commit 519be4566e2e60293d55bcfec71490af8e61b9e7
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Aug 14 22:59:42 2013 -0700

    Linux 3.10.7

commit 5954bd0f29212194f0beb6dab03f9c26a482c560
Author: Markos Chandras <markos.chandras@imgtec.com>
Date:   Mon Jun 17 08:09:00 2013 +0000

    MIPS: Expose missing pci_io{map,unmap} declarations
    
    commit 78857614104a26cdada4c53eea104752042bf5a1 upstream.
    
    The GENERIC_PCI_IOMAP does not depend on CONFIG_PCI so move
    it to the CONFIG_MIPS symbol so it's always selected for MIPS.
    This fixes the missing pci_iomap declaration for MIPS.
    Moreover, the pci_iounmap function was not defined in the
    io.h header file if the CONFIG_PCI symbol is not set,
    but it should since MIPS is not using CONFIG_GENERIC_IOMAP.
    
    This fixes the following problem on a allyesconfig:
    
    drivers/net/ethernet/3com/3c59x.c:1031:2: error: implicit declaration of
    function 'pci_iomap' [-Werror=implicit-function-declaration]
    drivers/net/ethernet/3com/3c59x.c:1044:3: error: implicit declaration of
    function 'pci_iounmap' [-Werror=implicit-function-declaration]
    
    Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
    Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
    Patchwork: https://patchwork.linux-mips.org/patch/5478/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ddb2a2d9e0b2c87696d1a81b57edf545e201c143
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Tue Apr 23 15:47:50 2013 +0200

    mtd: omap2: allow bulding as a module
    
    commit 930d800bded771b26d9944c47810829130ff7c8c upstream.
    
    The omap2 nand device driver calls into the the elm code, which can
    be a loadable module, and in that case it cannot be built-in itself.
    I can see no reason why the omap2 driver cannot also be a module,
    so let's make the option "tristate" in Kconfig to fix this allmodconfig
    build error:
    
    ERROR: "elm_config" [drivers/mtd/nand/omap2.ko] undefined!
    ERROR: "elm_decode_bch_error_page" [drivers/mtd/nand/omap2.ko] undefined!
    
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: Tony Lindgren <tony@atomide.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Cc: Afzal Mohammed <afzal@ti.com>
    Cc: Russell King <rmk+kernel@arm.linux.org.uk>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7cf2a7505ba6859fa2f5a2055dee3d98b5b3e41
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Mar 14 15:21:36 2013 +0100

    SCSI: nsp32: use mdelay instead of large udelay constants
    
    commit b497ceb964a80ebada3b9b3cea4261409039e25a upstream.
    
    ARM cannot handle udelay for more than 2 miliseconds, so we
    should use mdelay instead for those.
    
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: GOTO Masanori <gotom@debian.or.jp>
    Cc: YOKOTA Hiroshi <yokota@netlab.is.tsukuba.ac.jp>
    Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ff2cb528a3eb18da1d94ac08abd365b8bb9abae
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Sun Aug 4 12:13:17 2013 -0400

    drm/radeon: always program the MC on startup
    
    commit 6fab3febf6d949b0a12b1e4e73db38e4a177a79e upstream.
    
    For r6xx+ asics.  This mirrors the behavior of pre-r6xx
    asics.  We need to program the MC even if something
    else in startup() fails.  Failure to do so results in
    an unusable GPU.
    
    Based on a fix from: Mark Kettenis <kettenis@openbsd.org>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    [ rebased for 3.10 and dropped the drivers/gpu/drm/radeon/cik.c
      bit as it's 3.11 specific code / tmb ]
    Signed-off-by: Thomas Backlund <tmb@mageia.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23b6ec0bab2444d66ae61f1eb1dff852bfb4f149
Author: Christian König <christian.koenig@amd.com>
Date:   Mon Aug 5 14:10:55 2013 +0200

    drm/radeon: only save UVD bo when we have open handles
    
    commit 4ad9c1c774c2af152283f510062094e768876f55 upstream.
    
    Otherwise just reinitialize from scratch on resume,
    and so make it more likely to succeed.
    
    v2: rebased for 3.10-stable tree
    
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6b061129ce0f86d8ae2ef9e01979041676a47fe5
Author: Christian König <christian.koenig@amd.com>
Date:   Thu Aug 1 17:34:07 2013 +0200

    drm/radeon: fix halting UVD
    
    commit 2858c00d2823c83acce2a1175dbabb2cebee8678 upstream.
    
    Removing the clock/power or resetting the VCPU can cause
    hangs if that happens in the middle of a register write.
    
    Stall the memory and register bus before putting the VCPU
    into reset. Keep it in reset when unloading the module or
    suspending.
    
    v2: rebased on 3.10-stable tree
    
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86813a19f976fe2bcac437e3816f12e7a3700186
Author: Jani Nikula <jani.nikula@linux.intel.com>
Date:   Thu Jul 25 12:44:34 2013 +0300

    drm/i915: initialize gt_lock early with other spin locks
    
    commit 14c5cec5d0cd73e7e9d4fbea2bbfeea8f3ade871 upstream.
    
    commit 181d1b9e31c668259d3798c521672afb8edd355c
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Sun Jul 21 13:16:24 2013 +0200
    
        drm/i915: fix up gt init sequence fallout
    
    moved dev_priv->gt_lock initialization after use. Do the initialization
    much earlier with other spin lock initializations.
    
    Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Zhouping Liu <zliu@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71986ee029bada49f4517dbc6b0caf2243a566a2
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Aug 5 17:37:37 2013 +0400

    reiserfs: fix deadlock in umount
    
    commit 672fe15d091ce76d6fb98e489962e9add7c1ba4c upstream.
    
    Since remove_proc_entry() started to wait for IO in progress (i.e.
    since 2007 or so), the locking in fs/reiserfs/proc.c became wrong;
    if procfs read happens between the moment when umount() locks the
    victim superblock and removal of /proc/fs/reiserfs/<device>/*,
    we'll get a deadlock - read will wait for s_umount (in sget(),
    called by r_start()), while umount will wait in remove_proc_entry()
    for that read to finish, holding s_umount all along.
    
    Fortunately, the same change allows a much simpler race avoidance -
    all we need to do is remove the procfs entries in the very beginning
    of reiserfs ->kill_sb(); that'll guarantee that pointer to superblock
    will remain valid for the duration for procfs IO, so we don't need
    sget() to keep the sucker alive.  As the matter of fact, we can
    get rid of the home-grown iterator completely, and use single_open()
    instead.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a9800654317a89b0224edbe51edcde8c54be2acc
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Fri Jul 26 17:12:56 2013 +0200

    debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)
    
    commit 776164c1faac4966ab14418bb0922e1820da1d19 upstream.
    
    debugfs_remove_recursive() is wrong,
    
    1. it wrongly assumes that !list_empty(d_subdirs) means that this
       dir should be removed.
    
       This is not that bad by itself, but:
    
    2. if d_subdirs does not becomes empty after __debugfs_remove()
       it gives up and silently fails, it doesn't even try to remove
       other entries.
    
       However ->d_subdirs can be non-empty because it still has the
       already deleted !debugfs_positive() entries.
    
    3. simple_release_fs() is called even if __debugfs_remove() fails.
    
    Suppose we have
    
    	dir1/
    		dir2/
    			file2
    		file1
    
    and someone opens dir1/dir2/file2.
    
    Now, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes
    away.
    
    But debugfs_remove_recursive(dir1) silently fails and doesn't remove
    this directory. Because it tries to delete (the already deleted)
    dir1/dir2/file2 again and then fails due to "Avoid infinite loop"
    logic.
    
    Test-case:
    
    	#!/bin/sh
    
    	cd /sys/kernel/debug/tracing
    	echo 'p:probe/sigprocmask sigprocmask' >> kprobe_events
    	sleep 1000 < events/probe/sigprocmask/id &
    	echo -n >| kprobe_events
    
    	[ -d events/probe ] && echo "ERR!! failed to rm probe"
    
    And after that it is not possible to create another probe entry.
    
    With this patch debugfs_remove_recursive() skips !debugfs_positive()
    files although this is not strictly needed. The most important change
    is that it does not try to make ->d_subdirs empty, it simply scans
    the whole list(s) recursively and removes as much as possible.
    
    Link: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com
    
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6b9cb24deb2e856b111f77415e9a7da9b09020f6
Author: Julius Werner <jwerner@chromium.org>
Date:   Tue Jul 30 19:51:20 2013 -0700

    usb: core: don't try to reset_device() a port that got just disconnected
    
    commit 481f2d4f89f87a0baa26147f323380e31cfa7c44 upstream.
    
    The USB hub driver's event handler contains a check to catch SuperSpeed
    devices that transitioned into the SS.Inactive state and tries to fix
    them with a reset. It decides whether to do a plain hub port reset or
    call the usb_reset_device() function based on whether there was a device
    attached to the port.
    
    However, there are device/hub combinations (found with a JetFlash
    Transcend mass storage stick (8564:1000) on the root hub of an Intel
    LynxPoint PCH) which can transition to the SS.Inactive state on
    disconnect (and stay there long enough for the host to notice). In this
    case, above-mentioned reset check will call usb_reset_device() on the
    stale device data structure. The kernel will send pointless LPM control
    messages to the no longer connected device address and can even cause
    several 5 second khubd stalls on some (buggy?) host controllers, before
    finally accepting the device's fate amongst a flurry of error messages.
    
    This patch makes the choice of reset dependent on the port status that
    has just been read from the hub in addition to the existence of an
    in-kernel data structure for the device, and only proceeds with the more
    extensive reset if both are valid.
    
    Signed-off-by: Julius Werner <jwerner@chromium.org>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 94bcc7deb8fed472360ad72ef3717c5409057fca
Author: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Date:   Sat Jun 22 17:21:00 2013 +0300

    zram: allow request end to coincide with disksize
    
    commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.
    
    Pass valid_io_request() checks if request end coincides with disksize
    (end equals bound), only fail if we attempt to read beyond the bound.
    
    mkfs.ext2 produces numerous errors:
    [ 2164.632747] quiet_error: 1 callbacks suppressed
    [ 2164.633260] Buffer I/O error on device zram0, logical block 153599
    [ 2164.633265] lost page write due to I/O error on zram0
    
    Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
    Cc: Thomas Backlund <tmb@mageia.org>
    Cc: Minchan Kim <minchan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d1e8adc0865d7091f3c437d984a8527259b80378
Author: Jeff Layton <jlayton@redhat.com>
Date:   Wed Aug 7 10:29:08 2013 -0400

    cifs: don't instantiate new dentries in readdir for inodes that need to be revalidated immediately
    
    commit 757c4f6260febff982276818bb946df89c1105aa upstream.
    
    David reported that commit c2b93e06 (cifs: only set ops for inodes in
    I_NEW state) caused a regression with mfsymlinks. Prior to that patch,
    if a mfsymlink dentry was instantiated at readdir time, the inode would
    get a new set of ops when it was revalidated. After that patch, this
    did not occur.
    
    This patch addresses this by simply skipping instantiating dentries in
    the readdir codepath when we know that they will need to be immediately
    revalidated. The next attempt to use that dentry will cause a new lookup
    to occur (which is basically what we want to happen anyway).
    
    Reported-and-Tested-by: David McBride <dwm37@cam.ac.uk>
    Cc: "Stefan (metze) Metzmacher" <metze@samba.org>
    Cc: Sachin Prabhu <sprabhu@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4350018a57c333907db092beeb9fa65a82a258ed
Author: Chen Gang <gang.chen@asianux.com>
Date:   Fri Jul 19 09:01:36 2013 +0800

    cifs: extend the buffer length enought for sprintf() using
    
    commit 057d6332b24a4497c55a761c83c823eed9e3f23b upstream.
    
    For cifs_set_cifscreds() in "fs/cifs/connect.c", 'desc' buffer length
    is 'CIFSCREDS_DESC_SIZE' (56 is less than 256), and 'ses->domainName'
    length may be "255 + '\0'".
    
    The related sprintf() may cause memory overflow, so need extend related
    buffer enough to hold all things.
    
    It is also necessary to be sure of 'ses->domainName' must be less than
    256, and define the related macro instead of hard code number '256'.
    
    Signed-off-by: Chen Gang <gang.chen@asianux.com>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Reviewed-by: Scott Lovenberg <scott.lovenberg@gmail.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 72766b0bec55b104c414a22f2e8ecdbb6bb1e19e
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Mon Aug 12 09:29:30 2013 -0400

    ext4: flush the extent status cache during EXT4_IOC_SWAP_BOOT
    
    commit cde2d7a796f7e895e25b43471ed658079345636d upstream.
    
    Previously we weren't swapping only some of the extent_status LRU
    fields during the processing of the EXT4_IOC_SWAP_BOOT ioctl.  The
    much safer thing to do is to just completely flush the extent status
    tree when doing the swap.
    
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Cc: Zheng Liu <gnehzuil.liu@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c4fa10098c869072e96cca0f372b37d30fa10be2
Author: Piotr Sarna <p.sarna@partner.samsung.com>
Date:   Thu Aug 8 23:02:24 2013 -0400

    ext4: fix mount/remount error messages for incompatible mount options
    
    commit 6ae6514b33f941d3386da0dfbe2942766eab1577 upstream.
    
    Commit 5688978 ("ext4: improve handling of conflicting mount options")
    introduced incorrect messages shown while choosing wrong mount options.
    
    First of all, both cases of incorrect mount options,
    "data=journal,delalloc" and "data=journal,dioread_nolock" result in
    the same error message.
    
    Secondly, the problem above isn't solved for remount option: the
    mismatched parameter is simply ignored.  Moreover, ext4_msg states
    that remount with options "data=journal,delalloc" succeeded, which is
    not true.
    
    To fix it up, I added a simple check after parse_options() call to
    ensure that data=journal and delalloc/dioread_nolock parameters are
    not present at the same time.
    
    Signed-off-by: Piotr Sarna <p.sarna@partner.samsung.com>
    Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1929c51fc204bf84c5cbbd08861dd0a9da86b921
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Thu Aug 8 23:01:24 2013 -0400

    ext4: allow the mount options nodelalloc and data=journal
    
    commit 59d9fa5c2e9086db11aa287bb4030151d0095a17 upstream.
    
    Commit 26092bf ("ext4: use a table-driven handler for mount options")
    wrongly disallows the specifying the mount options nodelalloc and
    data=journal simultaneously.  This is incorrect; it should have only
    disallowed the combination of delalloc and data=journal
    simultaneously.
    
    Reported-by: Piotr Sarna <p.sarna@partner.samsung.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce512e58aa200513472a438e72a0fbe2bcaf8524
Author: Christian König <christian.koenig@amd.com>
Date:   Mon Aug 5 14:10:56 2013 +0200

    drm/radeon: stop sending invalid UVD destroy msg
    
    commit 641a00593f7d07eab778fbabf546fb68fff3d5ce upstream.
    
    We also need to check the handle.
    
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a76faeeb472b213c92f6fef54ec3cd7246f87f64
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Jul 29 18:56:13 2013 -0400

    drm/radeon: select audio dto based on encoder id for DCE3
    
    commit e1accbf0543eecfdb161131208c3dfefee22d61f upstream.
    
    There are two audio dtos on radeon asics that you can
    select between.  Normally, dto0 is used for hdmi and
    dto1 for DP, but it seems that the dto is somehow
    tied to the encoders on DCE3 asics.
    
    fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=67435
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ac4ae0b99e3d708e90fe39019601d2a91dff7011
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Wed Jun 12 11:58:44 2013 +0200

    drm: Don't pass negative delta to ktime_sub_ns()
    
    commit e91abf80a0998f326107874c88d549f94839f13c upstream.
    
    It takes an unsigned value. This happens not to blow up on 64-bit
    architectures, but it does on 32-bit, causing
    drm_calc_vbltimestamp_from_scanoutpos() to calculate totally bogus
    timestamps for vblank events. Which in turn causes e.g. gnome-shell to
    hang after a DPMS off cycle with current xf86-video-ati Git.
    
    [airlied: regression introduced in drm: use monotonic time in drm_calc_vbltimestamp_from_scanoutpos]
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59339
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59836
    Tested-by: shui yangwei <yangweix.shui@intel.com>
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by: Imre Deak <imre.deak@intel.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aabfe27dfe71d29b9ac08790f1a0ca240c1264b6
Author: Dave Airlie <airlied@redhat.com>
Date:   Wed Aug 7 10:01:56 2013 +1000

    drm/ast: invalidate page tables when pinning a BO
    
    commit 3ac65259328324de323dc006b52ff7c1a5b18d19 upstream.
    
    same fix as cirrus and mgag200.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12fb12f1f103676c2e81bcc392436171349d37db
Author: Egbert Eich <eich@suse.com>
Date:   Wed Jul 17 17:40:56 2013 +0200

    drm/mgag200: Invalidate page tables when pinning a BO
    
    commit ecaac1c866bcda4780a963b3d18cd310d971aea3 upstream.
    
    When a BO gets pinned the placement may get changed. If the memory is
    mapped into user space and user space has already accessed the mapped
    range the page tables are set up but now point to the wrong memory.
    Set bo.mdev->dev_mapping in mgag200_bo_create() to make sure that
    ttm_bo_unmap_virtual() called from ttm_bo_handle_move_mem() will take
    care of this.
    
    v2: Don't call ttm_bo_unmap_virtual() in mgag200_bo_pin(), fix comment.
    
    Signed-off-by: Egbert Eich <eich@suse.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18da37c30dfb6bd4e46b39fefe06b891524d80a6
Author: Michal Srb <msrb@suse.com>
Date:   Tue Aug 6 15:26:50 2013 +0200

    drm/cirrus: Invalidate page tables when pinning a BO
    
    commit 109a51598869a39fdcec2d49672a9a39b6d89481 upstream.
    
    This is a cirrus version of Egbert Eich's patch for mgag200.
    
    Without bo.bdev->dev_mapping set, the ttm_bo_unmap_virtual_locked
    called from ttm_bo_handle_move_mem returns with no effect. If any
    application accessed the memory before it was moved, it will
    access wrong memory next time. This causes crashes when changing
    resolution down.
    
    Signed-off-by: Michal Srb <msrb@suse.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61ffac73366844578d7e773cdc33a4f6adca09d3
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:23:21 2013 +0930

    virtio: console: return -ENODEV on all read operations after unplug
    
    commit 96f97a83910cdb9d89d127c5ee523f8fc040a804 upstream.
    
    If a port gets unplugged while a user is blocked on read(), -ENODEV is
    returned.  However, subsequent read()s returned 0, indicating there's no
    host-side connection (but not indicating the device went away).
    
    This also happened when a port was unplugged and the user didn't have
    any blocking operation pending.  If the user didn't monitor the SIGIO
    signal, they won't have a chance to find out if the port went away.
    
    Fix by returning -ENODEV on all read()s after the port gets unplugged.
    write() already behaves this way.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2817b99f91475b84c23cd353741ea485564f4562
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:21:32 2013 +0930

    virtio: console: fix raising SIGIO after port unplug
    
    commit 92d3453815fbe74d539c86b60dab39ecdf01bb99 upstream.
    
    SIGIO should be sent when a port gets unplugged.  It should only be sent
    to prcesses that have the port opened, and have asked for SIGIO to be
    delivered.  We were clearing out guest_connected before calling
    send_sigio_to_port(), resulting in a sigio not getting sent to
    processes.
    
    Fix by setting guest_connected to false after invoking the sigio
    function.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 707ea94eb328e81dce48e3cdc457e82afb745cf1
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:20:29 2013 +0930

    virtio: console: clean up port data immediately at time of unplug
    
    commit ea3768b4386a8d1790f4cc9a35de4f55b92d6442 upstream.
    
    We used to keep the port's char device structs and the /sys entries
    around till the last reference to the port was dropped.  This is
    actually unnecessary, and resulted in buggy behaviour:
    
    1. Open port in guest
    2. Hot-unplug port
    3. Hot-plug a port with the same 'name' property as the unplugged one
    
    This resulted in hot-plug being unsuccessful, as a port with the same
    name already exists (even though it was unplugged).
    
    This behaviour resulted in a warning message like this one:
    
    -------------------8<---------------------------------------
    WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xc9/0x130() (Not tainted)
    Hardware name: KVM
    sysfs: cannot create duplicate filename
    '/devices/pci0000:00/0000:00:04.0/virtio0/virtio-ports/vport0p1'
    
    Call Trace:
     [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0
     [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50
     [<ffffffff811f2319>] ? sysfs_add_one+0xc9/0x130
     [<ffffffff811f23e8>] ? create_dir+0x68/0xb0
     [<ffffffff811f2469>] ? sysfs_create_dir+0x39/0x50
     [<ffffffff81273129>] ? kobject_add_internal+0xb9/0x260
     [<ffffffff812733d8>] ? kobject_add_varg+0x38/0x60
     [<ffffffff812734b4>] ? kobject_add+0x44/0x70
     [<ffffffff81349de4>] ? get_device_parent+0xf4/0x1d0
     [<ffffffff8134b389>] ? device_add+0xc9/0x650
    
    -------------------8<---------------------------------------
    
    Instead of relying on guest applications to release all references to
    the ports, we should go ahead and unregister the port from all the core
    layers.  Any open/read calls on the port will then just return errors,
    and an unplug/plug operation on the host will succeed as expected.
    
    This also caused buggy behaviour in case of the device removal (not just
    a port): when the device was removed (which means all ports on that
    device are removed automatically as well), the ports with active
    users would clean up only when the last references were dropped -- and
    it would be too late then to be referencing char device pointers,
    resulting in oopses:
    
    -------------------8<---------------------------------------
    PID: 6162   TASK: ffff8801147ad500  CPU: 0   COMMAND: "cat"
     #0 [ffff88011b9d5a90] machine_kexec at ffffffff8103232b
     #1 [ffff88011b9d5af0] crash_kexec at ffffffff810b9322
     #2 [ffff88011b9d5bc0] oops_end at ffffffff814f4a50
     #3 [ffff88011b9d5bf0] die at ffffffff8100f26b
     #4 [ffff88011b9d5c20] do_general_protection at ffffffff814f45e2
     #5 [ffff88011b9d5c50] general_protection at ffffffff814f3db5
        [exception RIP: strlen+2]
        RIP: ffffffff81272ae2  RSP: ffff88011b9d5d00  RFLAGS: 00010246
        RAX: 0000000000000000  RBX: ffff880118901c18  RCX: 0000000000000000
        RDX: ffff88011799982c  RSI: 00000000000000d0  RDI: 3a303030302f3030
        RBP: ffff88011b9d5d38   R8: 0000000000000006   R9: ffffffffa0134500
        R10: 0000000000001000  R11: 0000000000001000  R12: ffff880117a1cc10
        R13: 00000000000000d0  R14: 0000000000000017  R15: ffffffff81aff700
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
     #6 [ffff88011b9d5d00] kobject_get_path at ffffffff8126dc5d
     #7 [ffff88011b9d5d40] kobject_uevent_env at ffffffff8126e551
     #8 [ffff88011b9d5dd0] kobject_uevent at ffffffff8126e9eb
     #9 [ffff88011b9d5de0] device_del at ffffffff813440c7
    
    -------------------8<---------------------------------------
    
    So clean up when we have all the context, and all that's left to do when
    the references to the port have dropped is to free up the port struct
    itself.
    
    Reported-by: chayang <chayang@redhat.com>
    Reported-by: YOGANANTH SUBRAMANIAN <anantyog@in.ibm.com>
    Reported-by: FuXiangChun <xfu@redhat.com>
    Reported-by: Qunfang Zhang <qzhang@redhat.com>
    Reported-by: Sibiao Luo <sluo@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60391483d53a0a9bb43e78a867173b92cf9da996
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:17:13 2013 +0930

    virtio: console: fix race in port_fops_open() and port unplug
    
    commit 671bdea2b9f210566610603ecbb6584c8a201c8c upstream.
    
    Between open() being called and processed, the port can be unplugged.
    Check if this happened, and bail out.
    
    A simple test script to reproduce this is:
    
    while true; do for i in $(seq 1 100); do echo $i > /dev/vport0p3; done; done;
    
    This opens and closes the port a lot of times; unplugging the port while
    this is happening triggers the bug.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b9f0c23359a5a20dccda4db14cc760625ad64c4
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:16:13 2013 +0930

    virtio: console: fix race with port unplug and open/close
    
    commit 057b82be3ca3d066478e43b162fc082930a746c9 upstream.
    
    There's a window between find_port_by_devt() returning a port and us
    taking a kref on the port, where the port could get unplugged.  Fix it
    by taking the reference in find_port_by_devt() itself.
    
    Problem reported and analyzed by Mateusz Guzik.
    
    Reported-by: Mateusz Guzik <mguzik@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98c9710e0aa2b939423605488b5817f27118ce40
Author: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
Date:   Tue Jul 23 11:30:49 2013 +0930

    virtio/console: Add pipe_lock/unlock for splice_write
    
    commit 2b4fbf029dff5a28d9bf646346dea891ec43398a upstream.
    
    Add pipe_lock/unlock for splice_write to avoid oops by following competition:
    
    (1) An application gets fds of a trace buffer, virtio-serial, pipe.
    (2) The application does fork()
    (3) The processes execute splice_read(trace buffer) and
        splice_write(virtio-serial) via same pipe.
    
            <parent>                   <child>
      get fds of a trace buffer,
             virtio-serial, pipe
              |
            fork()----------create--------+
              |                           |
          splice(read)                    |           ---+
          splice(write)                   |              +-- no competition
              |                       splice(read)       |
              |                       splice(write)   ---+
              |                           |
          splice(read)                    |
          splice(write)               splice(read)    ------ competition
              |                       splice(write)
    
    Two processes share a pipe_inode_info structure. If the child execute
    splice(read) when the parent tries to execute splice(write), the
    structure can be broken. Existing virtio-serial driver does not get
    lock for the structure in splice_write, so this competition will induce
    oops.
    
    <oops messages>
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
     IP: [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
     PGD 7223e067 PUD 72391067 PMD 0
     Oops: 0000 [#1] SMP
     Modules linked in: lockd bnep bluetooth rfkill sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd soundcore pcspkr virtio_net virtio_balloon i2c_piix4 i2c_core microcode uinput floppy
     CPU: 0 PID: 1072 Comm: compete-test Not tainted 3.10.0ws+ #55
     Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
     task: ffff880071b98000 ti: ffff88007b55e000 task.ti: ffff88007b55e000
     RIP: 0010:[<ffffffff811a6b5f>]  [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
     RSP: 0018:ffff88007b55fd78  EFLAGS: 00010287
     RAX: 0000000000000000 RBX: ffff88007b55fe20 RCX: 0000000000000000
     RDX: 0000000000001000 RSI: ffff88007a95ba30 RDI: ffff880036f9e6c0
     RBP: ffff88007b55fda8 R08: 00000000000006ec R09: ffff880077626708
     R10: 0000000000000003 R11: ffffffff8139ca59 R12: ffff88007a95ba30
     R13: 0000000000000000 R14: ffffffff8139dd00 R15: ffff880036f9e6c0
     FS:  00007f2e2e3a0740(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
     CR2: 0000000000000018 CR3: 0000000071bd1000 CR4: 00000000000006f0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
     Stack:
      ffffffff8139ca59 ffff88007b55fe20 ffff880036f9e6c0 ffffffff8139dd00
      ffff8800776266c0 ffff880077626708 ffff88007b55fde8 ffffffff811a6e8e
      ffff88007b55fde8 ffffffff8139ca59 ffff880036f9e6c0 ffff88007b55fe20
     Call Trace:
      [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0
      [<ffffffff8139dd00>] ? virtcons_restore+0x100/0x100
      [<ffffffff811a6e8e>] __splice_from_pipe+0x7e/0x90
      [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0
      [<ffffffff8139d739>] port_fops_splice_write+0xe9/0x140
      [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120
      [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0
      [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110
      [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0
      [<ffffffff8161facf>] tracesys+0xdd/0xe2
     Code: 49 8b 87 80 00 00 00 4c 8d 24 d0 8b 53 04 41 8b 44 24 0c 4d 8b 6c 24 10 39 d0 89 03 76 02 89 13 49 8b 44 24 10 4c 89 e6 4c 89 ff <ff> 50 18 85 c0 0f 85 aa 00 00 00 48 89 da 4c 89 e6 4c 89 ff 41
     RIP  [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
      RSP <ffff88007b55fd78>
     CR2: 0000000000000018
     ---[ end trace 24572beb7764de59 ]---
    
    V2: Fix a locking problem for error
    V3: Add Reviewed-by lines and stable@ line in sign-off area
    
    Signed-off-by: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
    Reviewed-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Amit Shah <amit.shah@redhat.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 81b80fb88ca579363abebb6da2e7023ffe657203
Author: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
Date:   Tue Jul 23 11:30:49 2013 +0930

    virtio/console: Quit from splice_write if pipe->nrbufs is 0
    
    commit 68c034fefe20eaf7d5569aae84584b07987ce50a upstream.
    
    Quit from splice_write if pipe->nrbufs is 0 for avoiding oops in virtio-serial.
    
    When an application was doing splice from a kernel buffer to virtio-serial on
    a guest, the application received signal(SIGINT). This situation will normally
    happen, but the kernel executed a kernel panic by oops as follows:
    
     BUG: unable to handle kernel paging request at ffff882071c8ef28
     IP: [<ffffffff812de48f>] sg_init_table+0x2f/0x50
     PGD 1fac067 PUD 0
     Oops: 0000 [#1] SMP
     Modules linked in: lockd sunrpc bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd microcode virtio_balloon virtio_net pcspkr soundcore i2c_piix4 i2c_core uinput floppy
     CPU: 1 PID: 908 Comm: trace-cmd Not tainted 3.10.0+ #49
     Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
     task: ffff880071c64650 ti: ffff88007bf24000 task.ti: ffff88007bf24000
     RIP: 0010:[<ffffffff812de48f>]  [<ffffffff812de48f>] sg_init_table+0x2f/0x50
     RSP: 0018:ffff88007bf25dd8  EFLAGS: 00010286
     RAX: 0000001fffffffe0 RBX: ffff882071c8ef28 RCX: 0000000000000000
     RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880071c8ef48
     RBP: ffff88007bf25de8 R08: ffff88007fd15d40 R09: ffff880071c8ef48
     R10: ffffea0001c71040 R11: ffffffff8139c555 R12: 0000000000000000
     R13: ffff88007506a3c0 R14: ffff88007c862500 R15: ffff880071c8ef00
     FS:  00007f0a3646c740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: ffff882071c8ef28 CR3: 000000007acbb000 CR4: 00000000000006e0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
     Stack:
      ffff880071c8ef48 ffff88007bf25e20 ffff88007bf25e88 ffffffff8139d6fa
      ffff88007bf25e28 ffffffff8127a3f4 0000000000000000 0000000000000000
      ffff880071c8ef48 0000100000000000 0000000000000003 ffff88007bf25e08
     Call Trace:
      [<ffffffff8139d6fa>] port_fops_splice_write+0xaa/0x130
      [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120
      [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0
      [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110
      [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0
      [<ffffffff8161f8c2>] system_call_fastpath+0x16/0x1b
     Code: c1 e2 05 48 89 e5 48 83 ec 10 4c 89 65 f8 41 89 f4 31 f6 48 89 5d f0 48 89 fb e8 8d ce ff ff 41 8d 44 24 ff 48 c1 e0 05 48 01 c3 <48> 8b 03 48 83 e0 fe 48 83 c8 02 48 89 03 48 8b 5d f0 4c 8b 65
     RIP  [<ffffffff812de48f>] sg_init_table+0x2f/0x50
      RSP <ffff88007bf25dd8>
     CR2: ffff882071c8ef28
     ---[ end trace 86323505eb42ea8f ]---
    
    It seems to induce pagefault in sg_init_tabel() when pipe->nrbufs is equal to
    zero. This may happen in a following situation:
    
    (1) The application normally does splice(read) from a kernel buffer, then does
        splice(write) to virtio-serial.
    (2) The application receives SIGINT when is doing splice(read), so splice(read)
        is failed by EINTR. However, the application does not finish the operation.
    (3) The application tries to do splice(write) without pipe->nrbufs.
    (4) The virtio-console driver tries to touch scatterlist structure sgl in
        sg_init_table(), but the region is out of bound.
    
    To avoid the case, a kernel should check whether pipe->nrbufs is empty or not
    when splice_write is executed in the virtio-console driver.
    
    V3: Add Reviewed-by lines and stable@ line in sign-off area.
    
    Signed-off-by: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
    Reviewed-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Amit Shah <amit.shah@redhat.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4662ffcbe30f95deeae95a7009faa54e1209b466
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Aug 5 16:04:47 2013 -0400

    SUNRPC: If the rpcbind channel is disconnected, fail the call to unregister
    
    commit 786615bc1ce84150ded80daea6bd9f6297f48e73 upstream.
    
    If rpcbind causes our connection to the AF_LOCAL socket to close after
    we've registered a service, then we want to be careful about reconnecting
    since the mount namespace may have changed.
    
    By simply refusing to reconnect the AF_LOCAL socket in the case of
    unregister, we avoid the need to somehow save the mount namespace. While
    this may lead to some services not unregistering properly, it should
    be safe.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Nix <nix@esperi.org.uk>
    Cc: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 533a54ffb012864cccd6aad6917741624c666dc1
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Aug 5 14:10:43 2013 -0400

    SUNRPC: Don't auto-disconnect from the local rpcbind socket
    
    commit 00326ed6442c66021cd4b5e19e80f3e2027d5d42 upstream.
    
    There is no need for the kernel to time out the AF_LOCAL connection to
    the rpcbind socket, and doing so is problematic because when it is
    time to reconnect, our process may no longer be using the same mount
    namespace.
    
    Reported-by: Nix <nix@esperi.org.uk>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 870bfc6b47ecf64845dbf8e5d7a09877998e1b69
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Aug 5 12:06:12 2013 -0400

    LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs
    
    commit 9a1b6bf818e74bb7aabaecb59492b739f2f4d742 upstream.
    
    Firstly, nlmclnt_setlockargs can be called from a reclaimer thread, in
    which case we're in entirely the wrong namespace.
    
    Secondly, commit 8aac62706adaaf0fab02c4327761561c8bda9448 (move
    exit_task_namespaces() outside of exit_notify()) now means that
    exit_task_work() is called after exit_task_namespaces(), which
    triggers an Oops when we're freeing up the locks.
    
    Fix this by ensuring that we initialise the nlm_host's rpc_client at mount
    time, so that the cl_nodename field is initialised to the value of
    utsname()->nodename that the net namespace uses. Then replace the
    lockd callers of utsname()->nodename.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Toralf Förster <toralf.foerster@gmx.de>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Nix <nix@esperi.org.uk>
    Cc: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31a9bd79d76026a8c8cff63c6887483e2e766ee4
Author: Josef Bacik <jbacik@fusionio.com>
Date:   Mon Jul 22 12:54:30 2013 -0400

    Btrfs: release both paths before logging dir/changed extents
    
    commit f3b15ccdbb9a79781578249a63318805e55a6c34 upstream.
    
    The ceph guys tripped over this bug where we were still holding onto the
    original path that we used to copy the inode with when logging.  This is based
    on Chris's fix which was reported to fix the problem.  We need to drop the paths
    in two cases anyway so just move the drop up so that we don't have duplicate
    code.  Thanks,
    
    Signed-off-by: Josef Bacik <jbacik@fusionio.com>
    Signed-off-by: Chris Mason <chris.mason@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 34a24b3fe7ee2234682e3abcad906c8c9c6de9aa
Author: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Date:   Tue Aug 6 14:53:24 2013 +0300

    ALSA: 6fire: fix DMA issues with URB transfer_buffer usage
    
    commit ddb6b5a964371e8e52e696b2b258bda144c8bd3f upstream.
    
    Patch fixes 6fire not to use stack as URB transfer_buffer. URB buffers need to
    be DMA-able, which stack is not. Furthermore, transfer_buffer should not be
    allocated as part of larger device structure because DMA coherency issues and
    patch fixes this issue too.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
    Tested-by: Torsten Schenk <torsten.schenk@zoho.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f004da5326d74b43d90ebf06699674378d4f0bb3
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Thu Aug 8 11:24:55 2013 +0200

    ALSA: usb-audio: do not trust too-big wMaxPacketSize values
    
    commit 57e6dae1087bbaa6b33d3dd8a8e90b63888939a3 upstream.
    
    The driver used to assume that the streaming endpoint's wMaxPacketSize
    value would be an indication of how much data the endpoint expects or
    sends, and compute the number of packets per URB using this value.
    
    However, the Focusrite Scarlett 2i4 declares a value of 1024 bytes,
    while only about 88 or 44 bytes are be actually used.  This discrepancy
    would result in URBs with far too few packets, which would not work
    correctly on the EHCI driver.
    
    To get correct URBs, use wMaxPacketSize only as an upper limit on the
    packet size.
    
    Reported-by: James Stone <jamesmstone@gmail.com>
    Tested-by: James Stone <jamesmstone@gmail.com>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e88512e77c0a22fc860cfb1100920cb1ca3705d3
Author: Alexander Z Lam <azl@google.com>
Date:   Fri Aug 2 18:36:16 2013 -0700

    tracing: Fix reset of time stamps during trace_clock changes
    
    commit 9457158bbc0ee04ecef76862d73eecd8076e9c7b upstream.
    
    Fixed two issues with changing the timestamp clock with trace_clock:
    
     - The global buffer was reset on instance clock changes. Change this to pass
       the correct per-instance buffer
     - ftrace_now() is used to set buf->time_start in tracing_reset_online_cpus().
       This was incorrect because ftrace_now() used the global buffer's clock to
       return the current time. Change this to use buffer_ftrace_now() which
       returns the current time for the correct per-instance buffer.
    
    Also removed tracing_reset_current() because it is not used anywhere
    
    Link: http://lkml.kernel.org/r/1375493777-17261-2-git-send-email-azl@google.com
    
    Signed-off-by: Alexander Z Lam <azl@google.com>
    Cc: Vaibhav Nagarnaik <vnagarnaik@google.com>
    Cc: David Sharp <dhsharp@google.com>
    Cc: Alexander Z Lam <lambchop468@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2fd821ee4dd784a940d6840ebc85ecc8d7b80744
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Mon Jul 1 15:58:24 2013 -0400

    tracing: Use flag buffer_disabled for irqsoff tracer
    
    commit 10246fa35d4ffdfe472185d4cbf9c2dfd9a9f023 upstream.
    
    If the ring buffer is disabled and the irqsoff tracer records a trace it
    will clear out its buffer and lose the data it had previously recorded.
    
    Currently there's a callback when writing to the tracing_of file, but if
    tracing is disabled via the function tracer trigger, it will not inform
    the irqsoff tracer to stop recording.
    
    By using the "mirror" flag (buffer_disabled) in the trace_array, that keeps
    track of the status of the trace_array's buffer, it gives the irqsoff
    tracer a fast way to know if it should record a new trace or not.
    The flag may be a little behind the real state of the buffer, but it
    should not affect the trace too much. It's more important for the irqsoff
    tracer to be fast.
    
    Reported-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e25d45868ca209a7d13772ed313a99ea0f9194d6
Author: Alexander Z Lam <azl@google.com>
Date:   Fri Aug 2 18:36:15 2013 -0700

    tracing: Make TRACE_ITER_STOP_ON_FREE stop the correct buffer
    
    commit 711e124379e0f889e40e2f01d7f5d61936d3cd23 upstream.
    
    Releasing the free_buffer file in an instance causes the global buffer
    to be stopped when TRACE_ITER_STOP_ON_FREE is enabled. Operate on the
    correct buffer.
    
    Link: http://lkml.kernel.org/r/1375493777-17261-1-git-send-email-azl@google.com
    
    Signed-off-by: Alexander Z Lam <azl@google.com>
    Cc: Vaibhav Nagarnaik <vnagarnaik@google.com>
    Cc: David Sharp <dhsharp@google.com>
    Cc: Alexander Z Lam <lambchop468@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d7ddf0a8fa2cffded6b8785f16e0c08c66f5007
Author: Andrew Vagin <avagin@openvz.org>
Date:   Fri Aug 2 21:16:43 2013 +0400

    tracing: Fix fields of struct trace_iterator that are zeroed by mistake
    
    commit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.
    
    tracing_read_pipe zeros all fields bellow "seq". The declaration contains
    a comment about that, but it doesn't help.
    
    The first field is "snapshot", it's true when current open file is
    snapshot. Looks obvious, that it should not be zeroed.
    
    The second field is "started". It was converted from cpumask_t to
    cpumask_var_t (v2.6.28-4983-g4462344), in other words it was
    converted from cpumask to pointer on cpumask.
    
    Currently the reference on "started" memory is lost after the first read
    from tracing_read_pipe and a proper object will never be freed.
    
    The "started" is never dereferenced for trace_pipe, because trace_pipe
    can't have the TRACE_FILE_ANNOTATE options.
    
    Link: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org
    
    Signed-off-by: Andrew Vagin <avagin@openvz.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b97f921b94b1e70d5de999fd820ccf8504dc6528
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Tue Aug 6 02:26:22 2013 +0200

    ACPI / PM: Walk physical_node_list under physical_node_lock
    
    commit 623cf33cb055b1e81fa47e4fc16789b2c129e31e upstream.
    
    The list of physical devices corresponding to an ACPI device
    object is walked by acpi_system_wakeup_device_seq_show() and
    physical_device_enable_wakeup() without taking that object's
    physical_node_lock mutex.  Since each of those functions may be
    run at any time as a result of a user space action, the lack of
    appropriate locking in them may lead to a kernel crash if that
    happens during device hot-add or hot-remove involving the device
    object in question.
    
    Fix the issue by modifying acpi_system_wakeup_device_seq_show() and
    physical_device_enable_wakeup() to use physical_node_lock as
    appropriate.
    
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da712f3a8c493986b19fd0863b45607c34061ba6
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Mon Aug 5 12:28:02 2013 +0530

    cpufreq: rename ignore_nice as ignore_nice_load
    
    commit 6c4640c3adfd97ce10efed7c07405f52d002b9a8 upstream.
    
    This sysfs file was called ignore_nice_load earlier and commit
    4d5dcc4 (cpufreq: governor: Implement per policy instances of
    governors) changed its name to ignore_nice by mistake.
    
    Lets get it renamed back to its original name.
    
    Reported-by: Martin von Gagern <Martin.vGagern@gmx.net>
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b0be00599c98bb20e0396f41f47a593e1c9d4ea
Author: Aaro Koskinen <aaro.koskinen@iki.fi>
Date:   Mon Aug 5 21:27:12 2013 +0300

    cpufreq: loongson2: fix regression related to clock management
    
    commit f54fe64d14dff3df6d45a48115d248a82557811f upstream.
    
    Commit 42913c799 (MIPS: Loongson2: Use clk API instead of direct
    dereferences) broke the cpufreq functionality on Loongson2 boards:
    clk_set_rate() is called before the CPU frequency table is
    initialized, and therefore will always fail.
    
    Fix by moving the clk_set_rate() after the table initialization.
    Tested on Lemote FuLoong mini-PC.
    
    Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 060a7c36d7ba82d7f520d7f328db5d38e99c20a4
Author: Fabio Estevam <fabio.estevam@freescale.com>
Date:   Mon Jul 1 18:14:21 2013 -0300

    i2c: i2c-mxs: Use DMA mode even for small transfers
    
    commit d6e102f498cbcc8dd2e36721a01213f036397112 upstream.
    
    Recently we have been seing some reports about PIO mode not working properly.
    
    - http://www.spinics.net/lists/linux-i2c/msg11985.html
    - http://marc.info/?l=linux-i2c&m=137235593101385&w=2
    - https://lkml.org/lkml/2013/6/24/430
    
    Let's use DMA mode even for small transfers.
    
    Without this patch, i2c reads the incorrect sgtl5000 version on a mx28evk when
    touchscreen is enabled:
    
    [    5.856270] sgtl5000 0-000a: Device with ID register 0 is not a sgtl5000
    [    9.877307] sgtl5000 0-000a: ASoC: failed to probe CODEC -19
    [    9.883528] mxs-sgtl5000 sound.12: ASoC: failed to instantiate card -19
    [    9.892955] mxs-sgtl5000 sound.12: snd_soc_register_card failed (-19)
    
    [wsa: we have a proper solution for -next, so this non intrusive
    solution is OK for now]
    
    Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
    Acked-by: Shawn Guo <shawn.guo@linaro.org>
    Acked-by: Lucas Stach <l.stach@pengutronix.de>
    Acked-by: Marek Vasut <marex@denx.de>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 630d2243751d762ea9e1baabecd6536e9db8d0be
Author: Alban Browaeys <alban.browaeys@gmail.com>
Date:   Tue Jul 16 18:57:53 2013 -0300

    media: em28xx: fix assignment of the eeprom data
    
    commit f813b5775b471b656382ae8f087bb34dc894261f upstream.
    
    Set the config structure pointer to the eeprom data pointer (data,
    here eedata dereferenced) not the pointer to the pointer to
    the eeprom data (eedata itself).
    
    Signed-off-by: Alban Browaeys <prahal@yahoo.com>
    Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65967f15aa05ea23cd4fcd58db6ef4ef690982af
Author: Piotr Sarna <p.sarna@partner.samsung.com>
Date:   Mon Jul 29 12:25:20 2013 +0200

    staging: zcache: fix "zcache=" kernel parameter
    
    commit 02073798a6b081bf74e6c10d6f7e7a693c067ecd upstream.
    
    Commit 835f2f5 ("staging: zcache: enable zcache to be built/loaded as
    a module") introduced an incorrect handling of "zcache=" parameter.
    
    Inside zcache_comp_init() function, zcache_comp_name variable is
    checked for being empty. If not empty, the above variable is tested
    for being compatible with Crypto API. Unfortunately, after that
    function ends unconditionally (by the "goto out" directive) and returns:
    - non-zero value if verification succeeded, wrongly indicating an error
    - zero value if verification failed, falsely informing that function
      zcache_comp_init() ended properly.
    
    A solution to this problem is as following:
    1. Move the "goto out" directive inside the "if (!ret)" statement
    2. In case that crypto_has_comp() returned 0, change the value of ret
       to non-zero before "goto out" to indicate an error.
    
    This patch replaces an earlier one from Michal Hocko (based on report
    from Cristian Rodriguez):
    
    	http://permalink.gmane.org/gmane.linux.kernel.mm/102484
    
    It also addressed the same issue but didn't fix the zcache_comp_init()
    for case when the compressor data passed to "zcache=" option was invalid
    or unsupported.
    
    Signed-off-by: Piotr Sarna <p.sarna@partner.samsung.com>
    [bzolnier: updated patch description]
    Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Michal Hocko <mhocko@suse.cz>
    Cc: Cristian Rodriguez <crrodriguez@opensuse.org>
    Cc: Bob Liu <bob.liu@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 334428c3b3ad6e9007e370dc59dc1889abaa2222
Author: Curt Brune <curt@cumulusnetworks.com>
Date:   Thu Aug 8 12:11:03 2013 -0700

    hwmon: (adt7470) Fix incorrect return code check
    
    commit 93d783bcca69bfacc8dc739d8a050498402587b5 upstream.
    
    In adt7470_write_word_data(), which writes two bytes using
    i2c_smbus_write_byte_data(), the return codes are incorrectly AND-ed
    together when they should be OR-ed together.
    
    The return code of i2c_smbus_write_byte_data() is zero for success.
    
    The upshot is only the first byte was ever written to the hardware.
    The 2nd byte was never written out.
    
    I noticed that trying to set the fan speed limits was not working
    correctly on my system.  Setting the fan speed limits is the only
    code that uses adt7470_write_word_data().  After making the change
    the limit settings work and the alarms work also.
    
    Signed-off-by: Curt Brune <curt@cumulusnetworks.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9300766810ffff36c2db8efc2fe7c7a6c0469129
Author: Mateusz Krawczuk <m.krawczuk@partner.samsung.com>
Date:   Tue Aug 6 18:34:40 2013 +0200

    regmap: Add missing header for !CONFIG_REGMAP stubs
    
    commit 49ccc142f9cbc33fdda18e8fa90c1c5b4a79c0ad upstream.
    
    regmap.h requires linux/err.h if CONFIG_REGMAP is not defined. Without it I get
    error.
    CC      drivers/media/platform/exynos4-is/fimc-reg.o
    In file included from drivers/media/platform/exynos4-is/fimc-reg.c:14:0:
    include/linux/regmap.h: In function ‘regmap_write’:
    include/linux/regmap.h:525:10: error: ‘EINVAL’ undeclared (first use in this function)
    include/linux/regmap.h:525:10: note: each undeclared identifier is reported only once for each function it appears in
    
    Signed-off-by: Mateusz Krawczuk <m.krawczuk@partner.samsung.com>
    Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 83b83227df02fbabf583c902fc6d55ebab47139a
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Mon Aug 5 11:21:29 2013 +0200

    regmap: cache: Make sure to sync the last register in a block
    
    commit 2d49b5987561e480bdbd8692b27fc5f49a1e2f0b upstream.
    
    regcache_sync_block_raw_flush() expects the address of the register after last
    register that needs to be synced as its parameter. But the last call to
    regcache_sync_block_raw_flush() in regcache_sync_block_raw() passes the address
    of the last register in the block. This effectively always skips over the last
    register in a block, even if it needs to be synced. In order to fix it increase
    the address by one register.
    
    The issue was introduced in commit 75a5f89 ("regmap: cache: Write consecutive
    registers in a single block write").
    
    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7039e94cecff031efbdc8ccf7e316c1c6130971
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Mon Jul 29 12:12:56 2013 -0400

    ext4: fix retry handling in ext4_ext_truncate()
    
    commit 94eec0fc3520c759831763d866421b4d60b599b4 upstream.
    
    We tested for ENOMEM instead of -ENOMEM.   Oops.
    
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc953e8985b02cf8952eca4214604f6bd20f1d86
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Fri Jul 26 15:15:46 2013 -0400

    ext4: make sure group number is bumped after a inode allocation race
    
    commit a34eb503742fd25155fd6cff6163daacead9fbc3 upstream.
    
    When we try to allocate an inode, and there is a race between two
    CPU's trying to grab the same inode, _and_ this inode is the last free
    inode in the block group, make sure the group number is bumped before
    we continue searching the rest of the block groups.  Otherwise, we end
    up searching the current block group twice, and we end up skipping
    searching the last block group.  So in the unlikely situation where
    almost all of the inodes are allocated, it's possible that we will
    return ENOSPC even though there might be free inodes in that last
    block group.
    
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9aff080cc65e4eb6af8909d2efc1dc0b72fbbc9c
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Fri Jul 26 15:21:11 2013 -0400

    ext4: destroy ext4_es_cachep on module unload
    
    commit dd12ed144e9797094c04736f97aa27d5fe401476 upstream.
    
    Without this, module can't be reloaded.
    
    [  500.521980] kmem_cache_sanity_check (ext4_extent_status): Cache name already exists.
    
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab9530578e03d7fc00f41f4c406d213d81579de0
Author: Michael Neuling <mikey@neuling.org>
Date:   Fri Aug 9 17:29:31 2013 +1000

    powerpc/tm: Fix context switching TAR, PPR and DSCR SPRs
    
    commit 28e61cc466d8daace4b0f04ba2b83e0bd68f5832 upstream.
    
    If a transaction is rolled back, the Target Address Register (TAR), Processor
    Priority Register (PPR) and Data Stream Control Register (DSCR) should be
    restored to the checkpointed values before the transaction began.  Any changes
    to these SPRs inside the transaction should not be visible in the abort
    handler.
    
    Currently Linux doesn't save or restore the checkpointed TAR, PPR or DSCR.  If
    we preempt a processes inside a transaction which has modified any of these, on
    process restore, that same transaction may be aborted we but we won't see the
    checkpointed versions of these SPRs.
    
    This adds checkpointed versions of these SPRs to the thread_struct and adds the
    save/restore of these three SPRs to the treclaim/trechkpt code.
    
    Without this if any of these SPRs are modified during a transaction, users may
    incorrectly see a speculated SPR value even if the transaction is aborted.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80737512591c7b56b6e66e17d0b373218b1428b0
Author: Michael Neuling <mikey@neuling.org>
Date:   Fri Aug 9 17:29:30 2013 +1000

    powerpc: Save the TAR register earlier
    
    commit c2d52644e2da8a07ecab5ca62dd0bc563089e8dc upstream.
    
    This moves us to save the Target Address Register (TAR) a earlier in
    __switch_to.  It introduces a new function save_tar() to do this.
    
    We need to save the TAR earlier as we will overwrite it in the transactional
    memory reclaim/recheckpoint path.  We are going to do this in a subsequent
    patch which will fix saving the TAR register when it's modified inside a
    transaction.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 734ce4ea808b69a9896677fd1ebdf272a29665d9
Author: Michael Neuling <mikey@neuling.org>
Date:   Fri Aug 9 17:29:29 2013 +1000

    powerpc: Fix context switch DSCR on POWER8
    
    commit 2517617e0de65f8f7cfe75cae745d06b1fa98586 upstream.
    
    POWER8 allows the DSCR to be accessed directly from userspace via a new SPR
    number 0x3 (Rather than 0x11.  DSCR SPR number 0x11 is still used on POWER8 but
    like POWER7, is only accessible in HV and OS modes).  Currently, we allow this
    by setting H/FSCR DSCR bit on boot.
    
    Unfortunately this doesn't work, as the kernel needs to see the DSCR change so
    that it knows to no longer restore the system wide version of DSCR on context
    switch (ie. to set thread.dscr_inherit).
    
    This clears the H/FSCR DSCR bit initially.  If a process then accesses the DSCR
    (via SPR 0x3), it'll trap into the kernel where we set thread.dscr_inherit in
    facility_unavailable_exception().
    
    We also change _switch() so that we set or clear the H/FSCR DSCR bit based on
    the thread.dscr_inherit.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f60232beaf08ab9567fb40b55379acba0c649aed
Author: Michael Neuling <mikey@neuling.org>
Date:   Fri Aug 9 17:29:28 2013 +1000

    powerpc: Rework setting up H/FSCR bit definitions
    
    commit 74e400cee6c0266ba2d940ed78d981f1e24a8167 upstream.
    
    This reworks the Facility Status and Control Regsiter (FSCR) config bit
    definitions so that we can access the bit numbers.  This is needed for a
    subsequent patch to fix the userspace DSCR handling.
    
    HFSCR and FSCR bit definitions are the same, so reuse them.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7ab7de87432c7d6544b8c1b45ba6520f4115539f
Author: Michael Neuling <mikey@neuling.org>
Date:   Fri Aug 9 17:29:27 2013 +1000

    powerpc: Fix hypervisor facility unavaliable vector number
    
    commit 88f094120bd2f012ff494ae50a8d4e0d8af8f69e upstream.
    
    Currently if we take hypervisor facility unavaliable (from 0xf80/0x4f80) we
    mark it as an OS facility unavaliable (0xf60) as the two share the same code
    path.
    
    The becomes a problem in facility_unavailable_exception() as we aren't able to
    see the hypervisor facility unavailable exceptions.
    
    Below fixes this by duplication the required macros.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70aabee48d28ead09817660d35d9f53a13b99eda
Author: Anton Blanchard <anton@samba.org>
Date:   Wed Jul 31 16:31:26 2013 +1000

    powerpc: On POWERNV enable PPC_DENORMALISATION by default
    
    commit 4e90a2a7375e86827541bda9393414c03e7721c6 upstream.
    
    We want PPC_DENORMALISATION enabled when POWERNV is enabled,
    so update the Kconfig.
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Acked-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96e9cd3d0609e76839ae25efe1ea8b75ca81e588
Author: Asias He <asias@redhat.com>
Date:   Thu Aug 1 11:07:18 2013 +0930

    virtio-scsi: Fix virtqueue affinity setup
    
    commit aa52aeea2725839bdd3dcce394486e9a043065e0 upstream.
    
    vscsi->num_queues counts the number of request virtqueue which does not
    include the control and event virtqueue. It is wrong to subtract
    VIRTIO_SCSI_VQ_BASE from vscsi->num_queues.
    
    This patch fixes the following panic.
    
    (qemu) device_del scsi0
    
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
     IP: [<ffffffff8179b29f>] __virtscsi_set_affinity+0x6f/0x120
     PGD 0
     Oops: 0000 [#1] SMP
     Modules linked in:
     CPU: 0 PID: 659 Comm: kworker/0:1 Not tainted 3.11.0-rc2+ #1172
     Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
     Workqueue: kacpi_hotplug _handle_hotplug_event_func
     task: ffff88007bee1cc0 ti: ffff88007bfe4000 task.ti: ffff88007bfe4000
     RIP: 0010:[<ffffffff8179b29f>]  [<ffffffff8179b29f>] __virtscsi_set_affinity+0x6f/0x120
     RSP: 0018:ffff88007bfe5a38  EFLAGS: 00010202
     RAX: 0000000000000010 RBX: ffff880077fd0d28 RCX: 0000000000000050
     RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000000
     RBP: ffff88007bfe5a58 R08: ffff880077f6ff00 R09: 0000000000000001
     R10: ffffffff8143e673 R11: 0000000000000001 R12: 0000000000000001
     R13: ffff880077fd0800 R14: 0000000000000000 R15: ffff88007bf489b0
     FS:  0000000000000000(0000) GS:ffff88007ea00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
     CR2: 0000000000000020 CR3: 0000000079f8b000 CR4: 00000000000006f0
     Stack:
      ffff880077fd0d28 0000000000000000 ffff880077fd0800 0000000000000008
      ffff88007bfe5a78 ffffffff8179b37d ffff88007bccc800 ffff88007bccc800
      ffff88007bfe5a98 ffffffff8179b3b6 ffff88007bccc800 ffff880077fd0d28
     Call Trace:
      [<ffffffff8179b37d>] virtscsi_set_affinity+0x2d/0x40
      [<ffffffff8179b3b6>] virtscsi_remove_vqs+0x26/0x50
      [<ffffffff8179c7d2>] virtscsi_remove+0x82/0xa0
      [<ffffffff814cb6b2>] virtio_dev_remove+0x22/0x70
      [<ffffffff8167ca49>] __device_release_driver+0x69/0xd0
      [<ffffffff8167cb9d>] device_release_driver+0x2d/0x40
      [<ffffffff8167bb96>] bus_remove_device+0x116/0x150
      [<ffffffff81679936>] device_del+0x126/0x1e0
      [<ffffffff81679a06>] device_unregister+0x16/0x30
      [<ffffffff814cb889>] unregister_virtio_device+0x19/0x30
      [<ffffffff814cdad6>] virtio_pci_remove+0x36/0x80
      [<ffffffff81464ae7>] pci_device_remove+0x37/0x70
      [<ffffffff8167ca49>] __device_release_driver+0x69/0xd0
      [<ffffffff8167cb9d>] device_release_driver+0x2d/0x40
      [<ffffffff8167bb96>] bus_remove_device+0x116/0x150
      [<ffffffff81679936>] device_del+0x126/0x1e0
      [<ffffffff8145edfc>] pci_stop_bus_device+0x9c/0xb0
      [<ffffffff8145f036>] pci_stop_and_remove_bus_device+0x16/0x30
      [<ffffffff81474a9e>] acpiphp_disable_slot+0x8e/0x150
      [<ffffffff81474f6a>] hotplug_event_func+0xba/0x1a0
      [<ffffffff814906c8>] ? acpi_os_release_object+0xe/0x12
      [<ffffffff81475911>] _handle_hotplug_event_func+0x31/0x70
      [<ffffffff810b5333>] process_one_work+0x183/0x500
      [<ffffffff810b66e2>] worker_thread+0x122/0x400
      [<ffffffff810b65c0>] ? manage_workers+0x2d0/0x2d0
      [<ffffffff810bc5de>] kthread+0xce/0xe0
      [<ffffffff810bc510>] ? kthread_freezable_should_stop+0x70/0x70
      [<ffffffff81ca045c>] ret_from_fork+0x7c/0xb0
      [<ffffffff810bc510>] ? kthread_freezable_should_stop+0x70/0x70
     Code: 01 00 00 00 74 59 45 31 e4 83 bb c8 01 00 00 02 74 46 66 2e 0f 1f 84 00 00 00 00 00 49 63 c4 48 c1 e0 04 48 8b bc 0
    3 10 02 00 00 <48> 8b 47 20 48 8b 80 d0 01 00 00 48 8b 40 50 48 85 c0 74 07 be
     RIP  [<ffffffff8179b29f>] __virtscsi_set_affinity+0x6f/0x120
      RSP <ffff88007bfe5a38>
     CR2: 0000000000000020
     ---[ end trace 99679331a3775f48 ]---
    
    Signed-off-by: Asias He <asias@redhat.com>
    Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e842dbeb5777ce9494ed838a4ba0c9af9fa7bd9e
Author: Sumit.Saxena@lsi.com <Sumit.Saxena@lsi.com>
Date:   Tue Jul 16 02:26:05 2013 +0530

    SCSI: megaraid_sas: megaraid_sas driver init fails in kdump kernel
    
    commit 6431f5d7c6025f8b007af06ea090de308f7e6881 upstream.
    
    Problem: When Hardware IOMMU is on, megaraid_sas driver initialization fails
    in kdump kernel with LSI MegaRAID controller(device id-0x73).
    
    Actually this issue needs fix in firmware, but for firmware running in field,
    this driver fix is proposed to resolve the issue.  At firmware initialization
    time, if firmware does not come to ready state, driver will reset the adapter
    and retry for firmware transition to ready state unconditionally(not only
    executed for kdump kernel).
    
    Signed-off-by: Sumit Saxena <sumit.saxena@lsi.com>
    Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ac10bd036f0f3b8ce7ac2390446eab9531c72eb
Author: Martin K. Petersen <martin.petersen@oracle.com>
Date:   Tue Jul 30 22:58:34 2013 -0400

    SCSI: Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
    
    commit 7562523e84ddc742fe1f9db8bd76b01acca89f6b upstream.
    
    If a device has the skip_vpd_pages flag set we should simply fail the
    scsi_get_vpd_page() call.
    
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Stuart Foster <smf.linux@ntlworld.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>