UART)
    in a tight loop. I'm also able to verify making this change corrects the
    problem on that platform and kernel version.

    Signed-off-by: George McCollister <george.mccollister@gmail.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1392767811-28916-1-git-send-email-george.mccollister@gmail.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit efcb9185af1155146326a850aaa6617a5bb55172
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Feb 10 15:18:55 2014 -0500

    ocfs2 syncs the wrong range...

    commit 1b56e98990bcdbb20b9fab163654b9315bf158e8 upstream.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e7f76c836ca734a861b57aed10eb78b30c3a71c7
Author: Jan Kara <jack@suse.cz>
Date:   Mon Mar 3 15:38:32 2014 -0800

    ocfs2: fix quota file corruption

    commit 15c34a760630ca2c803848fba90ca0646a9907dd upstream.

    Global quota files are accessed from different nodes.  Thus we cannot
    cache offset of quota structure in the quota file after we drop our node
    reference count to it because after that moment quota structure may be
    freed and reallocated elsewhere by a different node resulting in
    corruption of quota file.

    Fix the problem by clearing dq_off when we are releasing dquot structure.
    We also remove the DB_READ_B handling because it is useless -
    DQ_ACTIVE_B is set iff DQ_READ_B is set.

    Signed-off-by: Jan Kara <jack@suse.cz>
    Cc: Goldwyn Rodrigues <rgoldwyn@suse.de>
    Cc: Joel Becker <jlbec@evilplan.org>
    Reviewed-by: Mark Fasheh <mfasheh@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b8a8aeeff5a925f7a47c618503c278cfe18404d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Mar 22 21:20:51 2014 -0400

    d2: board-mms-tsp: fix type mismatch for system_rev

    How did this not come up before??

    Change-Id: I125a25591a9e4999b25edf5474f971b03c5e0891

commit 396550ece179982770341b4cc5336e5c7d3cc9f3
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Fri May 4 21:08:33 2012 -0700

    timer: optimize apply_slack()

    __fls(mask) is equivalent to find_last_bit(&mask, BITS_PER_LONG), but cheaper.
    find_last_bit was showing up high on the list when I was profiling for stalls
    on icache misses on a system with very small cache size (MIPS).

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: edoko <r_data@naver.com>

    Change-Id: I8a5021a2fb2936c00ffd456663a76cb1b23e3100

commit 533ee05a61662f9fda24d1f34b039c63ad2a8a04
Author: Konstantin Dorfman <kdorfman@codeaurora.org>
Date:   Sun Jan 5 16:10:42 2014 +0200

    mmc: core: do not reinsert prepeared FUA and FLUSH requests in stop flow

    When mmc context has unblocked from waiting current request because of
    urgent request notification coming from block layer, there is prepeared
    request.  In the case, when the request is REQ_FUA or REQ_FLUSH, the
    flow should not reinsert it back to i/o scheduler (since according to
    block layer logic flush requests with data should never enter elevator).
    Instead this request starts immediately.

    Change-Id: Ia78b56c6135dd1a8d75a98fd5b771a5035e5c360
    Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>

commit 55d73a0c300e997cbc93440ed0a7d3eca3ca4c4f
Author: Ashwin Chaugule <ashwinc@codeaurora.org>
Date:   Mon Mar 19 17:22:43 2012 -0700

    Optimized ARM RWSEM algorithm

    RWSEM implementation for ARM using atomic functions.
    Heavily based on arch/sh/include/asm/rwsem.h

    Change-Id: I0e836157618a9757b5fe8ff1c799524b2dfda83b
    Signed-off-by: Ashwin Chaugule <ashwinc@codeaurora.org>

commit 2d0ece0883343db3233a7501dfbde9f1ad7d18ea
Author: Jan Kara <jack@suse.cz>
Date:   Fri Jul 12 17:30:07 2013 +0200

    writeback: Fix occasional slow sync(1)

    In case when system contains no dirty pages, wakeup_flusher_threads()
    will submit WB_SYNC_NONE writeback for 0 pages so wb_writeback() exits
    immediately without doing anything. Thus sync(1) will write all the
    dirty inodes from a WB_SYNC_ALL writeback pass which is slow.

    Fix the problem by using get_nr_dirty_pages() in
    wakeup_flusher_threads() instead of calculating number of dirty pages
    manually. That function also takes number of dirty inodes into account.

    Change-Id: I458027ae08d9a5a93202a7b97ace1f8da7a18a07
    CC: stable@vger.kernel.org
    Reported-by: Paul Taysom <taysom@chromium.org>
    Signed-off-by: Jan Kara <jack@suse.cz>

commit d8ed9ce7805a228cc3d24c9896140fbceaa29f57
Author: Namjae Jeon <namjae.jeon@samsung.com>
Date:   Wed Jan 2 20:00:40 2013 -0600

    writeback: fix writeback cache thrashing

    From: Namjae Jeon <namjae.jeon@samsung.com>

    Consider Process A: huge I/O on sda
            doing heavy write operation - dirty memory becomes more
            than dirty_background_ratio
            on HDD - flusher thread flush-8:0

    Consider Process B: small I/O on sdb
            doing while [1]; read 1024K + rewrite 1024K + sleep 2sec
            on Flash device - flusher thread flush-8:16

    As Process A is a heavy dirtier, dirty memory becomes more
    than dirty_background_thresh. Due to this, below check becomes
    true(checking global_page_state in over_bground_thresh)
    for all bdi devices(even for very small dirtied bdi - sdb):

    In this case, even small cached data on 'sdb' is forced to flush
    and writeback cache thrashing happens.

    When we added debug prints inside above 'if' condition and ran
    above Process A(heavy dirtier on bdi with flush-8:0) and
    Process B(1024K frequent read/rewrite on bdi with flush-8:16)
    we got below prints:

    [Test setup: ARM dual core CPU, 512 MB RAM]

    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  56064 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  56704 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 84720 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 94720 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   384 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   960 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =    64 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 92160 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   256 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   768 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =    64 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   256 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   320 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =     0 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 92032 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 91968 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   192 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =  1024 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =    64 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   192 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   576 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =     0 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 84352 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   192 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =   512 KB
    [over_bground_thresh]: wakeup flush-8:16 : BDI_RECLAIMABLE =     0 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 92608 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE = 92544 KB

    As mentioned in above log, when global dirty memory > global background_thresh
    small cached data is also forced to flush by flush-8:16.
    If removing global background_thresh checking code, we can reduce cache
    thrashing of frequently used small data.
    And It will be great if we can reserve a portion of writeback cache using
    min_ratio.

    After applying patch:
    $ echo 5 > /sys/block/sdb/bdi/min_ratio
    $ cat /sys/block/sdb/bdi/min_ratio
    5
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  56064 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  56704 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  84160 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  96960 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  94080 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  93120 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  93120 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  91520 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  89600 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  93696 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  93696 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  72960 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  90624 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  90624 KB
    [over_bground_thresh]: wakeup flush-8:0 : BDI_RECLAIMABLE =  90688 KB

    As mentioned in the above logs, once cache is reserved for Process B,
    and patch is applied there is less writeback cache thrashing on sdb
    by frequent forced writeback by flush-8:16 in over_bground_thresh.

    After all, small cached data will be flushed by periodic writeback
    once every dirty_writeback_interval.

    Change-Id: I678b30a5a28ed99bed0e782e38926ba4626b86ee
    Suggested-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
    Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
    Signed-off-by: Vivek Trivedi <t.vivek@samsung.com>

commit 59b3428f932f16a8f8d16ce4d8a81b182685084e
Author: Ming Lei <ming.lei@canonical.com>
Date:   Wed Feb 27 17:05:19 2013 -0800

    block/partitions: optimize memory allocation in check_partition()

    Currently, sizeof(struct parsed_partitions) may be 64KB in 32bit arch, so
    it is easy to trigger page allocation failure by check_partition,
    especially in hotplug block device situation(such as, USB mass storage,
    MMC card, ...), and Felipe Balbi has observed the failure.

    This patch does below optimizations on the allocation of struct
    parsed_partitions to try to address the issue:

    - make parsed_partitions.parts as pointer so that the pointed memory can
      fit in 32KB buffer, then approximate 32KB memory can be saved

    - vmalloc the buffer pointed by parsed_partitions.parts because 32KB is
      still a bit big for kmalloc

    - given that many devices have the partition count limit, so only
      allocate disk_max_parts() partitions instead of 256 partitions always

    Change-Id: Iee8afc643ea8e7dd2d7c038c542a0377f71bd34e
    Signed-off-by: Ming Lei <ming.lei@canonical.com>
    Reported-by: Felipe Balbi <balbi@ti.com>
    Cc: Jens Axboe <axboe@kernel.dk>
    Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 770f7a3cc82cf2f8216040506ce5f7295724a184
Author: Dave Chinner <dchinner@redhat.com>
Date:   Tue Jul 2 22:38:35 2013 +1000

    sync: don't block the flusher thread waiting on IO

    When sync does it's WB_SYNC_ALL writeback, it issues data Io and
    then immediately waits for IO completion. This is done in the
    context of the flusher thread, and hence completely ties up the
    flusher thread for the backing device until all the dirty inodes
    have been synced. On filesystems that are dirtying inodes constantly
    and quickly, this means the flusher thread can be tied up for
    minutes per sync call and hence badly affect system level write IO
    performance as the page cache cannot be cleaned quickly.

    We already have a wait loop for IO completion for sync(2), so cut
    this out of the flusher thread and delegate it to wait_sb_inodes().
    Hence we can do rapid IO submission, and then wait for it all to
    complete.

    Effect of sync on fsmark before the patch:

    FSUse%        Count         Size    Files/sec     App Overhead
    .....
         0       640000         4096      35154.6          1026984
         0       720000         4096      36740.3          1023844
         0       800000         4096      36184.6           916599
         0       880000         4096       1282.7          1054367
         0       960000         4096       3951.3           918773
         0      1040000         4096      40646.2           996448
         0      1120000         4096      43610.1           895647
         0      1200000         4096      40333.1           921048

    And a single sync pass took:

      real    0m52.407s
      user    0m0.000s
      sys     0m0.090s

    After the patch, there is no impact on fsmark results, and each
    individual sync(2) operation run concurrently with the same fsmark
    workload takes roughly 7s:

      real    0m6.930s
      user    0m0.000s
      sys     0m0.039s

    IOWs, sync is 7-8x faster on a busy filesystem and does not have an
    adverse impact on ongoing async data write operations.

    Signed-off-by: Dave Chinner <dchinner@redhat.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Change-Id: I9e55d65f5ecb2305497711d4688f0647d9346035

commit 2a146f20d60beb148e2857aafc139386cd9d0909
Author: mrg666 <drgungor@hotmail.com>
Date:   Sun Dec 22 20:52:32 2013 -0500

    jbd2: optimize jbd2_journal_force_commit

    Current implementation of jbd2_journal_force_commit() is suboptimal because
    result in empty and useless commits. But callers just want to force and wait
    any unfinished commits. We already have jbd2_journal_force_commit_nested()
    which does exactly what we want, except we are guaranteed that we do not hold
    journal transaction open.

    Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

    Change-Id: I5c041a1898838e880714a913b5a915f105a8dfb9

commit 7560c36f02b4039d4a4107aa5aab24a09e16f490
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Wed Sep 11 14:23:04 2013 -0700

    writeback: fix race that cause writeback hung

    There is a race between mark inode dirty and writeback thread, see the
    following scenario.  In this case, writeback thread will not run though
    there is dirty_io.

    __mark_inode_dirty()                                          bdi_writeback_workfn()
    	...                                                       	...
    	spin_lock(&inode->i_lock);
    	...
    	if (bdi_cap_writeback_dirty(bdi)) {
    	    <<< assume wb has dirty_io, so wakeup_bdi is false.
    	    <<< the following inode_dirty also have wakeup_bdi false.
    	    if (!wb_has_dirty_io(&bdi->wb))
    		    wakeup_bdi = true;
    	}
    	spin_unlock(&inode->i_lock);
    	                                                            <<< assume last dirty_io is removed here.
    	                                                            pages_written = wb_do_writeback(wb);
    	                                                            ...
    	                                                            <<< work_list empty and wb has no dirty_io,
    	                                                            <<< delayed_work will not be queued.
    	                                                            if (!list_empty(&bdi->work_list) ||
    	                                                                (wb_has_dirty_io(wb) && dirty_writeback_interval))
    	                                                                queue_delayed_work(bdi_wq, &wb->dwork,
    	                                                                    msecs_to_jiffies(dirty_writeback_interval * 10));
    	spin_lock(&bdi->wb.list_lock);
    	inode->dirtied_when = jiffies;
    	<<< new dirty_io is added.
    	list_move(&inode->i_wb_list, &bdi->wb.b_dirty);
    	spin_unlock(&bdi->wb.list_lock);

    	<<< though there is dirty_io, but wakeup_bdi is false,
    	<<< so writeback thread will not be waked up and
    	<<< the new dirty_io will not be flushed.
    	if (wakeup_bdi)
    	    bdi_wakeup_thread_delayed(bdi);

    Writeback will run until there is a new flush work queued.  This may cause
    a lot of dirty pages stay in memory for a long time.

    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Cc: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>

    Change-Id: I973fcba5381881a003a035ffff48f64348660079

commit 58054ceedfcf0b765c2c18693f16264dc13be737
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Mar 22 14:26:19 2014 -0400

    msm_zsl: port NULL checks and irq enable/disable from non zsl variant

    Fixes ability to take 1080p video on rear cam, and ability to shoot more
    than 3 videos in a row on front cam

    Change-Id: I2d28c3460c7422e67d0993f24f6c1e5ee59f3955

commit bfb5b0fdf165e2e806e9b6d0bf17883a8146e086
Author: Huaibin Yang <huaibiny@codeaurora.org>
Date:   Wed Mar 12 16:48:39 2014 -0700

    msm_fb: display: workaround a single underrun when lcdc is on

    Develop a workaround for a single underrun instance which has no
    obvious s/w reasons. The justification behind this workaround is that
    when this single underrun happens, all pipes are intended to be solid
    fill mode because framebuffer is not ready yet to be displayed. So,
    the thing that really matters is to make sure this underrun dose not
    cause any visual side effects by identifying when this underrun
    happens and matching the underrun color to pipe solid color. And after
    that the underrun color can be restored.

    Change-Id: I039625c0522306492c4cefd7ca5ec1d14e7e9c0a
    Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>

commit 02bc3c2ef2af2600398cc16cb41972bfd16df85f
Author: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Date:   Wed Feb 26 19:30:18 2014 +0530

    USB: ci13xxx_msm: shutdown callback to disable D+ pullup

    SW reset may not reset the PHY properly by disabling
    the D+ pullup.

    Implement a shutdown callback to disable the pullup
    during soft reboot so that host controller does
    not go in bad state.

    CRs-Fixed: 616180
    Change-Id: I7bc76efdf78009a5e3705c049abd3678dc966885
    Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
    Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

commit fcea612168b3483b5f6bc73e6f07054916bbb740
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Mar 22 09:46:46 2014 -0400

    who are we kidding? we always want turbo mode

    Change-Id: I211650f1bfb12044be752b3b36753e8128624d31

commit 2d52c00a6374dd32922f3556e43fbbf83f48ec3b
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sun Mar 16 19:57:34 2014 -0400

    d2 camera: squash commits from caf

    msm-camera: Configure VPE for YV12
    Configure VPE for YV12 format to make sure that all the three planes of
    a frame have valid addresses in case of VPE processing.
    CRs-fixed: 344048
    Signed-off-by: Alekhya,Monika <malekh@codeaurora.org>
    (cherry picked from commit 977e89e413c3a38de569ffed76d3461d2fdb0db6)

    Change-Id: Ibe732266ed518fc355046d2bc748552a411d0bbf
    Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>

    msm: camera: Fix color invert issue
    The bayer pattern will invert if the frame lenght line is odd. The
    change ensures frame length line is always even.
    Change-Id: I7f796b8b0580a563c376f13ed781535df7f54389
    Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
    (cherry picked from commit ad09ecea54bb88dea5145a08f5b0c380f053d2c4)

    msm-camera: Add Double Padding Support in Gemini
    Add support to handle the padding on both sides of the input buffers to
    the Gemini driver to support rotation in ZSL mode
    Change-Id: I4bc0ef5a3d0f551021afbb93fd57acdcc83875b4
    Signed-off-by: Ashwini Rao <ashwinik@codeaurora.org>
    (cherry picked from commit 7a632c64debde89a280b20ca01e5ec1f27fe947f)

commit 31ef1b38606f63763094663274074b27367465e4
Author: Suresh Vankadara <svankada@codeaurora.org>
Date:   Mon Feb 4 13:08:06 2013 +0530

    msm: camera: Fix for camera crash

    In msm_server_control function add a check for src
    and dest before calling memcpy function to avoid
    kernel crash

    Change-Id: I814f654c223892a21d585fef31bd6ef75254c108
    CRs-Fixed: 444081
    Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>

commit b885a52d2fc2469931808b4e4273427367721810
Author: Ricardo Mendoza <ricardo.mendoza@canonical.com>
Date:   Tue Aug 6 11:05:56 2013 -0430

    binder: search for receiving context pid in global namespace

    BugLink: http://bugs.launchpad.net/bugs/1210149

    If binder cannot find the receiving task in the sender's namespace it
    will default to a null PID which thus breaks communication in our
    container-based scenario. This patch extends binder to first look in the
    senders namespace and if unsuccesfull search in the global namespace.

    Change-Id: I83077ffac575e632c1379bd69ea84b22acc61ba4
    Signed-off-by: Ricardo Mendoza <ricardo.mendoza@canonical.com>
    Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

commit c6baea3f1f109b8dc9bc0488b48991bed53875bc
Author: infernix <infernix@gmail.com>
Date:   Sat Mar 22 14:20:47 2014 -0400

    Drop SDR104 support as some SoC revisions can't handle it

    Change-Id: I9def8f67290d0151d9bad543add934b930412137

commit 3eb497627437ee82a6e8273eecb806d7a644f058
Author: infernix <infernix@gmail.com>
Date:   Sat Mar 22 14:20:06 2014 -0400

    Reset parameters for EMMC to stock 3.0

    Change-Id: I0c58573c07f58ab50dd94d6c711ef023e374b68a

commit 6c0c6cae5880c0c0d0fb65027081d008c7eb0505
Author: raghavendra ambadas <rambad@codeaurora.org>
Date:   Fri Mar 21 12:53:45 2014 +0530

    msm_fb: Register frame buffer device for device shutdown

    Many display panels have a requirement of executing panel-off
    commands when the device goes to shutdown. Hence, register frame
    buffer device for device shutdown so that the panel-off commands
    can be executed successfully.

    Change-Id: If39a93247542f5bbee8b0c4d1df1aab13270aa06
    Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>

commit cfefc53fa9ea08f55938d96c3bcfab0390c923b9
Merge: a111677 facad90
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 20 13:44:30 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit facad90cb05a0a9fdc1affb601a811fa5c8d0f11
Merge: a111677 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 20 06:31:30 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit a1116775cff73d11f6472aa7858d0f965bae791a
Merge: 8b29815 7119ec2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 20 01:31:41 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit 7119ec2e266bc1826a50baaa7cdeee0679c686c1
Merge: 8b29815 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 19 20:58:37 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit 8b29815fb1bcf52f3013518637229296a62e163a
Merge: a09691f c464b8d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 19 12:15:48 2014 -0700

    Merge "Merge "Merge "ASoC: msm: Null dereference check added"""

commit c464b8d4ce3a2e62edd877c39aad38c771975ef8
Merge: a09691f 9eb22a9
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 19 06:48:54 2014 -0700

    Merge "Merge "ASoC: msm: Null dereference check added""

commit 655261c78d9555080d2e124b43595a4740ff1296
Author: Raghu DP <dp.raghu@codeaurora.org>
Date:   Wed Mar 19 11:36:24 2014 +0530

    kernel:Dont set stop_issued flag in stop recording

    stop_issued flag should not be set
    to TRUE during stop recording and liveshot.

    CRs-Fixed: 629368

    Change-Id: Ibf57a4e72e48ad1ce9821415ebf6de01fd881e64
    Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>

commit 9eb22a94685c3a4b0b13ce93472070a2216a1625
Merge: 16f1f12 3b10265
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 22:08:29 2014 -0700

    Merge "ASoC: msm: Null dereference check added"

commit a09691fc68b6819f1b799d4918cfde5ecae335d7
Merge: f1310ab a0d969c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 15:20:56 2014 -0700

    Merge "Merge "Merge "Revert "msm: vidc: No need to allocate metadata by default""""

commit a0d969cdec5edc38afcd1bec83d626bef50b25cb
Merge: f1310ab 16f1f12
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 10:50:33 2014 -0700

    Merge "Merge "Revert "msm: vidc: No need to allocate metadata by default"""

commit f1310ab12e54b18cf5d4f3a730638611e95241ca
Merge: ec10f85 78fc23e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 10:31:16 2014 -0700

    Merge "Merge "Merge "Revert "msm: vidc: No need to allocate metadata by default""""

commit 78fc23ee55861a6a7d42957a66c6679ff96f8cbd
Merge: ec10f85 16f1f12
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 05:46:52 2014 -0700

    Merge "Merge "Revert "msm: vidc: No need to allocate metadata by default"""

commit ec10f8562d6eaf98eac658e5f3060dc699151abe
Merge: ef525ae 4395424
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 05:14:32 2014 -0700

    Merge "Merge "Merge "misc: isa1200: Add mutex for clk_on"""

commit 16f1f12e233395421ba44468eaa99ae43cf83fc4
Merge: 1ae8c1f 42c4b7e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 18 01:58:45 2014 -0700

    Merge "Revert "msm: vidc: No need to allocate metadata by default""

commit 43954242406d0f8a7dba3cc2345fae20f0158b67
Merge: ef525ae 1ae8c1f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 23:18:41 2014 -0700

    Merge "Merge "misc: isa1200: Add mutex for clk_on""

commit 3b1026542bb4d85a735cc62a46d32b955eb7e06a
Author: Anish Kumar <kanish@codeaurora.org>
Date:   Thu Mar 13 19:43:48 2014 +0530

    ASoC: msm: Null dereference check added

    In asm_read function we should check buffer pointer
    before it is dererferenced.

    CRs-Fixed: 612682
    Change-Id: I1968c038e1d35381bf174000287d542441e41092
    Signed-off-by: Anish Kumar <kanish@codeaurora.org>

commit e1926e0c614b3e352b128dd0c7d3c7a914cfbe28
Merge: a77a671 bf9f9df
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 22:58:42 2014 -0700

    Merge "Revert "msm: vidc: No need to allocate metadata by default""

commit bf9f9df609a22c4f1ad922e1f59d96d80ec9b43c
Author: Prados Das <prados@codeaurora.org>
Date:   Tue Mar 18 10:47:38 2014 +0530

    Revert "msm: vidc: No need to allocate metadata by default"

    This reverts commit 0efc959be55801808454292cc61d11ff8ab1bfa1

    Change-Id: I08163ac9e4d4481cb9df324fd8ccc14bef536d96
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit 42c4b7e9e848bf7b77d904ff2e75e3d1a7b9815d
Author: Prados Das <prados@codeaurora.org>
Date:   Tue Mar 18 10:47:38 2014 +0530

    Revert "msm: vidc: No need to allocate metadata by default"

    This reverts commit 0efc959be55801808454292cc61d11ff8ab1bfa1

    Change-Id: I08163ac9e4d4481cb9df324fd8ccc14bef536d96
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit ef525ae7bd2323657ae35f89796d2c98af0f1e10
Merge: 36ef3b6 a0151e4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 20:54:38 2014 -0700

    Merge "Merge "Merge "misc: isa1200: Add mutex for clk_on"""

commit a0151e45fbdf442de3239b1e9381310010b0af32
Merge: 36ef3b6 1ae8c1f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 16:11:35 2014 -0700

    Merge "Merge "misc: isa1200: Add mutex for clk_on""

commit 36ef3b66f37515fc31a85fb03a5428a5c0ed33f9
Merge: 18eec5f ba48252
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 02:34:44 2014 -0700

    Merge "Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup"""

commit 1ae8c1ff0c28905bf7d37f0f56fadb1796d54211
Merge: f66da6d 06e59e0
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 17 02:30:17 2014 -0700

    Merge "misc: isa1200: Add mutex for clk_on"

commit ba4825219c9cdfa86956ff6ab132c5a6cf71d5bd
Merge: 18eec5f f66da6d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Mar 16 20:48:07 2014 -0700

    Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup""

commit 18eec5f7ef2581d142fd4050fe765dfd57f853f9
Merge: 8224707 ba1b02a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Mar 16 20:31:46 2014 -0700

    Merge "Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup"""

commit ba1b02aa6001a50f04fc28a61d4b450c53c236e3
Merge: 8224707 f66da6d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Mar 16 16:00:35 2014 -0700

    Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup""

commit 8224707aae01ecfc37580bcd31e3e00f04b8916e
Merge: 2fd0566 64ff53c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 22:02:35 2014 -0700

    Merge "Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup"""

commit 64ff53c95db12f23983e6ab0234abb6580877801
Merge: 2fd0566 f66da6d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 17:26:22 2014 -0700

    Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup""

commit 2fd0566c25f62e3fb392386c4dee231a6e308e53
Merge: 68f8a0b d940199
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 17:11:08 2014 -0700

    Merge "Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup"""

commit d940199e284a9a26d74fcbcafb6feea0afd8df1a
Merge: 68f8a0b f66da6d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 11:33:23 2014 -0700

    Merge "Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup""

commit 68f8a0b25d429f09a052240550c00073ba37ade0
Merge: 900d0bd 9c4acd5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 10:51:34 2014 -0700

    Merge "Merge "Merge "msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c"""

commit 9c4acd58de1555f493bb8df8f2067dc610915625
Merge: 900d0bd 1981d3a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 06:14:57 2014 -0700

    Merge "Merge "msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c""

commit 900d0bd5009e4626e44fbdf11c79dc4af2a4dfc8
Merge: 648d0eb 40a58dd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 05:54:54 2014 -0700

    Merge "Merge "Merge "msm: vidc: No need to allocate metadata by default"""

commit f66da6da98917505717ca610e15de5fe007e0963
Merge: 1981d3a d5e7bb2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 05:17:03 2014 -0700

    Merge "USB: ci13xxx_msm: shutdown callback to disable D+ pullup"

commit 40a58ddc8bfa112f4ac15d368453a1749aa9a345
Merge: 648d0eb 4385f62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 01:09:12 2014 -0700

    Merge "Merge "msm: vidc: No need to allocate metadata by default""

commit 648d0eb45d83ceb578952ce1afb5a26746806d5d
Merge: 6eb7450 bc4226d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 14 00:33:32 2014 -0700

    Merge "Merge "Merge "msm: vidc: No need to allocate metadata by default"""

commit 1981d3ad29d574636b57298ab328da9713a87167
Merge: 4385f62 a249035
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 13 23:53:39 2014 -0700

    Merge "msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c"

commit bc4226d7f086c88500741fb616cbf09d83922a12
Merge: 6eb7450 4385f62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 13 18:43:58 2014 -0700

    Merge "Merge "msm: vidc: No need to allocate metadata by default""

commit 6eb745055226200ff619d2d461518fabb32952ef
Merge: ba76f63 dc4959e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 13 12:32:34 2014 -0700

    Merge "Merge "Merge "msm: vidc: No need to allocate metadata by default"""

commit dc4959e035084fd22026957273b3363929b8dace
Merge: ba76f63 4385f62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 13 06:10:10 2014 -0700

    Merge "Merge "msm: vidc: No need to allocate metadata by default""

commit ba76f63326426b8814074cd630ca7c7fc780b778
Merge: 36bac55 7bbc294
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 13 05:32:19 2014 -0700

    Merge "Merge "Merge "msm: vidc: No need to allocate metadata by default"""

commit 7bbc2949ebcbccd23594580d39cf7e54cdaa8a60
Merge: 36bac55 4385f62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 12 22:32:08 2014 -0700

    Merge "Merge "msm: vidc: No need to allocate metadata by default""

commit e6f22a53ed98568664e5e7502cab7295e050fe6d
Author: Dave Daynard <nardholio@gmail.com>
Date:   Sat Feb 15 02:49:31 2014 -0500

    Apexq: update some defconfig parameters for usb

    Change-Id: Ic91f9215b127c6b39c96fe220252e6e2cef9e959

commit a53decce7c67c114ca190dacb582655c806cbb63
Author: SeongJae Park <sj38.park@gmail.com>
Date:   Thu Nov 14 21:15:12 2013 +0900

    staging: alarm-dev: Seperate functions with one blank line

    Change-Id: I62edac3c394046cc5c8431bff34e11c089900dea
    Signed-off-by: SeongJae Park <sj38.park@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49622ee31b43eebeabf94ab9fb8a9d8f4024641a
Author: Cruz Julian Bishop <cruzjbishop@gmail.com>
Date:   Tue Sep 3 22:05:09 2013 +1000

    staging/android: Add kerneldoc to one function in alarm-dev.c

    Sorry. I thought that this would be a nice easy class to document fully.
    Turns out I was very wrong - I will have to research the Linux alarm and
    timer subsystem one day next week and try again.

    Here is what I started out with, anyway. It's not much, but it's better
    than nothing!

    Change-Id: Ic884b743d73564374eac1e4e405a3283c9e898f9
    Signed-off-by: Cruz Julian Bishop <cruzjbishop@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c78a7563b6cfbc87eb94d409c5d8208a0136031
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Mar 4 21:31:33 2014 -0500

    drivers: rtc-pm8xxx: Clear alarm register when IRQ is disabled

    Based on
    https://github.com/CyanogenMod/android_kernel_samsung_d2/commit/0287c9698a6e09fd22aabfc7536d8b503aaa27d4

    QCOM never anticipated people turning the RTC on on this class of
    devices.

    Change-Id: Ia151e1ddb737ed4a3e4c68540f2882285460d8b9

commit b35c4ac3a2a631f23aff550262143283ab73bf4e
Author: Maria Yu <aiquny@codeaurora.org>
Date:   Thu Jan 9 16:59:21 2014 +0800

    rtc: alarm: have dummy set_power_on_alarm function

    When !CONFIG_RTC_CLASS we need to have a dummy set_power_on_alarm
    function. Otherwise, it is easy to have build issues.

    Change-Id: I39310241cc2e59f672964c8bc0ee4c3607aedf4e
    Signed-off-by: Maria Yu <aiquny@codeaurora.org>

commit 23fb3e3772d161923577b509ad154eaa00dbdcf1
Author: Kumar Gala <galak@codeaurora.org>
Date:   Thu Jan 2 14:15:29 2014 -0600

    rtc: alarm: init power_on_alarm_lock mutex in alarmtimer_rtc_timer_init

    Moved mutex_init of power_on_alarm_lock into alarmtimer_rtc_timer_init
    so that if CONFIG_RTC_CLASS is not enabled, we dont try to initialize
    the mutex.  This fixes a build issue when !CONFIG_RTC_CLASS

    Change-Id: I270564b94fd54162aa177a2c9767655098662259
    Signed-off-by: Kumar Gala <galak@codeaurora.org>

commit d4b088354257b900fb5a349bcb4c3f9d9300306e
Author: John Stultz <john.stultz@linaro.org>
Date:   Thu Sep 13 19:25:22 2012 -0400

    alarmtimer: Rename alarmtimer_remove to alarmtimer_dequeue

    Now that alarmtimer_remove has been simplified, change
    its name to _dequeue to better match its paired _enqueue
    function.

    Cc: Arve Hjønnevåg <arve@android.com>
    Cc: Colin Cross <ccross@android.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: John Stultz <john.stultz@linaro.org>

commit 0c7e983bd5456c8f8fe219d74305374978de54dc
Author: David Linares <dlinares.linux@gmail.com>
Date:   Mon Mar 25 10:50:27 2013 +0000

    USB: hub: Avoid NULL pointer dereference when hub doesn't have any ports

    Return an error if hub->descriptor->bNbrPorts==0. Without this additional
    check, we can end up doing a "hub->ports = kzalloc(0, GFP_KERNEL)".
    This hub->ports pointer will therefore be non-NULL and will be used.
    Example of dmesg:
       INIT: usb 1-1: New USB device found, idVendor=0424, idProduct=2512
       usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
       hub 1-1:1.0: USB hub found
       version 2.86 bootinghub 1-1:1.0: 0 ports detected
       Unable to handle kernel NULL pointer dereference at virtual address 00000010

    Signed-off-by: David Linares <dlinares.linux@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aafd57b7ff2f3a6117a41a083dbce4d435be042a
Author: Dave Daynard <nardholio@gmail.com>
Date:   Tue Mar 11 22:03:54 2014 -0400

    usb: ehci-msm: enable HCD_OLD_ENUM

    Change-Id: I9aecb672319353345d4150a8b054e0fd38e27fd1

commit 95bc0a863ef1297deaf3856a016ca6d73fd11d12
Merge: 41dd99d 0c4f537
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Mar 12 20:09:34 2014 -0400

    Merge remote-tracking branch 'korg/linux-3.4.y' into cm-11.0

    Conflicts:
    	arch/arm/mm/proc-v7.S
    	mm/memory_hotplug.c

    Change-Id: I93d8945521940a31f3d16133c432a46d28f87b47

commit 41dd99d2f87c5903cb59212e47a708ba3052a036
Merge: 3af1e42 36bac55
Author: Dave Daynard <nardholio@gmail.com>
Date:   Wed Mar 12 20:08:00 2014 -0400

    Merge remote-tracking branch 'caf/kk_2.7-stable' into cm-11.0

    Conflicts:
    	net/wireless/nl80211.c

    Change-Id: I06146f89d2382cc9bedaabed4ebb2297af3f1bdc

commit a77a671ffd3970e58df04ee3d3532d6896856361
Merge: 0833e30 94cc170
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 12 11:16:15 2014 -0700

    Merge "Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.044 on remote branch""

commit 0833e30e50bd61ddbb83e8f6b2bf297d8be77fb9
Merge: 94cc170 8bb5d0d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 12 11:08:20 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.044 on remote branch"

commit 94cc170f7e62a4733ed3ee19b93e838553b7fbb8
Merge: 4385f62 8bb5d0d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 12 08:05:07 2014 -0700

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.044 on remote branch"

commit 06e59e01b79d82a1443b7d34f900fb6a9853344a
Author: Sarada Prasanna Garnayak <c_sgarna@codeaurora.org>
Date:   Wed Mar 12 19:00:58 2014 +0530

    misc: isa1200: Add mutex for clk_on

    clk_on is a boolean which maintains the enable/disbale
    status of clock. To avoid the race condition, mutex call
    is added for the clk_on.

    CRs-Fixed: 629529
    Change-Id: I4f61c629c503c658410b5c14da2e1612b82ec201
    Signed-off-by: Sarada Prasanna Garnayak <c_sgarna@codeaurora.org>

commit 8bb5d0d1ef5b5fe9a461a06c653182284d18a61d
Merge: 4385f62 9f48c5a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 12 06:33:51 2014 -0600

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.044 on remote branch

    Change-Id: I3a2ddda4c42b52bc8ee8e6fc7b48b48586f52270

commit 0c4f5371eb6b0566db53eb2437af2bbfc183e566
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Mar 11 16:10:41 2014 -0700

    Linux 3.4.83

commit 176485d0f36455db28edec5ab6581842c8d17203
Author: Emil Goode <emilgoode@gmail.com>
Date:   Thu Feb 13 19:30:39 2014 +0100

    net: asix: add missing flag to struct driver_info

    commit d43ff4cd798911736fb39025ec8004284b1b0bc2 upstream.

    The struct driver_info ax88178_info is assigned the function
    asix_rx_fixup_common as it's rx_fixup callback. This means that
    FLAG_MULTI_PACKET must be set as this function is cloning the
    data and calling usbnet_skb_return. Not setting this flag leads
    to usbnet_skb_return beeing called a second time from within
    the rx_process function in the usbnet module.

    Signed-off-by: Emil Goode <emilgoode@gmail.com>
    Reported-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20d700bc51e717c502e51c3fb857b03ba8f99f34
Author: Lucas Stach <dev@lynxeye.de>
Date:   Thu Feb 27 12:51:38 2014 +0100

    net: asix: handle packets crossing URB boundaries

    commit 8b5b6f5413e97c3e8bafcdd67553d508f4f698cd upstream.

    ASIX AX88772B started to pack data even more tightly. Packets and the ASIX packet
    header may now cross URB boundaries. To handle this we have to introduce
    some state between individual calls to asix_rx_fixup().

    Signed-off-by: Lucas Stach <dev@lynxeye.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [ Emil: backported to 3.4: dropped changes to drivers/net/usb/ax88172a.c ]
    Signed-off-by: Emil Goode <emilgoode@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 172ba81925a7f8fbec3c0f4146c28f223829e005
Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date:   Thu Feb 27 09:53:03 2014 +0800

    rtlwifi: Fix endian error in extracting packet type

    commit 0c5d63f0ab6728f05ddefa25aff55e31297f95e6 upstream.

    All of the rtlwifi drivers have an error in the routine that tests if
    the data is "special". If it is, the subsequant transmission will be
    at the lowest rate to enhance reliability. The 16-bit quantity is
    big-endian, but was being extracted in native CPU mode. One of the
    effects of this bug is to inhibit association under some conditions
    as the TX rate is too high.

    Based on suggestions by Joe Perches, the entire routine is rewritten.

    One of the local headers contained duplicates of some of the ETH_P_XXX
    definitions. These are deleted.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [wujg: Backported to 3.4:
     - adjust context
     - remove rtlpriv->enter_ps = false
     - use schedule_work(&rtlpriv->works.lps_leave_work)]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e87845b7d048925658199c863fe22b03e01e0438
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Feb 27 09:53:02 2014 +0800

    iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series

    commit 08a5dd3842f2ac61c6d69661d2d96022df8ae359 upstream.

    Add some new PCI IDs to the table for 6000, 6005 and 6235 series.

    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2:
     - Adjust filenames
     - Drop const from struct iwl_cfg]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - Adjust context
     - Do not drop const from struct iwl_cfg]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60e691100e48fea19bf35b28aa886ec12c892bab
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Thu Feb 27 09:53:01 2014 +0800

    iwlwifi: dvm: fix calling ieee80211_chswitch_done() with NULL

    commit 9186a1fd9ed190739423db84bc344d258ef3e3d7 upstream.

    If channel switch is pending and we remove interface we can
    crash like showed below due to passing NULL vif to mac80211:

    BUG: unable to handle kernel paging request at fffffffffffff8cc
    IP: [<ffffffff8130924d>] strnlen+0xd/0x40
    Call Trace:
     [<ffffffff8130ad2e>] string.isra.3+0x3e/0xd0
     [<ffffffff8130bf99>] vsnprintf+0x219/0x640
     [<ffffffff8130c481>] vscnprintf+0x11/0x30
     [<ffffffff81061585>] vprintk_emit+0x115/0x4f0
     [<ffffffff81657bd5>] printk+0x61/0x63
     [<ffffffffa048987f>] ieee80211_chswitch_done+0xaf/0xd0 [mac80211]
     [<ffffffffa04e7b34>] iwl_chswitch_done+0x34/0x40 [iwldvm]
     [<ffffffffa04f83c3>] iwlagn_commit_rxon+0x2a3/0xdc0 [iwldvm]
     [<ffffffffa04ebc50>] ? iwlagn_set_rxon_chain+0x180/0x2c0 [iwldvm]
     [<ffffffffa04e5e76>] iwl_set_mode+0x36/0x40 [iwldvm]
     [<ffffffffa04e5f0d>] iwlagn_mac_remove_interface+0x8d/0x1b0 [iwldvm]
     [<ffffffffa0459b3d>] ieee80211_do_stop+0x29d/0x7f0 [mac80211]

    This is because we nulify ctx->vif in iwlagn_mac_remove_interface()
    before calling some other functions that teardown interface. To fix
    just check ctx->vif on iwl_chswitch_done(). We should not call
    ieee80211_chswitch_done() as channel switch works were already canceled
    by mac80211 in ieee80211_do_stop() -> ieee80211_mgd_stop().

    Resolve:
    https://bugzilla.redhat.com/show_bug.cgi?id=979581

    Reported-by: Lukasz Jagiello <jagiello.lukasz@gmail.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2: adjust context, filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4: - adjust context]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b38b29d58fe03950b2ccd5eaa9af2acb3c1f084d
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Feb 27 09:53:00 2014 +0800

    iwlwifi: dvm: don't send BT_CONFIG on devices w/o Bluetooth

    commit 707aee401d2467baa785a697f40a6e2d9ee79ad5 upstream.

    The BT_CONFIG command that is sent to the device during
    startup will enable BT coex unless the module parameter
    turns it off, but on devices without Bluetooth this may
    cause problems, as reported in Redhat BZ 885407.

    Fix this by sending the BT_CONFIG command only when the
    device has Bluetooth.

    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
    [bwh: Backported to 3.2:
     - Adjust filename
     - s/priv->lib/priv->cfg/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - s/priv->cfg/priv->shrd->cfg/]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a41adefcefde57643b4fdf4696385e829fd265e3
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Feb 27 09:52:59 2014 +0800

    iwlwifi: always copy first 16 bytes of commands

    commit 8a964f44e01ad3bbc208c3e80d931ba91b9ea786 upstream.

    The FH hardware will always write back to the scratch field
    in commands, even host commands not just TX commands, which
    can overwrite parts of the command. This is problematic if
    the command is re-used (with IWL_HCMD_DFL_NOCOPY) and can
    cause calibration issues.

    Address this problem by always putting at least the first
    16 bytes into the buffer we also use for the command header
    and therefore make the DMA engine write back into this.

    For commands that are smaller than 16 bytes also always map
    enough memory for the DMA engine to write back to.

    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Drop the IWL_HCMD_DFL_DUP handling
     - Fix descriptor addresses and lengths for tracepoint, but otherwise
       leave it unchanged]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4: adjust context]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f2da4cebeffec9908b92ecb131b1108c3ef43769
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Feb 27 09:52:58 2014 +0800

    iwlwifi: handle DMA mapping failures

    commit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream.

    The RX replenish code doesn't handle DMA mapping failures,
    which will cause issues if there actually is a failure. This
    was reported by Shuah Khan who found a DMA mapping framework
    warning ("device driver failed to check map error").

    Reported-by: Shuah Khan <shuah.khan@hp.com>
    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2:
     - Adjust filename, context, indentation
     - Use bus(trans) instead of trans where necessary
     - Use hw_params(trans).rx_page_order instead of trans_pcie->rx_page_order]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - Adjust context
     - Use trans instead of bus(trans)
     - Use hw_params(trans).rx_page_order instead of trans_pcie->rx_page_order]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af720fc6ae76ea10216ede42b48ee0550d65e36f
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Feb 27 09:52:57 2014 +0800

    iwlwifi: don't handle masked interrupt

    commit 25a172655f837bdb032e451f95441bb4acec51bb upstream.

    This can lead to a panic if the driver isn't ready to
    handle them. Since our interrupt line is shared, we can get
    an interrupt at any time (and CONFIG_DEBUG_SHIRQ checks
    that even when the interrupt is being freed).

    If the op_mode has gone away, we musn't call it. To avoid
    this the transport disables the interrupts when the hw is
    stopped and the op_mode is leaving.
    If there is an event that would cause an interrupt the INTA
    register is updated regardless of the enablement of the
    interrupts: even if the interrupts are disabled, the INTA
    will be changed, but the device won't issue an interrupt.
    But the ISR can be called at any time, so we ought ignore
    the value in the INTA otherwise we can call the op_mode
    after it was freed.

    I found this bug when the op_mode_start failed, and called
    iwl_trans_stop_hw(trans, true). Then I played with the
    RFKILL button, and removed the module.
    While removing the module, the IRQ is freed, and the ISR is
    called (CONFIG_DEBUG_SHIRQ enabled). Panic.

    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Pass bus(trans), not trans, to iwl_{read,write}32()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - adjust context
     - Pass trans to iwl_{read,write}32()}]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8234281aea5f98e5216a01d4955ce44025e95212
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Feb 27 09:52:56 2014 +0800

    iwlwifi: protect SRAM debugfs

    commit 4fc79db178f0a0ede479b4713e00df2d106028b3 upstream.

    If the device is not started, we can't read its
    SRAM and attempting to do so will cause issues.
    Protect the debugfs read.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [wujg: Backported to 3.4: adjust context]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3ece09975ce21d9aa9a64d34d7f1f6ea179e8b4d
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Feb 27 09:52:55 2014 +0800

    iwlwifi: fix flow handler debug code

    commit 94543a8d4fb302817014981489f15cb3b92ec3c2 upstream.

    iwl_dbgfs_fh_reg_read() can cause crashes and/or
    BUG_ON in slub because the ifdefs are wrong, the
    code in iwl_dump_fh() should use DEBUGFS, not
    DEBUG to protect the buffer writing code.

    Also, while at it, clean up the arguments to the
    function, some code and make it generally safer.

    Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2: adjust filenames and context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4: adjust context]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 537762453afa3d6e03751d116b4cc21971262f8a
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:55:57 2013 +0200

    ALSA: asihpi: Fix unlocked snd_pcm_stop() call

    commit 60478295d6876619f8f47f6d1a5c25eaade69ee3 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 565ca886fed885e444f33ee66d8ae19f0ef4bbe3
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 18:02:38 2013 +0200

    staging: line6: Fix unlocked snd_pcm_stop() call

    commit 86f0b5b86d142b9323432fef078a6cf0fb5dda74 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eeb57ebb4820dad25f283ed0e875c6a0a498ba54
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 18:00:25 2013 +0200

    ASoC: s6000: Fix unlocked snd_pcm_stop() call

    commit 61be2b9a18ec70f3cbe3deef7a5f77869c71b5ae upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Acked-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0f8b1ca745aa237d690740f662a4e71d000941a
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:59:33 2013 +0200

    ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call

    commit 46f6c1aaf790be9ea3c8ddfc8f235a5f677d08e2 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Acked-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 475274c68b42752d252021714895b56ee43e52f4
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:58:47 2013 +0200

    ALSA: usx2y: Fix unlocked snd_pcm_stop() call

    commit 5be1efb4c2ed79c3d7c0cbcbecae768377666e84 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0843fce1e56c02d0f6667b88a12e2846dac3352b
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:58:25 2013 +0200

    ALSA: ua101: Fix unlocked snd_pcm_stop() call

    commit 9538aa46c2427d6782aa10036c4da4c541605e0e upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Acked-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f6101666e02d58039bdedc4deb320ed02e2b558
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:57:55 2013 +0200

    ALSA: 6fire: Fix unlocked snd_pcm_stop() call

    commit 5b9ab3f7324a1b94a5a5a76d44cf92dfeb3b5e80 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 593827efb8bfab1365124296a1059036fd7d6c9a
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 17:56:56 2013 +0200

    ALSA: atiixp: Fix unlocked snd_pcm_stop() call

    commit cc7282b8d5abbd48c81d1465925d464d9e3eaa8f upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e6114746b57adc3c6983b6cf96030372ed5d756
Author: Fabio Estevam <fabio.estevam@freescale.com>
Date:   Thu Jul 4 20:01:02 2013 -0300

    ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL

    commit 016fcab8ff46fca29375d484226ec91932aa4a07 upstream.

    According to the sgtl5000 reference manual, the default value of CHIP_SSS_CTRL
    is 0x10.

    Reported-by: Oskar Schirmer <oskar@scara.com>
    Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    [bwh: Backported to 3.2: format of register defaults array is different]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d17395ac947090c3258799207df8e574fd0ca7fd
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date:   Sun Mar 10 19:33:03 2013 +0100

    ASoC: imx-ssi: Fix occasional AC97 reset failure

    commit b6e51600f4e983e757b1b6942becaa1ae7d82e67 upstream.

    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d4d811d55f75e02ae7beaea3dc611498bf2bf5fb
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Wed May 22 12:57:24 2013 -0400

    SUNRPC: Prevent an rpc_task wakeup race

    commit a3c3cac5d31879cd9ae2de7874dc6544ca704aec upstream.

    The lockless RPC_IS_QUEUED() test in __rpc_execute means that we need to
    be careful about ordering the calls to rpc_test_and_set_running(task) and
    rpc_clear_queued(task). If we get the order wrong, then we may end up
    testing the RPC_TASK_RUNNING flag after __rpc_execute() has looped
    and changed the state of the rpc_task.

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e8d5ce17375e2ece50659f287ad1a3daf2335d7e
Author: Jeff Layton <jlayton@redhat.com>
Date:   Mon Jul 23 15:51:55 2012 -0400

    sunrpc: clarify comments on rpc_make_runnable

    commit 506026c3ec270e18402f0c9d33fee37482c23861 upstream.

    rpc_make_runnable is not generally called with the queue lock held, unless
    it's waking up a task that has been sitting on a waitqueue. This is safe
    when the task has not entered the FSM yet, but the comments don't really
    spell this out.

    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b7d2a5e8cfe2dde13c9d05e1d220c2fc66da3164
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Thu Aug 15 13:21:07 2013 +0100

    xen/events: mask events when changing their VCPU binding

    commit 5e72fdb8d827560893642e85a251d339109a00f4 upstream.

    commit 4704fe4f03a5ab27e3c36184af85d5000e0f8a48 upstream.

    When a event is being bound to a VCPU there is a window between the
    EVTCHNOP_bind_vpcu call and the adjustment of the local per-cpu masks
    where an event may be lost.  The hypervisor upcalls the new VCPU but
    the kernel thinks that event is still bound to the old VCPU and
    ignores it.

    There is even a problem when the event is being bound to the same VCPU
    as there is a small window beween the clear_bit() and set_bit() calls
    in bind_evtchn_to_cpu().  When scanning for pending events, the kernel
    may read the bit when it is momentarily clear and ignore the event.

    Avoid this by masking the event during the whole bind operation.

    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    [bwh: Backported to 3.2: remove the BM() cast]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 62047439828b2f7c984b7471d00dc11a07a1452b
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed Jan 23 16:54:32 2013 -0500

    xen/blkback: Check for insane amounts of request on the ring (v6).

    commit 9371cadbbcc7c00c81753b9727b19fb3bc74d458 upstream.

    commit 8e3f8755545cc4a7f4da8e9ef76d6d32e0dca576 upstream.

    Check that the ring does not have an insane amount of requests
    (more than there could fit on the ring).

    If we detect this case we will stop processing the requests
    and wait until the XenBus disconnects the ring.

    The existing check RING_REQUEST_CONS_OVERFLOW which checks for how
    many responses we have created in the past (rsp_prod_pvt) vs
    requests consumed (req_cons) and whether said difference is greater or
    equal to the size of the ring, does not catch this case.

    Wha the condition does check if there is a need to process more
    as we still have a backlog of responses to finish. Note that both
    of those values (rsp_prod_pvt and req_cons) are not exposed on the
    shared ring.

    To understand this problem a mini crash course in ring protocol
    response/request updates is in place.

    There are four entries: req_prod and rsp_prod; req_event and rsp_event
    to track the ring entries. We are only concerned about the first two -
    which set the tone of this bug.

    The req_prod is a value incremented by frontend for each request put
    on the ring. Conversely the rsp_prod is a value incremented by the backend
    for each response put on the ring (rsp_prod gets set by rsp_prod_pvt when
    pushing the responses on the ring).  Both values can
    wrap and are modulo the size of the ring (in block case that is 32).
    Please see RING_GET_REQUEST and RING_GET_RESPONSE for the more details.

    The culprit here is that if the difference between the
    req_prod and req_cons is greater than the ring size we have a problem.
    Fortunately for us, the '__do_block_io_op' loop:

    	rc = blk_rings->common.req_cons;
    	rp = blk_rings->common.sring->req_prod;

    	while (rc != rp) {

    		..
    		blk_rings->common.req_cons = ++rc; /* before make_response() */

    	}

    will loop up to the point when rc == rp. The macros inside of the
    loop (RING_GET_REQUEST) is smart and is indexing based on the modulo
    of the ring size. If the frontend has provided a bogus req_prod value
    we will loop until the 'rc == rp' - which means we could be processing
    already processed requests (or responses) often.

    The reason the RING_REQUEST_CONS_OVERFLOW is not helping here is
    b/c it only tracks how many responses we have internally produced
    and whether we would should process more. The astute reader will
    notice that the macro RING_REQUEST_CONS_OVERFLOW provides two
    arguments - more on this later.

    For example, if we were to enter this function with these values:

           	blk_rings->common.sring->req_prod =  X+31415 (X is the value from
    		the last time __do_block_io_op was called).
            blk_rings->common.req_cons = X
            blk_rings->common.rsp_prod_pvt = X

    The RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, blk_rings->common.req_cons)
    is doing:

    	req_cons - rsp_prod_pvt >= 32

    Which is,
    	X - X >= 32 or 0 >= 32

    And that is false, so we continue on looping (this bug).

    If we re-use said macro RING_REQUEST_CONS_OVERFLOW and pass in the rp
    instead (sring->req_prod) of rc, the this macro can do the check:

         req_prod - rsp_prov_pvt >= 32

    Which is,
           X + 31415 - X >= 32 , or 31415 >= 32

    which is true, so we can error out and break out of the function.

    Unfortunatly the difference between rsp_prov_pvt and req_prod can be
    at 32 (which would error out in the macro). This condition exists when
    the backend is lagging behind with the responses and still has not finished
    responding to all of them (so make_response has not been called), and
    the rsp_prov_pvt + 32 == req_cons. This ends up with us not being able
    to use said macro.

    Hence introducing a new macro called RING_REQUEST_PROD_OVERFLOW which does
    a simple check of:

        req_prod - rsp_prod_pvt > RING_SIZE

    And with the X values from above:

       X + 31415 - X > 32

    Returns true. Also not that if the ring is full (which is where
    the RING_REQUEST_CONS_OVERFLOW triggered), we would not hit the
    same condition:

       X + 32 - X > 32

    Which is false.

    Lets use that macro.
    Note that in v5 of this patchset the macro was different - we used an
    earlier version.

    [v1: Move the check outside the loop]
    [v2: Add a pr_warn as suggested by David]
    [v3: Use RING_REQUEST_CONS_OVERFLOW as suggested by Jan]
    [v4: Move wake_up after kthread_stop as suggested by Jan]
    [v5: Use RING_REQUEST_PROD_OVERFLOW instead]
    [v6: Use RING_REQUEST_PROD_OVERFLOW - Jan's version]
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23ced59b3765bc593712fda19af40658829db197
Author: Jan Beulich <jbeulich@suse.com>
Date:   Mon Jun 17 15:16:33 2013 -0400

    xen/io/ring.h: new macro to detect whether there are too many requests on the ring

    commit 8d9256906a97c24e97e016482b9be06ea2532b05 upstream.

    Backends may need to protect themselves against an insane number of
    produced requests stored by a frontend, in case they iterate over
    requests until reaching the req_prod value. There can't be more
    requests on the ring than the difference between produced requests
    and produced (but possibly not yet published) responses.

    This is a more strict alternative to a patch previously posted by
    Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>.

    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f1369580791ff1eb18a210a58405131e2c3611d2
Author: Wei Liu <wei.liu2@citrix.com>
Date:   Mon Apr 22 02:20:43 2013 +0000

    xen-netback: don't disconnect frontend when seeing oversize packet

    commit 03393fd5cc2b6cdeec32b704ecba64dbb0feae3c upstream.

    Some frontend drivers are sending packets > 64 KiB in length. This length
    overflows the length field in the first slot making the following slots have
    an invalid length.

    Turn this error back into a non-fatal error by dropping the packet. To avoid
    having the following slots having fatal errors, consume all slots in the
    packet.

    This does not reopen the security hole in XSA-39 as if the packet as an
    invalid number of slots it will still hit fatal error case.

    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Wei Liu <wei.liu2@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9832f4a0fd7b5f412b2f41ede5b431bd2102b8dd
Author: Wei Liu <wei.liu2@citrix.com>
Date:   Mon Apr 22 02:20:42 2013 +0000

    xen-netback: coalesce slots in TX path and fix regressions

    commit 2810e5b9a7731ca5fce22bfbe12c96e16ac44b6f upstream.

    This patch tries to coalesce tx requests when constructing grant copy
    structures. It enables netback to deal with situation when frontend's
    MAX_SKB_FRAGS is larger than backend's MAX_SKB_FRAGS.

    With the help of coalescing, this patch tries to address two regressions
    avoid reopening the security hole in XSA-39.

    Regression 1. The reduction of the number of supported ring entries (slots)
    per packet (from 18 to 17). This regression has been around for some time but
    remains unnoticed until XSA-39 security fix. This is fixed by coalescing
    slots.

    Regression 2. The XSA-39 security fix turning "too many frags" errors from
    just dropping the packet to a fatal error and disabling the VIF. This is fixed
    by coalescing slots (handling 18 slots when backend's MAX_SKB_FRAGS is 17)
    which rules out false positive (using 18 slots is legit) and dropping packets
    using 19 to `max_skb_slots` slots.

    To avoid reopening security hole in XSA-39, frontend sending packet using more
    than max_skb_slots is considered malicious.

    The behavior of netback for packet is thus:

        1-18            slots: valid
       19-max_skb_slots slots: drop and respond with an error
       max_skb_slots+   slots: fatal error

    max_skb_slots is configurable by admin, default value is 20.

    Also change variable name from "frags" to "slots" in netbk_count_requests.

    Please note that RX path still has dependency on MAX_SKB_FRAGS. This will be
    fixed with separate patch.

    Signed-off-by: Wei Liu <wei.liu2@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 047140a3c2a68b7f1ce24dad37ba2463031aef6a
Author: stephen hemminger <stephen@networkplumber.org>
Date:   Wed Apr 10 10:54:46 2013 +0000

    xen-netback: fix sparse warning

    commit 9eaee8beeeb3bca0d9b14324fd9d467d48db784c upstream.

    Fix warning about 0 used as NULL.

    Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63f12e8d2bea38715b30a6051325230f6ec25a3b
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Tue Apr 16 14:08:50 2013 -0400

    xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline

    commit 66ff0fe9e7bda8aec99985b24daad03652f7304e upstream.

    While we don't use the spinlock interrupt line (see for details
    commit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 -
    xen: disable PV spinlocks on HVM) - we should still do the proper
    init / deinit sequence. We did not do that correctly and for the
    CPU init for PVHVM guest we would allocate an interrupt line - but
    failed to deallocate the old interrupt line.

    This resulted in leakage of an irq_desc but more importantly this splat
    as we online an offlined CPU:

    genirq: Flags mismatch irq 71. 0002cc20 (spinlock1) vs. 0002cc20 (spinlock1)
    Pid: 2542, comm: init.late Not tainted 3.9.0-rc6upstream #1
    Call Trace:
     [<ffffffff811156de>] __setup_irq+0x23e/0x4a0
     [<ffffffff81194191>] ? kmem_cache_alloc_trace+0x221/0x250
     [<ffffffff811161bb>] request_threaded_irq+0xfb/0x160
     [<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
     [<ffffffff813a8423>] bind_ipi_to_irqhandler+0xa3/0x160
     [<ffffffff81303758>] ? kasprintf+0x38/0x40
     [<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
     [<ffffffff810cad35>] ? update_max_interval+0x15/0x40
     [<ffffffff816605db>] xen_init_lock_cpu+0x3c/0x78
     [<ffffffff81660029>] xen_hvm_cpu_notify+0x29/0x33
     [<ffffffff81676bdd>] notifier_call_chain+0x4d/0x70
     [<ffffffff810bb2a9>] __raw_notifier_call_chain+0x9/0x10
     [<ffffffff8109402b>] __cpu_notify+0x1b/0x30
     [<ffffffff8166834a>] _cpu_up+0xa0/0x14b
     [<ffffffff816684ce>] cpu_up+0xd9/0xec
     [<ffffffff8165f754>] store_online+0x94/0xd0
     [<ffffffff8141d15b>] dev_attr_store+0x1b/0x20
     [<ffffffff81218f44>] sysfs_write_file+0xf4/0x170
     [<ffffffff811a2864>] vfs_write+0xb4/0x130
     [<ffffffff811a302a>] sys_write+0x5a/0xa0
     [<ffffffff8167ada9>] system_call_fastpath+0x16/0x1b
    cpu 1 spinlock event irq -16
    smpboot: Booting Node 0 Processor 1 APIC 0x2

    And if one looks at the /proc/interrupts right after
    offlining (CPU1):

      70:          0          0  xen-percpu-ipi       spinlock0
      71:          0          0  xen-percpu-ipi       spinlock1
      77:          0          0  xen-percpu-ipi       spinlock2

    There is the oddity of the 'spinlock1' still being present.

    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32ed904ec15d37d35afae9ce784951ec955d20a5
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Tue Apr 16 13:49:26 2013 -0400

    xen/smp: Fix leakage of timer interrupt line for every CPU online/offline.

    commit 888b65b4bc5e7fcbbb967023300cd5d44dba1950 upstream.

    In the PVHVM path when we do CPU online/offline path we would
    leak the timer%d IRQ line everytime we do a offline event. The
    online path (xen_hvm_setup_cpu_clockevents via
    x86_cpuinit.setup_percpu_clockev) would allocate a new interrupt
    line for the timer%d.

    But we would still use the old interrupt line leading to:

    kernel BUG at /home/konrad/ssd/konrad/linux/kernel/hrtimer.c:1261!
    invalid opcode: 0000 [#1] SMP
    RIP: 0010:[<ffffffff810b9e21>]  [<ffffffff810b9e21>] hrtimer_interrupt+0x261/0x270
    .. snip..
     <IRQ>
     [<ffffffff810445ef>] xen_timer_interrupt+0x2f/0x1b0
     [<ffffffff81104825>] ? stop_machine_cpu_stop+0xb5/0xf0
     [<ffffffff8111434c>] handle_irq_event_percpu+0x7c/0x240
     [<ffffffff811175b9>] handle_percpu_irq+0x49/0x70
     [<ffffffff813a74a3>] __xen_evtchn_do_upcall+0x1c3/0x2f0
     [<ffffffff813a760a>] xen_evtchn_do_upcall+0x2a/0x40
     [<ffffffff8167c26d>] xen_hvm_callback_vector+0x6d/0x80
     <EOI>
     [<ffffffff81666d01>] ? start_secondary+0x193/0x1a8
     [<ffffffff81666cfd>] ? start_secondary+0x18f/0x1a8

    There is also the oddity (timer1) in the /proc/interrupts after
    offlining CPU1:

      64:       1121          0  xen-percpu-virq      timer0
      78:          0          0  xen-percpu-virq      timer1
      84:          0       2483  xen-percpu-virq      timer2

    This patch fixes it.

    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 79b6a2d6bd21bf90b38dbad0cf9210235944e8f9
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed Sep 19 08:30:55 2012 -0400

    xen/boot: Disable BIOS SMP MP table search.

    commit bd49940a35ec7d488ae63bd625639893b3385b97 upstream.

    As the initial domain we are able to search/map certain regions
    of memory to harvest configuration data. For all low-level we
    use ACPI tables - for interrupts we use exclusively ACPI _PRT
    (so DSDT) and MADT for INT_SRC_OVR.

    The SMP MP table is not used at all. As a matter of fact we do
    not even support machines that only have SMP MP but no ACPI tables.

    Lets follow how Moorestown does it and just disable searching
    for BIOS SMP tables.

    This also fixes an issue on HP Proliant BL680c G5 and DL380 G6:

    9f->100 for 1:1 PTE
    Freeing 9f-100 pfn range: 97 pages freed
    1-1 mapping on 9f->100
    .. snip..
    e820: BIOS-provided physical RAM map:
    Xen: [mem 0x0000000000000000-0x000000000009efff] usable
    Xen: [mem 0x000000000009f400-0x00000000000fffff] reserved
    Xen: [mem 0x0000000000100000-0x00000000cfd1dfff] usable
    .. snip..
    Scan for SMP in [mem 0x00000000-0x000003ff]
    Scan for SMP in [mem 0x0009fc00-0x0009ffff]
    Scan for SMP in [mem 0x000f0000-0x000fffff]
    found SMP MP-table at [mem 0x000f4fa0-0x000f4faf] mapped at [ffff8800000f4fa0]
    (XEN) mm.c:908:d0 Error getting mfn 100 (pfn 5555555555555555) from L1 entry 0000000000100461 for l1e_owner=0, pg_owner=0
    (XEN) mm.c:4995:d0 ptwr_emulate: could not get_page_from_l1e()
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [<ffffffff81ac07e2>] xen_set_pte_init+0x66/0x71
    . snip..
    Pid: 0, comm: swapper Not tainted 3.6.0-rc6upstream-00188-gb6fb969-dirty #2 HP ProLiant BL680c G5
    .. snip..
    Call Trace:
     [<ffffffff81ad31c6>] __early_ioremap+0x18a/0x248
     [<ffffffff81624731>] ? printk+0x48/0x4a
     [<ffffffff81ad32ac>] early_ioremap+0x13/0x15
     [<ffffffff81acc140>] get_mpc_size+0x2f/0x67
     [<ffffffff81acc284>] smp_scan_config+0x10c/0x136
     [<ffffffff81acc2e4>] default_find_smp_config+0x36/0x5a
     [<ffffffff81ac3085>] setup_arch+0x5b3/0xb5b
     [<ffffffff81624731>] ? printk+0x48/0x4a
     [<ffffffff81abca7f>] start_kernel+0x90/0x390
     [<ffffffff81abc356>] x86_64_start_reservations+0x131/0x136
     [<ffffffff81abfa83>] xen_start_kernel+0x65f/0x661
    (XEN) Domain 0 crashed: 'noreboot' set - not rebooting.

    which is that ioremap would end up mapping 0xff using _PAGE_IOMAP
    (which is what early_ioremap sticks as a flag) - which meant
    we would get MFN 0xFF (pte ff461, which is OK), and then it would
    also map 0x100 (b/c ioremap tries to get page aligned request, and
    it was trying to map 0xf4fa0 + PAGE_SIZE - so it mapped the next page)
    as _PAGE_IOMAP. Since 0x100 is actually a RAM page, and the _PAGE_IOMAP
    bypasses the P2M lookup we would happily set the PTE to 1000461.
    Xen would deny the request since we do not have access to the
    Machine Frame Number (MFN) of 0x100. The P2M[0x100] is for example
    0x80140.

    Fixes-Oracle-Bugzilla: https://bugzilla.oracle.com/bugzilla/show_bug.cgi?id=13665
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d54ecc0f3edbf3d50b508e45b7a6b80d73f7ed64
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Jul 11 18:00:59 2013 +0200

    saa7134: Fix unlocked snd_pcm_stop() call

    commit e6355ad7b1c6f70e2f48ae159f5658b441ccff95 upstream.

    snd_pcm_stop() must be called in the PCM substream lock context.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    [wml: Backported to 3.4: Adjust filename]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c28414d3497a0db41a9fb08650131ee15989ee9c
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sat Jan 12 16:19:36 2013 -0500

    ext4: return ENOMEM if sb_getblk() fails

    commit 860d21e2c585f7ee8a4ecc06f474fdc33c9474f4 upstream.

    The only reason for sb_getblk() failing is if it can't allocate the
    buffer_head.  So ENOMEM is more appropriate than EIO.  In addition,
    make sure that the file system is marked as being inconsistent if
    sb_getblk() fails.

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    [xr: Backported to 3.4:
     - Drop change to inline.c
     - Call to ext4_ext_check() from ext4_ext_find_extent() is conditional]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ef4c881e4ade7a45174d9cf45eca6f9e10f5ccc
Author: Roland Dreier <roland@purestorage.com>
Date:   Thu Nov 22 02:00:11 2012 -0800

    block: Don't access request after it might be freed

    commit 893d290f1d7496db97c9471bc352ad4a11dc8a25 upstream.

    After we've done __elv_add_request() and __blk_run_queue() in
    blk_execute_rq_nowait(), the request might finish and be freed
    immediately.  Therefore checking if the type is REQ_TYPE_PM_RESUME
    isn't safe afterwards, because if it isn't, rq might be gone.
    Instead, check beforehand and stash the result in a temporary.

    This fixes crashes in blk_execute_rq_nowait() I get occasionally when
    running with lots of memory debugging options enabled -- I think this
    race is usually harmless because the window for rq to be reallocated
    is so small.

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 50e97121b728014dfbc34f07d1ac5a507466a2b7
Author: Paul Clements <paul.clements@steeleye.com>
Date:   Wed Jul 3 15:09:04 2013 -0700

    nbd: correct disconnect behavior

    commit c378f70adbc1bbecd9e6db145019f14b2f688c7c upstream.

    Currently, when a disconnect is requested by the user (via NBD_DISCONNECT
    ioctl) the return from NBD_DO_IT is undefined (it is usually one of
    several error codes).  This means that nbd-client does not know if a
    manual disconnect was performed or whether a network error occurred.
    Because of this, nbd-client's persist mode (which tries to reconnect after
    error, but not after manual disconnect) does not always work correctly.

    This change fixes this by causing NBD_DO_IT to always return 0 if a user
    requests a disconnect.  This means that nbd-client can correctly either
    persist the connection (if an error occurred) or disconnect (if the user
    requested it).

    Signed-off-by: Paul Clements <paul.clements@steeleye.com>
    Acked-by: Rob Landley <rob@landley.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0f9634dcc55be0ad7cfbc96c790bad780bd463d
Author: Jeff Layton <jlayton@redhat.com>
Date:   Thu Dec 27 08:05:03 2012 -0500

    cifs: adjust sequence number downward after signing NT_CANCEL request

    commit 31efee60f489c759c341454d755a9fd13de8c03d upstream.

    When a call goes out, the signing code adjusts the sequence number
    upward by two to account for the request and the response. An NT_CANCEL
    however doesn't get a response of its own, it just hurries the server
    along to get it to respond to the original request more quickly.
    Therefore, we must adjust the sequence number back down by one after
    signing a NT_CANCEL request.

    Reported-by: Tim Perry <tdparmor-sambabugs@yahoo.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b54e3acc375bf344c2273662c61ce0265969b5fd
Author: Jan Kara <jack@suse.cz>
Date:   Tue Jan 29 22:48:17 2013 -0500

    ext4: fix possible use-after-free with AIO

    commit 091e26dfc156aeb3b73bc5c5f277e433ad39331c upstream.

    Running AIO is pinning inode in memory using file reference. Once AIO
    is completed using aio_complete(), file reference is put and inode can
    be freed from memory. So we have to be sure that calling aio_complete()
    is the last thing we do with the inode.

    Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
    Acked-by: Jeff Moyer <jmoyer@redhat.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8a4188e2d84ab2ec720f29ede1799a6882969857
Author: Adam Thomas <adamthomas1111@gmail.com>
Date:   Sat Feb 2 22:35:08 2013 +0000

    UBIFS: fix double free of ubifs_orphan objects

    commit 8afd500cb52a5d00bab4525dd5a560d199f979b9 upstream.

    The last orphan in the dnext list has its dnext set to NULL. Because
    of that, ubifs_delete_orphan assumes that it is not on the dnext list
    and frees it immediately instead ignoring it as a second delete. The
    orphan is later freed again by erase_deleted.

    This change adds an explicit flag to ubifs_orphan indicating whether
    it is pending delete.

    Signed-off-by: Adam Thomas <adamthomas1111@gmail.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ebdc12a0b5ed501c23b52b1ab5d28aea681badcd
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed Apr 3 22:02:52 2013 -0400

    ext4/jbd2: don't wait (forever) for stale tid caused by wraparound

    commit d76a3a77113db020d9bb1e894822869410450bd9 upstream.

    In the case where an inode has a very stale transaction id (tid) in
    i_datasync_tid or i_sync_tid, it's possible that after a very large
    (2**31) number of transactions, that the tid number space might wrap,
    causing tid_geq()'s calculations to fail.

    Commit deeeaf13 "jbd2: fix fsync() tid wraparound bug", later modified
    by commit e7b04ac0 "jbd2: don't wake kjournald unnecessarily",
    attempted to fix this problem, but it only avoided kjournald spinning
    forever by fixing the logic in jbd2_log_start_commit().

    Unfortunately, in the codepaths in fs/ext4/fsync.c and fs/ext4/inode.c
    that might call jbd2_log_start_commit() with a stale tid, those
    functions will subsequently call jbd2_log_wait_commit() with the same
    stale tid, and then wait for a very long time.  To fix this, we
    replace the calls to jbd2_log_start_commit() and
    jbd2_log_wait_commit() with a call to a new function,
    jbd2_complete_transaction(), which will correctly handle stale tid's.

    As a bonus, jbd2_complete_transaction() will avoid locking
    j_state_lock for writing unless a commit needs to be started.  This
    should have a small (but probably not measurable) improvement for
    ext4's scalability.

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Reported-by: Ben Hutchings <ben@decadent.org.uk>
    Reported-by: George Barnett <gbarnett@atlassian.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7d659d6baad472a8e810412e0c27cafe899bde9
Author: Dave Chiluk <chiluk@canonical.com>
Date:   Tue May 28 16:06:08 2013 -0500

    ncpfs: fix rmdir returns Device or resource busy

    commit 698b8223631472bf982ed570b0812faa61955683 upstream.

    1d2ef5901483004d74947bbf78d5146c24038fe7 caused a regression in ncpfs such that
    directories could no longer be removed.  This was because ncp_rmdir checked
    to see if a dentry could be unhashed before allowing it to be removed. Since
    1d2ef5901483004d74947bbf78d5146c24038fe7 introduced a change that incremented
    dentry->d_count causing it to always be greater than 1 unhash would always
    fail.  Thus causing the error path in ncp_rmdir to always be taken.  Removing
    this error path is safe as unhashing is still accomplished by calls to dput
    from vfs_rmdir.

    Signed-off-by: Dave Chiluk <chiluk@canonical.com>
    Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3d956c8a399285b1b51548fbaecad202d3a845c2
Author: Jeff Layton <jlayton@redhat.com>
Date:   Wed Aug 7 10:29:08 2013 -0400

    cifs: don't instantiate new dentries in readdir for inodes that need to be revalidated immediately

    commit 757c4f6260febff982276818bb946df89c1105aa upstream.

    David reported that commit c2b93e06 (cifs: only set ops for inodes in
    I_NEW state) caused a regression with mfsymlinks. Prior to that patch,
    if a mfsymlink dentry was instantiated at readdir time, the inode would
    get a new set of ops when it was revalidated. After that patch, this
    did not occur.

    This patch addresses this by simply skipping instantiating dentries in
    the readdir codepath when we know that they will need to be immediately
    revalidated. The next attempt to use that dentry will cause a new lookup
    to occur (which is basically what we want to happen anyway).

    Cc: "Stefan (metze) Metzmacher" <metze@samba.org>
    Cc: Sachin Prabhu <sprabhu@redhat.com>
    Reported-and-Tested-by: David McBride <dwm37@cam.ac.uk>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    [bwh: Backported to 3.2: need to return NULL]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b3f19e7fb89f09ca56324a06b4ef7caf6745259b
Author: majianpeng <majianpeng@gmail.com>
Date:   Tue Jul 16 15:45:48 2013 +0800

    libceph: unregister request in __map_request failed and nofail == false

    commit 73d9f7eef3d98c3920e144797cc1894c6b005a1e upstream.

    For nofail == false request, if __map_request failed, the caller does
    cleanup work, like releasing the relative pages.  It doesn't make any sense
    to retry this request.

    Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
    Reviewed-by: Sage Weil <sage@inktank.com>
    [bwh: Backported to 3.2: adjust indentation]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe17c202b59ee36cff6ac87ca7ed31a9e9ea5f73
Author: Maxim Patlasov <MPatlasov@parallels.com>
Date:   Fri Aug 30 17:06:04 2013 +0400

    fuse: hotfix truncate_pagecache() issue

    commit 06a7c3c2781409af95000c60a5df743fd4e2f8b4 upstream.

    The way how fuse calls truncate_pagecache() from fuse_change_attributes()
    is completely wrong. Because, w/o i_mutex held, we never sure whether
    'oldsize' and 'attr->size' are valid by the time of execution of
    truncate_pagecache(inode, oldsize, attr->size). In fact, as soon as we
    released fc->lock in the middle of fuse_change_attributes(), we completely
    loose control of actions which may happen with given inode until we reach
    truncate_pagecache. The list of potentially dangerous actions includes
    mmap-ed reads and writes, ftruncate(2) and write(2) extending file size.

    The typical outcome of doing truncate_pagecache() with outdated arguments
    is data corruption from user point of view. This is (in some sense)
    acceptable in cases when the issue is triggered by a change of the file on
    the server (i.e. externally wrt fuse operation), but it is absolutely
    intolerable in scenarios when a single fuse client modifies a file without
    any external intervention. A real life case I discovered by fsx-linux
    looked like this:

    1. Shrinking ftruncate(2) comes to fuse_do_setattr(). The latter sends
    FUSE_SETATTR to the server synchronously, but before getting fc->lock ...
    2. fuse_dentry_revalidate() is asynchronously called. It sends FUSE_LOOKUP
    to the server synchronously, then calls fuse_change_attributes(). The
    latter updates i_size, releases fc->lock, but before comparing oldsize vs
    attr->size..
    3. fuse_do_setattr() from the first step proceeds by acquiring fc->lock and
    updating attributes and i_size, but now oldsize is equal to
    outarg.attr.size because i_size has just been updated (step 2). Hence,
    fuse_do_setattr() returns w/o calling truncate_pagecache().
    4. As soon as ftruncate(2) completes, the user extends file size by
    write(2) making a hole in the middle of file, then reads data from the hole
    either by read(2) or mmap-ed read. The user expects to get zero data from
    the hole, but gets stale data because truncate_pagecache() is not executed
    yet.

    The scenario above illustrates one side of the problem: not truncating the
    page cache even though we should. Another side corresponds to truncating
    page cache too late, when the state of inode changed significantly.
    Theoretically, the following is possible:

    1. As in the previous scenario fuse_dentry_revalidate() discovered that
    i_size changed (due to our own fuse_do_setattr()) and is going to call
    truncate_pagecache() for some 'new_size' it believes valid right now. But
    by the time that particular truncate_pagecache() is called ...
    2. fuse_do_setattr() returns (either having called truncate_pagecache() or
    not -- it doesn't matter).
    3. The file is extended either by write(2) or ftruncate(2) or fallocate(2).
    4. mmap-ed write makes a page in the extended region dirty.

    The result will be the lost of data user wrote on the fourth step.

    The patch is a hotfix resolving the issue in a simplistic way: let's skip
    dangerous i_size update and truncate_pagecache if an operation changing
    file size is in progress. This simplistic approach looks correct for the
    cases w/o external changes. And to handle them properly, more sophisticated
    and intrusive techniques (e.g. NFS-like one) would be required. I'd like to
    postpone it until the issue is well discussed on the mailing list(s).

    Changed in v2:
     - improved patch description to cover both sides of the issue.

    Signed-off-by: Maxim Patlasov <mpatlasov@parallels.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    [bwh: Backported to 3.2: add the fuse_inode::state field which we didn't have]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4a69e06dc99cd683fa001c49eb92da36fd76d1d
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Tue Sep 3 14:28:38 2013 +0200

    fuse: readdir: check for slash in names

    commit efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd upstream.

    Userspace can add names containing a slash character to the directory
    listing.  Don't allow this as it could cause all sorts of trouble.

    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    [bwh: Backported to 3.2: drop changes to parse_dirplusfile() which we
     don't have]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 831c87640d23ccb253a02e4901bd9a325b5e8c2d
Author: Vyacheslav Dubeyko <slava@dubeyko.com>
Date:   Mon Sep 30 13:45:12 2013 -0700

    nilfs2: fix issue with race condition of competition between segments for dirty blocks

    commit 7f42ec3941560f0902fe3671e36f2c20ffd3af0a upstream.

    Many NILFS2 users were reported about strange file system corruption
    (for example):

       NILFS: bad btree node (blocknr=185027): level = 0, flags = 0x0, nchildren = 768
       NILFS error (device sda4): nilfs_bmap_last_key: broken bmap (inode number=11540)

    But such error messages are consequence of file system's issue that takes
    place more earlier.  Fortunately, Jerome Poulin <jeromepoulin@gmail.com>
    and Anton Eliasson <devel@antoneliasson.se> were reported about another
    issue not so recently.  These reports describe the issue with segctor
    thread's crash:

      BUG: unable to handle kernel paging request at 0000000000004c83
      IP: nilfs_end_page_io+0x12/0xd0 [nilfs2]

      Call Trace:
       nilfs_segctor_do_construct+0xf25/0x1b20 [nilfs2]
       nilfs_segctor_construct+0x17b/0x290 [nilfs2]
       nilfs_segctor_thread+0x122/0x3b0 [nilfs2]
       kthread+0xc0/0xd0
       ret_from_fork+0x7c/0xb0

    These two issues have one reason.  This reason can raise third issue
    too.  Third issue results in hanging of segctor thread with eating of
    100% CPU.

    REPRODUCING PATH:

    One of the possible way or the issue reproducing was described by
    Jermoe me Poulin <jeromepoulin@gmail.com>:

    1. init S to get to single user mode.
    2. sysrq+E to make sure only my shell is running
    3. start network-manager to get my wifi connection up
    4. login as root and launch "screen"
    5. cd /boot/log/nilfs which is a ext3 mount point and can log when NILFS dies.
    6. lscp | xz -9e > lscp.txt.xz
    7. mount my snapshot using mount -o cp=3360839,ro /dev/vgUbuntu/root /mnt/nilfs
    8. start a screen to dump /proc/kmsg to text file since rsyslog is killed
    9. start a screen and launch strace -f -o find-cat.log -t find
    /mnt/nilfs -type f -exec cat {} > /dev/null \;
    10. start a screen and launch strace -f -o apt-get.log -t apt-get update
    11. launch the last command again as it did not crash the first time
    12. apt-get crashes
    13. ps aux > ps-aux-crashed.log
    13. sysrq+W
    14. sysrq+E  wait for everything to terminate
    15. sysrq+SUSB

    Simplified way of the issue reproducing is starting kernel compilation
    task and "apt-get update" in parallel.

    REPRODUCIBILITY:

    The issue is reproduced not stable [60% - 80%].  It is very important to
    have proper environment for the issue reproducing.  The critical
    conditions for successful reproducing:

    (1) It should have big modified file by mmap() way.

    (2) This file should have the count of dirty blocks are greater that
        several segments in size (for example, two or three) from time to time
        during processing.

    (3) It should be intensive background activity of files modification
        in another thread.

    INVESTIGATION:

    First of all, it is possible to see that the reason of crash is not valid
    page address:

      NILFS [nilfs_segctor_complete_write]:2100 bh->b_count 0, bh->b_blocknr 13895680, bh->b_size 13897727, bh->b_page 0000000000001a82
      NILFS [nilfs_segctor_complete_write]:2101 segbuf->sb_segnum 6783

    Moreover, value of b_page (0x1a82) is 6786.  This value looks like segment
    number.  And b_blocknr with b_size values look like block numbers.  So,
    buffer_head's pointer points on not proper address value.

    Detailed investigation of the issue is discovered such picture:

      [-----------------------------SEGMENT 6783-------------------------------]
      NILFS [nilfs_segctor_do_construct]:2310 nilfs_segctor_begin_construction
      NILFS [nilfs_segctor_do_construct]:2321 nilfs_segctor_collect
      NILFS [nilfs_segctor_do_construct]:2336 nilfs_segctor_assign
      NILFS [nilfs_segctor_do_construct]:2367 nilfs_segctor_update_segusage
      NILFS [nilfs_segctor_do_construct]:2371 nilfs_segctor_prepare_write
      NILFS [nilfs_segctor_do_construct]:2376 nilfs_add_checksums_on_logs
      NILFS [nilfs_segctor_do_construct]:2381 nilfs_segctor_write
      NILFS [nilfs_segbuf_submit_bio]:464 bio->bi_sector 111149024, segbuf->sb_segnum 6783

      [-----------------------------SEGMENT 6784-------------------------------]
      NILFS [nilfs_segctor_do_construct]:2310 nilfs_segctor_begin_construction
      NILFS [nilfs_segctor_do_construct]:2321 nilfs_segctor_collect
      NILFS [nilfs_lookup_dirty_data_buffers]:782 bh->b_count 1, bh->b_page ffffea000709b000, page->index 0, i_ino 1033103, i_size 25165824
      NILFS [nilfs_lookup_dirty_data_buffers]:783 bh->b_assoc_buffers.next ffff8802174a6798, bh->b_assoc_buffers.prev ffff880221cffee8
      NILFS [nilfs_segctor_do_construct]:2336 nilfs_segctor_assign
      NILFS [nilfs_segctor_do_construct]:2367 nilfs_segctor_update_segusage
      NILFS [nilfs_segctor_do_construct]:2371 nilfs_segctor_prepare_write
      NILFS [nilfs_segctor_do_construct]:2376 nilfs_add_checksums_on_logs
      NILFS [nilfs_segctor_do_construct]:2381 nilfs_segctor_write
      NILFS [nilfs_segbuf_submit_bh]:575 bh->b_count 1, bh->b_page ffffea000709b000, page->index 0, i_ino 1033103, i_size 25165824
      NILFS [nilfs_segbuf_submit_bh]:576 segbuf->sb_segnum 6784
      NILFS [nilfs_segbuf_submit_bh]:577 bh->b_assoc_buffers.next ffff880218a0d5f8, bh->b_assoc_buffers.prev ffff880218bcdf50
      NILFS [nilfs_segbuf_submit_bio]:464 bio->bi_sector 111150080, segbuf->sb_segnum 6784, segbuf->sb_nbio 0
      [----------] ditto
      NILFS [nilfs_segbuf_submit_bio]:464 bio->bi_sector 111164416, segbuf->sb_segnum 6784, segbuf->sb_nbio 15

      [-----------------------------SEGMENT 6785-------------------------------]
      NILFS [nilfs_segctor_do_construct]:2310 nilfs_segctor_begin_construction
      NILFS [nilfs_segctor_do_construct]:2321 nilfs_segctor_collect
      NILFS [nilfs_lookup_dirty_data_buffers]:782 bh->b_count 2, bh->b_page ffffea000709b000, page->index 0, i_ino 1033103, i_size 25165824
      NILFS [nilfs_lookup_dirty_data_buffers]:783 bh->b_assoc_buffers.next ffff880219277e80, bh->b_assoc_buffers.prev ffff880221cffc88
      NILFS [nilfs_segctor_do_construct]:2367 nilfs_segctor_update_segusage
      NILFS [nilfs_segctor_do_construct]:2371 nilfs_segctor_prepare_write
      NILFS [nilfs_segctor_do_construct]:2376 nilfs_add_checksums_on_logs
      NILFS [nilfs_segctor_do_construct]:2381 nilfs_segctor_write
      NILFS [nilfs_segbuf_submit_bh]:575 bh->b_count 2, bh->b_page ffffea000709b000, page->index 0, i_ino 1033103, i_size 25165824
      NILFS [nilfs_segbuf_submit_bh]:576 segbuf->sb_segnum 6785
      NILFS [nilfs_segbuf_submit_bh]:577 bh->b_assoc_buffers.next ffff880218a0d5f8, bh->b_assoc_buffers.prev ffff880222cc7ee8
      NILFS [nilfs_segbuf_submit_bio]:464 bio->bi_sector 111165440, segbuf->sb_segnum 6785, segbuf->sb_nbio 0
      [----------] ditto
      NILFS [nilfs_segbuf_submit_bio]:464 bio->bi_sector 111177728, segbuf->sb_segnum 6785, segbuf->sb_nbio 12

      NILFS [nilfs_segctor_do_construct]:2399 nilfs_segctor_wait
      NILFS [nilfs_segbuf_wait]:676 segbuf->sb_segnum 6783
      NILFS [nilfs_segbuf_wait]:676 segbuf->sb_segnum 6784
      NILFS [nilfs_segbuf_wait]:676 segbuf->sb_segnum 6785

      NILFS [nilfs_segctor_complete_write]:2100 bh->b_count 0, bh->b_blocknr 13895680, bh->b_size 13897727, bh->b_page 0000000000001a82

      BUG: unable to handle kernel paging request at 0000000000001a82
      IP: [<ffffffffa024d0f2>] nilfs_end_page_io+0x12/0xd0 [nilfs2]

    Usually, for every segment we collect dirty files in list.  Then, dirty
    blocks are gathered for every dirty file, prepared for write and
    submitted by means of nilfs_segbuf_submit_bh() call.  Finally, it takes
    place complete write phase after calling nilfs_end_bio_write() on the
    block layer.  Buffers/pages are marked as not dirty on final phase and
    processed files removed from the list of dirty files.

    It is possible to see that we had three prepare_write and submit_bio
    phases before segbuf_wait and complete_write phase.  Moreover, segments
    compete between each other for dirty blocks because on every iteration
    of segments processing dirty buffer_heads are added in several lists of
    payload_buffers:

      [SEGMENT 6784]: bh->b_assoc_buffers.next ffff880218a0d5f8, bh->b_assoc_buffers.prev ffff880218bcdf50
      [SEGMENT 6785]: bh->b_assoc_buffers.next ffff880218a0d5f8, bh->b_assoc_buffers.prev ffff880222cc7ee8

    The next pointer is the same but prev pointer has changed.  It means
    that buffer_head has next pointer from one list but prev pointer from
    another.  Such modification can be made several times.  And, finally, it
    can be resulted in various issues: (1) segctor hanging, (2) segctor
    crashing, (3) file system metadata corruption.

    FIX:
    This patch adds:

    (1) setting of BH_Async_Write flag in nilfs_segctor_prepare_write()
        for every proccessed dirty block;

    (2) checking of BH_Async_Write flag in
        nilfs_lookup_dirty_data_buffers() and
        nilfs_lookup_dirty_node_buffers();

    (3) clearing of BH_Async_Write flag in nilfs_segctor_complete_write(),
        nilfs_abort_logs(), nilfs_forget_buffer(), nilfs_clear_dirty_page().

    Reported-by: Jerome Poulin <jeromepoulin@gmail.com>
    Reported-by: Anton Eliasson <devel@antoneliasson.se>
    Cc: Paul Fertser <fercerpav@gmail.com>
    Cc: ARAI Shun-ichi <hermes@ceres.dti.ne.jp>
    Cc: Piotr Szymaniak <szarpaj@grubelek.pl>
    Cc: Juan Barry Manuel Canham <Linux@riotingpacifist.net>
    Cc: Zahid Chowdhury <zahid.chowdhury@starsolutions.com>
    Cc: Elmer Zhang <freeboy6716@gmail.com>
    Cc: Kenneth Langga <klangga@gmail.com>
    Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
    Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: nilfs_clear_dirty_page() has not been separated
     from nilfs_clear_dirty_pages()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73a1182808116574b21e134b80a437cec9459642
Author: Jiri Olsa <jolsa@redhat.com>
Date:   Wed Sep 5 19:51:33 2012 +0200

    perf tools: Fix cache event name generation

    commit 275ef3878f698941353780440fec6926107a320b upstream.

    If the event name is specified with all 3 components, the last one
    overwrites the previous one during the name composing within the
    parse_events_add_cache function.

    Fixing this by properly adjusting the string index.

    Reported-by: Joel Uckelman <joel@lightboxtechnologies.com>
    Signed-off-by: Jiri Olsa <jolsa@redhat.com>
    Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Joel Uckelman <joel@lightboxtechnologies.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    LPU-Reference: 20120905175133.GA18352@krava.brq.redhat.com
    [ committer note: Remove the newline fix, done already in 42e1fb7 ]
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Vinson Lee <vlee@twopensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f25c118ba56ee7d9430a9e8daa6eb5e783146a00
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Date:   Thu Sep 6 14:43:28 2012 -0300

    perf tools: Remove extraneous newline when parsing hardware cache events

    commit 42e1fb776087713b5482cd7cf6cac998fbdd6544 upstream.

    Noticed while developing a 'perf test' entry to verify that
    perf_evsel__name works.

    Cc: David Ahern <dsahern@gmail.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Mike Galbraith <efault@gmx.de>
    Cc: Namhyung Kim <namhyung@gmail.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Link: http://lkml.kernel.org/n/tip-xz6zgh38mp3cjnd2udh38z8f@git.kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Vinson Lee <vlee@twopensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 446327d6f1763bbe7f9793cc8dae04fca82c9d48
Author: Jiang Liu <jiang.liu@huawei.com>
Date:   Tue Jul 31 16:43:30 2012 -0700

    mm/hotplug: correctly add new zone to all other nodes' zone lists

    commit 08dff7b7d629807dbb1f398c68dd9cd58dd657a1 upstream.

    When online_pages() is called to add new memory to an empty zone, it
    rebuilds all zone lists by calling build_all_zonelists().  But there's a
    bug which prevents the new zone to be added to other nodes' zone lists.

    online_pages() {
    	build_all_zonelists()
    	.....
    	node_set_state(zone_to_nid(zone), N_HIGH_MEMORY)
    }

    Here the node of the zone is put into N_HIGH_MEMORY state after calling
    build_all_zonelists(), but build_all_zonelists() only adds zones from
    nodes in N_HIGH_MEMORY state to the fallback zone lists.
    build_all_zonelists()

        ->__build_all_zonelists()
    	->build_zonelists()
    	    ->find_next_best_node()
    		->for_each_node_state(n, N_HIGH_MEMORY)

    So memory in the new zone will never be used by other nodes, and it may
    cause strange behavor when system is under memory pressure.  So put node
    into N_HIGH_MEMORY state before calling build_all_zonelists().

    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Jiang Liu <liuj97@gmail.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Michal Hocko <mhocko@suse.cz>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Keping Chen <chenkeping@huawei.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71a2068595ac1e8c45e97dff47df0148c2acbbfc
Author: Tejun Heo <tj@kernel.org>
Date:   Tue Jun 25 11:48:32 2013 -0700

    cgroup: fix RCU accesses to task->cgroups

    commit 14611e51a57df10240817d8ada510842faf0ec51 upstream.

    task->cgroups is a RCU pointer pointing to struct css_set.  A task
    switches to a different css_set on cgroup migration but a css_set
    doesn't change once created and its pointers to cgroup_subsys_states
    aren't RCU protected.

    task_subsys_state[_check]() is the macro to acquire css given a task
    and subsys_id pair.  It RCU-dereferences task->cgroups->subsys[] not
    task->cgroups, so the RCU pointer task->cgroups ends up being
    dereferenced without read_barrier_depends() after it.  It's broken.

    Fix it by introducing task_css_set[_check]() which does
    RCU-dereference on task->cgroups.  task_subsys_state[_check]() is
    reimplemented to directly dereference ->subsys[] of the css_set
    returned from task_css_set[_check]().

    This removes some of sparse RCU warnings in cgroup.

    v2: Fixed unbalanced parenthsis and there's no need to use
        rcu_dereference_raw() when !CONFIG_PROVE_RCU.  Both spotted by Li.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Acked-by: Li Zefan <lizefan@huawei.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Remove CONFIG_PROVE_RCU condition
     - s/lockdep_is_held(&cgroup_mutex)/cgroup_lock_is_held()/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f590c47013d610800770be179b8fbfd7c6bb1f8
Author: Kees Cook <keescook@chromium.org>
Date:   Mon Feb 25 21:32:25 2013 +0000

    proc connector: reject unprivileged listener bumps

    commit e70ab977991964a5a7ad1182799451d067e62669 upstream.

    While PROC_CN_MCAST_LISTEN/IGNORE is entirely advisory, it was possible
    for an unprivileged user to turn off notifications for all listeners by
    sending PROC_CN_MCAST_IGNORE. Instead, require the same privileges as
    required for a multicast bind.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: Evgeniy Polyakov <zbr@ioremap.net>
    Cc: Matt Helsley <matthltc@us.ibm.com>
    Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
    Acked-by: Matt Helsley <matthltc@us.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f7741e3b3f9d3827e7bc75118118f102553f7564
Author: Greg Edwards <gedwards@ddn.com>
Date:   Mon Nov 4 09:08:12 2013 -0700

    KVM: IOMMU: hva align mapping page size

    commit 27ef63c7e97d1e5dddd85051c03f8d44cc887f34 upstream.

    When determining the page size we could use to map with the IOMMU, the
    page size should also be aligned with the hva, not just the gfn.  The
    gfn may not reflect the real alignment within the hugetlbfs file.

    Most of the time, this works fine.  However, if the hugetlbfs file is
    backed by non-contiguous huge pages, a multi-huge page memslot starts at
    an unaligned offset within the hugetlbfs file, and the gfn is aligned
    with respect to the huge page size, kvm_host_page_size() will return the
    huge page size and we will use that to map with the IOMMU.

    When we later unpin that same memslot, the IOMMU returns the unmap size
    as the huge page size, and we happily unpin that many pfns in
    monotonically increasing order, not realizing we are spanning
    non-contiguous huge pages and partially unpin the wrong huge page.

    Ensure the IOMMU mapping page size is aligned with the hva corresponding
    to the gfn, which does reflect the alignment within the hugetlbfs file.

    Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Greg Edwards <gedwards@ddn.com>
    Signed-off-by: Gleb Natapov <gleb@redhat.com>
    [bwh: Backported to 3.2: s/__gfn_to_hva_memslot/gfn_to_hva_memslot/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 67bc20f722e2d3b77566f3eac9e9f6ce1b890d23
Author: Alexander Graf <agraf@suse.de>
Date:   Thu Jan 17 13:50:25 2013 +0100

    KVM: PPC: Emulate dcbf

    commit d3286144c92ec876da9e30320afa875699b7e0f1 upstream.

    Guests can trigger MMIO exits using dcbf. Since we don't emulate cache
    incoherent MMIO, just do nothing and move on.

    Reported-by: Ben Collins <ben.c@servergy.com>
    Signed-off-by: Alexander Graf <agraf@suse.de>
    Tested-by: Ben Collins <ben.c@servergy.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 115f50635c5addb145f20e090fa6345ee31fb2b8
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Tue Oct 2 16:25:38 2012 +0200

    s390/kvm: dont announce RRBM support

    commit 87cac8f879a5ecd7109dbe688087e8810b3364eb upstream.

    Newer kernels (linux-next with the transparent huge page patches)
    use rrbm if the feature is announced via feature bit 66.
    RRBM will cause intercepts, so KVM does not handle it right now,
    causing an illegal instruction in the guest.
    The  easy solution is to disable the feature bit for the guest.

    This fixes bugs like:
    Kernel BUG at 0000000000124c2a [verbose debug info unavailable]
    illegal operation: 0001 [#1] SMP
    Modules linked in: virtio_balloon virtio_net ipv6 autofs4
    CPU: 0 Not tainted 3.5.4 #1
    Process fmempig (pid: 659, task: 000000007b712fd0, ksp: 000000007bed3670)
    Krnl PSW : 0704d00180000000 0000000000124c2a (pmdp_clear_flush_young+0x5e/0x80)
         R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
         00000000003cc000 0000000000000004 0000000000000000 0000000079800000
         0000000000040000 0000000000000000 000000007bed3918 000000007cf40000
         0000000000000001 000003fff7f00000 000003d281a94000 000000007bed383c
         000000007bed3918 00000000005ecbf8 00000000002314a6 000000007bed36e0
     Krnl Code:>0000000000124c2a: b9810025          ogr     %r2,%r5
               0000000000124c2e: 41343000           la      %r3,0(%r4,%r3)
               0000000000124c32: a716fffa           brct    %r1,124c26
               0000000000124c36: b9010022           lngr    %r2,%r2
               0000000000124c3a: e3d0f0800004       lg      %r13,128(%r15)
               0000000000124c40: eb22003f000c       srlg    %r2,%r2,63
    [ 2150.713198] Call Trace:
    [ 2150.713223] ([<00000000002312c4>] page_referenced_one+0x6c/0x27c)
    [ 2150.713749]  [<0000000000233812>] page_referenced+0x32a/0x410
    [...]

    CC: Alex Graf <agraf@suse.de>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf5597c693051a29efb77a6853daa869cd9667ab
Author: Dominik Dingel <dingel@linux.vnet.ibm.com>
Date:   Fri Jul 26 15:04:00 2013 +0200

    KVM: s390: move kvm_guest_enter,exit closer to sie

    commit 2b29a9fdcb92bfc6b6f4c412d71505869de61a56 upstream.

    Any uaccess between guest_enter and guest_exit could trigger a page fault,
    the page fault handler would handle it as a guest fault and translate a
    user address as guest address.

    Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    CC: stable@vger.kernel.org
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    [hq: Backported to 3.4: adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30ec268be37bdb5b1614cce40af8083f1a7c27f3
Author: Tejun Heo <tj@kernel.org>
Date:   Tue Oct 16 15:03:14 2012 -0700

    cgroup: cgroup_subsys->fork() should be called after the task is added to css_set

    commit 5edee61edeaaebafe584f8fb7074c1ef4658596b upstream.

    cgroup core has a bug which violates a basic rule about event
    notifications - when a new entity needs to be added, you add that to
    the notification list first and then make the new entity conform to
    the current state.  If done in the reverse order, an event happening
    inbetween will be lost.

    cgroup_subsys->fork() is invoked way before the new task is added to
    the css_set.  Currently, cgroup_freezer is the only user of ->fork()
    and uses it to make new tasks conform to the current state of the
    freezer.  If FROZEN state is requested while fork is in progress
    between cgroup_fork_callbacks() and cgroup_post_fork(), the child
    could escape freezing - the cgroup isn't frozen when ->fork() is
    called and the freezer couldn't see the new task on the css_set.

    This patch moves cgroup_subsys->fork() invocation to
    cgroup_post_fork() after the new task is added to the css_set.
    cgroup_fork_callbacks() is removed.

    Because now a task may be migrated during cgroup_subsys->fork(),
    freezer_fork() is updated so that it adheres to the usual RCU locking
    and the rather pointless comment on why locking can be different there
    is removed (if it doesn't make anything simpler, why even bother?).

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Rafael J. Wysocki <rjw@sisk.pl>
    [hq: Backported to 3.4:
     - Adjust context
     - Iterate over first CGROUP_BUILTIN_SUBSYS_COUNT elements of subsys]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f47929fd5093c4b5c134ff2b2811ae327102bafd
Author: Johannes Weiner <hannes@cmpxchg.org>
Date:   Thu Nov 29 13:54:23 2012 -0800

    mm: vmscan: fix endless loop in kswapd balancing

    commit 60cefed485a02bd99b6299dad70666fe49245da7 upstream.

    Kswapd does not in all places have the same criteria for a balanced
    zone.  Zones are only being reclaimed when their high watermark is
    breached, but compaction checks loop over the zonelist again when the
    zone does not meet the low watermark plus two times the size of the
    allocation.  This gets kswapd stuck in an endless loop over a small
    zone, like the DMA zone, where the high watermark is smaller than the
    compaction requirement.

    Add a function, zone_balanced(), that checks the watermark, and, for
    higher order allocations, if compaction has enough free memory.  Then
    use it uniformly to check for balanced zones.

    This makes sure that when the compaction watermark is not met, at least
    reclaim happens and progress is made - or the zone is declared
    unreclaimable at some point and skipped entirely.

    Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
    Reported-by: George Spelvin <linux@horizon.com>
    Reported-by: Johannes Hirte <johannes.hirte@fem.tu-ilmenau.de>
    Reported-by: Tomas Racek <tracek@redhat.com>
    Tested-by: Johannes Hirte <johannes.hirte@fem.tu-ilmenau.de>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [hq: Backported to 3.4: adjust context]
    Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8371cffe8a9c704e3d240d5cb73142b6bd62245b
Author: Hannes Reinecke <hare@suse.de>
Date:   Wed Feb 26 10:07:04 2014 +0100

    dm mpath: fix stalls when handling invalid ioctls

    commit a1989b330093578ea5470bea0a00f940c444c466 upstream.

    An invalid ioctl will never be valid, irrespective of whether multipath
    has active paths or not.  So for invalid ioctls we do not have to wait
    for multipath to activate any paths, but can rather return an error
    code immediately.  This fix resolves numerous instances of:

     udevd[]: worker [] unexpectedly returned with status 0x0100

    that have been seen during testing.

    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d8e4839b5457e20e371a5f7485ce7855c7870c9
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Thu Feb 13 10:39:01 2014 +0100

    dma: ste_dma40: don't dereference free:d descriptor

    commit e9baa9d9d520fb0e24cca671e430689de2d4a4b2 upstream.

    It appears that in the DMA40 driver the DMA tasklet will very
    often dereference memory for a descriptor just free:d from the
    DMA40 slab. Nothing happens because no other part of the driver
    has yet had a chance to claim this memory, but it's really
    nasty to dereference free:d memory, so let's check the flag
    before the descriptor is free and store it in a bool variable.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 54499e71eccdeab9295af9150e3ffb99223447a8
Author: Jan Kara <jack@suse.cz>
Date:   Thu Feb 20 17:02:27 2014 +0100

    quota: Fix race between dqput() and dquot_scan_active()

    commit 1362f4ea20fa63688ba6026e586d9746ff13a846 upstream.

    Currently last dqput() can race with dquot_scan_active() causing it to
    call callback for an already deactivated dquot. The race is as follows:

    CPU1					CPU2
      dqput()
        spin_lock(&dq_list_lock);
        if (atomic_read(&dquot->dq_count) > 1) {
         - not taken
        if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
          spin_unlock(&dq_list_lock);
          ->release_dquot(dquot);
            if (atomic_read(&dquot->dq_count) > 1)
             - not taken
    					  dquot_scan_active()
    					    spin_lock(&dq_list_lock);
    					    if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
    					     - not taken
    					    atomic_inc(&dquot->dq_count);
    					    spin_unlock(&dq_list_lock);
            - proceeds to release dquot
    					    ret = fn(dquot, priv);
    					     - called for inactive dquot

    Fix the problem by making sure possible ->release_dquot() is finished by
    the time we call the callback and new calls to it will notice reference
    dquot_scan_active() has taken and bail out.

    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 186ef2385c50ee6b2232f2ab8edb354ca71332bf
Author: Eric Paris <eparis@redhat.com>
Date:   Thu Feb 20 10:56:45 2014 -0500

    SELinux: bigendian problems with filename trans rules

    commit 9085a6422900092886da8c404e1c5340c4ff1cbf upstream.

    When writing policy via /sys/fs/selinux/policy I wrote the type and class
    of filename trans rules in CPU endian instead of little endian.  On
    x86_64 this works just fine, but it means that on big endian arch's like
    ppc64 and s390 userspace reads the policy and converts it from
    le32_to_cpu.  So the values are all screwed up.  Write the values in le
    format like it should have been to start.

    Signed-off-by: Eric Paris <eparis@redhat.com>
    Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f80747a43fc2613b9f5e1ded16f50ef28815652e
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Mon Feb 24 12:06:12 2014 +0100

    perf: Fix hotplug splat

    commit e3703f8cdfcf39c25c4338c3ad8e68891cca3731 upstream.

    Drew Richardson reported that he could make the kernel go *boom* when hotplugging
    while having perf events active.

    It turned out that when you have a group event, the code in
    __perf_event_exit_context() fails to remove the group siblings from
    the context.

    We then proceed with destroying and freeing the event, and when you
    re-plug the CPU and try and add another event to that CPU, things go
    *boom* because you've still got dead entries there.

    Reported-by: Drew Richardson <drew.richardson@arm.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Will Deacon <will.deacon@arm.com>
    Link: http://lkml.kernel.org/n/tip-k6v5wundvusvcseqj1si0oz0@git.kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23f0913c2b3816b11f32dcf774758b3f63b81f60
Author: Lai Jiangshan <laijs@cn.fujitsu.com>
Date:   Sat Feb 15 22:02:28 2014 +0800

    workqueue: ensure @task is valid across kthread_stop()

    commit 5bdfff96c69a4d5ab9c49e60abf9e070ecd2acbb upstream.

    When a kworker should die, the kworkre is notified through WORKER_DIE
    flag instead of kthread_should_stop().  This, IIRC, is primarily to
    keep the test synchronized inside worker_pool lock.  WORKER_DIE is
    first set while holding pool->lock, the lock is dropped and
    kthread_stop() is called.

    Unfortunately, this means that there's a slight chance that the target
    kworker may see WORKER_DIE before kthread_stop() finishes and exits
    and frees the target task before or during kthread_stop().

    Fix it by pinning the target task before setting WORKER_DIE and
    putting it after kthread_stop() is done.

    tj: Improved patch description and comment.  Moved pinning above
        WORKER_DIE for better signify what it's protecting.

    Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d36299431351e5c3a893d9c1eae7579ebc57ad5
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Sat Feb 15 17:54:06 2014 -0800

    hwmon: (max1668) Fix writing the minimum temperature

    commit 500a91571f0a5d0d3242d83802ea2fd1faccc66e upstream.

    When trying to set the minimum temperature, the driver was erroneously
    writing the maximum temperature into the chip.

    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Reviewed-by: Jean Delvare <jdelvare@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 564a4d6c3205fc001579c00a0ce19b665f860487
Author: Joerg Dorchain <joerg@dorchain.net>
Date:   Fri Feb 21 20:29:33 2014 +0100

    USB: ftdi_sio: add Cressi Leonardo PID

    commit 6dbd46c849e071e6afc1e0cad489b0175bca9318 upstream.

    Hello,

    the following patch adds an entry for the PID of a Cressi Leonardo
    diving computer interface to kernel 3.13.0.
    It is detected as FT232RL.
    Works with subsurface.

    Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f922754e32d72b890ad471b5efd76b38c25f7d17
Author: Aleksander Morgado <aleksander@aleksander.es>
Date:   Wed Feb 12 16:04:45 2014 +0100

    USB: serial: option: blacklist interface 4 for Cinterion PHS8 and PXS8

    commit 12df84d4a80278a5b1abfec3206795291da52fc9 upstream.

    This interface is to be handled by the qmi_wwan driver.

    CC: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
    CC: Christian Schmiedl <christian.schmiedl@gemalto.com>
    CC: Nicolaus Colberg <nicolaus.colberg@gemalto.com>
    CC: David McCullough <david.mccullough@accelecon.com>
    Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d0230273dea6597819c4fe9f64f5bb891241578
Author: Lan Tianyu <tianyu.lan@intel.com>
Date:   Wed Feb 26 21:03:05 2014 +0800

    ACPI / processor: Rework processor throttling with work_on_cpu()

    commit f3ca4164529b875374c410193bbbac0ee960895f upstream.

    acpi_processor_set_throttling() uses set_cpus_allowed_ptr() to make
    sure that the (struct acpi_processor)->acpi_processor_set_throttling()
    callback will run on the right CPU.  However, the function may be
    called from a worker thread already bound to a different CPU in which
    case that won't work.

    Make acpi_processor_set_throttling() use work_on_cpu() as appropriate
    instead of abusing set_cpus_allowed_ptr().

    Reported-and-tested-by: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
    [rjw: Changelog]
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0b0c264549a424a453bf21ba41941db83f0899b
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Thu Feb 13 16:32:51 2014 +0100

    ACPI / video: Filter the _BCL table for duplicate brightness values

    commit bd8ba20597f0cfef3ef65c3fd2aa92ab23d4c8e1 upstream.

    Some devices have duplicate entries in there brightness levels table, ie
    on my Dell Latitude E6430 the table looks like this:

    [    3.686060] acpi backlight index   0, val 80
    [    3.686095] acpi backlight index   1, val 50
    [    3.686122] acpi backlight index   2, val 5
    [    3.686147] acpi backlight index   3, val 5
    [    3.686172] acpi backlight index   4, val 5
    [    3.686197] acpi backlight index   5, val 5
    [    3.686223] acpi backlight index   6, val 5
    [    3.686248] acpi backlight index   7, val 5
    [    3.686273] acpi backlight index   8, val 6
    [    3.686332] acpi backlight index   9, val 7
    [    3.686356] acpi backlight index  10, val 8
    [    3.686380] acpi backlight index  11, val 9
    etc.

    Notice that brightness values 0-5 are all mapped to 5. This means that
    if userspace writes any value between 0 and 5 to the brightness sysfs attribute
    and then reads it, it will always return 0, which is somewhat unexpected.

    This is a problem for ie gnome-settings-daemon, which uses read-modify-write
    logic when the users presses the brightness up or down keys. This is done
    this way to take brightness changes from other sources into account.

    On this specific laptop what happens once the brightness has been set to 0,
    is that gsd reads 0, adds 5, writes 5, and on the next brightness up key press
    again reads 0, so things get stuck at the lowest brightness setting.

    Filtering out the duplicate table entries, makes any write to brightness
    read back as the written value as one would expect, fixing this.

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Aaron Lu <aaron.lu@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9f84cff07159c0b21b3725a216c3f3d615f93b7c
Author: Jean Delvare <jdelvare@suse.de>
Date:   Mon Feb 24 09:39:27 2014 +0100

    i7core_edac: Fix PCI device reference count

    commit c0f5eeed0f4cef4f05b74883a7160e7edde58b6a upstream.

    The reference count changes done by pci_get_device can be a little
    misleading when the usage diverges from the most common scheme. The
    reference count of the device passed as the last parameter is always
    decreased, even if the function returns no new device. So if we are
    going to try alternative device IDs, we must manually increment the
    device reference count before each retry. If we don't, we end up
    decreasing the reference count, and after a few modprobe/rmmod cycles
    the PCI devices will vanish.

    In other words and as Alan put it: without this fix the EDAC code
    corrupts the PCI device list.

    This fixes kernel bug #50491:
    https://bugzilla.kernel.org/show_bug.cgi?id=50491

    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Link: http://lkml.kernel.org/r/20140224093927.7659dd9d@endymion.delvare
    Reviewed-by: Alan Cox <alan@linux.intel.com>
    Cc: Mauro Carvalho Chehab <m.chehab@samsung.com>
    Cc: Doug Thompson <dougthompson@xmission.com>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31d183aa91d4220afc6429e8b9578aa436a3597d
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Feb 3 10:42:07 2014 -0500

    sata_sil: apply MOD15WRITE quirk to TOSHIBA MK2561GSYN

    commit 9f9c47f00ce99329b1a82e2ac4f70f0fe3db549c upstream.

    It's a bit odd to see a newer device showing mod15write; however, the
    reported behavior is highly consistent and other factors which could
    contribute seem to have been verified well enough.  Also, both
    sata_sil itself and the drive are fairly outdated at this point making
    the risk of this change fairly low.  It is possible, probably likely,
    that other drive models in the same family have the same problem;
    however, for now, let's just add the specific model which was tested.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: matson <lists-matsonpa@luxsci.me>
    References: http://lkml.kernel.org/g/201401211912.s0LJCk7F015058@rs103.luxsci.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 13e60b225fc1f8394447363dc3ce02899badc99e
Author: Denis V. Lunev <den@openvz.org>
Date:   Thu Jan 30 15:20:30 2014 +0400

    ata: enable quirk from jmicron JMB350 for JMB394

    commit efb9e0f4f43780f0ae0c6428d66bd03e805c7539 upstream.

    Without the patch the kernel generates the following error.

     ata11.15: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
     ata11.15: Port Multiplier vendor mismatch '0x197b' != '0x123'
     ata11.15: PMP revalidation failed (errno=-19)
     ata11.15: failed to recover PMP after 5 tries, giving up

    This patch helps to bypass this error and the device becomes
    functional.

    Signed-off-by: Denis V. Lunev <den@openvz.org>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: <linux-ide@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 494dac8e333e873cb5266ede3be957680d6194ad
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Fri Feb 21 16:03:12 2014 +0100

    perf/x86: Fix event scheduling

    commit 26e61e8939b1fe8729572dabe9a9e97d930dd4f6 upstream.

    Vince "Super Tester" Weaver reported a new round of syscall fuzzing (Trinity) failures,
    with perf WARN_ON()s triggering. He also provided traces of the failures.

    This is I think the relevant bit:

    	>    pec_1076_warn-2804  [000] d...   147.926153: x86_pmu_disable: x86_pmu_disable
    	>    pec_1076_warn-2804  [000] d...   147.926153: x86_pmu_state: Events: {
    	>    pec_1076_warn-2804  [000] d...   147.926156: x86_pmu_state:   0: state: .R config: ffffffffffffffff (          (null))
    	>    pec_1076_warn-2804  [000] d...   147.926158: x86_pmu_state:   33: state: AR config: 0 (ffff88011ac99800)
    	>    pec_1076_warn-2804  [000] d...   147.926159: x86_pmu_state: }
    	>    pec_1076_warn-2804  [000] d...   147.926160: x86_pmu_state: n_events: 1, n_added: 0, n_txn: 1
    	>    pec_1076_warn-2804  [000] d...   147.926161: x86_pmu_state: Assignment: {
    	>    pec_1076_warn-2804  [000] d...   147.926162: x86_pmu_state:   0->33 tag: 1 config: 0 (ffff88011ac99800)
    	>    pec_1076_warn-2804  [000] d...   147.926163: x86_pmu_state: }
    	>    pec_1076_warn-2804  [000] d...   147.926166: collect_events: Adding event: 1 (ffff880119ec8800)

    So we add the insn:p event (fd[23]).

    At this point we should have:

      n_events = 2, n_added = 1, n_txn = 1

    	>    pec_1076_warn-2804  [000] d...   147.926170: collect_events: Adding event: 0 (ffff8800c9e01800)
    	>    pec_1076_warn-2804  [000] d...   147.926172: collect_events: Adding event: 4 (ffff8800cbab2c00)

    We try and add the {BP,cycles,br_insn} group (fd[3], fd[4], fd[15]).
    These events are 0:cycles and 4:br_insn, the BP event isn't x86_pmu so
    that's not visible.

    	group_sched_in()
    	  pmu->start_txn() /* nop - BP pmu */
    	  event_sched_in()
    	     event->pmu->add()

    So here we should end up with:

      0: n_events = 3, n_added = 2, n_txn = 2
      4: n_events = 4, n_added = 3, n_txn = 3

    But seeing the below state on x86_pmu_enable(), the must have failed,
    because the 0 and 4 events aren't there anymore.

    Looking at group_sched_in(), since the BP is the leader, its
    event_sched_in() must have succeeded, for otherwise we would not have
    seen the sibling adds.

    But since neither 0 or 4 are in the below state; their event_sched_in()
    must have failed; but I don't see why, the complete state: 0,0,1:p,4
    fits perfectly fine on a core2.

    However, since we try and schedule 4 it means the 0 event must have
    succeeded!  Therefore the 4 event must have failed, its failure will
    have put group_sched_in() into the fail path, which will call:

    	event_sched_out()
    	  event->pmu->del()

    on 0 and the BP event.

    Now x86_pmu_del() will reduce n_events; but it will not reduce n_added;
    giving what we see below:

     n_event = 2, n_added = 2, n_txn = 2

    	>    pec_1076_warn-2804  [000] d...   147.926177: x86_pmu_enable: x86_pmu_enable
    	>    pec_1076_warn-2804  [000] d...   147.926177: x86_pmu_state: Events: {
    	>    pec_1076_warn-2804  [000] d...   147.926179: x86_pmu_state:   0: state: .R config: ffffffffffffffff (          (null))
    	>    pec_1076_warn-2804  [000] d...   147.926181: x86_pmu_state:   33: state: AR config: 0 (ffff88011ac99800)
    	>    pec_1076_warn-2804  [000] d...   147.926182: x86_pmu_state: }
    	>    pec_1076_warn-2804  [000] d...   147.926184: x86_pmu_state: n_events: 2, n_added: 2, n_txn: 2
    	>    pec_1076_warn-2804  [000] d...   147.926184: x86_pmu_state: Assignment: {
    	>    pec_1076_warn-2804  [000] d...   147.926186: x86_pmu_state:   0->33 tag: 1 config: 0 (ffff88011ac99800)
    	>    pec_1076_warn-2804  [000] d...   147.926188: x86_pmu_state:   1->0 tag: 1 config: 1 (ffff880119ec8800)
    	>    pec_1076_warn-2804  [000] d...   147.926188: x86_pmu_state: }
    	>    pec_1076_warn-2804  [000] d...   147.926190: x86_pmu_enable: S0: hwc->idx: 33, hwc->last_cpu: 0, hwc->last_tag: 1 hwc->state: 0

    So the problem is that x86_pmu_del(), when called from a
    group_sched_in() that fails (for whatever reason), and without x86_pmu
    TXN support (because the leader is !x86_pmu), will corrupt the n_added
    state.

    Reported-and-Tested-by: Vince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Dave Jones <davej@redhat.com>
    Link: http://lkml.kernel.org/r/20140221150312.GF3104@twins.programming.kicks-ass.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8dd74be4a175ff8f5818a14a9c13aa027b667cf6
Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Date:   Mon Feb 24 17:30:55 2014 +0100

    powerpc/crashdump : Fix page frame number check in copy_oldmem_page

    commit f5295bd8ea8a65dc5eac608b151386314cb978f1 upstream.

    In copy_oldmem_page, the current check using max_pfn and min_low_pfn to
    decide if the page is backed or not, is not valid when the memory layout is
    not continuous.

    This happens when running as a QEMU/KVM guest, where RTAS is mapped higher
    in the memory. In that case max_pfn points to the end of RTAS, and a hole
    between the end of the kdump kernel and RTAS is not backed by PTEs. As a
    consequence, the kdump kernel is crashing in copy_oldmem_page when accessing
    in a direct way the pages in that hole.

    This fix relies on the memblock's service memblock_is_region_memory to
    check if the read page is part or not of the directly accessible memory.

    Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
    Tested-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5dd00a93ea27897deb79e23797f7ced6910e7979
Author: Trond Myklebust <trond.myklebust@primarydata.com>
Date:   Tue Feb 11 09:15:54 2014 -0500

    SUNRPC: Fix races in xs_nospace()

    commit 06ea0bfe6e6043cb56a78935a19f6f8ebc636226 upstream.

    When a send failure occurs due to the socket being out of buffer space,
    we call xs_nospace() in order to have the RPC task wait until the
    socket has drained enough to make it worth while trying again.
    The current patch fixes a race in which the socket is drained before
    we get round to setting up the machinery in xs_nospace(), and which
    is reported to cause hangs.

    Link: http://lkml.kernel.org/r/20140210170315.33dfc621@notabene.brown
    Fixes: a9a6b52ee1ba (SUNRPC: Don't start the retransmission timer...)
    Reported-by: Neil Brown <neilb@suse.com>
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 52b418e832d133f5fa657efae0ca0fa87242fe2c
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Sat Feb 22 18:30:13 2014 +0100

    ASoC: wm8958-dsp: Fix firmware block loading

    commit 548da08fc1e245faf9b0d7c41ecd8e07984fc332 upstream.

    The codec->control_data contains a pointer to the device's regmap struct. But
    wm8994_bulk_write() expects a pointer to the parent wm8998 device.

    The issue was introduced in commit d9a7666f ("ASoC: Remove ASoC-specific
    WM8994 I/O code").

    Fixes: d9a7666f ("ASoC: Remove ASoC-specific WM8994 I/O code")
    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71a3a9e7d1b783ab7a61a82361f3849d4592ece1
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 18 09:24:12 2014 +0100

    ASoC: sta32x: Fix array access overflow

    commit 025c3fa9256d4c54506b7a29dc3befac54f5c68d upstream.

    Preset EQ enum of sta32x codec driver declares too many number of
    items and it may lead to the access over the actual array size.

    Use SOC_ENUM_SINGLE_DECL() helper and it's automatically fixed.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
    Acked-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7cc835745183631e6fd0ec173e4942942a508191
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Feb 27 07:41:32 2014 +0100

    ASoC: sta32x: Fix wrong enum for limiter2 release rate

    commit b3619b288b621e63f66908045f48495869a996a6 upstream.

    There is a typo in the Limiter2 Release Rate control, a wrong enum for
    Limiter1 is assigned.  It must point to Limiter2.
    Spotted by a compile warning:

    In file included from sound/soc/codecs/sta32x.c:34:0:
    sound/soc/codecs/sta32x.c:223:29: warning: ‘sta32x_limiter2_release_rate_enum’ defined but not used [-Wunused-variable]
     static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
                                 ^
    include/sound/soc.h:275:18: note: in definition of macro ‘SOC_ENUM_DOUBLE_DECL’
      struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \
                      ^
    sound/soc/codecs/sta32x.c:223:8: note: in expansion of macro ‘SOC_ENUM_SINGLE_DECL’
     static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
            ^

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff177edb2ec3e16428d0fdf834706840f1111d1f
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 18 09:37:30 2014 +0100

    ASoC: wm8770: Fix wrong number of enum items

    commit 7a6c0a58dc824523966f212c76322d47c5b0e6fe upstream.

    wm8770 codec driver defines ain_enum with a wrong number of items.

    Use SOC_ENUM_DOUBLE_DECL() macro and it's automatically fixed.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
    Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Acked-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 969d5499ee64ec2ece7b6c9bb553011a6cd20a00
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Sun Feb 16 17:11:10 2014 +0100

    ALSA: usb-audio: work around KEF X300A firmware bug

    commit 624aef494f86ed0c58056361c06347ad62b26806 upstream.

    When the driver tries to access Function Unit 10, the KEF X300A
    speakers' firmware apparently locks up, making even PCM streaming
    impossible.  Work around this by ignoring this FU.

    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 29a3cd46644ec8098dbe1c12f89643b5c11831a9
Author: Florian Westphal <fw@strlen.de>
Date:   Sat Feb 22 10:33:26 2014 +0100

    net: ip, ipv6: handle gso skbs in forwarding path

    commit fe6cc55f3a9a053482a76f5a6b2257cee51b4663 upstream.

    [ use zero netdev_feature mask to avoid backport of
      netif_skb_dev_features function ]

    Marcelo Ricardo Leitner reported problems when the forwarding link path
    has a lower mtu than the incoming one if the inbound interface supports GRO.

    Given:
    Host <mtu1500> R1 <mtu1200> R2

    Host sends tcp stream which is routed via R1 and R2.  R1 performs GRO.

    In this case, the kernel will fail to send ICMP fragmentation needed
    messages (or pkt too big for ipv6), as GSO packets currently bypass dstmtu
    checks in forward path. Instead, Linux tries to send out packets exceeding
    the mtu.

    When locking route MTU on Host (i.e., no ipv4 DF bit set), R1 does
    not fragment the packets when forwarding, and again tries to send out
    packets exceeding R1-R2 link mtu.

    This alters the forwarding dstmtu checks to take the individual gso
    segment lengths into account.

    For ipv6, we send out pkt too big error for gso if the individual
    segments are too big.

    For ipv4, we either send icmp fragmentation needed, or, if the DF bit
    is not set, perform software segmentation and let the output path
    create fragments when the packet is leaving the machine.
    It is not 100% correct as the error message will contain the headers of
    the GRO skb instead of the original/segmented one, but it seems to
    work fine in my (limited) tests.

    Eric Dumazet suggested to simply shrink mss via ->gso_size to avoid
    sofware segmentation.

    However it turns out that skb_segment() assumes skb nr_frags is related
    to mss size so we would BUG there.  I don't want to mess with it considering
    Herbert and Eric disagree on what the correct behavior should be.

    Hannes Frederic Sowa notes that when we would shrink gso_size
    skb_segment would then also need to deal with the case where
    SKB_MAX_FRAGS would be exceeded.

    This uses sofware segmentation in the forward path when we hit ipv4
    non-DF packets and the outgoing link mtu is too small.  Its not perfect,
    but given the lack of bug reports wrt. GRO fwd being broken this is a
    rare case anyway.  Also its not like this could not be improved later
    once the dust settles.

    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Reported-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32e66c065179e598c0e692f4d57ded48715e0d99
Author: Florian Westphal <fw@strlen.de>
Date:   Sat Feb 22 10:33:25 2014 +0100

    net: add and use skb_gso_transport_seglen()

    commit de960aa9ab4decc3304959f69533eef64d05d8e8 upstream.

    [ no skb_gso_seglen helper in 3.4, leave tbf alone ]

    This moves part of Eric Dumazets skb_gso_seglen helper from tbf sched to
    skbuff core so it may be reused by upcoming ip forwarding path patch.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 19e48381ab5da05c5fb398336a90a52a2b623cdc
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Mon Feb 17 12:11:11 2014 +0100

    net: sctp: fix sctp_connectx abi for ia32 emulation/compat mode

    [ Upstream commit ffd5939381c609056b33b7585fb05a77b4c695f3 ]

    SCTP's sctp_connectx() abi breaks for 64bit kernels compiled with 32bit
    emulation (e.g. ia32 emulation or x86_x32). Due to internal usage of
    'struct sctp_getaddrs_old' which includes a struct sockaddr pointer,
    sizeof(param) check will always fail in kernel as the structure in
    64bit kernel space is 4bytes larger than for user binaries compiled
    in 32bit mode. Thus, applications making use of sctp_connectx() won't
    be able to run under such circumstances.

    Introduce a compat interface in the kernel to deal with such
    situations by using a 'struct compat_sctp_getaddrs_old' structure
    where user data is copied into it, and then sucessively transformed
    into a 'struct sctp_getaddrs_old' structure with the help of
    compat_ptr(). That fixes sctp_connectx() abi without any changes
    needed in user space, and lets the SCTP test suite pass when compiled
    in 32bit and run on 64bit kernels.

    Fixes: f9c67811ebc0 ("sctp: Fix regression introduced by new sctp_connectx api")
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4d4d28ccf594979041d90e0ac9d22b183b61071e
Author: Emil Goode <emilgoode@gmail.com>
Date:   Thu Feb 13 17:50:19 2014 +0100

    usbnet: remove generic hard_header_len check

    [ Upstream commit eb85569fe2d06c2fbf4de7b66c263ca095b397aa ]

    This patch removes a generic hard_header_len check from the usbnet
    module that is causing dropped packages under certain circumstances
    for devices that send rx packets that cross urb boundaries.

    One example is the AX88772B which occasionally send rx packets that
    cross urb boundaries where the remaining partial packet is sent with
    no hardware header. When the buffer with a partial packet is of less
    number of octets than the value of hard_header_len the buffer is
    discarded by the usbnet module.

    With AX88772B this can be reproduced by using ping with a packet
    size between 1965-1976.

    The bug has been reported here:

    https://bugzilla.kernel.org/show_bug.cgi?id=29082

    This patch introduces the following changes:
    - Removes the generic hard_header_len check in the rx_complete
      function in the usbnet module.
    - Introduces a ETH_HLEN check for skbs that are not cloned from
      within a rx_fixup callback.
    - For safety a hard_header_len check is added to each rx_fixup
      callback function that could be affected by this change.
      These extra checks could possibly be removed by someone
      who has the hardware to test.
    - Removes a call to dev_kfree_skb_any() and instead utilizes the
      dev->done list to queue skbs for cleanup.

    The changes place full responsibility on the rx_fixup callback
    functions that clone skbs to only pass valid skbs to the
    usbnet_skb_return function.

    Signed-off-by: Emil Goode <emilgoode@gmail.com>
    Reported-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dcff06e8e8b6fceeef93c8c9a1eab38dc166a69b
Author: Jiri Bohac <jiri@boha.cz>
Date:   Fri Feb 14 18:13:50 2014 +0100

    bonding: 802.3ad: make aggregator_identifier bond-private

    [ Upstream commit 163c8ff30dbe473abfbb24a7eac5536c87f3baa9 ]

    aggregator_identifier is used to assign unique aggregator identifiers
    to aggregators of a bond during device enslaving.

    aggregator_identifier is currently a global variable that is zeroed in
    bond_3ad_initialize().

    This sequence will lead to duplicate aggregator identifiers for eth1 and eth3:

    create bond0
    change bond0 mode to 802.3ad
    enslave eth0 to bond0 		//eth0 gets agg id 1
    enslave eth1 to bond0 		//eth1 gets agg id 2
    create bond1
    change bond1 mode to 802.3ad
    enslave eth2 to bond1		//aggregator_identifier is reset to 0
    				//eth2 gets agg id 1
    enslave eth3 to bond0 		//eth3 gets agg id 2

    Fix this by making aggregator_identifier private to the bond.

    Signed-off-by: Jiri Bohac <jbohac@suse.cz>
    Acked-by: Veaceslav Falico <vfalico@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c649ae0be4eb26e17600be49c6fc0ff3058bc88
Author: Nithin Sujir <nsujir@broadcom.com>
Date:   Thu Feb 6 14:13:05 2014 -0800

    tg3: Fix deadlock in tg3_change_mtu()

    [ Upstream commit c6993dfd7db9b0c6b7ca7503a56fda9236a4710f ]

    Quoting David Vrabel -
    "5780 cards cannot have jumbo frames and TSO enabled together.  When
    jumbo frames are enabled by setting the MTU, the TSO feature must be
    cleared.  This is done indirectly by calling netdev_update_features()
    which will call tg3_fix_features() to actually clear the flags.

    netdev_update_features() will also trigger a new netlink message for the
    feature change event which will result in a call to tg3_get_stats64()
    which deadlocks on the tg3 lock."

    tg3_set_mtu() does not need to be under the tg3 lock since converting
    the flags to use set_bit(). Move it out to after tg3_netif_stop().

    Reported-by: David Vrabel <david.vrabel@citrix.com>
    Tested-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d4f0afc9ecf77da7da6e1e5a8b35ce8067bdf0dc
Author: Maciej Żenczykowski <maze@google.com>
Date:   Fri Feb 7 16:23:48 2014 -0800

    net: fix 'ip rule' iif/oif device rename

    [ Upstream commit 946c032e5a53992ea45e062ecb08670ba39b99e3 ]

    ip rules with iif/oif references do not update:
    (detach/attach) across interface renames.

    Signed-off-by: Maciej Żenczykowski <maze@google.com>
    CC: Willem de Bruijn <willemb@google.com>
    CC: Eric Dumazet <edumazet@google.com>
    CC: Chris Davis <chrismd@google.com>
    CC: Carlo Contavalli <ccontavalli@google.com>
    Google-Bug-Id: 12936021
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c649eee753c545e430d461274400dcd458c68ea9
Author: Olivier Langlois <olivier@trillion01.com>
Date:   Sat Feb 1 01:11:09 2014 -0500

    rtlwifi: rtl8192ce: Fix too long disable of IRQs

    commit f78bccd79ba3cd9d9664981b501d57bdb81ab8a4 upstream.

    rtl8192ce is disabling for too long the local interrupts during hw initiatialisation when performing scans

    The observable symptoms in dmesg can be:

    - underruns from ALSA playback
    - clock freezes (tstamps do not change for several dmesg entries until irqs are finaly reenabled):

    [  250.817669] rtlwifi:rtl_op_config():<0-0-0> 0x100
    [  250.817685] rtl8192ce:_rtl92ce_phy_set_rf_power_state():<0-1-0> IPS Set eRf nic enable
    [  250.817732] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.817796] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.817910] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818024] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818139] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818253] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818367] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818472] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818472] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818472] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818472] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:18051d59:11
    [  250.818472] rtl8192ce:_rtl92ce_init_mac():<0-1-0> reg0xec:98053f15:10
    [  250.818472] rtl8192ce:rtl92ce_sw_led_on():<0-1-0> LedAddr:4E ledpin=1
    [  250.818472] rtl8192c_common:rtl92c_download_fw():<0-1-0> Firmware Version(49), Signature(0x88c1),Size(32)
    [  250.818472] rtl8192ce:rtl92ce_enable_hw_security_config():<0-1-0> PairwiseEncAlgorithm = 0 GroupEncAlgorithm = 0
    [  250.818472] rtl8192ce:rtl92ce_enable_hw_security_config():<0-1-0> The SECR-value cc
    [  250.818472] rtl8192c_common:rtl92c_dm_check_txpower_tracking_thermal_meter():<0-1-0> Schedule TxPowerTracking direct call!!
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> rtl92c_dm_txpower_tracking_callback_thermalmeter
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> Readback Thermal Meter = 0xe pre thermal meter 0xf eeprom_thermalmeter 0xf
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> Initial pathA ele_d reg0xc80 = 0x40000000, ofdm_index=0xc
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> Initial reg0xa24 = 0x90e1317, cck_index=0xc, ch14 0
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> Readback Thermal Meter = 0xe pre thermal meter 0xf eeprom_thermalmeter 0xf delta 0x1 delta_lck 0x0 delta_iqk 0x0
    [  250.818472] rtl8192c_common:rtl92c_dm_txpower_tracking_callback_thermalmeter():<0-1-0> <===
    [  250.818472] rtl8192c_common:rtl92c_dm_initialize_txpower_tracking_thermalmeter():<0-1-0> pMgntInfo->txpower_tracking = 1
    [  250.818472] rtl8192ce:rtl92ce_led_control():<0-1-0> ledaction 3
    [  250.818472] rtl8192ce:rtl92ce_sw_led_on():<0-1-0> LedAddr:4E ledpin=1
    [  250.818472] rtlwifi:rtl_ips_nic_on():<0-1-0> before spin_unlock_irqrestore
    [  251.154656] PCM: Lost interrupts? [Q]-0 (stream=0, delta=15903, new_hw_ptr=293408, old_hw_ptr=277505)

    The exact code flow that causes that is:

    1. wpa_supplicant send a start_scan request to the nl80211 driver
    2. mac80211 module call rtl_op_config with IEEE80211_CONF_CHANGE_IDLE
    3.   rtl_ips_nic_on is called which disable local irqs
    4.     rtl92c_phy_set_rf_power_state() is called
    5.       rtl_ps_enable_nic() is called and hw_init()is executed and then the interrupts on the device are enabled

    A good solution could be to refactor the code to avoid calling rtl92ce_hw_init() with the irqs disabled
    but a quick and dirty solution that has proven to work is
    to reenable the irqs during the function rtl92ce_hw_init().

    I think that it is safe doing so since the device interrupt will only be enabled after the init function succeed.

    Signed-off-by: Olivier Langlois <olivier@trillion01.com>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ed01545c37ed5dc485f1cbdda6d5fdbe1199dad
Author: Olivier Langlois <olivier@trillion01.com>
Date:   Sat Feb 1 01:11:10 2014 -0500

    rtlwifi: Fix incorrect return from rtl_ps_enable_nic()

    commit 2e8c5e56b307271c2dab6f8bfd1d8a3822ca2390 upstream.

    rtl_ps_enable_nic() is called from loops that will loop until this function returns true or a
    maximum number of retries is performed.

    hw_init() returns non-zero on error. In that situation return false to
    restore the original design intent to retry hw init when it fails.

    Signed-off-by: Olivier Langlois <olivier@trillion01.com>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed20a7cd3107a15d5748710b8d8b9b7d6f6a8fd6
Author: Stanislaw Gruszka <stf_xl@wp.pl>
Date:   Mon Feb 10 22:38:28 2014 +0100

    rtl8187: fix regression on MIPS without coherent DMA

    commit b6213e413a4e0c66548153516b074df14f9d08e0 upstream.

    This patch fixes regression caused by commit a16dad77634 "MIPS: Fix
    potencial corruption". That commit fixes one corruption scenario in
    cost of adding another one, which actually start to cause crashes
    on Yeeloong laptop when rtl8187 driver is used.

    For correct DMA read operation on machines without DMA coherence, kernel
    have to invalidate cache, such it will refill later with new data that
    device wrote to memory, when that data is needed to process. We can only
    invalidate full cache line. Hence when cache line includes both dma
    buffer and some other data (written in cache, but not yet in main
    memory), the other data can not hit memory due to invalidation. That
    happen on rtl8187 where struct rtl8187_priv fields are located just
    before and after small buffers that are passed to USB layer and DMA
    is performed on them.

    To fix the problem we align buffers and reserve space after them to make
    them match cache line.

    This patch does not resolve all possible MIPS problems entirely, for
    that we have to assure that we always map cache aligned buffers for DMA,
    what can be complex or even not possible. But patch fixes visible and
    reproducible regression and seems other possible corruptions do not
    happen in practice, since Yeeloong laptop works stable without rtl8187
    driver.

    Bug report:
    https://bugzilla.kernel.org/show_bug.cgi?id=54391

    Reported-by: Petr Pisar <petr.pisar@atlas.cz>
    Bisected-by: Tom Li <biergaizi2009@gmail.com>
    Reported-and-tested-by: Tom Li <biergaizi2009@gmail.com>
    Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.next>
    Acked-by: Hin-Tak Leung <htl10@users.sourceforge.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 01ef0c9fb8c1d681b114de0ad2a29a6f018eb4f5
Author: Jeff Layton <jlayton@redhat.com>
Date:   Fri Feb 14 07:20:35 2014 -0500

    cifs: ensure that uncached writes handle unmapped areas correctly

    commit 5d81de8e8667da7135d3a32a964087c0faf5483f upstream.

    It's possible for userland to pass down an iovec via writev() that has a
    bogus user pointer in it. If that happens and we're doing an uncached
    write, then we can end up getting less bytes than we expect from the
    call to iov_iter_copy_from_user. This is CVE-2014-0069

    cifs_iovec_write isn't set up to handle that situation however. It'll
    blindly keep chugging through the page array and not filling those pages
    with anything useful. Worse yet, we'll later end up with a negative
    number in wdata->tailsz, which will confuse the sending routines and
    cause an oops at the very least.

    Fix this by having the copy phase of cifs_iovec_write stop copying data
    in this situation and send the last write as a short one. At the same
    time, we want to avoid sending a zero-length write to the server, so
    break out of the loop and set rc to -EFAULT if that happens. This also
    allows us to handle the case where no address in the iovec is valid.

    [Note: Marking this for stable on v3.4+ kernels, but kernels as old as
           v2.6.38 may have a similar problem and may need similar fix]

    Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru>
    Reported-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da06e904d622fd9012fdbe468995c013492b6ed4
Author: Chen Gang <gang.chen.5i5j@gmail.com>
Date:   Sat Feb 1 20:35:54 2014 +0800

    avr32: Makefile: add '-D__linux__' flag for gcc-4.4.7 use

    commit 8d80390cfc9434d5aa4fb9e5f9768a66b30cb8a6 upstream.

    For avr32 cross compiler, do not define '__linux__' internally, so it
    will cause issue with allmodconfig.

    The related error:

        CC [M]  fs/coda/psdev.o
      In file included from include/linux/coda.h:64,
                       from fs/coda/psdev.c:45:
      include/uapi/linux/coda.h:221: error: expected specifier-qualifier-list before 'u_quad_t'

    The related toolchain version (which only download, not re-compile):

      [root@gchen linux-next]# /upstream/toolchain/download/avr32-gnu-toolchain-linux_x86/bin/avr32-gcc -v
      Using built-in specs.
      Target: avr32
      Configured with: /data2/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/src/gcc/configure --target=avr32 --host=i686-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/avr32-gnu-toolchain-linux_x86 --enable-languages=c,c++ --disable-nls --disable-libssp --disable-libstdcxx-pch --with-dwarf2 --enable-version-specific-runtime-libs --disable-shared --enable-doc --with-mpfr-lib=/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/avr32-gnu-toolchain-linux_x86/lib --with-mpfr-include=/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/avr32-gnu-toolchain-linux_x86/include --with-gmp=/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/avr32-gnu-toolchain-linux_x86 --with-mpc=/home/toolsbuild/jenkins-knuth/workspace/avr32-gnu-toolchain/avr32-gnu-toolchain-linux_x86 --enable-__cxa_atexit --disable-shared --with-newlib --with-pkgversion=AVR_32_bit_GNU_Toolchain_3.4.2_435 --with-bugurl=http://www
    .atmel.com/avr
      Thread model: single
      gcc version 4.4.7 (AVR_32_bit_GNU_Toolchain_3.4.2_435)

    Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
    Acked-by: Hans-Christian Egtvedt <hegtvedt@cisco.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c48ca4946a2e39775e3a89ea803a84a782fc27be
Author: Paul Gortmaker <paul.gortmaker@windriver.com>
Date:   Fri Jan 10 09:29:39 2014 -0500

    avr32: fix missing module.h causing build failure in mimc200/fram.c

    commit 5745d6a41a4f4aec29e2ccd591c6fb09ed73a955 upstream.

    Causing this:

    In file included from arch/avr32/boards/mimc200/fram.c:13:
    include/linux/miscdevice.h:51: error: field 'list' has incomplete type
    include/linux/miscdevice.h:55: error: expected specifier-qualifier-list before 'mode_t'
    arch/avr32/boards/mimc200/fram.c:42: error: 'THIS_MODULE' undeclared here (not in a function)

    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
    Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
    Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d25de0cc257d404bfbd401a246a37a89171a163b
Author: Vinayak Kale <vkale@apm.com>
Date:   Wed Feb 12 07:30:01 2014 +0100

    ARM: 7957/1: add DSB after icache flush in __flush_icache_all()

    commit 39544ac9df20f73e49fc6b9ac19ff533388c82c0 upstream.

    Add DSB after icache flush to complete the cache maintenance operation.

    Signed-off-by: Vinayak Kale <vkale@apm.com>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0dcbe514c5d7cbbb6e52e771454475e967bbf85a
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Feb 7 19:12:20 2014 +0100

    ARM: 7953/1: mm: ensure TLB invalidation is complete before enabling MMU

    commit bae0ca2bc550d1ec6a118fb8f2696f18c4da3d8e upstream.

    During __v{6,7}_setup, we invalidate the TLBs since we are about to
    enable the MMU on return to head.S. Unfortunately, without a subsequent
    dsb instruction, the invalidation is not guaranteed to have completed by
    the time we write to the sctlr, potentially exposing us to junk/stale
    translations cached in the TLB.

    This patch reworks the init functions so that the dsb used to ensure
    completion of cache/predictor maintenance is also used to ensure
    completion of the TLB invalidation.

    Reported-by: Albin Tonnerre <Albin.Tonnerre@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c3515f0ec08a1aa21007f3b261d2c3445adaae7
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sun Feb 16 19:29:32 2014 -0500

    ext4: don't leave i_crtime.tv_sec uninitialized

    commit 19ea80603715d473600cd993b9987bc97d042e02 upstream.

    If the i_crtime field is not present in the inode, don't leave the
    field uninitialized.

    Fixes: ef7f38359 ("ext4: Add nanosecond timestamps")
    Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
    Tested-by: Vegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 080368aadcb269a5949f331e6f2594720866eb83
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sat Feb 15 22:42:25 2014 -0500

    ext4: fix online resize with a non-standard blocks per group setting

    commit 3d2660d0c9c2f296837078c189b68a47f6b2e3b5 upstream.

    The set_flexbg_block_bitmap() function assumed that the number of
    blocks in a blockgroup was sb->blocksize * 8, which is normally true,
    but not always!  Use EXT4_BLOCKS_PER_GROUP(sb) instead, to fix block
    bitmap corruption after:

    mke2fs -t ext4 -g 3072 -i 4096 /dev/vdd 1G
    mount -t ext4 /dev/vdd /vdd
    resize2fs /dev/vdd 8G

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Reported-by: Jon Bernard <jbernard@tuxion.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a8909f1fc06b034f0d790f48c8babf9bc6b2341f
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed Feb 12 12:16:04 2014 -0500

    ext4: don't try to modify s_flags if the the file system is read-only

    commit 23301410972330c0ae9a8afc379ba2005e249cc6 upstream.

    If an ext4 file system is created by some tool other than mke2fs
    (perhaps by someone who has a pathalogical fear of the GPL) that
    doesn't set one or the other of the EXT2_FLAGS_{UN}SIGNED_HASH flags,
    and that file system is then mounted read-only, don't try to modify
    the s_flags field.  Otherwise, if dm_verity is in use, the superblock
    will change, causing an dm_verity failure.

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36bac55768316c15480a77bdd9478ef1d6f2f116
Merge: 555da4f 95d7d81
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 11 10:30:21 2014 -0700

    Merge "Merge "Merge "msm: vidc: No need to allocate metadata by default"""

commit 95d7d81abf14d917a4423257fd874a4ec1ab9d50
Merge: 555da4f 4385f62
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 11 06:07:34 2014 -0700

    Merge "Merge "msm: vidc: No need to allocate metadata by default""

commit 555da4f59b3c2b5bbe025f450f60a7663163cac5
Merge: 45e82d3 0ab18b07
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 11 05:42:19 2014 -0700

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit 0ab18b07c9ccabf78d546f57bb1ad82414ddf63b
Merge: 45e82d3 f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Mar 11 00:04:40 2014 -0700

    Merge "Merge "nl80211: support vendor-specific events""

commit 4385f6232d27926b19ad25ecbe59fc998a91a41e
Merge: f33364e 0efc959
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 21:56:56 2014 -0700

    Merge "msm: vidc: No need to allocate metadata by default"

commit 45e82d3967cc8a731580ef7b1ad30196c5e7cf6f
Merge: 4919a78 5faa7cb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 21:16:32 2014 -0700

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit 5faa7cb927005bec675a09718cd713c696e2207e
Merge: 4919a78 f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 16:49:24 2014 -0700

    Merge "Merge "nl80211: support vendor-specific events""

commit 4919a786fcaac9ef1f0e36ec5add8e097ba4f511
Merge: b169048 ab9aa7f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 16:32:37 2014 -0700

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit ab9aa7ff4683dd73389c52c7fc1780375e43d196
Merge: b169048 f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 11:53:17 2014 -0700

    Merge "Merge "nl80211: support vendor-specific events""

commit b1690483936af2435c56bb01e9d47c93e9738b23
Merge: b542e64 245b854
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 11:27:00 2014 -0700

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit 245b8542e209a7d06bf47894c154fe020e22eb96
Merge: b542e64 f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 07:08:39 2014 -0700

    Merge "Merge "nl80211: support vendor-specific events""

commit aa9f375b1f19471cc58bae4ad0381d08cd9c8b66
Author: Deepak Verma <dverma@codeaurora.org>
Date:   Fri Feb 7 15:44:06 2014 +0530

    msm: wfd: Free ion memory properly during a ion failure

    This change takes care of freeing allocated ion memory
    properly which avoids unnecessary memory leaks.

    CRs-Fixed: 627325
    Change-Id: Icbbb1f2c8f8b02541a38aedd0066c7b079b144fb
    Signed-off-by: Deepak Verma <dverma@codeaurora.org>

commit b542e647a40ab2faa9d8969f5f763ee0a80e6775
Merge: 4628f4e 8048739
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Mar 10 00:45:37 2014 -0700

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit 804873954a6d32d37606f64866ba103134a0cdb0
Merge: 4628f4e f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Mar 9 19:28:36 2014 -0700

    Merge "Merge "nl80211: support vendor-specific events""

commit 3af1e420707ebf62ee8e1f9b077038a531cf5364
Author: Malcolm Mallardi <mdmallardi@gmail.com>
Date:   Fri Mar 7 09:15:24 2014 -0500

    remove extraneous loop in apexq camera driver

commit 578b2ceb3c821efdc00c1826e9fa1a5d523911f9
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:52:50 2012 +0800

    staging: zcache: cleanup the code between tmem_obj_init and tmem_obj_find

    tmem_obj_find and insertion tmem-obj have the some logic, we can integrate
    the code

    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 421d3542f5f8982cab99594c98005ce1cbbe2f81
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:52:17 2012 +0800

    staging: zcache: introduce get_zcache_client

    Introduce get_zcache_client to remove the common code

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3857fbc0dd22a00672606b92390ec2a87279b7d
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:51:55 2012 +0800

    staging: zcache: cleanup zcache_do_preload and zcache_put_page

    Cleanup the code for zcache_do_preload and zcache_put_page

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 59413e9432939fcae59b0b5650a153a2cc590e85
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:51:34 2012 +0800

    staging: zcache: optimize zcache_do_preload

    zcache_do_preload is called in zcache_put_page where IRQ is disabled, so, need
    not care preempt

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6a1617f8267bae47fe58a7f81ddc95b32919f206
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:51:10 2012 +0800

    staging: zcache: cleanup zbud_init

    Need not set global parameters to 0

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49cecdbe1e42b945e7e2cbf6afbc0e8f28b9be03
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:50:50 2012 +0800

    staging: zcache: mark zbud_init/zcache_comp_init as __init

    These functions are called only when system is initializing, so mark __init
    for them to free memory

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa3e2f433860229de095ecb7a0498d4ce0ebc3f7
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:50:10 2012 +0800

    staging: zcache: fix a compile warning

    Fix:

    drivers/staging/zcache/zcache-main.c: In function ‘zcache_comp_op’:
    drivers/staging/zcache/zcache-main.c:112:2: warning: ‘ret’ may be used uninitial

    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43bcfbbb60be81dd7da9095a0e1c4b96ff4eeda5
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Tue Jun 26 16:49:46 2012 +0800

    staging: zcache: fix refcount leak

    In zcache_get_pool_by_id, the refcount of zcache_host is not increased, but
    it is always decreased in zcache_put_pool

    Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 842072106431ba2611cab32b3466ba2c2d9bb5a3
Author: Sasha Levin <levinsasha928@gmail.com>
Date:   Wed Jun 6 21:05:48 2012 +0200

    staging: zcache: don't limit number of pools per client

    Currently the amount of pools each client can use is limited to 16, this is
    and arbitrary limit which isn't really required by current implementation.

    This places and arbitrary limit on the number of mounted filesystems that
    can use cleancache.

    This patch removes that limit and uses IDR to do sparse mapping of pools
    in each client.

    Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4628f4e70d5d24246a79d5dc14e81c60d2cf7951
Merge: 9ac941b e6d0920
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 8 15:10:21 2014 -0800

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit e6d0920d2d1c5a6ca72349a245f08ac0dd876a06
Merge: 9ac941b f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 8 11:12:41 2014 -0800

    Merge "Merge "nl80211: support vendor-specific events""

commit 9ac941ba4d38ab2796e7eca0c21455d60fad26a7
Merge: 59cd6ac b5e6d49
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 8 06:27:32 2014 -0800

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit b5e6d496bf5166cdc2300d62e100afeffb51446b
Merge: 59cd6ac f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 8 02:14:33 2014 -0800

    Merge "Merge "nl80211: support vendor-specific events""

commit 59cd6ac8ab6e829caeaccd7015a9691cccfaa558
Merge: 9a8b3c1 bee777d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 19:13:15 2014 -0800

    Merge "Merge "Merge "nl80211: support vendor-specific events"""

commit bee777dcc633271ad1f7edc0d65ad6cf7660ccb7
Merge: 9a8b3c1 f33364e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 15:02:46 2014 -0800

    Merge "Merge "nl80211: support vendor-specific events""

commit f33364e2359ae08121b1981c869e44d4a187f58d
Merge: aa7bdbd d950549
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 10:02:54 2014 -0800

    Merge "nl80211: support vendor-specific events"

commit aa7bdbd9b90a259f8c600cae4fb4f2ef1df6ee45
Merge: 9ad1198 b784fbe
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 10:02:52 2014 -0800

    Merge "nl80211: vendor command support"

commit 9ad119819d2c7884c9e1836f08627d0e3280b8df
Merge: 4077fcc 60a48a8
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 10:02:51 2014 -0800

    Merge "cfg80211: pass station supported channel and oper class info"

commit 9a8b3c178922ed4e5ea5f101b6f81448cb735789
Merge: 046794b 7511347
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 07:21:30 2014 -0800

    Merge "Merge "Merge "msm: kgsl: don't use sscanf()"""

commit 75113477cbe6bfbb9a97e277a6e11e7a16e6d096
Merge: 046794b 4077fcc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Mar 7 02:18:53 2014 -0800

    Merge "Merge "msm: kgsl: don't use sscanf()""

commit 5d45d152015db80346780d86ae61bd1bff51609c
Author: Malcolm Mallardi <mdmallardi@gmail.com>
Date:   Thu Mar 6 21:32:27 2014 -0500

    ApexQ: High brightness mode for torch

    Change-Id: I2358275df3605db4ca594a93045d59aa451a0032

commit 046794bde6b4c3c3d69b0afe86ebcad160353e06
Merge: d172935 4f6c99f
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 19:56:10 2014 -0800

    Merge "Merge "Merge "msm: kgsl: don't use sscanf()"""

commit 4f6c99fe7a4e8606c153ab351ed42f04e7ace0f4
Merge: d172935 4077fcc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 13:37:38 2014 -0800

    Merge "Merge "msm: kgsl: don't use sscanf()""

commit d172935bc4856cbf3cec83ddc5d57672ff5a3123
Merge: cac0777 d56515d
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 12:50:45 2014 -0800

    Merge "Merge "Merge "msm: clock-rpm: Make rpm clocks sleeping clocks"""

commit d56515d0435581264429c626bd81529412736e4a
Merge: cac0777 b917893
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 07:37:54 2014 -0800

    Merge "Merge "msm: clock-rpm: Make rpm clocks sleeping clocks""

commit 4077fccfa88d3336f7c006bb75bdf8c59bb94ad1
Merge: b917893 9a0c1e5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 03:36:30 2014 -0800

    Merge "msm: kgsl: don't use sscanf()"

commit cac0777b7f266c1ea3c2868e24f924be6dbb9996
Merge: fdc3985 bd8bb70
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 02:05:42 2014 -0800

    Merge "Merge "Merge "msm: ADSPRPC: Add checks for erroneous values"""

commit b9178938523462b3b98287b2251547286f9ed996
Merge: cbbd2e3 07c202b
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 01:00:51 2014 -0800

    Merge "msm: clock-rpm: Make rpm clocks sleeping clocks"

commit cbbd2e39026eb0acfcdeb6c562875b5dff7b2d3e
Merge: 0c1efb4 aea8045
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Mar 6 01:00:49 2014 -0800

    Merge "power: don't wait for timeout if sys_sync completes early"

commit bd8bb70297fbcbd5485ca1ad1aed5131f65788ea
Merge: fdc3985 0c1efb4
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 5 21:42:47 2014 -0800

    Merge "Merge "msm: ADSPRPC: Add checks for erroneous values""

commit 9f48c5a49a9f69c98c3ead6bf820072df3f14732
Merge: 0c1efb4 a0ffb07
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 5 08:18:39 2014 -0800

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.043 on remote branch"

commit a0ffb0791ad1ff17ae265294354bc3ae21742b58
Merge: 0c1efb4 d172051
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Mar 5 06:33:27 2014 -0700

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.043 on remote branch

    Change-Id: I68ce4112588b3a9f740e0c9af0dd385366674489

commit 0c1efb415d0505f9a467e7f431d9e83315a2ac6d
Merge: a6705c0 cb117bb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sat Mar 1 20:48:18 2014 -0800

    Merge "msm: ADSPRPC: Add checks for erroneous values"

commit a6705c0e69ec625b75a515c65c7bf6db387e7722
Merge: e49205c 13ececa
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Feb 28 07:18:06 2014 -0800

    Merge "msm: camera: Clear frame stucture before use"

commit cb117bb19e8063c14107b076250e1a187824418c
Author: Mitchel Humpherys <mitchelh@codeaurora.org>
Date:   Fri Oct 25 12:05:47 2013 -0700

    msm: ADSPRPC: Add checks for erroneous values

    Check for invalid parameters passed in user invocation
    and validate the return values using appropriate macros.

    Change-Id: If529873d025ac0c13725efbedda5a58fae327722
    Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
    Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
    Signed-off-by: Prados Das <prados@codeaurora.org>

commit e49205c0c229cb27f1084dcd2e50f1a2f5bca704
Merge: ebc1bd0 279e7cc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Thu Feb 27 06:39:36 2014 -0800

    Merge "defconfig: remove support for /dev/mem and /dev/kmem on perf builds"

commit ebc1bd037c6b989ca19102bc1f1ed47a1fc99afb
Merge: 80588a2 7f285eb
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Feb 26 21:32:20 2014 -0800

    Merge "WLAN subsystem: Sysctl support for key TCP/IP parameters"

commit dc41b901fdcc34df2b6479e95d5214822a0872f7
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Wed Nov 27 10:46:13 2013 -0700

    msm: kgsl: use %pK to restrict printing GPU / memory addresses

    Use %pK in the output for the per-process memory dump to keep from
    printing the GPU and user memory addresses for the GPU memory
    objects own by the process.  This allows us to make the 'mem' file
    world readable without exposing any really dangerous information.

    Change-Id: Ic0dedbad21654110905d1b3744f562966584d8ed
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>

commit d5e7bb22b713c4042a19ca6c3e380ec03abe70c0
Author: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Date:   Wed Feb 26 19:30:18 2014 +0530

    USB: ci13xxx_msm: shutdown callback to disable D+ pullup

    SW reset may not reset the PHY properly by disabling
    the D+ pullup.

    Implement a shutdown callback to disable the pullup
    during soft reboot so that host controller does
    not go in bad state.

    CRs-Fixed: 616180
    Change-Id: I7bc76efdf78009a5e3705c049abd3678dc966885
    Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
    Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

commit b675850664700a50aa3b1b4dec566188b968bbb8
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Tue Feb 26 15:46:43 2013 -0700

    msm: kgsl: Add the buffer user address to the debugfs memory list

    For each buffer in the debugfs memory list print the address it is
    mapped to in the user process.  This is useful for matching up the
    user side allocations with what the kernel thinks it has.

    Change-Id: Ic0dedbadd07a8f704c0bf73b183aaeeddbbdd129
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

commit 0efc959be55801808454292cc61d11ff8ab1bfa1
Author: Deepak Verma <dverma@codeaurora.org>
Date:   Tue Feb 25 16:37:07 2014 +0530

    msm: vidc: No need to allocate metadata by default

    If metadata is not enabled by client, there is no need
    to enable it by default.

    Change-Id: I6d5bd1c04dcdf78549afac57bcaceb82602da270
    Signed-off-by: Deepak Verma <dverma@codeaurora.org>

commit 80588a2888aff6d554e699cc167b642dd6aa4848
Merge: ffc94e7 ed82017
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Feb 25 11:15:12 2014 -0800

    Merge "msm-camera: Assign NULL after freeing memory"

commit d172051ec38556253c7613aa6b24f0ab9140e0c3
Merge: fdc3985 d22d96c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Feb 25 09:32:32 2014 -0800

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.041 on remote branch"

commit d22d96c07ba095d4687eb6bfd1def6409eefcbb7
Merge: fdc3985 7afc0a7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Tue Feb 25 06:18:00 2014 -0700

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.041 on remote branch

    Change-Id: Ib765ba23c19ae50332261f1cf59cef6d9bda788f

commit 9a0c1e531d4fa5407a16407f8e7cd95e78d882b1
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Feb 24 13:52:54 2014 -0700

    msm: kgsl: don't use sscanf()

    Friends do not let friends use sscanf().

    CRs-Fixed: 563605
    Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
    Signed-off-by: Ananta Kishore K <akollipa@codeaurora.org>

commit fdc3985b32c5d09fec798cd6aba742843abefeb1
Merge: 930b27f 0cc2dd5
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 13:29:04 2014 -0800

    Merge "Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf"""

commit a249035f12442f6064bb6f66e58aa6800c3d771b
Author: Jordan Crouse <jcrouse@codeaurora.org>
Date:   Mon Feb 24 13:47:40 2014 -0700

    msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

    Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
    convert 32 bit unsigned ints.

    CRs-fixed: 563585
    Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
    Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

commit 7afc0a7043d103e831b9060c52088b4cb6f44b56
Merge: 06df18a 929cd5a
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 09:25:48 2014 -0800

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.040 on remote branch"

commit 0cc2dd58e34d62638facb1d263aa97b5f1791743
Merge: 930b27f ffc94e7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 09:08:08 2014 -0800

    Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf""

commit 929cd5ab2e54ab6aa6ada24ea456bb181ae78e28
Merge: 06df18a 3cc0c2e
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 07:29:13 2014 -0700

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.040 on remote branch

    Change-Id: I9271c3a23d06bf692720fed7c1f539950394462f

commit 930b27f43f5868c7a4789bf346142073a5e95667
Merge: 06df18a a6e188c
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 05:26:38 2014 -0800

    Merge "Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf"""

commit 13ececa0ac4e31a38406c2e5ae0db1d228751d11
Author: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Date:   Mon Feb 24 15:56:12 2014 +0530

    msm: camera: Clear frame stucture before use

    Clear frame structure before use and avoid unnecessary side
    effects

    CRs-Fixed: 563447

    Change-Id: I9acd436f30c65c01fa366328f7227a2045f42657
    Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

commit a6e188c0080d9b5cc6ad288e3a422cfdb6414d63
Merge: 06df18a ffc94e7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 01:08:30 2014 -0800

    Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf""

commit 06df18ab1119ad37159510e2e3fc1184f11074cd
Merge: 3785e22 f6ebbcf
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 24 00:47:09 2014 -0800

    Merge "Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf"""

commit ed8201700247d2b9d7c98054e9de67059c1aef91
Author: Raghu DP <dp.raghu@codeaurora.org>
Date:   Fri Feb 21 15:30:36 2014 +0530

    msm-camera: Assign NULL after freeing memory

    In msm_actuator we need to assign memory
    pointer to  NULL after freeing that memory
    using kfree.

    CRs-Fixed: 621818
    Change-Id: Id6bc85a74c94556b53f4a868a168637e0733bde4
    Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>

commit f6ebbcf904bfd16dceebf529bda9e9aa4921b1f3
Merge: 3785e22 ffc94e7
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Sun Feb 23 20:29:00 2014 -0800

    Merge "Merge "qseecom: Validate the pointer returned by ion_import_dma_buf""

commit 3785e222ca644404f6c307fd6e93bf2cd72ea683
Merge: 93e6810 a3719cf
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Feb 21 11:50:19 2014 -0800

    Merge "Merge "Merge "arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw"""

commit ffc94e715e7d69e58dbc801ccce1150615f587e6
Merge: 32cedf1 6086eed
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Feb 21 11:44:36 2014 -0800

    Merge "qseecom: Validate the pointer returned by ion_import_dma_buf"

commit 32cedf18165a0aef7490acd8c19590934699f28a
Merge: 08e79dc f4a5bbd
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Feb 21 11:44:29 2014 -0800

    Merge "[media] media: Init the reserved fields of struct media_link_desc"

commit a3719cfb75404f1b1b14744e622510469a13c567
Merge: 93e6810 08e79dc
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Fri Feb 21 07:32:13 2014 -0800

    Merge "Merge "arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw""

commit d950549504d4302846d80b66a000b91a9eae50af
Author: Leo Chang <leochang@codeaurora.org>
Date:   Wed Jan 15 19:52:00 2014 -0800

    nl80211: support vendor-specific events

    In addition to vendor-specific commands, also support vendor-specific
    events. These must be registered with cfg80211 before they can be used.
    They're also advertised in nl80211 in the wiphy information so that
    userspace knows can be expected. The events themselves are sent on a
    new multicast group called "vendor".

    Change-Id: I184aaa9f9e8461aee572f7d0a35916cd668c2218
    CRs-fixed: 576020
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Git-commit: 567ffc3509b2d3f965a49a18631d3da7f9a96d4f
    Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
    Signed-off-by: Leo Chang <leochang@codeaurora.org>

commit b784fbe8d030a5204126e56727ee63144e16e50b
Author: Leo Chang <leochang@codeaurora.org>
Date:   Wed Jan 15 19:22:28 2014 -0800

    nl80211: vendor command support

    Add support for vendor-specific commands to nl80211. This is
    intended to be used for really vendor-specific functionality
    that can't be implemented in a generic fashion for any reason.
    It's *NOT* intended to be used for any normal/generic feature
    or any optimisations that could be implemented across drivers.
    Currently, only vendor commands (with replies) are supported,
    no dump operations or vendor-specific notifications.
    Also add a function wdev_to_ieee80211_vif() to mac80211 which
    is needed for mac80211-based drivers wanting to implement any
    vendor commands.

    Change-Id: If73cf90d152ca0888a563cf4ae685aad9cec6443
    CRs-fixed: 576020
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Git-commit: ad7e718c9b4f717823fd920a0103f7b0fb06183f
    Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
    Signed-off-by: Leo Chang <leochang@codeaurora.org>

commit 60a48a89ebd20ef285636719a7f0a02dd8175021
Author: Naresh Jayaram <njayar@codeaurora.org>
Date:   Fri Jan 3 14:46:34 2014 +0530

    cfg80211: pass station supported channel and oper class info

    The information of the peer's supported channels and supported operating
    classes are required for the driver to perform TDLS off channel
    operations. This commit enhances the function nl80211_(new)set_station
    to pass this information of the peer to the driver.

    CRs-fixed: 595620
    Change-Id: I1d630deb4cf435e7f72e3a59276d3771c2b03114
    Signed-off-by: Naresh Jayaram <njayar@codeaurora.org>

commit 6086eedf3592bf9d1037b91dcd2efac2518a0d07
Author: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Date:   Tue Feb 18 13:46:37 2014 -0800

    qseecom: Validate the pointer returned by ion_import_dma_buf

    Do a "IS_ERR_OR_NULL" check for the return value of
    ion_import_dma_buf.

    Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
    Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

commit 3cc0c2ed5bc2510f29f808305c0ebea7dc6e9c0d
Merge: 79038ba b8bd480
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 17 01:58:11 2014 -0800

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.037 on remote branch"

commit b8bd480b945f3cb715476a78f5e6f7fbd084a729
Merge: 79038ba 56c62b3
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Mon Feb 17 01:11:33 2014 -0700

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.037 on remote branch

    Change-Id: I5d2ecbf0a3988605614568a931cb62c98d66c519

commit 07c202b4b4569654f68bb6c610c58316dac66409
Author: Stephen Boyd <sboyd@codeaurora.org>
Date:   Fri Sep 21 18:00:39 2012 +0000

    msm: clock-rpm: Make rpm clocks sleeping clocks

    Now that we have clk_prepare/unprepare we can make the RPM clocks
    sleepable. This allows us to move the sometimes costly busy wait
    that RPM clocks incur when enabling and disabling or changing
    rates.

    CRs-Fixed: 552223

    Change-Id: I8ac53c0b7fc79e56051b19fedb6910ac3f1cda42
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
    Git-commit: b500badb5dc821dd92f93833003170cb9ae106b0
    Git-repo: https://android.googlesource.com/kernel/msm/
    Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

commit aea8045d06f0711cdbacf19517bf01e5c6d9acf9
Author: Srinivasarao P <spathi@codeaurora.org>
Date:   Thu Jan 30 15:31:59 2014 +0530

    power: don't wait for timeout if sys_sync completes early

    In some cases the suspend thread is waiting for timer to expire
    even if the sync workqueue is empty. So the suspend is taking extra
    time.
    To avoid this waiting, sending the completion event from
    last sync item in workqueue.

    CRs-Fixed: 583016

    Change-Id: Ia3219e90762ec7f6ad3e7096126832acfd03ed69
    Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

commit f4a5bbdbb29d459914b8ac7fe5f6ca958ccad6e6
Author: Deva Ramasubramanian <dramasub@codeaurora.org>
Date:   Fri Jan 24 12:38:37 2014 -0800

    [media] media: Init the reserved fields of struct media_link_desc

    struct media_link_desc is copy_to_user'ed as the return value of
    MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
    the reserved fields.  This commit fixes that by initialising the
    reserved fields to 0.

    CRs-Fixed: 570757
    Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
    Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>

commit 56c62b3825154cac549cd0c73ce176e3603641a0
Merge: b4d055f 6a23ea2
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Feb 12 04:41:48 2014 -0800

    Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.033 on remote branch"

commit 6a23ea2f567f7b6c8686eaa516ed364fee08642d
Merge: b4d055f 9aa9562
Author: Linux Build Service Account <lnxbuild@localhost>
Date:   Wed Feb 12 04:04:34 2014 -0700

    Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.033 on remote branch

    Change-Id: I6092daa26027521ac5bde90b1d7597d4329b6a67

commit 7f285eb6d3ab8aca873632bfc9ff6faf645a246b
Author: Mahesh A Saptasagar <msapta@codeaurora.org>
Date:   Tue Feb 11 13:39:05 2014 +0530

    WLAN subsystem: Sysctl support for key TCP/IP parameters

    It has been observed that default values for some of key tcp/ip
    parameters are affecting the tput/performance of the system. Hence
    extending configuration capabilities to TCP/Ip stack through
    sysctl interface.

    Change-Id: I0c99d5b50cbe0d6496e40d391eacc12b0c62dbed
    CRs-Fixed: 507581
    Signed-off-by: Mahesh A Saptasagar <msapta@codeaurora.org>

commit 5e3d1c4d20967b5c029df18a8172b9f7853d0a5f
Author: Mohammad Johny Shaik <mjshai@codeaurora.org>
Date:   Mon Feb 3 16:59:49 2014 +0530

    ASoc: msm: qdsp6v2: Fix for NULL check

    - Required check added for NULL pointer

    Change-Id: I204dddb37048ba410381e46c0e906d0390951dd9
    CRs-fixed: 583939
    Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>

commit 279e7cc463eb126a8cd31d0a8edb7d21bbbde85d
Author: Sarang Joshi <spjoshi@codeaurora.org>
Date:   Fri Oct 25 12:51:51 2013 -0700

    defconfig: remove support for /dev/mem and /dev/kmem on perf builds

    Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
    to peek/poke to these areas and is a security risk. Remove support for
    /dev/mem and /dev/kmem on perf builds.

    Change-Id: Iad85b34039a67c5f8796adfd16543a94a1bc3054
    CRs-Fixed: 530719
    Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>

Change-Id: I66a3e29c78873e3ab87feabed88b1af21be2e297