--- /dev/null
+gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch
+gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch
+pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch
+mips-fix-c0_pagegrain-support.patch
+mips-irq-fix-disable_irq-on-cpu-irqs.patch
+mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch
+complete-oplock-break-jobs-before-closing-file-handle.patch
+mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch
+lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch
+nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch
--- /dev/null
+From 8e64806672466392acf19e14427d1c29df3e58b9 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 29 Jan 2015 16:41:46 +0100
+Subject: ARM: 8299/1: mm: ensure local active ASID is marked as allocated on rollover
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 8e64806672466392acf19e14427d1c29df3e58b9 upstream.
+
+Commit e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0
+when running with LPAE") removed the use of the reserved TTBR0 value
+for LPAE systems, since the ASID is held in the TTBR and can be updated
+atomicly with the pgd of the next mm.
+
+Unfortunately, this patch forgot to update flush_context, which
+deliberately avoids marking the local active ASID as allocated, since we
+used to switch via ASID zero and didn't need to allocate the ASID of
+the previous mm. The side-effect of this is that we can allocate the
+same ASID to the next mm and, between flushing the local TLB and updating
+TTBR0, we can perform speculative TLB fills for userspace nG mappings
+using the page table of the previous mm.
+
+The consequence of this is that the next mm can erroneously hit some
+mappings of the previous mm. Note that this was made significantly
+harder to hit by a391263cd84e ("ARM: 8203/1: mm: try to re-use old ASID
+assignments following a rollover") but is still theoretically possible.
+
+This patch fixes the problem by removing the code from flush_context
+that forces the allocated ASID to zero for the local CPU. Many thanks
+to the Broadcom guys for tracking this one down.
+
+Fixes: e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 when running with LPAE")
+
+Reported-by: Raymond Ngun <rngun@broadcom.com>
+Tested-by: Raymond Ngun <rngun@broadcom.com>
+Reviewed-by: Gregory Fong <gregory.0xf0@gmail.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/context.c | 26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -144,21 +144,17 @@ static void flush_context(unsigned int c
+ /* Update the list of reserved ASIDs and the ASID bitmap. */
+ bitmap_clear(asid_map, 0, NUM_USER_ASIDS);
+ for_each_possible_cpu(i) {
+- if (i == cpu) {
+- asid = 0;
+- } else {
+- asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+- /*
+- * If this CPU has already been through a
+- * rollover, but hasn't run another task in
+- * the meantime, we must preserve its reserved
+- * ASID, as this is the only trace we have of
+- * the process it is still running.
+- */
+- if (asid == 0)
+- asid = per_cpu(reserved_asids, i);
+- __set_bit(asid & ~ASID_MASK, asid_map);
+- }
++ asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
++ /*
++ * If this CPU has already been through a
++ * rollover, but hasn't run another task in
++ * the meantime, we must preserve its reserved
++ * ASID, as this is the only trace we have of
++ * the process it is still running.
++ */
++ if (asid == 0)
++ asid = per_cpu(reserved_asids, i);
++ __set_bit(asid & ~ASID_MASK, asid_map);
+ per_cpu(reserved_asids, i) = asid;
+ }
+
--- /dev/null
+From ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 Mon Sep 17 00:00:00 2001
+From: Sachin Prabhu <sprabhu@redhat.com>
+Date: Thu, 15 Jan 2015 12:22:04 +0000
+Subject: Complete oplock break jobs before closing file handle
+
+From: Sachin Prabhu <sprabhu@redhat.com>
+
+commit ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 upstream.
+
+Commit
+c11f1df5003d534fd067f0168bfad7befffb3b5c
+requires writers to wait for any pending oplock break handler to
+complete before proceeding to write. This is done by waiting on bit
+CIFS_INODE_PENDING_OPLOCK_BREAK in cifsFileInfo->flags. This bit is
+cleared by the oplock break handler job queued on the workqueue once it
+has completed handling the oplock break allowing writers to proceed with
+writing to the file.
+
+While testing, it was noticed that the filehandle could be closed while
+there is a pending oplock break which results in the oplock break
+handler on the cifsiod workqueue being cancelled before it has had a
+chance to execute and clear the CIFS_INODE_PENDING_OPLOCK_BREAK bit.
+Any subsequent attempt to write to this file hangs waiting for the
+CIFS_INODE_PENDING_OPLOCK_BREAK bit to be cleared.
+
+We fix this by ensuring that we also clear the bit
+CIFS_INODE_PENDING_OPLOCK_BREAK when we remove the oplock break handler
+from the workqueue.
+
+The bug was found by Red Hat QA while testing using ltp's fsstress
+command.
+
+Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
+Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@samba.org>
+Signed-off-by: Steve French <steve.french@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/file.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInf
+ struct cifsLockInfo *li, *tmp;
+ struct cifs_fid fid;
+ struct cifs_pending_open open;
++ bool oplock_break_cancelled;
+
+ spin_lock(&cifs_file_list_lock);
+ if (--cifs_file->count > 0) {
+@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInf
+ }
+ spin_unlock(&cifs_file_list_lock);
+
+- cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInf
+ _free_xid(xid);
+ }
+
++ if (oplock_break_cancelled)
++ cifs_done_oplock_break(cifsi);
++
+ cifs_del_pending_open(&open);
+
+ /*
--- /dev/null
+From 0f303db08df0df9bd0966443ad6001e63960af16 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Jan 2015 12:02:45 +0100
+Subject: gpio: sysfs: fix memory leak in gpiod_export_link
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0f303db08df0df9bd0966443ad6001e63960af16 upstream.
+
+Fix memory leak in the gpio sysfs interface due to failure to drop
+reference to device returned by class_find_device when creating a link.
+
+Fixes: a4177ee7f1a8 ("gpiolib: allow exported GPIO nodes to be named using sysfs links")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -911,6 +911,7 @@ int gpiod_export_link(struct device *dev
+ if (tdev != NULL) {
+ status = sysfs_create_link(&dev->kobj, &tdev->kobj,
+ name);
++ put_device(tdev);
+ } else {
+ status = -ENODEV;
+ }
--- /dev/null
+From 49d2ca84e433dab854c7a866bc6add09cfab682d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Jan 2015 12:02:46 +0100
+Subject: gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 49d2ca84e433dab854c7a866bc6add09cfab682d upstream.
+
+Fix memory leak in the gpio sysfs interface due to failure to drop
+reference to device returned by class_find_device when setting the
+gpio-line polarity.
+
+Fixes: 0769746183ca ("gpiolib: add support for changing value polarity in sysfs")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -959,7 +959,7 @@ int gpiod_sysfs_set_active_low(struct gp
+ }
+
+ status = sysfs_set_active_low(desc, dev, value);
+-
++ put_device(dev);
+ unlock:
+ mutex_unlock(&sysfs_lock);
+
--- /dev/null
+From 2d560306096739e2251329ab5c16059311a151b0 Mon Sep 17 00:00:00 2001
+From: Peter Kümmel <syntheticpp@gmx.net>
+Date: Tue, 4 Nov 2014 12:01:59 +0100
+Subject: kconfig: Fix warning "‘jump’ may be used uninitialized"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Kümmel <syntheticpp@gmx.net>
+
+commit 2d560306096739e2251329ab5c16059311a151b0 upstream.
+
+Warning:
+In file included from scripts/kconfig/zconf.tab.c:2537:0:
+scripts/kconfig/menu.c: In function ‘get_symbol_str’:
+scripts/kconfig/menu.c:590:18: warning: ‘jump’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ jump->offset = strlen(r->s);
+
+Simplifies the test logic because (head && local) means (jump != 0)
+and makes GCC happy when checking if the jump pointer was initialized.
+
+Signed-off-by: Peter Kümmel <syntheticpp@gmx.net>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Cc: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/kconfig/menu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/kconfig/menu.c
++++ b/scripts/kconfig/menu.c
+@@ -545,7 +545,7 @@ static void get_prompt_str(struct gstr *
+ {
+ int i, j;
+ struct menu *submenu[8], *menu, *location = NULL;
+- struct jump_key *jump;
++ struct jump_key *jump = NULL;
+
+ str_printf(r, _("Prompt: %s\n"), _(prop->text));
+ menu = prop->menu->parent;
+@@ -583,7 +583,7 @@ static void get_prompt_str(struct gstr *
+ str_printf(r, _(" Location:\n"));
+ for (j = 4; --i >= 0; j += 2) {
+ menu = submenu[i];
+- if (head && location && menu == location)
++ if (jump && menu == location)
+ jump->offset = strlen(r->s);
+ str_printf(r, "%*c-> %s", j, ' ',
+ _(menu_get_prompt(menu)));
--- /dev/null
+From 150ae0e94634714b23919f0c333fee28a5b199d5 Mon Sep 17 00:00:00 2001
+From: karl beldan <karl.beldan@gmail.com>
+Date: Wed, 28 Jan 2015 10:58:11 +0100
+Subject: lib/checksum.c: fix carry in csum_tcpudp_nofold
+
+From: karl beldan <karl.beldan@gmail.com>
+
+commit 150ae0e94634714b23919f0c333fee28a5b199d5 upstream.
+
+The carry from the 64->32bits folding was dropped, e.g with:
+saddr=0xFFFFFFFF daddr=0xFF0000FF len=0xFFFF proto=0 sum=1,
+csum_tcpudp_nofold returned 0 instead of 1.
+
+Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Mike Frysinger <vapier@gentoo.org>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/checksum.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/lib/checksum.c
++++ b/lib/checksum.c
+@@ -47,6 +47,15 @@ static inline unsigned short from32to16(
+ return x;
+ }
+
++static inline u32 from64to32(u64 x)
++{
++ /* add up 32-bit and 32-bit for 32+c bit */
++ x = (x & 0xffffffff) + (x >> 32);
++ /* add up carry.. */
++ x = (x & 0xffffffff) + (x >> 32);
++ return (u32)x;
++}
++
+ static unsigned int do_csum(const unsigned char *buff, int len)
+ {
+ int odd;
+@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr,
+ #else
+ s += (proto + len) << 8;
+ #endif
+- s += (s >> 32);
+- return (__force __wsum)s;
++ return (__force __wsum)from64to32(s);
+ }
+ EXPORT_SYMBOL(csum_tcpudp_nofold);
+ #endif
--- /dev/null
+From 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 Mon Sep 17 00:00:00 2001
+From: David Daney <david.daney@cavium.com>
+Date: Tue, 6 Jan 2015 10:42:23 -0800
+Subject: MIPS: Fix C0_Pagegrain[IEC] support.
+
+From: David Daney <david.daney@cavium.com>
+
+commit 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 upstream.
+
+The following commits:
+
+ 5890f70f15c52d (MIPS: Use dedicated exception handler if CPU supports RI/XI exceptions)
+ 6575b1d4173eae (MIPS: kernel: cpu-probe: Detect unique RI/XI exceptions)
+
+break the kernel for *all* existing MIPS CPUs that implement the
+CP0_PageGrain[IEC] bit. They cause the TLB exception handlers to be
+generated without the legacy execute-inhibit handling, but never set
+the CP0_PageGrain[IEC] bit to activate the use of dedicated exception
+vectors for execute-inhibit exceptions. The result is that upon
+detection of an execute-inhibit violation, we loop forever in the TLB
+exception handlers instead of sending SIGSEGV to the task.
+
+If we are generating TLB exception handlers expecting separate
+vectors, we must also enable the CP0_PageGrain[IEC] feature.
+
+The bug was introduced in kernel version 3.17.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Cc: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: http://patchwork.linux-mips.org/patch/8880/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/tlb-r4k.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -445,6 +445,8 @@ void tlb_init(void)
+ #ifdef CONFIG_64BIT
+ pg |= PG_ELPA;
+ #endif
++ if (cpu_has_rixiex)
++ pg |= PG_IEC;
+ write_c0_pagegrain(pg);
+ }
+
--- /dev/null
+From c7754e75100ed5e3068ac5085747f2bfc386c8d6 Mon Sep 17 00:00:00 2001
+From: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Date: Thu, 15 Jan 2015 23:01:59 +0200
+Subject: MIPS: Fix kernel lockup or crash after CPU offline/online
+
+From: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+
+commit c7754e75100ed5e3068ac5085747f2bfc386c8d6 upstream.
+
+As printk() invocation can cause e.g. a TLB miss, printk() cannot be
+called before the exception handlers have been properly initialized.
+This can happen e.g. when netconsole has been loaded as a kernel module
+and the TLB table has been cleared when a CPU was offline.
+
+Call cpu_report() in start_secondary() only after the exception handlers
+have been initialized to fix this.
+
+Without the patch the kernel will randomly either lockup or crash
+after a CPU is onlined and the console driver is a module.
+
+Signed-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: David Daney <david.daney@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/8953/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -109,10 +109,10 @@ asmlinkage void start_secondary(void)
+ else
+ #endif /* CONFIG_MIPS_MT_SMTC */
+ cpu_probe();
+- cpu_report();
+ per_cpu_trap_init(false);
+ mips_clockevent_init();
+ mp_ops->init_secondary();
++ cpu_report();
+
+ /*
+ * XXX parity protection should be folded in here when it's converted
--- /dev/null
+From a3e6c1eff54878506b2dddcc202df9cc8180facb Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 15 Jan 2015 19:05:28 +0100
+Subject: MIPS: IRQ: Fix disable_irq on CPU IRQs
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit a3e6c1eff54878506b2dddcc202df9cc8180facb upstream.
+
+If the irq_chip does not define .irq_disable, any call to disable_irq
+will defer disabling the IRQ until it fires while marked as disabled.
+This assumes that the handler function checks for this condition, which
+handle_percpu_irq does not. In this case, calling disable_irq leads to
+an IRQ storm, if the interrupt fires while disabled.
+
+This optimization is only useful when disabling the IRQ is slow, which
+is not true for the MIPS CPU IRQ.
+
+Disable this optimization by implementing .irq_disable and .irq_enable
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8949/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/irq_cpu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/irq_cpu.c
++++ b/arch/mips/kernel/irq_cpu.c
+@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_cont
+ .irq_mask_ack = mask_mips_irq,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ /*
+@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_c
+ .irq_mask_ack = mips_mt_cpu_irq_ack,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ void __init mips_cpu_irq_init(void)
--- /dev/null
+From 63a87fe0d0de2ce126a8cec9a299a133cfd5658e Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Thu, 15 Jan 2015 23:01:58 +0200
+Subject: MIPS: OCTEON: fix kernel crash when offlining a CPU
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+commit 63a87fe0d0de2ce126a8cec9a299a133cfd5658e upstream.
+
+octeon_cpu_disable() will unconditionally enable interrupts when called.
+We can assume that the routine is always called with interrupts disabled,
+so just delete the incorrect local_irq_disable/enable().
+
+The patch fixes the following crash when offlining a CPU:
+
+[ 93.818785] ------------[ cut here ]------------
+[ 93.823421] WARNING: CPU: 1 PID: 10 at kernel/smp.c:231 flush_smp_call_function_queue+0x1c4/0x1d0()
+[ 93.836215] Modules linked in:
+[ 93.839287] CPU: 1 PID: 10 Comm: migration/1 Not tainted 3.19.0-rc4-octeon-los_b5f0 #1
+[ 93.847212] Stack : 0000000000000001 ffffffff81b2cf90 0000000000000004 ffffffff81630000
+ 0000000000000000 0000000000000000 0000000000000000 000000000000004a
+ 0000000000000006 ffffffff8117e550 0000000000000000 0000000000000000
+ ffffffff81b30000 ffffffff81b26808 8000000032c77748 ffffffff81627e07
+ ffffffff81595ec8 ffffffff81b26808 000000000000000a 0000000000000001
+ 0000000000000001 0000000000000003 0000000010008ce1 ffffffff815030c8
+ 8000000032cbbb38 ffffffff8113d42c 0000000010008ce1 ffffffff8117f36c
+ 8000000032c77300 8000000032cbba50 0000000000000001 ffffffff81503984
+ 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+ 0000000000000000 ffffffff81121668 0000000000000000 0000000000000000
+ ...
+[ 93.912819] Call Trace:
+[ 93.915273] [<ffffffff81121668>] show_stack+0x68/0x80
+[ 93.920335] [<ffffffff81503984>] dump_stack+0x6c/0x90
+[ 93.925395] [<ffffffff8113d58c>] warn_slowpath_common+0x94/0xd8
+[ 93.931324] [<ffffffff811a402c>] flush_smp_call_function_queue+0x1c4/0x1d0
+[ 93.938208] [<ffffffff811a4128>] hotplug_cfd+0xf0/0x108
+[ 93.943444] [<ffffffff8115bacc>] notifier_call_chain+0x5c/0xb8
+[ 93.949286] [<ffffffff8113d704>] cpu_notify+0x24/0x60
+[ 93.954348] [<ffffffff81501738>] take_cpu_down+0x38/0x58
+[ 93.959670] [<ffffffff811b343c>] multi_cpu_stop+0x154/0x180
+[ 93.965250] [<ffffffff811b3768>] cpu_stopper_thread+0xd8/0x160
+[ 93.971093] [<ffffffff8115ea4c>] smpboot_thread_fn+0x1ec/0x1f8
+[ 93.976936] [<ffffffff8115ab04>] kthread+0xd4/0xf0
+[ 93.981735] [<ffffffff8111c4f0>] ret_from_kernel_thread+0x14/0x1c
+[ 93.987835]
+[ 93.989326] ---[ end trace c9e3815ee655bda9 ]---
+[ 93.993951] Kernel bug detected[#1]:
+[ 93.997533] CPU: 1 PID: 10 Comm: migration/1 Tainted: G W 3.19.0-rc4-octeon-los_b5f0 #1
+[ 94.006591] task: 8000000032c77300 ti: 8000000032cb8000 task.ti: 8000000032cb8000
+[ 94.014081] $ 0 : 0000000000000000 0000000010000ce1 0000000000000001 ffffffff81620000
+[ 94.022146] $ 4 : 8000000002c72ac0 0000000000000000 00000000000001a7 ffffffff813b06f0
+[ 94.030210] $ 8 : ffffffff813b20d8 0000000000000000 0000000000000000 ffffffff81630000
+[ 94.038275] $12 : 0000000000000087 0000000000000000 0000000000000086 0000000000000000
+[ 94.046339] $16 : ffffffff81623168 0000000000000001 0000000000000000 0000000000000008
+[ 94.054405] $20 : 0000000000000001 0000000000000001 0000000000000001 0000000000000003
+[ 94.062470] $24 : 0000000000000038 ffffffff813b7f10
+[ 94.070536] $28 : 8000000032cb8000 8000000032cbbc20 0000000010008ce1 ffffffff811bcaf4
+[ 94.078601] Hi : 0000000000f188e8
+[ 94.082179] Lo : d4fdf3b646c09d55
+[ 94.085760] epc : ffffffff811bc9d0 irq_work_run_list+0x8/0xf8
+[ 94.091686] Tainted: G W
+[ 94.095613] ra : ffffffff811bcaf4 irq_work_run+0x34/0x60
+[ 94.101192] Status: 10000ce3 KX SX UX KERNEL EXL IE
+[ 94.106235] Cause : 40808034
+[ 94.109119] PrId : 000d9301 (Cavium Octeon II)
+[ 94.113653] Modules linked in:
+[ 94.116721] Process migration/1 (pid: 10, threadinfo=8000000032cb8000, task=8000000032c77300, tls=0000000000000000)
+[ 94.127168] Stack : 8000000002c74c80 ffffffff811a4128 0000000000000001 ffffffff81635720
+ fffffffffffffff2 ffffffff8115bacc 80000000320fbce0 80000000320fbca4
+ 80000000320fbc80 0000000000000002 0000000000000004 ffffffff8113d704
+ 80000000320fbce0 ffffffff81501738 0000000000000003 ffffffff811b343c
+ 8000000002c72aa0 8000000002c72aa8 ffffffff8159cae8 ffffffff8159caa0
+ ffffffff81650000 80000000320fbbf0 80000000320fbc80 ffffffff811b32e8
+ 0000000000000000 ffffffff811b3768 ffffffff81622b80 ffffffff815148a8
+ 8000000032c77300 8000000002c73e80 ffffffff815148a8 8000000032c77300
+ ffffffff81622b80 ffffffff815148a8 8000000032c77300 ffffffff81503f48
+ ffffffff8115ea0c ffffffff81620000 0000000000000000 ffffffff81174d64
+ ...
+[ 94.192771] Call Trace:
+[ 94.195222] [<ffffffff811bc9d0>] irq_work_run_list+0x8/0xf8
+[ 94.200802] [<ffffffff811bcaf4>] irq_work_run+0x34/0x60
+[ 94.206036] [<ffffffff811a4128>] hotplug_cfd+0xf0/0x108
+[ 94.211269] [<ffffffff8115bacc>] notifier_call_chain+0x5c/0xb8
+[ 94.217111] [<ffffffff8113d704>] cpu_notify+0x24/0x60
+[ 94.222171] [<ffffffff81501738>] take_cpu_down+0x38/0x58
+[ 94.227491] [<ffffffff811b343c>] multi_cpu_stop+0x154/0x180
+[ 94.233072] [<ffffffff811b3768>] cpu_stopper_thread+0xd8/0x160
+[ 94.238914] [<ffffffff8115ea4c>] smpboot_thread_fn+0x1ec/0x1f8
+[ 94.244757] [<ffffffff8115ab04>] kthread+0xd4/0xf0
+[ 94.249555] [<ffffffff8111c4f0>] ret_from_kernel_thread+0x14/0x1c
+[ 94.255654]
+[ 94.257146]
+Code: a2423c40 40026000 30420001 <00020336> dc820000 10400037 00000000 0000010f 0000010f
+[ 94.267183] ---[ end trace c9e3815ee655bdaa ]---
+[ 94.271804] Fatal exception: panic in 5 seconds
+
+Reported-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Acked-by: David Daney <david.daney@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/8952/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/cavium-octeon/smp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/mips/cavium-octeon/smp.c
++++ b/arch/mips/cavium-octeon/smp.c
+@@ -263,9 +263,7 @@ static int octeon_cpu_disable(void)
+
+ set_cpu_online(cpu, false);
+ cpu_clear(cpu, cpu_callin_map);
+- local_irq_disable();
+ octeon_fixup_irqs();
+- local_irq_enable();
+
+ flush_cache_all();
+ local_flush_tlb_all();
--- /dev/null
+From 23aaed6659df9adfabe9c583e67a36b54e21df46 Mon Sep 17 00:00:00 2001
+From: Shiraz Hashim <shashim@codeaurora.org>
+Date: Thu, 5 Feb 2015 12:25:06 -0800
+Subject: mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range
+
+From: Shiraz Hashim <shashim@codeaurora.org>
+
+commit 23aaed6659df9adfabe9c583e67a36b54e21df46 upstream.
+
+walk_page_range() silently skips vma having VM_PFNMAP set, which leads
+to undesirable behaviour at client end (who called walk_page_range).
+Userspace applications get the wrong data, so the effect is like just
+confusing users (if the applications just display the data) or sometimes
+killing the processes (if the applications do something with
+misunderstanding virtual addresses due to the wrong data.)
+
+For example for pagemap_read, when no callbacks are called against
+VM_PFNMAP vma, pagemap_read may prepare pagemap data for next virtual
+address range at wrong index.
+
+Eventually userspace may get wrong pagemap data for a task.
+Corresponding to a VM_PFNMAP marked vma region, kernel may report
+mappings from subsequent vma regions. User space in turn may account
+more pages (than really are) to the task.
+
+In my case I was using procmem, procrack (Android utility) which uses
+pagemap interface to account RSS pages of a task. Due to this bug it
+was giving a wrong picture for vmas (with VM_PFNMAP set).
+
+Fixes: a9ff785e4437 ("mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas")
+Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>
+Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/pagewalk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr,
+ */
+ if ((vma->vm_start <= addr) &&
+ (vma->vm_flags & VM_PFNMAP)) {
+- next = vma->vm_end;
++ if (walk->pte_hole)
++ err = walk->pte_hole(addr, next, walk);
++ if (err)
++ break;
+ pgd = pgd_offset(walk->mm, next);
+ continue;
+ }
--- /dev/null
+From 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Date: Thu, 5 Feb 2015 12:25:20 -0800
+Subject: nilfs2: fix deadlock of segment constructor over I_SYNC flag
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream.
+
+Nilfs2 eventually hangs in a stress test with fsstress program. This
+issue was caused by the following deadlock over I_SYNC flag between
+nilfs_segctor_thread() and writeback_sb_inodes():
+
+ nilfs_segctor_thread()
+ nilfs_segctor_thread_construct()
+ nilfs_segctor_unlock()
+ nilfs_dispose_list()
+ iput()
+ iput_final()
+ evict()
+ inode_wait_for_writeback() * wait for I_SYNC flag
+
+ writeback_sb_inodes()
+ * set I_SYNC flag on inode->i_state
+ __writeback_single_inode()
+ do_writepages()
+ nilfs_writepages()
+ nilfs_construct_dsync_segment()
+ nilfs_segctor_sync()
+ * wait for completion of segment constructor
+ inode_sync_complete()
+ * clear I_SYNC flag after __writeback_single_inode() completed
+
+writeback_sb_inodes() calls do_writepages() for dirty inodes after
+setting I_SYNC flag on inode->i_state. do_writepages() in turn calls
+nilfs_writepages(), which can run segment constructor and wait for its
+completion. On the other hand, segment constructor calls iput(), which
+can call evict() and wait for the I_SYNC flag on
+inode_wait_for_writeback().
+
+Since segment constructor doesn't know when I_SYNC will be set, it
+cannot know whether iput() will block or not unless inode->i_nlink has a
+non-zero count. We can prevent evict() from being called in iput() by
+implementing sop->drop_inode(), but it's not preferable to leave inodes
+with i_nlink == 0 for long periods because it even defers file
+truncation and inode deallocation. So, this instead resolves the
+deadlock by calling iput() asynchronously with a workqueue for inodes
+with i_nlink == 0.
+
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/nilfs.h | 2 --
+ fs/nilfs2/segment.c | 44 +++++++++++++++++++++++++++++++++++++++-----
+ fs/nilfs2/segment.h | 5 +++++
+ 3 files changed, 44 insertions(+), 7 deletions(-)
+
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -141,7 +141,6 @@ enum {
+ * @ti_save: Backup of journal_info field of task_struct
+ * @ti_flags: Flags
+ * @ti_count: Nest level
+- * @ti_garbage: List of inode to be put when releasing semaphore
+ */
+ struct nilfs_transaction_info {
+ u32 ti_magic;
+@@ -150,7 +149,6 @@ struct nilfs_transaction_info {
+ one of other filesystems has a bug. */
+ unsigned short ti_flags;
+ unsigned short ti_count;
+- struct list_head ti_garbage;
+ };
+
+ /* ti_magic */
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struc
+ ti->ti_count = 0;
+ ti->ti_save = cur_ti;
+ ti->ti_magic = NILFS_TI_MAGIC;
+- INIT_LIST_HEAD(&ti->ti_garbage);
+ current->journal_info = ti;
+
+ for (;;) {
+@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(str
+
+ up_write(&nilfs->ns_segctor_sem);
+ current->journal_info = ti->ti_save;
+- if (!list_empty(&ti->ti_garbage))
+- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
+ }
+
+ static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
+@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct th
+ }
+ }
+
++static void nilfs_iput_work_func(struct work_struct *work)
++{
++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
++ sc_iput_work);
++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
++
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
++}
++
+ static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
+ struct nilfs_root *root)
+ {
+@@ -1899,8 +1905,8 @@ static int nilfs_segctor_collect_dirty_f
+ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ struct the_nilfs *nilfs)
+ {
+- struct nilfs_transaction_info *ti = current->journal_info;
+ struct nilfs_inode_info *ii, *n;
++ int defer_iput = false;
+
+ spin_lock(&nilfs->ns_inode_lock);
+ list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
+@@ -1911,9 +1917,24 @@ static void nilfs_segctor_drop_written_f
+ clear_bit(NILFS_I_BUSY, &ii->i_state);
+ brelse(ii->i_bh);
+ ii->i_bh = NULL;
+- list_move_tail(&ii->i_dirty, &ti->ti_garbage);
++ list_del_init(&ii->i_dirty);
++ if (!ii->vfs_inode.i_nlink) {
++ /*
++ * Defer calling iput() to avoid a deadlock
++ * over I_SYNC flag for inodes with i_nlink == 0
++ */
++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
++ defer_iput = true;
++ } else {
++ spin_unlock(&nilfs->ns_inode_lock);
++ iput(&ii->vfs_inode);
++ spin_lock(&nilfs->ns_inode_lock);
++ }
+ }
+ spin_unlock(&nilfs->ns_inode_lock);
++
++ if (defer_iput)
++ schedule_work(&sci->sc_iput_work);
+ }
+
+ /*
+@@ -2580,6 +2601,8 @@ static struct nilfs_sc_info *nilfs_segct
+ INIT_LIST_HEAD(&sci->sc_segbufs);
+ INIT_LIST_HEAD(&sci->sc_write_logs);
+ INIT_LIST_HEAD(&sci->sc_gc_inodes);
++ INIT_LIST_HEAD(&sci->sc_iput_queue);
++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
+ init_timer(&sci->sc_timer);
+
+ sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
+@@ -2606,6 +2629,8 @@ static void nilfs_segctor_write_out(stru
+ ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
+ nilfs_transaction_unlock(sci->sc_super);
+
++ flush_work(&sci->sc_iput_work);
++
+ } while (ret && retrycount-- > 0);
+ }
+
+@@ -2630,6 +2655,9 @@ static void nilfs_segctor_destroy(struct
+ || sci->sc_seq_request != sci->sc_seq_done);
+ spin_unlock(&sci->sc_state_lock);
+
++ if (flush_work(&sci->sc_iput_work))
++ flag = true;
++
+ if (flag || !nilfs_segctor_confirm(sci))
+ nilfs_segctor_write_out(sci);
+
+@@ -2639,6 +2667,12 @@ static void nilfs_segctor_destroy(struct
+ nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
+ }
+
++ if (!list_empty(&sci->sc_iput_queue)) {
++ nilfs_warning(sci->sc_super, __func__,
++ "iput queue is not empty\n");
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
++ }
++
+ WARN_ON(!list_empty(&sci->sc_segbufs));
+ WARN_ON(!list_empty(&sci->sc_write_logs));
+
+--- a/fs/nilfs2/segment.h
++++ b/fs/nilfs2/segment.h
+@@ -26,6 +26,7 @@
+ #include <linux/types.h>
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/workqueue.h>
+ #include <linux/nilfs2_fs.h>
+ #include "nilfs.h"
+
+@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer {
+ * @sc_nblk_inc: Block count of current generation
+ * @sc_dirty_files: List of files to be written
+ * @sc_gc_inodes: List of GC inodes having blocks to be written
++ * @sc_iput_queue: list of inodes for which iput should be done
++ * @sc_iput_work: work struct to defer iput call
+ * @sc_freesegs: array of segment numbers to be freed
+ * @sc_nfreesegs: number of segments on @sc_freesegs
+ * @sc_dsync_inode: inode whose data pages are written for a sync operation
+@@ -135,6 +138,8 @@ struct nilfs_sc_info {
+
+ struct list_head sc_dirty_files;
+ struct list_head sc_gc_inodes;
++ struct list_head sc_iput_queue;
++ struct work_struct sc_iput_work;
+
+ __u64 *sc_freesegs;
+ size_t sc_nfreesegs;
--- /dev/null
+From 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 Mon Sep 17 00:00:00 2001
+From: Charlotte Richardson <charlotte.richardson@stratus.com>
+Date: Mon, 2 Feb 2015 09:36:23 -0600
+Subject: PCI: Add NEC variants to Stratus ftServer PCIe DMI check
+
+From: Charlotte Richardson <charlotte.richardson@stratus.com>
+
+commit 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 upstream.
+
+NEC OEMs the same platforms as Stratus does, which have multiple devices on
+some PCIe buses under downstream ports.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=51331
+Fixes: 1278998f8ff6 ("PCI: Work around Stratus ftServer broken PCIe hierarchy (fix DMI check)")
+Signed-off-by: Charlotte Richardson <charlotte.richardson@stratus.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Myron Stowe <myron.stowe@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/pci/common.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -448,6 +448,22 @@ static const struct dmi_system_id pcipro
+ DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"),
+ },
+ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"),
++ },
++ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch
+gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch
+pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch
+mips-fix-c0_pagegrain-support.patch
+mips-irq-fix-disable_irq-on-cpu-irqs.patch
+mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch
+mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch
+arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch
+complete-oplock-break-jobs-before-closing-file-handle.patch
+mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch
+lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch
+nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch
+kconfig-fix-warning-jump-may-be-used-uninitialized.patch
--- /dev/null
+gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch
+gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch
+gpio-mcp23s08-handle-default-gpio-base.patch
+pci-designware-reject-msi-x-irqs.patch
+pci-add-nec-variants-to-stratus-ftserver-pcie-dmi-check.patch
+pci-handle-read-only-bars-on-amd-cs553x-devices.patch
+spi-spi-fsl-dspi-remove-usage-of-devm_kzalloc.patch
+spi-imx-use-pio-mode-for-i.mx6dl.patch
+sd-fix-max-transfer-length-for-4k-disks.patch
+mips-fix-c0_pagegrain-support.patch
+mips-irq-fix-disable_irq-on-cpu-irqs.patch
+mips-octeon-fix-kernel-crash-when-offlining-a-cpu.patch
+mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch
+mips-traps-fix-inline-asm-ctc1-missing-.set-hardfloat.patch
+arm-8299-1-mm-ensure-local-active-asid-is-marked-as-allocated-on-rollover.patch
+complete-oplock-break-jobs-before-closing-file-handle.patch
+md-raid5-fix-another-livelock-caused-by-non-aligned-writes.patch
+mm-pagewalk-call-pte_hole-for-vm_pfnmap-during-walk_page_range.patch
+lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch
+memcg-shmem-fix-shmem-migration-to-use-lrucare.patch
+nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch
+drm-radeon-don-t-init-gpuvm-if-accel-is-disabled-v3.patch
+drm-radeon-fix-plls-on-rs880-and-older-v2.patch
+drm-radeon-fix-the-crash-in-benchmark-functions.patch
+drm-radeon-fix-the-crash-in-test-functions.patch
+drm-radeon-properly-set-vm-fragment-size-for-tn-rl.patch
+kconfig-fix-warning-jump-may-be-used-uninitialized.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
