commit 0bfd8ffeff9dda08c69381d65c72e0aa58706ef6 Author: Greg Kroah-Hartman Date: Fri May 24 11:45:59 2013 -0700 Linux 3.9.4 commit 7c3f227d5f62d607b4b09d6267a1943e9947dbeb Author: Alexander van Heukelum Date: Wed Mar 27 22:18:05 2013 +0100 x86, vm86: fix VM86 syscalls: use SYSCALL_DEFINEx(...) commit 5522ddb3fc0dfd4a503c8278eafd88c9f2d3fada upstream. Commit 49cb25e9290 x86: 'get rid of pt_regs argument in vm86/vm86old' got rid of the pt_regs stub for sys_vm86old and sys_vm86. The functions were, however, not changed to use the calling convention for syscalls. [AV: killed asmlinkage_protect() - it's done automatically now] Backported-by: Satoru Takeuchi Reported-and-tested-by: Hans de Bruin Signed-off-by: Alexander van Heukelum Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit eb1b60a0fbe29e66106b6cb65d17b9dfdb2d335d Author: Jon Mason Date: Fri Apr 26 14:51:57 2013 -0700 NTB: Multiple NTB client fix commit 8b19d450ad188d402a183ff4a4d40f31c3916fbf upstream. Fix issue with adding multiple ntb client devices to the ntb virtual bus. Previously, multiple devices would be added with the same name, resulting in crashes. To get around this issue, add a unique number to the device when it is added. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 32c0e1fe6fe8a9992f582b60a4f15858add89fcb Author: Jon Mason Date: Thu Apr 18 13:36:43 2013 -0700 ntb_netdev: remove from list on exit commit 904435cf76a9bdd5eb41b1c4e049d5a64f3a8400 upstream. The ntb_netdev device is not removed from the global list of devices upon device removal. If the device is re-added, the removal code would find the first instance and try to remove an already removed device. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 7e98a1733e34e1564a2668ea6210df94cf572a22 Author: Jon Mason Date: Thu Jan 17 15:28:45 2013 -0700 NTB: memcpy lockup workaround commit c336acd3331dcc191a97dbc66a557d47741657c7 upstream. The system will appear to lockup for long periods of time due to the NTB driver spending too much time in memcpy. Avoid this by reducing the number of packets that can be serviced on a given interrupt. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit b85fffd687b4886e5f4b53ed6af86725fb838eae Author: Jon Mason Date: Fri Feb 1 15:45:16 2013 -0700 NTB: Correctly handle receive buffers of the minimal size commit c9d534c8cbaedbb522a1d2cb037c6c394f610317 upstream. The ring logic of the NTB receive buffer/transmit memory window requires there to be at least 2 payload sized allotments. For the minimal size case, split the buffer into two and set the transport_mtu to the appropriate size. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 71f5fafba8ede25b833c939ed0c35d8c202fc1e3 Author: Jon Mason Date: Fri Feb 1 15:34:35 2013 -0700 NTB: reset tx_index on link toggle commit 90f9e934647e652a69396e18c779215a493271cf upstream. If the NTB link toggles, the driver could stop receiving due to the tx_index not being set to 0 on the transmitting size on a link-up event. This is due to the driver expecting the incoming data to start at the beginning of the receive buffer and not at a random place. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit e71ac54f810d7b4fac5c148052c78d523e57751f Author: Jon Mason Date: Fri Feb 1 15:25:37 2013 -0700 NTB: Link toggle memory leak commit b77b2637b39ecc380bb08992380d7d48452b0872 upstream. Each link-up will allocate a new NTB receive buffer when the NTB properties are negotiated with the remote system. These allocations did not check for existing buffers and thus did not free them. Now, the driver will check for an existing buffer and free it if not of the correct size, before trying to alloc a new one. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 086ae86effb4ba7d744f85f14cb9c63061fa38ce Author: Jon Mason Date: Wed Jan 30 11:40:52 2013 -0700 NTB: Handle 64bit BAR sizes commit 113fc505b83b2d16e820ca74fa07f99a34877b1d upstream. 64bit BAR sizes are permissible with an NTB device. To support them various modifications and clean-ups were required, most significantly using 2 32bit scratch pad registers for each BAR. Also, modify the driver to allow more than 2 Memory Windows. Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 36d51588f86a7c816ccbc06d6de2166f995d3e97 Author: Dan Carpenter Date: Wed Jan 23 22:26:05 2013 +0300 NTB: fix pointer math issues commit cc0f868d8adef7bdc12cda132654870086d766bc upstream. ->remote_rx_info and ->rx_info are struct ntb_rx_info pointers. If we add sizeof(struct ntb_rx_info) then it goes too far. Signed-off-by: Dan Carpenter Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 79f4ae0c560fab0e66c21f8b666a8b408cdb4586 Author: Dan Carpenter Date: Tue Jan 22 10:19:14 2013 +0300 ntb: off by one sanity checks commit ad3e2751e7c546ae678be1f8d86e898506b42cef upstream. These tests are off by one. If "mw" is equal to NTB_NUM_MW then we would go beyond the end of the ndev->mw[] array. Signed-off-by: Dan Carpenter Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit f22351258e21247e1faa73fa2b477510481d7f7c Author: Jon Mason Date: Tue Jan 22 11:35:40 2013 -0700 NTB: variable dereferenced before check commit 186f27ff9f9ec5c110739ced88ce9f8fca053882 upstream. Correct instances of variable dereferencing before checking its value on the functions exported to the client drivers. Also, add sanity checks for all exported functions. Reported-by: Dan Carpenter Signed-off-by: Jon Mason Signed-off-by: Greg Kroah-Hartman commit 1435b05b0477773ec80059a6f83bc99862fb0036 Author: Michael S. Tsirkin Date: Fri May 17 10:44:15 2013 +0930 virtio_console: fix uapi header commit 6407d75afd08545f2252bb39806ffd3f10c7faac upstream. uapi should use __u32 not u32. Fix a macro in virtio_console.h which uses u32. Signed-off-by: Michael S. Tsirkin Signed-off-by: Rusty Russell Signed-off-by: Greg Kroah-Hartman commit a7656384c9590f293e1e8cb11acb875322b8ec41 Author: Niels Ole Salscheider Date: Sat May 18 21:19:23 2013 +0200 drm/radeon: Fix VRAM size calculation for VRAM >= 4GB commit fc986034540102cd090237bf3f70262e1ae80d9c upstream. Add ULL prefix to avoid overflow. Signed-off-by: Niels Ole Salscheider Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 429d8945a2cc016ebb0c732c12e4356704f03685 Author: Ben Skeggs Date: Tue May 7 15:54:13 2013 +1000 drm/nouveau/bios: fix thinko in ZM_MASK_ADD opcode commit 46b47b8a7d9223b12ddcabf1f3fc6e753e2d84a1 upstream. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit da9d83cf6e1f64c5dafc7c47f6ce93788bc1263a Author: Linus Torvalds Date: Mon May 20 11:36:03 2013 -0700 x86: Fix bit corruption at CPU resume time commit 5e427ec2d066b48a5c27b3a5a3315f7e4e729077 upstream. In commit 78d77df71510 ("x86-64, init: Do not set NX bits on non-NX capable hardware") we added the early_pmd_flags that gets the NX bit set when a CPU supports NX. However, the new variable was marked __initdata, because the main _use_ of this is in an __init routine. However, the bit setting happens from secondary_startup_64(), which is called not only at bootup, but on every secondary CPU start. Including resuming from STR and at CPU hotplug time. So the value cannot be __initdata. Reported-bisected-and-tested-by: Michal Hocko Acked-by: Peter Anvin Cc: Fernando Luis Vázquez Cao Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 6fddcaed97292f001589c2c12878c76a394a52a4 Author: Mika Westerberg Date: Mon May 13 00:54:30 2013 +0000 i2c: designware: always clear interrupts before enabling them commit 2a2d95e9d6d29e726cc294b65391917ed2e32bf4 upstream. If the I2C bus is put to a low power state by an ACPI method it might pull the SDA line low (as its power is removed). Once the bus is put to full power state again, the SDA line is pulled back to high. This transition looks like a STOP condition from the controller point-of-view which sets STOP detected bit in its status register causing the driver to fail subsequent transfers. Fix this by always clearing all interrupts before we start a transfer. Signed-off-by: Mika Westerberg Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman commit d66affca2391a38a0fdfea47d263da089ab23d2f Author: Josef Ahmad Date: Fri Apr 19 17:28:10 2013 +0100 i2c: designware: fix RX FIFO overrun commit e6f34cea56f5b95498070eaa9f4aa3ba4a9e4f62 upstream. i2c_dw_xfer_msg() pushes a number of bytes to transmit/receive to/from the bus into the TX FIFO. For master-rx transactions, the maximum amount of data that can be received is calculated depending solely on TX and RX FIFO load. This is racy - TX FIFO may contain master-rx data yet to be processed, which will eventually land into the RX FIFO. This data is not taken into account and the function may request more data than the controller is actually capable of storing. This patch ensures the driver takes into account the outstanding master-rx data in TX FIFO to prevent RX FIFO overrun. Signed-off-by: Josef Ahmad Acked-by: Mika Westerberg Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman commit eb3c8adad2ebf3197d6feaef84d4df7561687fd6 Author: Wei Yongjun Date: Mon May 13 14:01:43 2013 +0800 hwmon: fix error return code in abituguru_probe() commit ecacb0b17c08fae89f65468727f0e4b8e91da4e1 upstream. Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 514b17caf165ec31d1f6b9d40c645aed55a0b721 Author: Gabriel de Perthuis Date: Mon May 6 17:40:18 2013 +0000 btrfs: don't stop searching after encountering the wrong item commit 03b71c6ca6286625d8f1ed44aabab9b5bf5dac10 upstream. The search ioctl skips items that are too large for a result buffer, but inline items of a certain size occuring before any search result is found would trigger an overflow and stop the search entirely. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=57641 Signed-off-by: Gabriel de Perthuis Signed-off-by: Josef Bacik Signed-off-by: Greg Kroah-Hartman commit c2672f87c3b10f44e7e8f15f23d4dfec434c9053 Author: Sukanto Ghosh Date: Tue May 14 10:26:54 2013 +0100 arm64: mm: Fix operands of clz in __flush_dcache_all commit b4fed0796841b5293b9c9427a5391b7bb20ef2d9 upstream. The format of the lower 32-bits of the 64-bit operand to 'dc cisw' is unchanged from ARMv7 architecture and the upper bits are RES0. This implies that the 'way' field of the operand of 'dc cisw' occupies the bit-positions [31 .. (32-A)]. Due to the use of 64-bit extended operands to 'clz', the existing implementation of __flush_dcache_all is incorrectly placing the 'way' field in the bit-positions [63 .. (64-A)]. Signed-off-by: Sukanto Ghosh Tested-by: Anup Patel Signed-off-by: Catalin Marinas Signed-off-by: Greg Kroah-Hartman commit 71b86dfc5ed5a27c6d02eff2957587b8a00ae3dd Author: Will Deacon Date: Wed May 8 17:01:12 2013 +0100 arm64: debug: clear mdscr_el1 instead of taking the OS lock commit 9c413e25d95fd3c0abe23eadad66191b22baa549 upstream. During boot, we take the debug OS lock before interrupts are enabled. This is required to prevent clearing of PSTATE.D on the interrupt entry path, which could result in spurious debug exceptions before we've got round to resetting things like the hardware breakpoints registers to a sane state. A problem with this approach is that taking the OS lock prevents an external JTAG debugger from debugging the system, which is especially irritating during boot, where JTAG debugging can be most useful. This patch clears mdscr_el1 rather than taking the lock, clearing the MDE and KDE bits and preventing self-hosted hardware debug exceptions from occurring. Tested-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Greg Kroah-Hartman