commit 05bcf8f867f4af11c93395d4a6dd1dd52d8904ea
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Dec 11 22:36:44 2013 -0800

    Linux 3.10.24

commit 9096e7d4889516c0bccb9b89b0c72cc5c127989a
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Thu Dec 5 13:09:53 2013 -0600

    crypto: scatterwalk - Use sg_chain_ptr on chain entries
    
    commit 389a5390583a18e45bc4abd4439291abec5e7a63 upstream.
    
    Now that scatterwalk_sg_chain sets the chain pointer bit the sg_page
    call in scatterwalk_sg_next hits a BUG_ON when CONFIG_DEBUG_SG is
    enabled. Use sg_chain_ptr instead of sg_page on a chain entry.
    
    Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a983e1d30993f57ea201063479e5ededf2de935b
Author: Arnaud Ebalard <arno@natisbad.org>
Date:   Tue Nov 5 21:45:48 2013 +0100

    ARM: mvebu: second PCIe unit of Armada XP mv78230 is only x1 capable
    
    commit 12b69a599745fc9e203f61fbb7160b2cc5f479dd upstream.
    
    Various Marvell datasheets advertise second PCIe unit of mv78230
    flavour of Armada XP as x4/quad x1 capable. This second unit is in
    fact only x1 capable. This patch fixes current mv78230 .dtsi to
    reflect that, i.e. makes 1.0 the second interface (instead of 2.0
    at the moment). This was successfully tested on a mv78230-based
    ReadyNAS 2120 platform with a x1 device (FL1009 XHCI controller)
    connected to this second interface.
    
    Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
    Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5f196ca90a717c0c40c33c4ca815c6c606d19c2
Author: Arnaud Ebalard <arno@natisbad.org>
Date:   Tue Nov 5 21:46:02 2013 +0100

    ARM: mvebu: fix second and third PCIe unit of Armada XP mv78260
    
    commit 2163e61c92d9337e721a0d067d88ae62b52e0d3e upstream.
    
    mv78260 flavour of Marvell Armada XP SoC has 3 PCIe units. The
    two first units are both x4 and quad x1 capable. The third unit
    is only x4 capable. This patch fixes mv78260 .dtsi to reflect
    those capabilities.
    
    Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
    Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c899b3f0e266c1c67a70819fc587ab8155010ea7
Author: Alan Cox <alan@linux.intel.com>
Date:   Tue Dec 3 13:56:56 2013 -0800

    drivers/char/i8k.c: add Dell XPLS L421X
    
    commit 9aa5b0181bdf335f0b731d8502e128a862884bcd upstream.
    
    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=60772
    
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Reported-by: Leho Kraav <leho@kraav.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 522a78bedb1f3ad65fbaf185a255abb253232f65
Author: David Cluytens <david.cluytens@gmail.com>
Date:   Tue Dec 3 14:18:57 2013 +0100

    USB: cdc-acm: Added support for the Lenovo RD02-D400 USB Modem
    
    commit 3b59d16c513da258ec8f6a0b4db85f257a0380d6 upstream.
    
    Signed-off-by: David Cluytens <david.cluytens@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7724c31ae18abbd6e29ad70b88af017abb2af883
Author: Colin Leitner <colin.leitner@googlemail.com>
Date:   Fri Nov 8 22:53:11 2013 +0100

    USB: spcp8x5: correct handling of CS5 setting
    
    commit 711fbdfbf2bc4827214a650afe3f64767a1aba16 upstream.
    
    This patch removes an erroneous check of CSIZE, which made it impossible to set
    CS5.
    
    Compiles clean, but couldn't test against hardware.
    
    Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d410cf277e7aa0168a2b88d8a49f75fe85809e68
Author: Colin Leitner <colin.leitner@googlemail.com>
Date:   Fri Nov 8 22:52:34 2013 +0100

    USB: mos7840: correct handling of CS5 setting
    
    commit 78692cc3382e0603a47e1f2aaeffe0d99891994d upstream.
    
    This patch removes an erroneous check of CSIZE, which made it impossible to set
    CS5.
    
    Compiles clean, but couldn't test against hardware.
    
    Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 536169b1c9a29a1931e07ec1115781be733e1a4c
Author: Colin Leitner <colin.leitner@googlemail.com>
Date:   Tue Nov 5 18:02:34 2013 +0100

    USB: ftdi_sio: fixed handling of unsupported CSIZE setting
    
    commit 8704211f65a2106ba01b6ac9727cdaf9ca11594c upstream.
    
    FTDI UARTs support only 7 or 8 data bits. Until now the ftdi_sio driver would
    only report this limitation for CS6 to dmesg and fail to reflect this fact to
    tcgetattr.
    
    This patch reverts the unsupported CSIZE setting and reports the fact with less
    severance to dmesg for both CS5 and CS6.
    
    To test the patch it's sufficient to call
    
        stty -F /dev/ttyUSB0 cs5
    
    which will succeed without the patch and report an error with the patch
    applied.
    
    As an additional fix this patch ensures that the control request will always
    include a data bit size.
    
    Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98e0cc7766b1f11856e3975f82184f513051c4f5
Author: Colin Leitner <colin.leitner@googlemail.com>
Date:   Mon Nov 4 19:40:43 2013 +0100

    USB: pl2303: fixed handling of CS5 setting
    
    commit a313249937820f8b1996133fc285efbd6aad2c5b upstream.
    
    This patch fixes the CS5 setting on the PL2303 USB-to-serial devices. CS5 has a
    value of 0 and the CSIZE setting has been skipped altogether by the enclosing
    if. Tested on 3.11.6 and the scope shows the correct output after the fix has
    been applied.
    
    Tagged to be added to stable, because it fixes a user visible driver bug and is
    simple enough to backport easily.
    
    Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8532c80b3ec3acf3cc22df033464980bae20b380
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Thu Dec 5 09:34:44 2013 +0200

    mei: add 9 series PCH mei device ids
    
    commit 76a9635979e543f04a5885198e68ff28e3311b67 upstream.
    
    And Lynx Point H Refresh and Wildcat Point LP
    device ids.
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e35ea1b11ca399be7631410fabb65228502fcb5e
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Wed Oct 16 12:09:43 2013 +0300

    mei: me: add Lynx Point Wellsburg work station device id
    
    commit 838b3a6d62413b336f3dde15ecff161070358957 upstream.
    
    add missing device id for LPT based work station
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e9295a956ba01ab0cab6a7e9f6eca73da23373a8
Author: Tom Gundersen <teg@jklm.no>
Date:   Thu Oct 31 00:44:49 2013 -0700

    Input: mousedev - allow disabling even without CONFIG_EXPERT
    
    commit dfaaed08ecc01bd513248ba7999daf50ce028352 upstream.
    
    Moust (if not all) modern software, including X, uses /dev/eventX rather than
    the legacy /dev/mouseX devices. It therefore makes sense for general-purpose
    (distro) kernels to use MOUSEDV=m (or even n), so let's drop the EXPERT=y
    requirement.
    
    Signed-off-by: Tom Gundersen <teg@jklm.no>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4cdd9497f6ece54905d1df1d793b136c79123b09
Author: Tom Gundersen <teg@jklm.no>
Date:   Thu Oct 31 00:38:30 2013 -0700

    Input: allow deselecting serio drivers even without CONFIG_EXPERT
    
    commit bcd2623073e98f69f84720308db0b142c4da0bd6 upstream.
    
    There is plenty of consumer hardware (e.g., mac books) that does not use AT
    keyboards or PS/2 mice. It therefore makes sense for distro kernels to
    build the related drivers as modules to avoid loading them on hardware that
    does not need them. As such, these options should no longer be protected by
    EXPERT.
    
    Moreover, building these drivers as modules gets rid of the following ugly
    error during boot:
    
    [    2.337745] i8042: PNP: No PS/2 controller found. Probing ports directly.
    [    3.439537] i8042: No controller found
    
    Signed-off-by: Tom Gundersen <teg@jklm.no>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e8cb3339b9e52c4d8dcaca913412ebab5dae271
Author: Joonyoung Shim <jy0922.shim@samsung.com>
Date:   Wed Sep 11 14:21:43 2013 -0700

    lib/genalloc.c: fix overflow of ending address of memory chunk
    
    commit 674470d97958a0ec72f72caf7f6451da40159cc7 upstream.
    
    In struct gen_pool_chunk, end_addr means the end address of memory chunk
    (inclusive), but in the implementation it is treated as address + size of
    memory chunk (exclusive), so it points to the address plus one instead of
    correct ending address.
    
    The ending address of memory chunk plus one will cause overflow on the
    memory chunk including the last address of memory map, e.g.  when starting
    address is 0xFFF00000 and size is 0x100000 on 32bit machine, ending
    address will be 0x100000000.
    
    Use correct ending address like starting address + size - 1.
    
    [akpm@linux-foundation.org: add comment to struct gen_pool_chunk:end_addr]
    Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a879b58d2f464a4a18087b48f7fbb8e23350cb49
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Wed Oct 2 17:35:27 2013 +0800

    HID: usbhid: quirk for SiS Touchscreen
    
    commit 684524d35fe8d13be1f2649633e43bd02c96c695 upstream.
    
    BugLink: http://bugs.launchpad.net/bugs/1180881
    
    This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS,
    otherwise it causes 10 seconds timeout during report initialization.
    
    [12431.828467] hid-multitouch 0003:0457:1013.0475: usb_submit_urb(ctrl) failed: -1
    [12431.828507] hid-multitouch 0003:0457:1013.0475: timeout initializing reports
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5fbe70c826f8ef985932328c28fc044ab790ee7
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Wed Oct 2 17:35:26 2013 +0800

    HID: usbhid: quirk for Synaptics Large Touchccreen
    
    commit 8171a67d587a09e14a4949a81e070345fedcf410 upstream.
    
    BugLink: http://bugs.launchpad.net/bugs/1180881
    
    Synaptics large touchscreen doesn't support some of the report request
    while initializing. The unspoorted request will make the device unreachable,
    and will lead to the following usb_submit_urb() function call timeout.
    So, add the IDs into HID_QUIRK_NO_INIT_REPORTS quirk.
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c02a5a2672bf6c70be5282316eaad28052fa1dd
Author: Ivan Vecera <ivecera@redhat.com>
Date:   Wed Nov 6 14:02:36 2013 +0100

    tg3: avoid double-freeing of rx data memory
    
    commit 85aec73d595b8847f9c4ea571deb127913f0d508 upstream.
    
    If build_skb fails the memory associated with the ring buffer is freed but
    the ri->data member is not zeroed in this case. This causes a double-free
    of this memory in tg3_free_rings->... path. The patch moves this block after
    setting ri->data to NULL.
    It would be nice to fix this bug also in stable >= v3.4 trees.
    
    Cc: Nithin Nayak Sujir <nsujir@broadcom.com>
    Cc: Michael Chan <mchan@broadcom.com>
    Signed-off-by: Ivan Vecera <ivecera@redhat.com>
    Acked-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61fca0fb44c77aadf31f89ff532d1012910264b6
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Tue Oct 15 22:04:54 2013 +0300

    iwlwifi: dvm: don't override mac80211's queue setting
    
    commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream.
    
    Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
    mac80211 do the queue assignement and don't need to
    override its decisions.
    While reassiging the same values is harmless of course,
    it triggered  a WARNING when iwlwifi and mac80211 came
    to different conclusions. This happened when mac80211 set
    IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
    packet to the cab_queue because no stations were asleep.
    
    iwlwifi should not override mac80211's decicions for
    offchannel packets and packets to  be sent after DTIM,
    but it should override mac80211's decision for AMPDUs
    since we have a special queue for them. So for AMPDU,
    we still override info->hw_queue by the AMPDU queue.
    
    This avoids:
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
    Modules linked in:
    CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
    Hardware name:                  /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
     0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
     ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
     ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
    Call Trace:
     [<ffffffff8189aa62>] ? dump_stack+0x41/0x51
     [<ffffffff8105a4f2>] ? warn_slowpath_common+0x78/0x90
     [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
     [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
     [<ffffffff818a0040>] ? put_cred+0x15/0x15
     [<ffffffff815f6db4>] ? iwlagn_mac_tx+0x19/0x2f
     [<ffffffff8186cc45>] ? __ieee80211_tx+0x226/0x29b
     [<ffffffff8186e6bd>] ? ieee80211_tx+0xa6/0xb5
     [<ffffffff8186e98b>] ? ieee80211_monitor_start_xmit+0x1e9/0x204
     [<ffffffff8171ce5f>] ? dev_hard_start_xmit+0x271/0x3ec
     [<ffffffff817351ac>] ? sch_direct_xmit+0x66/0x164
     [<ffffffff8171d1bf>] ? dev_queue_xmit+0x1e5/0x3c8
     [<ffffffff817fac5a>] ? packet_sendmsg+0xac5/0xb3d
     [<ffffffff81709a09>] ? sock_sendmsg+0x37/0x52
     [<ffffffff810f9e0c>] ? __do_fault+0x338/0x36b
     [<ffffffff81713820>] ? verify_iovec+0x44/0x94
     [<ffffffff81709e63>] ? ___sys_sendmsg+0x1f1/0x283
     [<ffffffff81140a73>] ? __inode_wait_for_writeback+0x67/0xae
     [<ffffffff8111735e>] ? __cache_free.isra.46+0x178/0x187
     [<ffffffff811173b1>] ? kmem_cache_free+0x44/0x84
     [<ffffffff81132c22>] ? dentry_kill+0x13d/0x149
     [<ffffffff81132f6f>] ? dput+0xe5/0xef
     [<ffffffff81136e04>] ? fget_light+0x2e/0x7c
     [<ffffffff8170ae62>] ? __sys_sendmsg+0x39/0x57
     [<ffffffff818a7e39>] ? system_call_fastpath+0x16/0x1b
    ---[ end trace 1b3eb79359c1d1e6 ]---
    
    Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8562d028775e7c88fc7fa8c5deaa791392892778
Author: Martin K. Petersen <martin.petersen@oracle.com>
Date:   Wed Oct 23 06:25:40 2013 -0400

    SCSI: Disable WRITE SAME for RAID and virtual host adapter drivers
    
    commit 54b2b50c20a61b51199bedb6e5d2f8ec2568fb43 upstream.
    
    Some host adapters do not pass commands through to the target disk
    directly. Instead they provide an emulated target which may or may not
    accurately report its capabilities. In some cases the physical device
    characteristics are reported even when the host adapter is processing
    commands on the device's behalf. This can lead to adapter firmware hangs
    or excessive I/O errors.
    
    This patch disables WRITE SAME for devices connected to host adapters
    that provide an emulated target. Driver writers can disable WRITE SAME
    by setting the no_write_same flag in the host adapter template.
    
    [jejb: fix up rejections due to eh_deadline patch]
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e43e33a63d72c6bd30f9fa14a9e82ffb58be422
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Wed Nov 20 13:31:49 2013 -0800

    x86-64, build: Always pass in -mno-sse
    
    commit 5551a34e5aeab868f8d37f70d8754868921b4ee5 upstream.
    
    Always pass in the -mno-sse argument, regardless if
    -preferred-stack-boundary is supported.  We never want to generate SSE
    instructions in the kernel unless we *really* know what we're doing.
    
    According to H. J. Lu, any version of gcc new enough that we support
    it at all should handle the -mno-sse option, so just add it
    unconditionally.
    
    Reported-by: Kevin B. Smith <kevin.b.smith@intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: H. J. Lu <hjl.tools@gmail.com>
    Link: http://lkml.kernel.org/n/tip-j21wzqv790q834n7yc6g80j1@git.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb050d976ccdff8c5499a826c19a818868824393
Author: Shawn Landden <shawn@churchofgit.com>
Date:   Sun Nov 24 22:36:28 2013 -0800

    net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST
    
    commit d3f7d56a7a4671d395e8af87071068a195257bf6 upstream.
    
    Commit 35f9c09fe (tcp: tcp_sendpages() should call tcp_push() once)
    added an internal flag MSG_SENDPAGE_NOTLAST, similar to
    MSG_MORE.
    
    algif_hash, algif_skcipher, and udp used MSG_MORE from tcp_sendpages()
    and need to see the new flag as identical to MSG_MORE.
    
    This fixes sendfile() on AF_ALG.
    
    v3: also fix udp
    
    Cc: Tom Herbert <therbert@google.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: David S. Miller <davem@davemloft.net>
    Reported-and-tested-by: Shawn Landden <shawnlandden@gmail.com>
    Original-patch: Richard Weinberger <richard@nod.at>
    Signed-off-by: Shawn Landden <shawn@churchofgit.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e98bb6cbd858b4b5efc123d59d6e2b4399a70f17
Author: Laxman Dewangan <ldewangan@nvidia.com>
Date:   Mon Nov 25 19:39:47 2013 +0530

    irq: Enable all irqs unconditionally in irq_resume
    
    commit ac01810c9d2814238f08a227062e66a35a0e1ea2 upstream.
    
    When the system enters suspend, it disables all interrupts in
    suspend_device_irqs(), including the interrupts marked EARLY_RESUME.
    
    On the resume side things are different. The EARLY_RESUME interrupts
    are reenabled in sys_core_ops->resume and the non EARLY_RESUME
    interrupts are reenabled in the normal system resume path.
    
    When suspend_noirq() failed or suspend is aborted for any other
    reason, we might omit the resume side call to sys_core_ops->resume()
    and therefor the interrupts marked EARLY_RESUME are not reenabled and
    stay disabled forever.
    
    To solve this, enable all irqs unconditionally in irq_resume()
    regardless whether interrupts marked EARLY_RESUMEhave been already
    enabled or not.
    
    This might try to reenable already enabled interrupts in the non
    failure case, but the only affected platform is XEN and it has been
    confirmed that it does not cause any side effects.
    
    [ tglx: Massaged changelog. ]
    
    Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
    Acked-by-and-tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Heiko Stuebner <heiko@sntech.de>
    Reviewed-by: Pavel Machek <pavel@ucw.cz>
    Cc: <ian.campbell@citrix.com>
    Cc: <rjw@rjwysocki.net>
    Cc: <len.brown@intel.com>
    Cc: <gregkh@linuxfoundation.org>
    Link: http://lkml.kernel.org/r/1385388587-16442-1-git-send-email-ldewangan@nvidia.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 950cda7f8e2bc6f182a2640817970166c55240db
Author: Hong Zhiguo <zhiguohong@tencent.com>
Date:   Wed Nov 20 10:35:05 2013 -0700

    Update of blkg_stat and blkg_rwstat may happen in bh context. While u64_stats_fetch_retry is only preempt_disable on 32bit UP system. This is not enough to avoid preemption by bh and may read strange 64 bit value.
    
    commit 2c575026fae6e63771bd2a4c1d407214a8096a89 upstream.
    
    Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com>
    Acked-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c52348079702c2fa0fcc74e2ac5ba81c70a47fbc
Author: Matt Wilson <msw@amazon.com>
Date:   Wed Nov 20 12:11:35 2013 -0800

    xen/gnttab: leave lazy MMU mode in the case of a m2p override failure
    
    commit 14883a75ec76b44759385fb12629f4a0f1aef4e3 upstream.
    
    Commit f62805f1 introduced a bug where lazy MMU mode isn't exited if a
    m2p_add/remove_override call fails.
    
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: David Vrabel <david.vrabel@citrix.com>
    Reviewed-by: Anthony Liguori <aliguori@amazon.com>
    Signed-off-by: Matt Wilson <msw@amazon.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ca62ebe3b1b6f3c9835cf84d1ba6e1f091c39726
Author: Helge Deller <deller@gmx.de>
Date:   Wed Nov 20 23:07:42 2013 +0100

    parisc: fix mmap(MAP_FIXED|MAP_SHARED) to already mmapped address
    
    commit 0576da2c08e3d332f1b0653030d28ab804585ab6 upstream.
    
    locale-gen on Debian showed a strange problem on parisc:
    mmap2(NULL, 536870912, PROT_NONE, MAP_SHARED, 3, 0) = 0x42a54000
    mmap2(0x42a54000, 103860, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 3, 0) = -1 EINVAL (Invalid argument)
    
    Basically it was just trying to re-mmap() a file at the same address
    which it was given by a previous mmap() call. But this remapping failed
    with EINVAL.
    
    The problem is, that when MAP_FIXED and MAP_SHARED flags were used, we didn't
    included the mapping-based offset when we verified the alignment of the given
    fixed address against the offset which we calculated it in the previous call.
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa1a9f327eefbad2ac93a2c3ad0c7188f14a5ce5
Author: Liu Gang <Gang.Liu@freescale.com>
Date:   Fri Nov 22 16:12:40 2013 +0800

    powerpc/gpio: Fix the wrong GPIO input data on MPC8572/MPC8536
    
    commit 1aeef303b5d9e243c41d5b80f8bb059366514a10 upstream.
    
    For MPC8572/MPC8536, the status of GPIOs defined as output
    cannot be determined by reading GPDAT register, so the code
    use shadow data register instead. But the code may give the
    wrong status of GPIOs defined as input under some scenarios:
    
    1. If some pins were configured as inputs and were asserted
    high before booting the kernel, the shadow data has been
    initialized with those pin values.
    2. Some pins have been configured as output first and have
    been set to the high value, then reconfigured as input.
    
    The above cases will make the shadow data for those input
    pins to be set to high. Then reading the pin status will
    always return high even if the actual pin status is low.
    
    The code should eliminate the effects of the shadow data to
    the input pins, and the status of those pins should be
    read directly from GPDAT.
    
    Acked-by: Scott Wood <scottwood@freescale.com>
    Acked-by: Anatolij Gustschin <agust@denx.de>
    Signed-off-by: Liu Gang <Gang.Liu@freescale.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78f8d9b5647283bdea224d9bb7fb99f8f37a7614
Author: Martin Schwidefsky <schwidefsky@de.ibm.com>
Date:   Fri Nov 22 11:44:51 2013 -0800

    time: Fix 1ns/tick drift w/ GENERIC_TIME_VSYSCALL_OLD
    
    commit 4be77398ac9d948773116b6be4a3c91b3d6ea18c upstream.
    
    Since commit 1e75fa8be9f (time: Condense timekeeper.xtime
    into xtime_sec - merged in v3.6), there has been an problem
    with the error accounting in the timekeeping code, such that
    when truncating to nanoseconds, we round up to the next nsec,
    but the balancing adjustment to the ntp_error value was dropped.
    
    This causes 1ns per tick drift forward of the clock.
    
    In 3.7, this logic was isolated to only GENERIC_TIME_VSYSCALL_OLD
    architectures (s390, ia64, powerpc).
    
    The fix is simply to balance the accounting and to subtract the
    added nanosecond from ntp_error. This allows the internal long-term
    clock steering to keep the clock accurate.
    
    While this fix removes the regression added in 1e75fa8be9f, the
    ideal solution is to move away from GENERIC_TIME_VSYSCALL_OLD
    and use the new VSYSCALL method, which avoids entirely the
    nanosecond granular rounding, and the resulting short-term clock
    adjustment oscillation needed to keep long term accurate time.
    
    [ jstultz: Many thanks to Martin for his efforts identifying this
      	   subtle bug, and providing the fix. ]
    
    Originally-from: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Paul Turner <pjt@google.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Richard Cochran <richardcochran@gmail.com>
    Cc: Prarit Bhargava <prarit@redhat.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/1385149491-20307-1-git-send-email-john.stultz@linaro.org
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d08c381362aca8ef20c7fe1fa4c1ce36728208b
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Tue Nov 19 16:34:14 2013 -0500

    NFSv4: Update list of irrecoverable errors on DELEGRETURN
    
    commit c97cf606e43b85a6cf158b810375dd77312024db upstream.
    
    If the DELEGRETURN errors out with something like NFS4ERR_BAD_STATEID
    then there is no recovery possible. Just quit without returning an error.
    
    Also, note that the client must not assume that the NFSv4 lease has been
    renewed when it sees an error on DELEGRETURN.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9fac703e99f250d6c8ff9caf306d1160bbf90064
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Thu Nov 28 14:33:52 2013 +0100

    net: smc91: fix crash regression on the versatile
    
    commit a0c20fb02592d372e744d1d739cda3e1b3defaae upstream.
    
    After commit e9e4ea74f06635f2ffc1dffe5ef40c854faa0a90
    "net: smc91x: dont't use SMC_outw for fixing up halfword-aligned data"
    The Versatile SMSC LAN91C111 is crashing like this:
    
    ------------[ cut here ]------------
    kernel BUG at /home/linus/linux/drivers/net/ethernet/smsc/smc91x.c:599!
    Internal error: Oops - BUG: 0 [#1] ARM
    Modules linked in:
    CPU: 0 PID: 43 Comm: udhcpc Not tainted 3.13.0-rc1+ #24
    task: c6ccfaa0 ti: c6cd0000 task.ti: c6cd0000
    PC is at smc_hardware_send_pkt+0x198/0x22c
    LR is at smc_hardware_send_pkt+0x24/0x22c
    pc : [<c01be324>]    lr : [<c01be1b0>]    psr: 20000013
    sp : c6cd1d08  ip : 00000001  fp : 00000000
    r10: c02adb08  r9 : 00000000  r8 : c6ced802
    r7 : c786fba0  r6 : 00000146  r5 : c8800000  r4 : c78d6000
    r3 : 0000000f  r2 : 00000146  r1 : 00000000  r0 : 00000031
    Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
    Control: 0005317f  Table: 06cf4000  DAC: 00000015
    Process udhcpc (pid: 43, stack limit = 0xc6cd01c0)
    Stack: (0xc6cd1d08 to 0xc6cd2000)
    1d00:                   00000010 c8800000 c78d6000 c786fba0 c78d6000 c01be868
    1d20: c01be7a4 00004000 00000000 c786fba0 c6c12b80 c0208554 000004d0 c780fc60
    1d40: 00000220 c01fb734 00000000 00000000 00000000 c6c9a440 c6c12b80 c78d6000
    1d60: c786fba0 c6c9a440 00000000 c021d1d8 00000000 00000000 c6c12b80 c78d6000
    1d80: c786fba0 00000001 c6c9a440 c02087f8 c6c9a4a0 00080008 00000000 00000000
    1da0: c78d6000 c786fba0 c78d6000 00000138 00000000 00000000 00000000 00000000
    1dc0: 00000000 c027ba74 00000138 00000138 00000001 00000010 c6cedc00 00000000
    1de0: 00000008 c7404400 c6cd1eec c6cd1f14 c067a73c c065c0b8 00000000 c067a740
    1e00: 01ffffff 002040d0 00000000 00000000 00000000 00000000 00000000 ffffffff
    1e20: 43004400 00110022 c6cdef20 c027ae8c c6ccfaa0 be82d65c 00000014 be82d3cc
    1e40: 00000000 00000000 00000000 c01f2870 00000000 00000000 00000000 c6cd1e88
    1e60: c6ccfaa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    1e80: 00000000 00000000 00000031 c7802310 c7802300 00000138 c7404400 c0771da0
    1ea0: 00000000 c6cd1eec c7800340 00000138 be82d65c 00000014 be82d3cc c6cd1f08
    1ec0: 00000014 00000000 c7404400 c7404400 00000138 c01f4628 c78d6000 00000000
    1ee0: 00000000 be82d3cc 00000138 c6cd1f08 00000014 c6cd1ee4 00000001 00000000
    1f00: 00000000 00000000 00080011 00000002 06000000 ffffffff 0000ffff 00000002
    1f20: 06000000 ffffffff 0000ffff c00928c8 c065c520 c6cd1f58 00000003 c009299c
    1f40: 00000003 c065c520 c7404400 00000000 c7404400 c01f2218 c78106b0 c7441cb0
    1f60: 00000000 00000006 c06799fc 00000000 00000000 00000006 00000000 c01f3ee0
    1f80: 00000000 00000000 be82d678 be82d65c 00000014 00000001 00000122 c00139c8
    1fa0: c6cd0000 c0013840 be82d65c 00000014 00000006 be82d3cc 00000138 00000000
    1fc0: be82d65c 00000014 00000001 00000122 00000000 00000000 00018cb1 00000000
    1fe0: 00003801 be82d3a8 0003a0c7 b6e9af08 60000010 00000006 00000000 00000000
    [<c01be324>] (smc_hardware_send_pkt+0x198/0x22c) from [<c01be868>] (smc_hard_start_xmit+0xc4/0x1e8)
    [<c01be868>] (smc_hard_start_xmit+0xc4/0x1e8) from [<c0208554>] (dev_hard_start_xmit+0x460/0x4cc)
    [<c0208554>] (dev_hard_start_xmit+0x460/0x4cc) from [<c021d1d8>] (sch_direct_xmit+0x94/0x18c)
    [<c021d1d8>] (sch_direct_xmit+0x94/0x18c) from [<c02087f8>] (dev_queue_xmit+0x238/0x42c)
    [<c02087f8>] (dev_queue_xmit+0x238/0x42c) from [<c027ba74>] (packet_sendmsg+0xbe8/0xd28)
    [<c027ba74>] (packet_sendmsg+0xbe8/0xd28) from [<c01f2870>] (sock_sendmsg+0x84/0xa8)
    [<c01f2870>] (sock_sendmsg+0x84/0xa8) from [<c01f4628>] (SyS_sendto+0xb8/0xdc)
    [<c01f4628>] (SyS_sendto+0xb8/0xdc) from [<c0013840>] (ret_fast_syscall+0x0/0x2c)
    Code: e3130002 1a000001 e3130001 0affffcd (e7f001f2)
    ---[ end trace 81104fe70e8da7fe ]---
    Kernel panic - not syncing: Fatal exception in interrupt
    
    This is because the macro operations in smc91x.h defined
    for Versatile are missing SMC_outsw() as used in this
    commit.
    
    The Versatile needs and uses the same accessors as the other
    platforms in the first if(...) clause, just switch it to using
    that and we have one problem less to worry about.
    
    This includes a hunk of a patch from Will Deacon fixin
    the other 32bit platforms as well: Innokom, Ramses, PXA,
    PCM027.
    
    Checkpatch complains about spacing, but I have opted to
    follow the style of this .h-file.
    
    Cc: Russell King <linux@arm.linux.org.uk>
    Cc: Nicolas Pitre <nico@fluxnic.net>
    Cc: Eric Miao <eric.y.miao@gmail.com>
    Cc: Jonathan Cameron <jic23@cam.ac.uk>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fa7273a3f09508923408f7c1b0f9156329bded1
Author: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Date:   Fri Nov 1 11:02:25 2013 -0500

    SCSI: hpsa: return 0 from driver probe function on success, not 1
    
    commit 88bf6d62db4393fa03a58bada9d746312d5b496f upstream.
    
    A return value of 1 is interpreted as an error.  See pci_driver.
    in local_pci_probe().  If you're wondering how this ever could
    have worked, it's because it used to be the case that only return
    values less than zero were interpreted as failure.  But even in
    the current kernel if the driver registers its various entry
    points with the kernel, and then returns a value which is
    interpreted as failure, those registrations aren't undone, so
    the driver still mostly works.  However, the driver's remove
    function wouldn't be called on rmmod, and pci power management
    functions wouldn't work.  In the case of Smart Array, since it
    has a battery backed cache (or else no cache) even if the driver
    is not shut down properly as long as there is no outstanding
    i/o, nothing too bad happens, which is why it took so long to
    notice.
    
    Requesting backport to stable because the change to pci-driver.c
    which requires driver probe functions to return 0 occurred between
    2.6.35 and 2.6.36 (the pci power management breakage) and again
    between 3.7 and 3.8 (pci_dev->driver getting set to NULL in
    local_pci_probe() preventing driver remove function from being
    called on rmmod.)
    
    Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f9c848e607ca4ac52a35ac56402989505dd61a23
Author: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Date:   Mon Sep 23 13:33:41 2013 -0500

    SCSI: hpsa: do not discard scsi status on aborted commands
    
    commit 2e311fbabdc23b7eaec77313dc3b9a151a5407b5 upstream.
    
    We inadvertantly discarded the scsi status for aborted commands.
    For some commands (e.g. reads from tape drives) these can't be retried,
    and if we discarded the scsi status, the scsi mid layer couldn't notice
    anything was wrong and the error was not reported.
    
    Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85249bdb91821d90c0e46bdf0a75a8e28a0bf05d
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Tue Oct 22 18:35:19 2013 -0700

    SCSI: libsas: fix usage of ata_tf_to_fis
    
    commit ae5fbae0ccd982dfca0ce363036ed92f5b13f150 upstream.
    
    Since commit 110dd8f19df5 "[SCSI] libsas: fix scr_read/write users and
    update the libata documentation" we have been passing pmp=1 and is_cmd=0
    to ata_tf_to_fis().  Praveen reports that eSATA attached drives do not
    discover correctly.  His investigation found that the BIOS was passing
    pmp=0 while Linux was passing pmp=1 and failing to discover the drives.
    Update libsas to follow the libata example of pulling the pmp setting
    from the ata_link and correct is_cmd to be 1 since all tf's submitted
    through ->qc_issue are commands.  Presumably libsas lldds do not care
    about is_cmd as they have sideband mechanisms to perform link
    management.
    
    http://marc.info/?l=linux-scsi&m=138179681726990
    
    [jejb: checkpatch fix]
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Reported-by: Praveen Murali <pmurali@logicube.com>
    Tested-by: Praveen Murali <pmurali@logicube.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e891b8e307009b44fa1e70a49a59e8db6cbe12fa
Author: James Bottomley <JBottomley@Parallels.com>
Date:   Fri Nov 15 14:58:00 2013 -0800

    SCSI: enclosure: fix WARN_ON in dual path device removing
    
    commit a1470c7bf3a4676e62e4c0fb204e339399eb5c59 upstream.
    
    Bug report from: wenxiong@linux.vnet.ibm.com
    
    The issue is happened in dual controller configuration. We got the
    sysfs warnings when rmmod the ipr module.
    
    enclosure_unregister() in drivers/msic/enclosure.c, call device_unregister()
    for each componment deivce, device_unregister() ->device_del()->kobject_del()
    ->sysfs_remove_dir(). In sysfs_remove_dir(), set kobj->sd = NULL.
    
    For each componment device,
    enclosure_component_release()->enclosure_remove_links()->sysfs_remove_link()
    in which checking kobj->sd again, it has been set as NULL when doing
    device_unregister. So we saw all these sysfs WARNING.
    
    Tested-by: wenxiong@linux.vnet.ibm.com
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8ce2dfb243bedc9113a722ae3614c6f33791923
Author: Vijaya Mohan Guvva <vmohan@brocade.com>
Date:   Thu Nov 21 01:37:49 2013 -0800

    SCSI: bfa: Fix crash when symb name set for offline vport
    
    commit 22a08538dca5c0630226f1c0c58dccd12e463d22 upstream.
    
    This patch fixes a crash when tried setting symbolic name for an offline
    vport through sysfs. Crash is due to uninitialized pointer lport->ns,
    which gets initialized only on linkup (port online).
    
    Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4563588ce57080fc18ead503e5012a11d1e6eea8
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Sun Nov 24 23:31:24 2013 +0100

    can: c_can: don't call pm_runtime_get_sync() from interrupt context
    
    commit e35d46adc49b469fd92bdb64fea8af93640e6651 upstream.
    
    The c_can driver contians a callpath (c_can_poll -> c_can_state_change ->
    c_can_get_berr_counter) which may call pm_runtime_get_sync() from the IRQ
    handler, which is not allowed and results in "BUG: scheduling while atomic".
    
    This problem is fixed by introducing __c_can_get_berr_counter, which will not
    call pm_runtime_get_sync().
    
    Reported-by: Andrew Glen <AGlen@bepmarine.com>
    Tested-by: Andrew Glen <AGlen@bepmarine.com>
    Signed-off-by: Andrew Glen <AGlen@bepmarine.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd56b24db9050289af0b4b6e5bfecc3a9e2fb400
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Thu Nov 21 18:03:07 2013 +0100

    can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value
    
    commit 2fea6cd303c0d0cd9067da31d873b6a6d5bd75e7 upstream.
    
    This patch fixes the issue that the sja1000_interrupt() function may have
    returned IRQ_NONE without processing the optional pre_irq() and post_irq()
    function before. Further the irq processing counter 'n' is moved to the end of
    the while statement to return correct IRQ_[NONE|HANDLED] values at error
    conditions.
    
    Reported-by: Wolfgang Grandegger <wg@grandegger.com>
    Acked-by: Wolfgang Grandegger <wg@grandegger.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 120d92a8729d1bc2994fcc52b9bb183f47947f2c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Dec 2 09:44:51 2013 -0800

    vfs: fix subtle use-after-free of pipe_inode_info
    
    commit b0d8d2292160bb63de1972361ebed100c64b5b37 upstream.
    
    The pipe code was trying (and failing) to be very careful about freeing
    the pipe info only after the last access, with a pattern like:
    
            spin_lock(&inode->i_lock);
            if (!--pipe->files) {
                    inode->i_pipe = NULL;
                    kill = 1;
            }
            spin_unlock(&inode->i_lock);
            __pipe_unlock(pipe);
            if (kill)
                    free_pipe_info(pipe);
    
    where the final freeing is done last.
    
    HOWEVER.  The above is actually broken, because while the freeing is
    done at the end, if we have two racing processes releasing the pipe
    inode info, the one that *doesn't* free it will decrement the ->files
    count, and unlock the inode i_lock, but then still use the
    "pipe_inode_info" afterwards when it does the "__pipe_unlock(pipe)".
    
    This is *very* hard to trigger in practice, since the race window is
    very small, and adding debug options seems to just hide it by slowing
    things down.
    
    Simon originally reported this way back in July as an Oops in
    kmem_cache_allocate due to a single bit corruption (due to the final
    "spin_unlock(pipe->mutex.wait_lock)" incrementing a field in a different
    allocation that had re-used the free'd pipe-info), it's taken this long
    to figure out.
    
    Since the 'pipe->files' accesses aren't even protected by the pipe lock
    (we very much use the inode lock for that), the simple solution is to
    just drop the pipe lock early.  And since there were two users of this
    pattern, create a helper function for it.
    
    Introduced commit ba5bb147330a ("pipe: take allocation and freeing of
    pipe_inode_info out of ->i_mutex").
    
    Reported-by: Simon Kirby <sim@hostway.ca>
    Reported-by: Ian Applegate <ia@cloudflare.com>
    Acked-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1687164fceb6412a3c9a1f10b1e9b619e4cf75dc
Author: Bo Shen <voice.shen@atmel.com>
Date:   Tue Dec 3 18:04:54 2013 +0800

    ASoC: wm8731: fix dsp mode configuration
    
    commit b4af6ef99a60c5b56df137d7accd81ba1ee1254e upstream.
    
    According to WM8731 "PD, Rev 4.9 October 2012" datasheet, when it
    works in DSP mode A, LRP = 1, while works in DSP mode B, LRP = 0.
    So, fix LRP for DSP mode as the datesheet specification.
    
    Signed-off-by: Bo Shen <voice.shen@atmel.com>
    Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dd7933f8de8cd877ae203a5e5608ac483ab21314
Author: Mark Brown <broonie@linaro.org>
Date:   Fri Nov 22 14:17:18 2013 +0000

    ASoC: wm8990: Mark the register map as dirty when powering down
    
    commit 2ab2b74277a86afe0dd92976db695a2bb8b93366 upstream.
    
    Otherwise we'll skip sync on resume.
    
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a06eca7f59d50a532c486a38e14a47316522acb
Author: Gregory CLEMENT <gregory.clement@free-electrons.com>
Date:   Mon Nov 25 17:26:46 2013 +0100

    ARM: mvebu: use the virtual CPU registers to access coherency registers
    
    commit b6dda00cddcc71d2030668bc0cc0fed758c411c2 upstream.
    
    The Armada XP provides a mechanism called "virtual CPU registers" or
    "per-CPU register banking", to access the per-CPU registers of the
    current CPU, without having to worry about finding on which CPU we're
    running. CPU0 has its registers at 0x21800, CPU1 at 0x21900, CPU2 at
    0x21A00 and CPU3 at 0x21B00. The virtual registers accessing the
    current CPU registers are at 0x21000.
    
    However, in the Device Tree node that provides the register addresses
    for the coherency unit (which is responsible for ensuring coherency
    between processors, and I/O coherency between processors and the
    DMA-capable devices), a mistake was made: the CPU0-specific registers
    were specified instead of the virtual CPU registers. This means that
    the coherency barrier needed for I/O coherency was not behaving
    properly when executed from a CPU different from CPU0. This patch
    fixes that by using the virtual CPU registers.
    
    Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
    Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    Fixes: e60304f8cb7bb5 "arm: mvebu: Add hardware I/O Coherency support"
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 72bb80c9b5e1e55149bbb874db1afdd9abfdccea
Author: Ludovic Desroches <ludovic.desroches@atmel.com>
Date:   Fri Nov 22 17:08:43 2013 +0100

    ARM: at91: sama5d3: reduce TWI internal clock frequency
    
    commit 58e7b1d5826ac6a64b1101d8a70162bc084a7d1e upstream.
    
    With some devices, transfer hangs during I2C frame transmission. This issue
    disappears when reducing the internal frequency of the TWI IP. Even if it is
    indicated that internal clock max frequency is 66MHz, it seems we have
    oversampling on I2C signals making TWI believe that a transfer in progress
    is done.
    
    This fix has no impact on the I2C bus frequency.
    
    Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
    Acked-by: Wolfram Sang <wsa@the-dreams.de>
    Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 87c337463a3fcc8f382caaa6b54e7547fb7ed818
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Fri Nov 29 00:54:38 2013 +0000

    ARM: footbridge: fix EBSA285 LEDs
    
    commit 67130c5464f50428aea0b4526a6729d61f9a1d53 upstream.
    
    - The LEDs register is write-only: it can't be read-modify-written.
    - The LEDs are write-1-for-off not 0.
    - The check for the platform was inverted.
    
    Fixes: cf6856d693dd ("ARM: mach-footbridge: retire custom LED code")
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d877bdfe0c784f4b1d9e0d0ba151d0f4e6a2d09b
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Thu Nov 28 21:55:41 2013 +0000

    ARM: footbridge: fix VGA initialisation
    
    commit 43659222e7a0113912ed02f6b2231550b3e471ac upstream.
    
    It's no good setting vga_base after the VGA console has been
    initialised, because if we do that we get this:
    
    Unable to handle kernel paging request at virtual address 000b8000
    pgd = c0004000
    [000b8000] *pgd=07ffc831, *pte=00000000, *ppte=00000000
    0Internal error: Oops: 5017 [#1] ARM
    Modules linked in:
    CPU: 0 PID: 0 Comm: swapper Not tainted 3.12.0+ #49
    task: c03e2974 ti: c03d8000 task.ti: c03d8000
    PC is at vgacon_startup+0x258/0x39c
    LR is at request_resource+0x10/0x1c
    pc : [<c01725d0>]    lr : [<c0022b50>]    psr: 60000053
    sp : c03d9f68  ip : 000b8000  fp : c03d9f8c
    r10: 000055aa  r9 : 4401a103  r8 : ffffaa55
    r7 : c03e357c  r6 : c051b460  r5 : 000000ff  r4 : 000c0000
    r3 : 000b8000  r2 : c03e0514  r1 : 00000000  r0 : c0304971
    Flags: nZCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
    
    which is an access to the 0xb8000 without the PCI offset required to
    make it work.
    
    Fixes: cc22b4c18540 ("ARM: set vga memory base at run-time")
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d47787bdf7cd4dfccfaffdab00b5b593d6270a6a
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Thu Nov 28 21:43:40 2013 +0000

    ARM: fix booting low-vectors machines
    
    commit d8aa712c30148ba26fd89a5dc14de95d4c375184 upstream.
    
    Commit f6f91b0d9fd9 (ARM: allow kuser helpers to be removed from the
    vector page) required two pages for the vectors code.  Although the
    code setting up the initial page tables was updated, the code which
    allocates page tables for new processes wasn't, neither was the code
    which tears down the mappings.  Fix this.
    
    Fixes: f6f91b0d9fd9 ("ARM: allow kuser helpers to be removed from the vector page")
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1c651d3627a2d3ba10f2f116303ca620e17b14d5
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Tue Nov 12 11:46:04 2013 -0600

    crypto: authenc - Find proper IV address in ablkcipher callback
    
    commit fc019c7122dfcd69c50142b57a735539aec5da95 upstream.
    
    When performing an asynchronous ablkcipher operation the authenc
    completion callback routine is invoked, but it does not locate and use
    the proper IV.
    
    The callback routine, crypto_authenc_encrypt_done, is updated to use
    the same method of calculating the address of the IV as is done in
    crypto_authenc_encrypt function which sets up the callback.
    
    Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf2e52300b9e5a329c5f76ba8d77e33ade976b1c
Author: Horia Geanta <horia.geanta@freescale.com>
Date:   Thu Nov 28 15:11:15 2013 +0200

    crypto: ccm - Fix handling of zero plaintext when computing mac
    
    commit 5638cabf3e4883f38dfb246c30980cebf694fbda upstream.
    
    There are cases when cryptlen can be zero in crypto_ccm_auth():
    -encryptiom: input scatterlist length is zero (no plaintext)
    -decryption: input scatterlist contains only the mac
    plus the condition of having different source and destination buffers
    (or else scatterlist length = max(plaintext_len, ciphertext_len)).
    
    These are not handled correctly, leading to crashes like:
    
    root@p4080ds:~/crypto# insmod tcrypt.ko mode=45
    ------------[ cut here ]------------
    kernel BUG at crypto/scatterwalk.c:37!
    Oops: Exception in kernel mode, sig: 5 [#1]
    SMP NR_CPUS=8 P4080 DS
    Modules linked in: tcrypt(+) crc32c xts xcbc vmac pcbc ecb gcm ghash_generic gf128mul ccm ctr seqiv
    CPU: 3 PID: 1082 Comm: cryptomgr_test Not tainted 3.11.0 #14
    task: ee12c5b0 ti: eecd0000 task.ti: eecd0000
    NIP: c0204d98 LR: f9225848 CTR: c0204d80
    REGS: eecd1b70 TRAP: 0700   Not tainted  (3.11.0)
    MSR: 00029002 <CE,EE,ME>  CR: 22044022  XER: 20000000
    
    GPR00: f9225c94 eecd1c20 ee12c5b0 eecd1c28 ee879400 ee879400 00000000 ee607464
    GPR08: 00000001 00000001 00000000 006b0000 c0204d80 00000000 00000002 c0698e20
    GPR16: ee987000 ee895000 fffffff4 ee879500 00000100 eecd1d58 00000001 00000000
    GPR24: ee879400 00000020 00000000 00000000 ee5b2800 ee607430 00000004 ee607460
    NIP [c0204d98] scatterwalk_start+0x18/0x30
    LR [f9225848] get_data_to_compute+0x28/0x2f0 [ccm]
    Call Trace:
    [eecd1c20] [f9225974] get_data_to_compute+0x154/0x2f0 [ccm] (unreliable)
    [eecd1c70] [f9225c94] crypto_ccm_auth+0x184/0x1d0 [ccm]
    [eecd1cb0] [f9225d40] crypto_ccm_encrypt+0x60/0x2d0 [ccm]
    [eecd1cf0] [c020d77c] __test_aead+0x3ec/0xe20
    [eecd1e20] [c020f35c] test_aead+0x6c/0xe0
    [eecd1e40] [c020f420] alg_test_aead+0x50/0xd0
    [eecd1e60] [c020e5e4] alg_test+0x114/0x2e0
    [eecd1ee0] [c020bd1c] cryptomgr_test+0x4c/0x60
    [eecd1ef0] [c0047058] kthread+0xa8/0xb0
    [eecd1f40] [c000eb0c] ret_from_kernel_thread+0x5c/0x64
    Instruction dump:
    0f080000 81290024 552807fe 0f080000 5529003a 4bffffb4 90830000 39400000
    39000001 8124000c 2f890000 7d28579e <0f090000> 81240008 91230004 4e800020
    ---[ end trace 6d652dfcd1be37bd ]---
    
    Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
    Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a426ea27b26cca933cba53e189d6478bd04eddd1
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Tue Nov 12 11:46:10 2013 -0600

    crypto: scatterwalk - Set the chain pointer indication bit
    
    commit 41da8b5adba77e22584f8b45f9641504fa885308 upstream.
    
    The scatterwalk_crypto_chain function invokes the scatterwalk_sg_chain
    function to chain two scatterlists, but the chain pointer indication
    bit is not set.  When the resulting scatterlist is used, for example,
    by sg_nents to count the number of scatterlist entries, a segfault occurs
    because sg_nents does not follow the chain pointer to the chained scatterlist.
    
    Update scatterwalk_sg_chain to set the chain pointer indication bit as is
    done by the sg_chain function.
    
    Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da94360f55be9d57c866f4d6b0861d9ecd1a1aeb
Author: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Date:   Tue Nov 19 17:12:47 2013 +0100

    crypto: s390 - Fix aes-xts parameter corruption
    
    commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream.
    
    Some s390 crypto algorithms incorrectly use the crypto_tfm structure to
    store private data. As the tfm can be shared among multiple threads, this
    can result in data corruption.
    
    This patch fixes aes-xts by moving the xts and pcc parameter blocks from
    the tfm onto the stack (48 + 96 bytes).
    
    Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 87a226e9df5efd1c7d26756fab9e9f29a267ac47
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Fri Nov 29 15:10:20 2013 +0800

    ALSA: hda - Add mono speaker quirk for Dell Inspiron 5439
    
    commit eb82594b75b0cf54c667189e061934b7c49b5d42 upstream.
    
    This machine also has mono output if run through DAC node 0x03.
    
    BugLink: https://bugs.launchpad.net/bugs/1256212
    Tested-by: David Chen <david.chen@canonical.com>
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64871fb0be804a971bcdc5db337101d2537167b4
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Dec 4 13:59:45 2013 +0100

    ALSA: hda - Fix silent output on MacBook Air 2,1
    
    commit 0756f09c4946fe2d9ce2ebcb6f2e3c58830d22a3 upstream.
    
    MacBook Air 2,1 has a fairly different pin assignment from its brother
    MBA 1,1, and yet another quirks are needed for pin 0x18 and 0x19,
    similarly like what iMac 9,1 requires, in order to make the sound
    working on it.
    
    Reported-and-tested-by: Bruno Prémont <bonbons@linux-vserver.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c4fcb3cd61aecde82df7d9856e3d2201e908ca65
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Mon Dec 2 18:06:20 2013 +0800

    ALSA: hda - Fix headset mic input after muted internal mic (Dell/Realtek)
    
    commit d59915d0655c5864b514f21daaeac98c047875dc upstream.
    
    By trial and error, I found this patch could work around an issue
    where the headset mic would stop working if you switch between the
    internal mic and the headset mic, and the internal mic was muted.
    
    It still takes a second or two before the headset mic actually starts
    working, but still better than nothing.
    
    Information update from Kailang:
      The verb was ADC digital mute(bit 6 default 1).
      Switch internal mic and headset mic will run alc_headset_mode_default.
      The coef index 0x11 will set to 0x0041.
      Because headset mode was fixed type. It doesn't need to run
      alc_determine_headset_type.
      So, the value still keep 0x0041. ADC was muted.
    
    BugLink: https://bugs.launchpad.net/bugs/1256840
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e0979ec7e098007b943b6e779093eb62b4551884
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 2 15:27:19 2013 +0100

    ALSA: hda - Another fixup for ASUS laptop with ALC660 codec
    
    commit e7ca237bfcf6a288702cb95e94ab94f642ccad88 upstream.
    
    ASUS Z35HL laptop also needs the very same fix as the previous one
    that was applied to ASUS W7J.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66231
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit daba76170151aa64ba29d46c9426b4d0b204601d
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Nov 29 12:47:34 2013 +0100

    ALSA: hda - Fix silent output on ASUS W7J laptop
    
    commit 6ddf0fd1c462a418a3cbb8b0653820dc48ffbd98 upstream.
    
    The recent kernels got regressions on ASUS W7J with ALC660 codec where
    no sound comes out.  After a long debugging session, we found out that
    setting the pin control on the unused NID 0x10 is mandatory for the
    outputs.  And, it was found out that another magic of NID 0x0f that is
    required for other ASUS laptops isn't needed on this machine.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66081
    Reported-and-tested-by: Andrey Lipaev <lipaev@mail.ru>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>