--- /dev/null
+From 4c235cb9e35407bdb4a2debeef4dc8721e8f91f2 Mon Sep 17 00:00:00 2001
+From: Ben Peddell <klightspeed@killerwolves.net>
+Date: Mon, 13 Jan 2014 23:25:18 +0100
+Subject: ARM: 7941/2: Fix incorrect FDT initrd parameter override
+
+From: Ben Peddell <klightspeed@killerwolves.net>
+
+commit 4c235cb9e35407bdb4a2debeef4dc8721e8f91f2 upstream.
+
+Commit 65939301acdb (arm: set initrd_start/initrd_end for fdt scan)
+caused the FDT initrd_start and initrd_end to override the
+phys_initrd_start and phys_initrd_size set by the initrd= kernel
+parameter. With this patch initrd_start and initrd_end will be
+overridden if phys_initrd_start and phys_initrd_size are set by the
+kernel initrd= parameter.
+
+Fixes: 65939301acdb (arm: set initrd_start/initrd_end for fdt scan)
+
+Signed-off-by: Ben Peddell <klightspeed@killerwolves.net>
+Acked-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -345,10 +345,11 @@ void __init arm_memblock_init(struct mem
+ #endif
+ #ifdef CONFIG_BLK_DEV_INITRD
+ /* FDT scan will populate initrd_start */
+- if (initrd_start) {
++ if (initrd_start && !phys_initrd_size) {
+ phys_initrd_start = __virt_to_phys(initrd_start);
+ phys_initrd_size = initrd_end - initrd_start;
+ }
++ initrd_start = initrd_end = 0;
+ if (phys_initrd_size &&
+ !memblock_is_region_memory(phys_initrd_start, phys_initrd_size)) {
+ pr_err("INITRD: 0x%08llx+0x%08lx is not a memory region - disabling initrd\n",
--- /dev/null
+From e126a646f77fdd66978785cb0a3a5e46b07aee2e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 13 Feb 2014 16:54:24 -0700
+Subject: ASoC: max98090: make REVISION_ID readable
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit e126a646f77fdd66978785cb0a3a5e46b07aee2e upstream.
+
+The REVISION_ID register is not currently marked readable. snd_soc_read()
+refuses to read the register, and hence probe() fails.
+
+Fixes: d4807ad2c4c0 ("regmap: Check readable regs in _regmap_read")
+[exposed the bug, by checking for readability]
+Fixes: 685e42154dcf ("ASoC: Replace max98090 Device Driver")
+[left out this register from the readable list]
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/max98090.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -336,6 +336,7 @@ static bool max98090_readable_register(s
+ case M98090_REG_RECORD_TDM_SLOT:
+ case M98090_REG_SAMPLE_RATE:
+ case M98090_REG_DMIC34_BIQUAD_BASE ... M98090_REG_DMIC34_BIQUAD_BASE + 0x0E:
++ case M98090_REG_REVISION_ID:
+ return true;
+ default:
+ return false;
--- /dev/null
+From 0f4706d2740f2a221cd502922b22e522009041d9 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 18 Mar 2014 14:50:50 +0200
+Subject: drm/i915: Disable stolen memory when DMAR is active
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 0f4706d2740f2a221cd502922b22e522009041d9 upstream.
+
+We have reports of heavy screen corruption if we try to use the stolen
+memory reserved by the BIOS whilst the DMA-Remapper is active. This
+quirk may be only specific to a few machines or BIOSes, but first lets
+apply the big hammer and always disable use of stolen memory when DMAR
+is active.
+
+v2 by Jani: Rebase on -fixes, only look at intel_iommu_gfx_mapped.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=68535
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_stolen.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -201,6 +201,13 @@ int i915_gem_init_stolen(struct drm_devi
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ int bios_reserved = 0;
+
++#ifdef CONFIG_INTEL_IOMMU
++ if (intel_iommu_gfx_mapped) {
++ DRM_INFO("DMAR active, disabling use of stolen memory\n");
++ return 0;
++ }
++#endif
++
+ if (dev_priv->gtt.stolen_size == 0)
+ return 0;
+
--- /dev/null
+From 5c673b60a9b3b23486f4eda75c72e91d31d26a2b Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 7 Mar 2014 20:34:46 +0100
+Subject: drm/i915: Don't enable display error interrupts from the start
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 5c673b60a9b3b23486f4eda75c72e91d31d26a2b upstream.
+
+We need to enable interrupt processing before all the modeset
+state is set up. But that means we can fall over when we get a pipe
+underrun. This shouldn't happen as long as the bios works correctly
+but as usual this turns out to be wishful thinking.
+
+So disable error interrupts at irq install time and rely on the
+re-enabling code in the modeset functions to take care of this.
+
+Note that due to the SDE interrupt handling race we must
+uncondtionally enable all interrupt sources in SDEIER, hence no need
+to enable the SERR bit specifically.
+
+On gmch platforms we don't have an explicit enable/mask bit for fifo
+underruns. Fixing this up would require a bit of software tracking,
+hence is material for a separate patch. To make this possible we need
+to switch all gmch platforms to the new pipestat interrupt handling
+scheme Imre implemented for vlv, and then also add a safe form of sw
+state checking to __cpu_fifo_underrun_reporting_enabled a bit.
+
+v2: Also handle the ilk/snb cpu fifo underrun bits accordingly.
+Spotted by Ville.
+
+v3: Also handle the south interrupt underrun bits on ibx. Again
+spotted by Ville.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -2760,10 +2760,9 @@ static void ibx_irq_postinstall(struct d
+ return;
+
+ if (HAS_PCH_IBX(dev)) {
+- mask = SDE_GMBUS | SDE_AUX_MASK | SDE_TRANSB_FIFO_UNDER |
+- SDE_TRANSA_FIFO_UNDER | SDE_POISON;
++ mask = SDE_GMBUS | SDE_AUX_MASK | SDE_POISON;
+ } else {
+- mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT | SDE_ERROR_CPT;
++ mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT;
+
+ I915_WRITE(SERR_INT, I915_READ(SERR_INT));
+ }
+@@ -2823,20 +2822,19 @@ static int ironlake_irq_postinstall(stru
+ display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE_IVB |
+ DE_PCH_EVENT_IVB | DE_PLANEC_FLIP_DONE_IVB |
+ DE_PLANEB_FLIP_DONE_IVB |
+- DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB |
+- DE_ERR_INT_IVB);
++ DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB);
+ extra_mask = (DE_PIPEC_VBLANK_IVB | DE_PIPEB_VBLANK_IVB |
+- DE_PIPEA_VBLANK_IVB);
++ DE_PIPEA_VBLANK_IVB | DE_ERR_INT_IVB);
+
+ I915_WRITE(GEN7_ERR_INT, I915_READ(GEN7_ERR_INT));
+ } else {
+ display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+ DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE |
+ DE_AUX_CHANNEL_A |
+- DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN |
+ DE_PIPEB_CRC_DONE | DE_PIPEA_CRC_DONE |
+ DE_POISON);
+- extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT;
++ extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT |
++ DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN;
+ }
+
+ dev_priv->irq_mask = ~display_mask;
+@@ -2952,9 +2950,9 @@ static void gen8_de_irq_postinstall(stru
+ struct drm_device *dev = dev_priv->dev;
+ uint32_t de_pipe_masked = GEN8_PIPE_FLIP_DONE |
+ GEN8_PIPE_CDCLK_CRC_DONE |
+- GEN8_PIPE_FIFO_UNDERRUN |
+ GEN8_DE_PIPE_IRQ_FAULT_ERRORS;
+- uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK;
++ uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
++ GEN8_PIPE_FIFO_UNDERRUN;
+ int pipe;
+ dev_priv->de_irq_mask[PIPE_A] = ~de_pipe_masked;
+ dev_priv->de_irq_mask[PIPE_B] = ~de_pipe_masked;
--- /dev/null
+From 24bd9bf54d45d28089251cdf62bf14323d1aa827 Mon Sep 17 00:00:00 2001
+From: Ben Widawsky <benjamin.widawsky@intel.com>
+Date: Tue, 4 Mar 2014 22:38:10 -0800
+Subject: drm/i915: Fix PSR programming
+
+From: Ben Widawsky <benjamin.widawsky@intel.com>
+
+commit 24bd9bf54d45d28089251cdf62bf14323d1aa827 upstream.
+
+| has a higher precedence than ?. Therefore, the calculation doesn't do
+at all what you would expect. Thanks to Ken for convincing me that this
+was indeed the issue. Send me back to C programmer school, please.
+
+I'm sort of surprised PSR was continuing to work for people. It should
+be broken IMO (and it was broken for me, but I had assumed it never
+worked).
+
+Regression from:
+commit ed8546ac1f99b850879f07b1e9b06b42fb0a36d9
+Author: Ben Widawsky <benjamin.widawsky@intel.com>
+Date: Mon Nov 4 22:45:05 2013 -0800
+
+ drm/i915/bdw: Support eDP PSR
+
+Cc: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Cc: Kenneth Graunke <kenneth.w.graunke@intel.com>
+Cc: Art Runyan <arthur.j.runyan@intel.com>
+Reported-by: "Kumar, Kiran S" <kiran.s.kumar@intel.com>
+Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1634,7 +1634,7 @@ static void intel_edp_psr_enable_source(
+ val |= EDP_PSR_LINK_DISABLE;
+
+ I915_WRITE(EDP_PSR_CTL(dev), val |
+- IS_BROADWELL(dev) ? 0 : link_entry_time |
++ (IS_BROADWELL(dev) ? 0 : link_entry_time) |
+ max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
+ idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
+ EDP_PSR_ENABLE);
--- /dev/null
+From 117309c51dca42121f70cacec801511b76acf75c Mon Sep 17 00:00:00 2001
+From: Reyad Attiyat <reyad.attiyat@gmail.com>
+Date: Tue, 28 Jan 2014 16:17:57 +0100
+Subject: HID: microsoft: Add ID's for Surface Type/Touch Cover 2
+
+From: Reyad Attiyat <reyad.attiyat@gmail.com>
+
+commit 117309c51dca42121f70cacec801511b76acf75c upstream.
+
+The Microsoft Surface Type/Touch cover 2 devices have the flag HID_DG_CONTACTID
+in their reports.This causes the device to bind to the hid-multitouch driver,
+which doesn't handle generic keyboard/mouse input events. The patch adds
+the hardware id's of the device to hid-microsoft and to the HID special
+driver array, which makes the device get handled by hid-generic/hid-input
+properly.
+
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=64811
+
+Singed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com>
+Reviewed-by: Benjamin Tissoires<benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-core.c | 2 ++
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-microsoft.c | 4 ++++
+ 3 files changed, 8 insertions(+)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1778,6 +1778,8 @@ static const struct hid_device_id hid_ha
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -611,6 +611,8 @@
+ #define USB_DEVICE_ID_MS_PRESENTER_8K_USB 0x0713
+ #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K 0x0730
+ #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500 0x076c
++#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7
++#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
+
+ #define USB_VENDOR_ID_MOJO 0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -207,6 +207,10 @@ static const struct hid_device_id ms_dev
+ .driver_data = MS_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
+ .driver_data = MS_DUPLICATE_USAGES },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
++ .driver_data = 0 },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
++ .driver_data = 0 },
+
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
+ .driver_data = MS_PRESENTER },
--- /dev/null
+From d29adb34a94715174c88ca93e8aba955850c9bde Mon Sep 17 00:00:00 2001
+From: Josh Durgin <josh.durgin@inktank.com>
+Date: Mon, 2 Dec 2013 19:11:48 -0800
+Subject: libceph: block I/O when PAUSE or FULL osd map flags are set
+
+From: Josh Durgin <josh.durgin@inktank.com>
+
+commit d29adb34a94715174c88ca93e8aba955850c9bde upstream.
+
+The PAUSEWR and PAUSERD flags are meant to stop the cluster from
+processing writes and reads, respectively. The FULL flag is set when
+the cluster determines that it is out of space, and will no longer
+process writes. PAUSEWR and PAUSERD are purely client-side settings
+already implemented in userspace clients. The osd does nothing special
+with these flags.
+
+When the FULL flag is set, however, the osd responds to all writes
+with -ENOSPC. For cephfs, this makes sense, but for rbd the block
+layer translates this into EIO. If a cluster goes from full to
+non-full quickly, a filesystem on top of rbd will not behave well,
+since some writes succeed while others get EIO.
+
+Fix this by blocking any writes when the FULL flag is set in the osd
+client. This is the same strategy used by userspace, so apply it by
+default. A follow-on patch makes this configurable.
+
+__map_request() is called to re-target osd requests in case the
+available osds changed. Add a paused field to a ceph_osd_request, and
+set it whenever an appropriate osd map flag is set. Avoid queueing
+paused requests in __map_request(), but force them to be resent if
+they become unpaused.
+
+Also subscribe to the next osd map from the monitor if any of these
+flags are set, so paused requests can be unblocked as soon as
+possible.
+
+Fixes: http://tracker.ceph.com/issues/6079
+
+Reviewed-by: Sage Weil <sage@inktank.com>
+Signed-off-by: Josh Durgin <josh.durgin@inktank.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/ceph/osd_client.h | 1 +
+ net/ceph/osd_client.c | 29 +++++++++++++++++++++++++++--
+ 2 files changed, 28 insertions(+), 2 deletions(-)
+
+--- a/include/linux/ceph/osd_client.h
++++ b/include/linux/ceph/osd_client.h
+@@ -138,6 +138,7 @@ struct ceph_osd_request {
+ __le64 *r_request_pool;
+ void *r_request_pgid;
+ __le32 *r_request_attempts;
++ bool r_paused;
+ struct ceph_eversion *r_request_reassert_version;
+
+ int r_result;
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1232,6 +1232,22 @@ void ceph_osdc_set_request_linger(struct
+ EXPORT_SYMBOL(ceph_osdc_set_request_linger);
+
+ /*
++ * Returns whether a request should be blocked from being sent
++ * based on the current osdmap and osd_client settings.
++ *
++ * Caller should hold map_sem for read.
++ */
++static bool __req_should_be_paused(struct ceph_osd_client *osdc,
++ struct ceph_osd_request *req)
++{
++ bool pauserd = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD);
++ bool pausewr = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR) ||
++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL);
++ return (req->r_flags & CEPH_OSD_FLAG_READ && pauserd) ||
++ (req->r_flags & CEPH_OSD_FLAG_WRITE && pausewr);
++}
++
++/*
+ * Pick an osd (the first 'up' osd in the pg), allocate the osd struct
+ * (as needed), and set the request r_osd appropriately. If there is
+ * no up osd, set r_osd to NULL. Move the request to the appropriate list
+@@ -1248,6 +1264,7 @@ static int __map_request(struct ceph_osd
+ int acting[CEPH_PG_MAX_SIZE];
+ int o = -1, num = 0;
+ int err;
++ bool was_paused;
+
+ dout("map_request %p tid %lld\n", req, req->r_tid);
+ err = ceph_calc_ceph_pg(&pgid, req->r_oid, osdc->osdmap,
+@@ -1264,12 +1281,18 @@ static int __map_request(struct ceph_osd
+ num = err;
+ }
+
++ was_paused = req->r_paused;
++ req->r_paused = __req_should_be_paused(osdc, req);
++ if (was_paused && !req->r_paused)
++ force_resend = 1;
++
+ if ((!force_resend &&
+ req->r_osd && req->r_osd->o_osd == o &&
+ req->r_sent >= req->r_osd->o_incarnation &&
+ req->r_num_pg_osds == num &&
+ memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) ||
+- (req->r_osd == NULL && o == -1))
++ (req->r_osd == NULL && o == -1) ||
++ req->r_paused)
+ return 0; /* no change */
+
+ dout("map_request tid %llu pgid %lld.%x osd%d (was osd%d)\n",
+@@ -1804,7 +1827,9 @@ done:
+ * we find out when we are no longer full and stop returning
+ * ENOSPC.
+ */
+- if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL))
++ if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL) ||
++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD) ||
++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR))
+ ceph_monc_request_next_osdmap(&osdc->client->monc);
+
+ mutex_lock(&osdc->request_mutex);
--- /dev/null
+From 9a1ea2dbff11547a8e664f143c1ffefc586a577a Mon Sep 17 00:00:00 2001
+From: Josh Durgin <josh.durgin@inktank.com>
+Date: Tue, 10 Dec 2013 09:35:13 -0800
+Subject: libceph: resend all writes after the osdmap loses the full flag
+
+From: Josh Durgin <josh.durgin@inktank.com>
+
+commit 9a1ea2dbff11547a8e664f143c1ffefc586a577a upstream.
+
+With the current full handling, there is a race between osds and
+clients getting the first map marked full. If the osd wins, it will
+return -ENOSPC to any writes, but the client may already have writes
+in flight. This results in the client getting the error and
+propagating it up the stack. For rbd, the block layer turns this into
+EIO, which can cause corruption in filesystems above it.
+
+To avoid this race, osds are being changed to drop writes that came
+from clients with an osdmap older than the last osdmap marked full.
+In order for this to work, clients must resend all writes after they
+encounter a full -> not full transition in the osdmap. osds will wait
+for an updated map instead of processing a request from a client with
+a newer map, so resent writes will not be dropped by the osd unless
+there is another not full -> full transition.
+
+This approach requires both osds and clients to be fixed to avoid the
+race. Old clients talking to osds with this fix may hang instead of
+returning EIO and potentially corrupting an fs. New clients talking to
+old osds have the same behavior as before if they encounter this race.
+
+Fixes: http://tracker.ceph.com/issues/6938
+
+Reviewed-by: Sage Weil <sage@inktank.com>
+Signed-off-by: Josh Durgin <josh.durgin@inktank.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/osd_client.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1636,14 +1636,17 @@ static void reset_changed_osds(struct ce
+ *
+ * Caller should hold map_sem for read.
+ */
+-static void kick_requests(struct ceph_osd_client *osdc, int force_resend)
++static void kick_requests(struct ceph_osd_client *osdc, bool force_resend,
++ bool force_resend_writes)
+ {
+ struct ceph_osd_request *req, *nreq;
+ struct rb_node *p;
+ int needmap = 0;
+ int err;
++ bool force_resend_req;
+
+- dout("kick_requests %s\n", force_resend ? " (force resend)" : "");
++ dout("kick_requests %s %s\n", force_resend ? " (force resend)" : "",
++ force_resend_writes ? " (force resend writes)" : "");
+ mutex_lock(&osdc->request_mutex);
+ for (p = rb_first(&osdc->requests); p; ) {
+ req = rb_entry(p, struct ceph_osd_request, r_node);
+@@ -1668,7 +1671,10 @@ static void kick_requests(struct ceph_os
+ continue;
+ }
+
+- err = __map_request(osdc, req, force_resend);
++ force_resend_req = force_resend ||
++ (force_resend_writes &&
++ req->r_flags & CEPH_OSD_FLAG_WRITE);
++ err = __map_request(osdc, req, force_resend_req);
+ if (err < 0)
+ continue; /* error */
+ if (req->r_osd == NULL) {
+@@ -1688,7 +1694,8 @@ static void kick_requests(struct ceph_os
+ r_linger_item) {
+ dout("linger req=%p req->r_osd=%p\n", req, req->r_osd);
+
+- err = __map_request(osdc, req, force_resend);
++ err = __map_request(osdc, req,
++ force_resend || force_resend_writes);
+ dout("__map_request returned %d\n", err);
+ if (err == 0)
+ continue; /* no change and no osd was specified */
+@@ -1730,6 +1737,7 @@ void ceph_osdc_handle_map(struct ceph_os
+ struct ceph_osdmap *newmap = NULL, *oldmap;
+ int err;
+ struct ceph_fsid fsid;
++ bool was_full;
+
+ dout("handle_map have %u\n", osdc->osdmap ? osdc->osdmap->epoch : 0);
+ p = msg->front.iov_base;
+@@ -1743,6 +1751,8 @@ void ceph_osdc_handle_map(struct ceph_os
+
+ down_write(&osdc->map_sem);
+
++ was_full = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL);
++
+ /* incremental maps */
+ ceph_decode_32_safe(&p, end, nr_maps, bad);
+ dout(" %d inc maps\n", nr_maps);
+@@ -1767,7 +1777,10 @@ void ceph_osdc_handle_map(struct ceph_os
+ ceph_osdmap_destroy(osdc->osdmap);
+ osdc->osdmap = newmap;
+ }
+- kick_requests(osdc, 0);
++ was_full = was_full ||
++ ceph_osdmap_flag(osdc->osdmap,
++ CEPH_OSDMAP_FULL);
++ kick_requests(osdc, 0, was_full);
+ } else {
+ dout("ignoring incremental map %u len %d\n",
+ epoch, maplen);
+@@ -1810,7 +1823,10 @@ void ceph_osdc_handle_map(struct ceph_os
+ skipped_map = 1;
+ ceph_osdmap_destroy(oldmap);
+ }
+- kick_requests(osdc, skipped_map);
++ was_full = was_full ||
++ ceph_osdmap_flag(osdc->osdmap,
++ CEPH_OSDMAP_FULL);
++ kick_requests(osdc, skipped_map, was_full);
+ }
+ p += maplen;
+ nr_maps--;
--- /dev/null
+From e351bf25fa373a3de0be2141b962c5c3c27006a2 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Nov 2013 04:51:47 -0300
+Subject: media: cx18: check for allocation failure in cx18_read_eeprom()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e351bf25fa373a3de0be2141b962c5c3c27006a2 upstream.
+
+It upsets static checkers when we don't check for allocation failure. I
+moved the memset() of "tv" earlier so we don't use uninitialized data on
+error.
+Fixes: 1d212cf0c2d8 ('[media] cx18: struct i2c_client is too big for stack')
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Andy Walls <awalls@md.metrocast.net>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/cx18/cx18-driver.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -327,13 +327,16 @@ void cx18_read_eeprom(struct cx18 *cx, s
+ struct i2c_client *c;
+ u8 eedata[256];
+
++ memset(tv, 0, sizeof(*tv));
++
+ c = kzalloc(sizeof(*c), GFP_KERNEL);
++ if (!c)
++ return;
+
+ strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
+ c->adapter = &cx->i2c_adap[0];
+ c->addr = 0xa0 >> 1;
+
+- memset(tv, 0, sizeof(*tv));
+ if (tveeprom_read(c, eedata, sizeof(eedata)))
+ goto ret;
+
--- /dev/null
+From 1cdbcc5db4e6d51ce9bb1313195167cada9aa6e9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Nov 2013 04:55:43 -0300
+Subject: media: cxusb: unlock on error in cxusb_i2c_xfer()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 1cdbcc5db4e6d51ce9bb1313195167cada9aa6e9 upstream.
+
+We recently introduced some new error paths which are missing their
+unlocks.
+Fixes: 64f7ef8afbf8 ('[media] cxusb: Don't use dynamic static allocation')
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/cxusb.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -149,6 +149,7 @@ static int cxusb_i2c_xfer(struct i2c_ada
+ int num)
+ {
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
++ int ret;
+ int i;
+
+ if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
+@@ -173,7 +174,8 @@ static int cxusb_i2c_xfer(struct i2c_ada
+ if (1 + msg[i].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[i].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = 0;
+ obuf[1] = msg[i].len;
+@@ -193,12 +195,14 @@ static int cxusb_i2c_xfer(struct i2c_ada
+ if (3 + msg[i].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[i].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ if (1 + msg[i + 1].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[i + 1].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = msg[i].len;
+ obuf[1] = msg[i+1].len;
+@@ -223,7 +227,8 @@ static int cxusb_i2c_xfer(struct i2c_ada
+ if (2 + msg[i].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[i].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = msg[i].addr;
+ obuf[1] = msg[i].len;
+@@ -237,8 +242,14 @@ static int cxusb_i2c_xfer(struct i2c_ada
+ }
+ }
+
++ if (i == num)
++ ret = num;
++ else
++ ret = -EREMOTEIO;
++
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+- return i == num ? num : -EREMOTEIO;
++ return ret;
+ }
+
+ static u32 cxusb_i2c_func(struct i2c_adapter *adapter)
--- /dev/null
+From 324ed533bf0b23c309b805272c4ffcc5d51493a6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Nov 2013 04:56:33 -0300
+Subject: media: dw2102: some missing unlocks on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 324ed533bf0b23c309b805272c4ffcc5d51493a6 upstream.
+
+We recently introduced some new error paths but the unlocks are missing.
+Fixes: 0065a79a8698 ('[media] dw2102: Don't use dynamic static allocation')
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/dw2102.c | 52 +++++++++++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 16 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -301,6 +301,7 @@ static int dw2102_serit_i2c_transfer(str
+ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num)
+ {
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
++ int ret;
+
+ if (!d)
+ return -ENODEV;
+@@ -316,7 +317,8 @@ static int dw2102_earda_i2c_transfer(str
+ if (2 + msg[1].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ obuf[0] = msg[0].addr << 1;
+@@ -340,7 +342,8 @@ static int dw2102_earda_i2c_transfer(str
+ if (2 + msg[0].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[1].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ obuf[0] = msg[0].addr << 1;
+@@ -357,7 +360,8 @@ static int dw2102_earda_i2c_transfer(str
+ if (2 + msg[0].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[1].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ obuf[0] = msg[0].addr << 1;
+@@ -386,15 +390,17 @@ static int dw2102_earda_i2c_transfer(str
+
+ break;
+ }
++ ret = num;
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+- return num;
++ return ret;
+ }
+
+ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num)
+ {
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
+- int len, i, j;
++ int len, i, j, ret;
+
+ if (!d)
+ return -ENODEV;
+@@ -430,7 +436,8 @@ static int dw2104_i2c_transfer(struct i2
+ if (2 + msg[j].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[j].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ dw210x_op_rw(d->udev, 0xc3,
+@@ -466,7 +473,8 @@ static int dw2104_i2c_transfer(struct i2
+ if (2 + msg[j].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[j].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ obuf[0] = msg[j].addr << 1;
+@@ -481,15 +489,18 @@ static int dw2104_i2c_transfer(struct i2
+ }
+
+ }
++ ret = num;
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+- return num;
++ return ret;
+ }
+
+ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ int num)
+ {
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
++ int ret;
+ int i;
+
+ if (!d)
+@@ -506,7 +517,8 @@ static int dw3101_i2c_transfer(struct i2
+ if (2 + msg[1].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = msg[0].addr << 1;
+ obuf[1] = msg[0].len;
+@@ -530,7 +542,8 @@ static int dw3101_i2c_transfer(struct i2
+ if (2 + msg[0].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[0].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = msg[0].addr << 1;
+ obuf[1] = msg[0].len;
+@@ -556,9 +569,11 @@ static int dw3101_i2c_transfer(struct i2
+ msg[i].flags == 0 ? ">>>" : "<<<");
+ debug_dump(msg[i].buf, msg[i].len, deb_xfer);
+ }
++ ret = num;
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+- return num;
++ return ret;
+ }
+
+ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+@@ -566,7 +581,7 @@ static int s6x0_i2c_transfer(struct i2c_
+ {
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
+ struct usb_device *udev;
+- int len, i, j;
++ int len, i, j, ret;
+
+ if (!d)
+ return -ENODEV;
+@@ -618,7 +633,8 @@ static int s6x0_i2c_transfer(struct i2c_
+ if (msg[j].len > sizeof(ibuf)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[j].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ dw210x_op_rw(d->udev, 0x91, 0, 0,
+@@ -652,7 +668,8 @@ static int s6x0_i2c_transfer(struct i2c_
+ if (2 + msg[j].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[j].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+
+ obuf[0] = msg[j + 1].len;
+@@ -671,7 +688,8 @@ static int s6x0_i2c_transfer(struct i2c_
+ if (2 + msg[j].len > sizeof(obuf)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[j].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ obuf[0] = msg[j].len + 1;
+ obuf[1] = (msg[j].addr << 1);
+@@ -685,9 +703,11 @@ static int s6x0_i2c_transfer(struct i2c_
+ }
+ }
+ }
++ ret = num;
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+- return num;
++ return ret;
+ }
+
+ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
--- /dev/null
+From 33b7107f59a61236d94ecd6b45e20283cd5abcc8 Mon Sep 17 00:00:00 2001
+From: Christian Riesch <christian.riesch@omicron.at>
+Date: Mon, 24 Mar 2014 13:46:26 +0100
+Subject: net: davinci_emac: Replace devm_request_irq with request_irq
+
+From: Christian Riesch <christian.riesch@omicron.at>
+
+commit 33b7107f59a61236d94ecd6b45e20283cd5abcc8 upstream.
+
+In commit 6892b41d9701283085b655c6086fb57a5d63fa47
+
+Author: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Date: Tue Jun 25 21:24:51 2013 +0530
+net: davinci: emac: Convert to devm_* api
+
+the call of request_irq is replaced by devm_request_irq and the call
+of free_irq is removed. But since interrupts are requested in
+emac_dev_open, doing ifconfig up/down on the board requests the
+interrupts again each time, causing devm_request_irq to fail. The
+interface is dead until the device is rebooted.
+
+This patch reverts said commit partially: It changes the driver back
+to use request_irq instead of devm_request_irq, puts free_irq back in
+place, but keeps the remaining changes of the original patch.
+
+Reported-by: Jon Ringle <jon@ringle.org>
+Signed-off-by: Christian Riesch <christian.riesch@omicron.at>
+Cc: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1532,7 +1532,7 @@ static int emac_dev_open(struct net_devi
+ struct device *emac_dev = &ndev->dev;
+ u32 cnt;
+ struct resource *res;
+- int ret;
++ int q, m, ret;
+ int i = 0;
+ int k = 0;
+ struct emac_priv *priv = netdev_priv(ndev);
+@@ -1567,8 +1567,7 @@ static int emac_dev_open(struct net_devi
+
+ while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
+ for (i = res->start; i <= res->end; i++) {
+- if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
+- 0, ndev->name, ndev))
++ if (request_irq(i, emac_irq, 0, ndev->name, ndev))
+ goto rollback;
+ }
+ k++;
+@@ -1641,7 +1640,15 @@ static int emac_dev_open(struct net_devi
+
+ rollback:
+
+- dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
++ dev_err(emac_dev, "DaVinci EMAC: request_irq() failed");
++
++ for (q = k; k >= 0; k--) {
++ for (m = i; m >= res->start; m--)
++ free_irq(m, ndev);
++ res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k-1);
++ m = res->end;
++ }
++
+ ret = -EBUSY;
+ err:
+ pm_runtime_put(&priv->pdev->dev);
+@@ -1659,6 +1666,9 @@ err:
+ */
+ static int emac_dev_stop(struct net_device *ndev)
+ {
++ struct resource *res;
++ int i = 0;
++ int irq_num;
+ struct emac_priv *priv = netdev_priv(ndev);
+ struct device *emac_dev = &ndev->dev;
+
+@@ -1674,6 +1684,13 @@ static int emac_dev_stop(struct net_devi
+ if (priv->phydev)
+ phy_disconnect(priv->phydev);
+
++ /* Free IRQ */
++ while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
++ for (irq_num = res->start; irq_num <= res->end; irq_num++)
++ free_irq(irq_num, priv->ndev);
++ i++;
++ }
++
+ if (netif_msg_drv(priv))
+ dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
+
--- /dev/null
+From 292f503cade2b1d966239ef56a851e6897d1ba92 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sun, 16 Feb 2014 21:42:56 -0500
+Subject: NFSv4: Use the correct net namespace in nfs4_update_server
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 292f503cade2b1d966239ef56a851e6897d1ba92 upstream.
+
+We need to use the same net namespace that was used to resolve
+the hostname and sockaddr arguments.
+
+Fixes: 32e62b7c3ef09 (NFS: Add nfs4_update_server)
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/internal.h | 3 ++-
+ fs/nfs/nfs4client.c | 7 ++++---
+ fs/nfs/nfs4namespace.c | 12 ++++++------
+ 3 files changed, 12 insertions(+), 10 deletions(-)
+
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -176,7 +176,8 @@ extern struct nfs_server *nfs4_create_se
+ extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
+ struct nfs_fh *);
+ extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
+- struct sockaddr *sap, size_t salen);
++ struct sockaddr *sap, size_t salen,
++ struct net *net);
+ extern void nfs_free_server(struct nfs_server *server);
+ extern struct nfs_server *nfs_clone_server(struct nfs_server *,
+ struct nfs_fh *,
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -1133,6 +1133,7 @@ static int nfs_probe_destination(struct
+ * @hostname: new end-point's hostname
+ * @sap: new end-point's socket address
+ * @salen: size of "sap"
++ * @net: net namespace
+ *
+ * The nfs_server must be quiescent before this function is invoked.
+ * Either its session is drained (NFSv4.1+), or its transport is
+@@ -1141,13 +1142,13 @@ static int nfs_probe_destination(struct
+ * Returns zero on success, or a negative errno value.
+ */
+ int nfs4_update_server(struct nfs_server *server, const char *hostname,
+- struct sockaddr *sap, size_t salen)
++ struct sockaddr *sap, size_t salen, struct net *net)
+ {
+ struct nfs_client *clp = server->nfs_client;
+ struct rpc_clnt *clnt = server->client;
+ struct xprt_create xargs = {
+ .ident = clp->cl_proto,
+- .net = &init_net,
++ .net = net,
+ .dstaddr = sap,
+ .addrlen = salen,
+ .servername = hostname,
+@@ -1187,7 +1188,7 @@ int nfs4_update_server(struct nfs_server
+ error = nfs4_set_client(server, hostname, sap, salen, buf,
+ clp->cl_rpcclient->cl_auth->au_flavor,
+ clp->cl_proto, clnt->cl_timeout,
+- clp->cl_minorversion, clp->cl_net);
++ clp->cl_minorversion, net);
+ nfs_put_client(clp);
+ if (error != 0) {
+ nfs_server_insert_lists(server);
+--- a/fs/nfs/nfs4namespace.c
++++ b/fs/nfs/nfs4namespace.c
+@@ -121,9 +121,8 @@ static int nfs4_validate_fspath(struct d
+ }
+
+ static size_t nfs_parse_server_name(char *string, size_t len,
+- struct sockaddr *sa, size_t salen, struct nfs_server *server)
++ struct sockaddr *sa, size_t salen, struct net *net)
+ {
+- struct net *net = rpc_net_ns(server->client);
+ ssize_t ret;
+
+ ret = rpc_pton(net, string, len, sa, salen);
+@@ -223,6 +222,7 @@ static struct vfsmount *try_location(str
+ const struct nfs4_fs_location *location)
+ {
+ const size_t addr_bufsize = sizeof(struct sockaddr_storage);
++ struct net *net = rpc_net_ns(NFS_SB(mountdata->sb)->client);
+ struct vfsmount *mnt = ERR_PTR(-ENOENT);
+ char *mnt_path;
+ unsigned int maxbuflen;
+@@ -248,8 +248,7 @@ static struct vfsmount *try_location(str
+ continue;
+
+ mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
+- mountdata->addr, addr_bufsize,
+- NFS_SB(mountdata->sb));
++ mountdata->addr, addr_bufsize, net);
+ if (mountdata->addrlen == 0)
+ continue;
+
+@@ -419,6 +418,7 @@ static int nfs4_try_replacing_one_locati
+ const struct nfs4_fs_location *location)
+ {
+ const size_t addr_bufsize = sizeof(struct sockaddr_storage);
++ struct net *net = rpc_net_ns(server->client);
+ struct sockaddr *sap;
+ unsigned int s;
+ size_t salen;
+@@ -440,7 +440,7 @@ static int nfs4_try_replacing_one_locati
+ continue;
+
+ salen = nfs_parse_server_name(buf->data, buf->len,
+- sap, addr_bufsize, server);
++ sap, addr_bufsize, net);
+ if (salen == 0)
+ continue;
+ rpc_set_port(sap, NFS_PORT);
+@@ -450,7 +450,7 @@ static int nfs4_try_replacing_one_locati
+ if (hostname == NULL)
+ break;
+
+- error = nfs4_update_server(server, hostname, sap, salen);
++ error = nfs4_update_server(server, hostname, sap, salen, net);
+ kfree(hostname);
+ if (error == 0)
+ break;
--- /dev/null
+From a2fb4d782c61f77480e586578eeb4dfd27d134ea Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 23 Mar 2014 16:39:52 +0100
+Subject: partly revert commit 8a10bc9: parisc/sti_console: prefer Linux fonts over built-in ROM fonts
+
+From: Helge Deller <deller@gmx.de>
+
+commit a2fb4d782c61f77480e586578eeb4dfd27d134ea upstream.
+
+STI console is used on parisc and m68k HP machines. This patch partly reverts
+my previous commit and as such restores the fonts for the m68k machines.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/fonts/Kconfig | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/lib/fonts/Kconfig
++++ b/lib/fonts/Kconfig
+@@ -9,7 +9,7 @@ if FONT_SUPPORT
+
+ config FONTS
+ bool "Select compiled-in fonts"
+- depends on FRAMEBUFFER_CONSOLE
++ depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ help
+ Say Y here if you would like to use fonts other than the default
+ your frame buffer console usually use.
+@@ -22,7 +22,7 @@ config FONTS
+
+ config FONT_8x8
+ bool "VGA 8x8 font" if FONTS
+- depends on FRAMEBUFFER_CONSOLE
++ depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ default y if !SPARC && !FONTS
+ help
+ This is the "high resolution" font for the VGA frame buffer (the one
+@@ -45,7 +45,7 @@ config FONT_8x16
+
+ config FONT_6x11
+ bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
+- depends on FRAMEBUFFER_CONSOLE
++ depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
+ default y if !SPARC && !FONTS && MAC
+ help
+ Small console font with Macintosh-style high-half glyphs. Some Mac
hid-hidraw-fix-warning-destroying-hidraw-device-files-after-parent.patch
alsa-compress-pass-through-return-value-of-open-ops-callback.patch
clocksource-vf_pit_timer-use-complement-for-sched_clock-reading.patch
+drm-i915-fix-psr-programming.patch
+drm-i915-don-t-enable-display-error-interrupts-from-the-start.patch
+drm-i915-disable-stolen-memory-when-dmar-is-active.patch
+tracing-fix-array-size-mismatch-in-format-string.patch
+partly-revert-commit-8a10bc9-parisc-sti_console-prefer-linux-fonts-over-built-in-rom-fonts.patch
+net-davinci_emac-replace-devm_request_irq-with-request_irq.patch
+nfsv4-use-the-correct-net-namespace-in-nfs4_update_server.patch
+hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch
+media-cxusb-unlock-on-error-in-cxusb_i2c_xfer.patch
+media-dw2102-some-missing-unlocks-on-error.patch
+media-cx18-check-for-allocation-failure-in-cx18_read_eeprom.patch
+libceph-block-i-o-when-pause-or-full-osd-map-flags-are-set.patch
+libceph-resend-all-writes-after-the-osdmap-loses-the-full-flag.patch
+asoc-max98090-make-revision_id-readable.patch
+stop_machine-fix-2-race-between-stop_two_cpus-and-stop_cpus.patch
+sfc-use-the-correct-maximum-tx-dma-ring-size-for-sfc9100.patch
+arm-7941-2-fix-incorrect-fdt-initrd-parameter-override.patch
--- /dev/null
+From d9317aea16ecec7694271ef11fb7791a0f0d9cc5 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Thu, 23 Jan 2014 14:35:48 +0000
+Subject: sfc: Use the correct maximum TX DMA ring size for SFC9100
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit d9317aea16ecec7694271ef11fb7791a0f0d9cc5 upstream.
+
+As part of a workaround for a hardware erratum in the SFC9100 family
+(SF bug 35388), the TX_DESC_UPD_DWORD register address is also used
+for communicating with the event block, and only descriptor pointer
+values < 2048 are valid.
+
+If the TX DMA ring size is increased to 4096 descriptors (which the
+firmware still allows) then we may write a descriptor pointer
+value >= 2048, which has entirely different and undesirable effects!
+
+Limit the TX DMA ring size correctly when this workaround is in
+effect.
+
+Fixes: 8127d661e77f ('sfc: Add support for Solarflare SFC9100 family')
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Shradha Shah <sshah@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/sfc/efx.h | 3 +++
+ drivers/net/ethernet/sfc/ethtool.c | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/efx.h
++++ b/drivers/net/ethernet/sfc/efx.h
+@@ -66,6 +66,9 @@ void efx_schedule_slow_fill(struct efx_r
+ #define EFX_RXQ_MIN_ENT 128U
+ #define EFX_TXQ_MIN_ENT(efx) (2 * efx_tx_max_skb_descs(efx))
+
++#define EFX_TXQ_MAX_ENT(efx) (EFX_WORKAROUND_35388(efx) ? \
++ EFX_MAX_DMAQ_SIZE / 2 : EFX_MAX_DMAQ_SIZE)
++
+ /* Filters */
+
+ /**
+--- a/drivers/net/ethernet/sfc/ethtool.c
++++ b/drivers/net/ethernet/sfc/ethtool.c
+@@ -583,7 +583,7 @@ static void efx_ethtool_get_ringparam(st
+ struct efx_nic *efx = netdev_priv(net_dev);
+
+ ring->rx_max_pending = EFX_MAX_DMAQ_SIZE;
+- ring->tx_max_pending = EFX_MAX_DMAQ_SIZE;
++ ring->tx_max_pending = EFX_TXQ_MAX_ENT(efx);
+ ring->rx_pending = efx->rxq_entries;
+ ring->tx_pending = efx->txq_entries;
+ }
+@@ -596,7 +596,7 @@ static int efx_ethtool_set_ringparam(str
+
+ if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
+ ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
+- ring->tx_pending > EFX_MAX_DMAQ_SIZE)
++ ring->tx_pending > EFX_TXQ_MAX_ENT(efx))
+ return -EINVAL;
+
+ if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
--- /dev/null
+From 177c53d943368fc97644ebc0a250dc8e2d124250 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 28 Feb 2014 13:39:05 +0100
+Subject: stop_machine: Fix^2 race between stop_two_cpus() and stop_cpus()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 177c53d943368fc97644ebc0a250dc8e2d124250 upstream.
+
+We must use smp_call_function_single(.wait=1) for the
+irq_cpu_stop_queue_work() to ensure the queueing is actually done under
+stop_cpus_lock. Without this we could have dropped the lock by the time
+we do the queueing and get the race we tried to fix.
+
+Fixes: 7053ea1a34fa ("stop_machine: Fix race between stop_two_cpus() and stop_cpus()")
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Prarit Bhargava <prarit@redhat.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Link: http://lkml.kernel.org/r/20140228123905.GK3104@twins.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/stop_machine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/stop_machine.c
++++ b/kernel/stop_machine.c
+@@ -293,7 +293,7 @@ int stop_two_cpus(unsigned int cpu1, uns
+ */
+ smp_call_function_single(min(cpu1, cpu2),
+ &irq_cpu_stop_queue_work,
+- &call_args, 0);
++ &call_args, 1);
+ lg_local_unlock(&stop_cpus_lock);
+ preempt_enable();
+
--- /dev/null
+From 87291347c49dc40aa339f587b209618201c2e527 Mon Sep 17 00:00:00 2001
+From: Vaibhav Nagarnaik <vnagarnaik@google.com>
+Date: Thu, 13 Feb 2014 19:51:48 -0800
+Subject: tracing: Fix array size mismatch in format string
+
+From: Vaibhav Nagarnaik <vnagarnaik@google.com>
+
+commit 87291347c49dc40aa339f587b209618201c2e527 upstream.
+
+In event format strings, the array size is reported in two locations.
+One in array subscript and then via the "size:" attribute. The values
+reported there have a mismatch.
+
+For e.g., in sched:sched_switch the prev_comm and next_comm character
+arrays have subscript values as [32] where as the actual field size is
+16.
+
+name: sched_switch
+ID: 301
+format:
+ field:unsigned short common_type; offset:0; size:2; signed:0;
+ field:unsigned char common_flags; offset:2; size:1; signed:0;
+ field:unsigned char common_preempt_count; offset:3; size:1;signed:0;
+ field:int common_pid; offset:4; size:4; signed:1;
+
+ field:char prev_comm[32]; offset:8; size:16; signed:1;
+ field:pid_t prev_pid; offset:24; size:4; signed:1;
+ field:int prev_prio; offset:28; size:4; signed:1;
+ field:long prev_state; offset:32; size:8; signed:1;
+ field:char next_comm[32]; offset:40; size:16; signed:1;
+ field:pid_t next_pid; offset:56; size:4; signed:1;
+ field:int next_prio; offset:60; size:4; signed:1;
+
+After bisection, the following commit was blamed:
+92edca0 tracing: Use direct field, type and system names
+
+This commit removes the duplication of strings for field->name and
+field->type assuming that all the strings passed in
+__trace_define_field() are immutable. This is not true for arrays, where
+the type string is created in event_storage variable and field->type for
+all array fields points to event_storage.
+
+Use __stringify() to create a string constant for the type string.
+
+Also, get rid of event_storage and event_storage_mutex that are not
+needed anymore.
+
+also, an added benefit is that this reduces the overhead of events a bit more:
+
+ text data bss dec hex filename
+8424787 2036472 1302528 11763787 b3804b vmlinux
+8420814 2036408 1302528 11759750 b37086 vmlinux.patched
+
+Link: http://lkml.kernel.org/r/1392349908-29685-1-git-send-email-vnagarnaik@google.com
+
+Cc: Laurent Chavey <chavey@google.com>
+Signed-off-by: Vaibhav Nagarnaik <vnagarnaik@google.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/ftrace_event.h | 4 ----
+ include/trace/ftrace.h | 7 ++-----
+ kernel/trace/trace_events.c | 6 ------
+ kernel/trace/trace_export.c | 7 ++-----
+ 4 files changed, 4 insertions(+), 20 deletions(-)
+
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -356,10 +356,6 @@ enum {
+ FILTER_TRACE_FN,
+ };
+
+-#define EVENT_STORAGE_SIZE 128
+-extern struct mutex event_storage_mutex;
+-extern char event_storage[EVENT_STORAGE_SIZE];
+-
+ extern int trace_event_raw_init(struct ftrace_event_call *call);
+ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
+ const char *name, int offset, int size,
+--- a/include/trace/ftrace.h
++++ b/include/trace/ftrace.h
+@@ -310,15 +310,12 @@ static struct trace_event_functions ftra
+ #undef __array
+ #define __array(type, item, len) \
+ do { \
+- mutex_lock(&event_storage_mutex); \
++ char *type_str = #type"["__stringify(len)"]"; \
+ BUILD_BUG_ON(len > MAX_FILTER_STR_VAL); \
+- snprintf(event_storage, sizeof(event_storage), \
+- "%s[%d]", #type, len); \
+- ret = trace_define_field(event_call, event_storage, #item, \
++ ret = trace_define_field(event_call, type_str, #item, \
+ offsetof(typeof(field), item), \
+ sizeof(field.item), \
+ is_signed_type(type), FILTER_OTHER); \
+- mutex_unlock(&event_storage_mutex); \
+ if (ret) \
+ return ret; \
+ } while (0);
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -27,12 +27,6 @@
+
+ DEFINE_MUTEX(event_mutex);
+
+-DEFINE_MUTEX(event_storage_mutex);
+-EXPORT_SYMBOL_GPL(event_storage_mutex);
+-
+-char event_storage[EVENT_STORAGE_SIZE];
+-EXPORT_SYMBOL_GPL(event_storage);
+-
+ LIST_HEAD(ftrace_events);
+ static LIST_HEAD(ftrace_common_fields);
+
+--- a/kernel/trace/trace_export.c
++++ b/kernel/trace/trace_export.c
+@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_c
+ #undef __array
+ #define __array(type, item, len) \
+ do { \
++ char *type_str = #type"["__stringify(len)"]"; \
+ BUILD_BUG_ON(len > MAX_FILTER_STR_VAL); \
+- mutex_lock(&event_storage_mutex); \
+- snprintf(event_storage, sizeof(event_storage), \
+- "%s[%d]", #type, len); \
+- ret = trace_define_field(event_call, event_storage, #item, \
++ ret = trace_define_field(event_call, type_str, #item, \
+ offsetof(typeof(field), item), \
+ sizeof(field.item), \
+ is_signed_type(type), filter_type); \
+- mutex_unlock(&event_storage_mutex); \
+ if (ret) \
+ return ret; \
+ } while (0);
projects / thirdparty / kernel / stable-queue.git / commitdiff
