--- /dev/null
+From c021f241f4fab2bb4fc4120a38a828a03dd3f970 Mon Sep 17 00:00:00 2001
+From: "David R. Piegdon" <lkml@p23q.org>
+Date: Mon, 16 Jun 2014 23:42:51 +0000
+Subject: ARM: OMAP2+: Fix parser-bug in platform muxing code
+
+From: "David R. Piegdon" <lkml@p23q.org>
+
+commit c021f241f4fab2bb4fc4120a38a828a03dd3f970 upstream.
+
+Fix a parser-bug in the omap2 muxing code where muxtable-entries will be
+wrongly selected if the requested muxname is a *prefix* of their
+m0-entry and they have a matching mN-entry. Fix by additionally checking
+that the length of the m0_entry is equal.
+
+For example muxing of "dss_data2.dss_data2" on omap32xx will fail
+because the prefix "dss_data2" will match the mux-entries "dss_data2" as
+well as "dss_data20", with the suffix "dss_data2" matching m0 (for
+dss_data2) and m4 (for dss_data20). Thus both are recognized as signal
+path candidates:
+
+Relevant muxentries from mux34xx.c:
+ _OMAP3_MUXENTRY(DSS_DATA20, 90,
+ "dss_data20", NULL, "mcspi3_somi", "dss_data2",
+ "gpio_90", NULL, NULL, "safe_mode"),
+ _OMAP3_MUXENTRY(DSS_DATA2, 72,
+ "dss_data2", NULL, NULL, NULL,
+ "gpio_72", NULL, NULL, "safe_mode"),
+
+This will result in a failure to mux the pin at all:
+
+ _omap_mux_get_by_name: Multiple signal paths (2) for dss_data2.dss_data2
+
+Patch should apply to linus' latest master down to rather old linux-2.6
+trees.
+
+Signed-off-by: David R. Piegdon <lkml@p23q.org>
+Cc: stable@vger.kernel.org
+[tony@atomide.com: updated description to include full description]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/mux.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-omap2/mux.c
++++ b/arch/arm/mach-omap2/mux.c
+@@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(
+ m0_entry = mux->muxnames[0];
+
+ /* First check for full name in mode0.muxmode format */
+- if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
+- continue;
++ if (mode0_len)
++ if (strncmp(muxname, m0_entry, mode0_len) ||
++ (strlen(m0_entry) != mode0_len))
++ continue;
+
+ /* Then check for muxmode only */
+ for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
--- /dev/null
+From 3906c2b53cd23c2ae03e6ce41432c8e7f0a3cbbb Mon Sep 17 00:00:00 2001
+From: ChiaHao <andy.jhshiu@gmail.com>
+Date: Thu, 12 Jun 2014 15:32:33 +0100
+Subject: arm64: Bug fix in stack alignment exception
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ChiaHao <andy.jhshiu@gmail.com>
+
+commit 3906c2b53cd23c2ae03e6ce41432c8e7f0a3cbbb upstream.
+
+The value of ESR has been stored into x1, and should be directly pass to
+do_sp_pc_abort function, "MOV x1, x25" is an extra operation and do_sp_pc_abort
+will get the wrong value of ESR.
+
+Signed-off-by: ChiaHao <andy.jhshiu@gmail.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/entry.S | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -275,7 +275,6 @@ el1_sp_pc:
+ * Stack or PC alignment exception handling
+ */
+ mrs x0, far_el1
+- mov x1, x25
+ mov x2, sp
+ b do_sp_pc_abort
+ el1_undef:
--- /dev/null
+From 923b8f5044da753e4985ab15c1374ced2cdf616c Mon Sep 17 00:00:00 2001
+From: Steve Capper <steve.capper@linaro.org>
+Date: Wed, 2 Jul 2014 11:46:23 +0100
+Subject: arm64: mm: Make icache synchronisation logic huge page aware
+
+From: Steve Capper <steve.capper@linaro.org>
+
+commit 923b8f5044da753e4985ab15c1374ced2cdf616c upstream.
+
+The __sync_icache_dcache routine will only flush the dcache for the
+first page of a compound page, potentially leading to stale icache
+data residing further on in a hugetlb page.
+
+This patch addresses this issue by taking into consideration the
+order of the page when flushing the dcache.
+
+Reported-by: Mark Brown <broonie@linaro.org>
+Tested-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Steve Capper <steve.capper@linaro.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/flush.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/mm/flush.c
++++ b/arch/arm64/mm/flush.c
+@@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, uns
+ return;
+
+ if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
+- __flush_dcache_area(page_address(page), PAGE_SIZE);
++ __flush_dcache_area(page_address(page),
++ PAGE_SIZE << compound_order(page));
+ __flush_icache_all();
+ } else if (icache_is_aivivt()) {
+ __flush_icache_all();
--- /dev/null
+From 2fc68eb122c7ea6cd5be1fe7d6650c0beb2f4f40 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 12 Jun 2014 22:28:22 +0200
+Subject: b43: fix frequency reported on G-PHY with /new/ firmware
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+
+commit 2fc68eb122c7ea6cd5be1fe7d6650c0beb2f4f40 upstream.
+
+Support for firmware rev 508+ was added years ago, but we never noticed
+it reports channel in a different way for G-PHY devices. Instead of
+offset from 2400 MHz it simply passes channel id (AKA hw_value).
+
+So far it was (most probably) affecting monitor mode users only, but
+the following recent commit made it noticeable for quite everybody:
+
+commit 3afc2167f60a327a2c1e1e2600ef209a3c2b75b7
+Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue Mar 4 16:50:13 2014 +0200
+
+ cfg80211/mac80211: ignore signal if the frame was heard on wrong channel
+
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/xmit.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -810,9 +810,13 @@ void b43_rx(struct b43_wldev *dev, struc
+ break;
+ case B43_PHYTYPE_G:
+ status.band = IEEE80211_BAND_2GHZ;
+- /* chanid is the radio channel cookie value as used
+- * to tune the radio. */
+- status.freq = chanid + 2400;
++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
++ * has been modified to be compatible with N-PHY and others.
++ */
++ if (dev->fw.rev >= 508)
++ status.freq = ieee80211_channel_to_frequency(chanid, status.band);
++ else
++ status.freq = chanid + 2400;
+ break;
+ case B43_PHYTYPE_N:
+ case B43_PHYTYPE_LP:
--- /dev/null
+From ce36d9ab3bab06b7b5522f5c8b68fac231b76ffb Mon Sep 17 00:00:00 2001
+From: Steve French <smfrench@gmail.com>
+Date: Sun, 22 Jun 2014 20:38:49 -0500
+Subject: CIFS: fix mount failure with broken pathnames when smb3 mount with mapchars option
+
+From: Steve French <smfrench@gmail.com>
+
+commit ce36d9ab3bab06b7b5522f5c8b68fac231b76ffb upstream.
+
+When we SMB3 mounted with mapchars (to allow reserved characters : \ / > < * ?
+via the Unicode Windows to POSIX remap range) empty paths
+(eg when we open "" to query the root of the SMB3 directory on mount) were not
+null terminated so we sent garbarge as a path name on empty paths which caused
+SMB2/SMB2.1/SMB3 mounts to fail when mapchars was specified. mapchars is
+particularly important since Unix Extensions for SMB3 are not supported (yet)
+
+Signed-off-by: Steve French <smfrench@gmail.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifs_unicode.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -290,7 +290,8 @@ int
+ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ const struct nls_table *cp, int mapChars)
+ {
+- int i, j, charlen;
++ int i, charlen;
++ int j = 0;
+ char src_char;
+ __le16 dst_char;
+ wchar_t tmp;
+@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const
+ if (!mapChars)
+ return cifs_strtoUTF16(target, source, PATH_MAX, cp);
+
+- for (i = 0, j = 0; i < srclen; j++) {
++ for (i = 0; i < srclen; j++) {
+ src_char = source[i];
+ charlen = 1;
+ switch (src_char) {
+ case 0:
+- put_unaligned(0, &target[j]);
+ goto ctoUTF16_out;
+ case ':':
+ dst_char = cpu_to_le16(UNI_COLON);
+@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const
+ }
+
+ ctoUTF16_out:
++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */
+ return j;
+ }
+
--- /dev/null
+From a1d0b84c308d7fdfb67eb76498116a6c2fdda507 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B6rn=20Baumbach?= <bb@sernet.de>
+Date: Tue, 10 Jun 2014 12:03:26 +0200
+Subject: fs/cifs: fix regression in cifs_create_mf_symlink()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B6rn=20Baumbach?= <bb@sernet.de>
+
+commit a1d0b84c308d7fdfb67eb76498116a6c2fdda507 upstream.
+
+commit d81b8a40e2ece0a9ab57b1fe1798e291e75bf8fc
+("CIFS: Cleanup cifs open codepath")
+changed disposition to FILE_OPEN.
+
+Signed-off-by: Björn Baumbach <bb@sernet.de>
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+Cc: Pavel Shilovsky <piastry@etersoft.ru>
+Cc: Steve French <sfrench@samba.org>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/link.c
++++ b/fs/cifs/link.c
+@@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid,
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_WRITE;
+ oparms.create_options = create_options;
+- oparms.disposition = FILE_OPEN;
++ oparms.disposition = FILE_CREATE;
+ oparms.path = path;
+ oparms.fid = &fid;
+ oparms.reconnect = false;
--- /dev/null
+From 4a705fef986231a3e7a6b1a6d3c37025f021f49f Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Mon, 23 Jun 2014 13:22:03 -0700
+Subject: hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned entry
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit 4a705fef986231a3e7a6b1a6d3c37025f021f49f upstream.
+
+There's a race between fork() and hugepage migration, as a result we try
+to "dereference" a swap entry as a normal pte, causing kernel panic.
+The cause of the problem is that copy_hugetlb_page_range() can't handle
+"swap entry" family (migration entry and hwpoisoned entry) so let's fix
+it.
+
+[akpm@linux-foundation.org: coding-style fixes]
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: Christoph Lameter <cl@linux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 71 +++++++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 43 insertions(+), 28 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2338,6 +2338,31 @@ static void set_huge_ptep_writable(struc
+ update_mmu_cache(vma, address, ptep);
+ }
+
++static int is_hugetlb_entry_migration(pte_t pte)
++{
++ swp_entry_t swp;
++
++ if (huge_pte_none(pte) || pte_present(pte))
++ return 0;
++ swp = pte_to_swp_entry(pte);
++ if (non_swap_entry(swp) && is_migration_entry(swp))
++ return 1;
++ else
++ return 0;
++}
++
++static int is_hugetlb_entry_hwpoisoned(pte_t pte)
++{
++ swp_entry_t swp;
++
++ if (huge_pte_none(pte) || pte_present(pte))
++ return 0;
++ swp = pte_to_swp_entry(pte);
++ if (non_swap_entry(swp) && is_hwpoison_entry(swp))
++ return 1;
++ else
++ return 0;
++}
+
+ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ struct vm_area_struct *vma)
+@@ -2377,10 +2402,26 @@ int copy_hugetlb_page_range(struct mm_st
+ dst_ptl = huge_pte_lock(h, dst, dst_pte);
+ src_ptl = huge_pte_lockptr(h, src, src_pte);
+ spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
+- if (!huge_pte_none(huge_ptep_get(src_pte))) {
++ entry = huge_ptep_get(src_pte);
++ if (huge_pte_none(entry)) { /* skip none entry */
++ ;
++ } else if (unlikely(is_hugetlb_entry_migration(entry) ||
++ is_hugetlb_entry_hwpoisoned(entry))) {
++ swp_entry_t swp_entry = pte_to_swp_entry(entry);
++
++ if (is_write_migration_entry(swp_entry) && cow) {
++ /*
++ * COW mappings require pages in both
++ * parent and child to be set to read.
++ */
++ make_migration_entry_read(&swp_entry);
++ entry = swp_entry_to_pte(swp_entry);
++ set_huge_pte_at(src, addr, src_pte, entry);
++ }
++ set_huge_pte_at(dst, addr, dst_pte, entry);
++ } else {
+ if (cow)
+ huge_ptep_set_wrprotect(src, addr, src_pte);
+- entry = huge_ptep_get(src_pte);
+ ptepage = pte_page(entry);
+ get_page(ptepage);
+ page_dup_rmap(ptepage);
+@@ -2396,32 +2437,6 @@ int copy_hugetlb_page_range(struct mm_st
+ return ret;
+ }
+
+-static int is_hugetlb_entry_migration(pte_t pte)
+-{
+- swp_entry_t swp;
+-
+- if (huge_pte_none(pte) || pte_present(pte))
+- return 0;
+- swp = pte_to_swp_entry(pte);
+- if (non_swap_entry(swp) && is_migration_entry(swp))
+- return 1;
+- else
+- return 0;
+-}
+-
+-static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+-{
+- swp_entry_t swp;
+-
+- if (huge_pte_none(pte) || pte_present(pte))
+- return 0;
+- swp = pte_to_swp_entry(pte);
+- if (non_swap_entry(swp) && is_hwpoison_entry(swp))
+- return 1;
+- else
+- return 0;
+-}
+-
+ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long start, unsigned long end,
+ struct page *ref_page)
--- /dev/null
+From 501fd9895c1d7d8161ed56698ae2fccb10ef14f5 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 8 May 2014 12:15:22 +0300
+Subject: iwlwifi: pcie: try to get ownership several times
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 501fd9895c1d7d8161ed56698ae2fccb10ef14f5 upstream.
+
+Some races with the hardware can happen when we take
+ownership of the device. Don't give up after the first try.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -318,6 +318,7 @@ static int iwl_pcie_prepare_card_hw(stru
+ {
+ int ret;
+ int t = 0;
++ int iter;
+
+ IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+
+@@ -326,18 +327,23 @@ static int iwl_pcie_prepare_card_hw(stru
+ if (ret >= 0)
+ return 0;
+
+- /* If HW is not ready, prepare the conditions to check again */
+- iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+- CSR_HW_IF_CONFIG_REG_PREPARE);
+-
+- do {
+- ret = iwl_pcie_set_hw_ready(trans);
+- if (ret >= 0)
+- return 0;
+-
+- usleep_range(200, 1000);
+- t += 200;
+- } while (t < 150000);
++ for (iter = 0; iter < 10; iter++) {
++ /* If HW is not ready, prepare the conditions to check again */
++ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++ CSR_HW_IF_CONFIG_REG_PREPARE);
++
++ do {
++ ret = iwl_pcie_set_hw_ready(trans);
++ if (ret >= 0)
++ return 0;
++
++ usleep_range(200, 1000);
++ t += 200;
++ } while (t < 150000);
++ msleep(25);
++ }
++
++ IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
+
+ return ret;
+ }
--- /dev/null
+From 7cd2b0a34ab8e4db971920eef8982f985441adfb Mon Sep 17 00:00:00 2001
+From: David Rientjes <rientjes@google.com>
+Date: Mon, 23 Jun 2014 13:22:04 -0700
+Subject: mm, pcp: allow restoring percpu_pagelist_fraction default
+
+From: David Rientjes <rientjes@google.com>
+
+commit 7cd2b0a34ab8e4db971920eef8982f985441adfb upstream.
+
+Oleg reports a division by zero error on zero-length write() to the
+percpu_pagelist_fraction sysctl:
+
+ divide error: 0000 [#1] SMP DEBUG_PAGEALLOC
+ CPU: 1 PID: 9142 Comm: badarea_io Not tainted 3.15.0-rc2-vm-nfs+ #19
+ Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
+ task: ffff8800d5aeb6e0 ti: ffff8800d87a2000 task.ti: ffff8800d87a2000
+ RIP: 0010: percpu_pagelist_fraction_sysctl_handler+0x84/0x120
+ RSP: 0018:ffff8800d87a3e78 EFLAGS: 00010246
+ RAX: 0000000000000f89 RBX: ffff88011f7fd000 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000010
+ RBP: ffff8800d87a3e98 R08: ffffffff81d002c8 R09: ffff8800d87a3f50
+ R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000060
+ R13: ffffffff81c3c3e0 R14: ffffffff81cfddf8 R15: ffff8801193b0800
+ FS: 00007f614f1e9740(0000) GS:ffff88011f440000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 00007f614f1fa000 CR3: 00000000d9291000 CR4: 00000000000006e0
+ Call Trace:
+ proc_sys_call_handler+0xb3/0xc0
+ proc_sys_write+0x14/0x20
+ vfs_write+0xba/0x1e0
+ SyS_write+0x46/0xb0
+ tracesys+0xe1/0xe6
+
+However, if the percpu_pagelist_fraction sysctl is set by the user, it
+is also impossible to restore it to the kernel default since the user
+cannot write 0 to the sysctl.
+
+This patch allows the user to write 0 to restore the default behavior.
+It still requires a fraction equal to or larger than 8, however, as
+stated by the documentation for sanity. If a value in the range [1, 7]
+is written, the sysctl will return EINVAL.
+
+This successfully solves the divide by zero issue at the same time.
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Reported-by: Oleg Drokin <green@linuxhacker.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/sysctl/vm.txt | 3 ++-
+ kernel/sysctl.c | 3 +--
+ mm/page_alloc.c | 40 ++++++++++++++++++++++++++++------------
+ 3 files changed, 31 insertions(+), 15 deletions(-)
+
+--- a/Documentation/sysctl/vm.txt
++++ b/Documentation/sysctl/vm.txt
+@@ -681,7 +681,8 @@ The batch value of each per cpu pagelist
+ set to pcp->high/4. The upper limit of batch is (PAGE_SHIFT * 8)
+
+ The initial value is zero. Kernel does not use this value at boot time to set
+-the high water marks for each per cpu page list.
++the high water marks for each per cpu page list. If the user writes '0' to this
++sysctl, it will revert to this default behavior.
+
+ ==============================================================
+
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -139,7 +139,6 @@ static unsigned long dirty_bytes_min = 2
+ /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
+ static int maxolduid = 65535;
+ static int minolduid;
+-static int min_percpu_pagelist_fract = 8;
+
+ static int ngroups_max = NGROUPS_MAX;
+ static const int cap_last_cap = CAP_LAST_CAP;
+@@ -1324,7 +1323,7 @@ static struct ctl_table vm_table[] = {
+ .maxlen = sizeof(percpu_pagelist_fraction),
+ .mode = 0644,
+ .proc_handler = percpu_pagelist_fraction_sysctl_handler,
+- .extra1 = &min_percpu_pagelist_fract,
++ .extra1 = &zero,
+ },
+ #ifdef CONFIG_MMU
+ {
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -69,6 +69,7 @@
+
+ /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
+ static DEFINE_MUTEX(pcp_batch_high_lock);
++#define MIN_PERCPU_PAGELIST_FRACTION (8)
+
+ #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
+ DEFINE_PER_CPU(int, numa_node);
+@@ -4106,7 +4107,7 @@ static void __meminit zone_init_free_lis
+ memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
+ #endif
+
+-static int __meminit zone_batchsize(struct zone *zone)
++static int zone_batchsize(struct zone *zone)
+ {
+ #ifdef CONFIG_MMU
+ int batch;
+@@ -4222,8 +4223,8 @@ static void pageset_set_high(struct per_
+ pageset_update(&p->pcp, high, batch);
+ }
+
+-static void __meminit pageset_set_high_and_batch(struct zone *zone,
+- struct per_cpu_pageset *pcp)
++static void pageset_set_high_and_batch(struct zone *zone,
++ struct per_cpu_pageset *pcp)
+ {
+ if (percpu_pagelist_fraction)
+ pageset_set_high(pcp,
+@@ -5848,23 +5849,38 @@ int percpu_pagelist_fraction_sysctl_hand
+ void __user *buffer, size_t *length, loff_t *ppos)
+ {
+ struct zone *zone;
+- unsigned int cpu;
++ int old_percpu_pagelist_fraction;
+ int ret;
+
++ mutex_lock(&pcp_batch_high_lock);
++ old_percpu_pagelist_fraction = percpu_pagelist_fraction;
++
+ ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
+- if (!write || (ret < 0))
+- return ret;
++ if (!write || ret < 0)
++ goto out;
++
++ /* Sanity checking to avoid pcp imbalance */
++ if (percpu_pagelist_fraction &&
++ percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
++ percpu_pagelist_fraction = old_percpu_pagelist_fraction;
++ ret = -EINVAL;
++ goto out;
++ }
++
++ /* No change? */
++ if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
++ goto out;
+
+- mutex_lock(&pcp_batch_high_lock);
+ for_each_populated_zone(zone) {
+- unsigned long high;
+- high = zone->managed_pages / percpu_pagelist_fraction;
++ unsigned int cpu;
++
+ for_each_possible_cpu(cpu)
+- pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
+- high);
++ pageset_set_high_and_batch(zone,
++ per_cpu_ptr(zone->pageset, cpu));
+ }
++out:
+ mutex_unlock(&pcp_batch_high_lock);
+- return 0;
++ return ret;
+ }
+
+ int hashdist = HASHDIST_DEFAULT;
--- /dev/null
+From b91113282bf44df46aba374a0b8f88a75bfd4b3f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Mon, 23 Jun 2014 22:49:40 +0200
+Subject: net: allwinner: emac: Add missing free_irq
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit b91113282bf44df46aba374a0b8f88a75bfd4b3f upstream.
+
+If the mdio probe function fails in emac_open, the interrupt we just requested
+isn't freed. If emac_open is called again, for example because we try to set up
+the interface again, the kernel will oops because the interrupt wasn't properly
+released.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/allwinner/sun4i-emac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -725,6 +725,7 @@ static int emac_open(struct net_device *
+
+ ret = emac_mdio_probe(dev);
+ if (ret < 0) {
++ free_irq(dev->irq, dev);
+ netdev_err(dev, "cannot probe MDIO bus\n");
+ return ret;
+ }
+++ /dev/null
-From 8b8b36834d0fff67fc8668093f4312dd04dcf21d Mon Sep 17 00:00:00 2001
-From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
-Date: Tue, 10 Jun 2014 09:46:00 -0400
-Subject: ring-buffer: Check if buffer exists before polling
-
-From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
-
-commit 8b8b36834d0fff67fc8668093f4312dd04dcf21d upstream.
-
-The per_cpu buffers are created one per possible CPU. But these do
-not mean that those CPUs are online, nor do they even exist.
-
-With the addition of the ring buffer polling, it assumes that the
-caller polls on an existing buffer. But this is not the case if
-the user reads trace_pipe from a CPU that does not exist, and this
-causes the kernel to crash.
-
-Simple fix is to check the cpu against buffer bitmask against to see
-if the buffer was allocated or not and return -ENODEV if it is
-not.
-
-More updates were done to pass the -ENODEV back up to userspace.
-
-Link: http://lkml.kernel.org/r/5393DB61.6060707@oracle.com
-
-Reported-by: Sasha Levin <sasha.levin@oracle.com>
-Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
-index d69cf637a15a..49a4d6f59108 100644
---- a/include/linux/ring_buffer.h
-+++ b/include/linux/ring_buffer.h
-@@ -97,7 +97,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k
- __ring_buffer_alloc((size), (flags), &__key); \
- })
-
--void ring_buffer_wait(struct ring_buffer *buffer, int cpu);
-+int ring_buffer_wait(struct ring_buffer *buffer, int cpu);
- int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
- struct file *filp, poll_table *poll_table);
-
-diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index c634868c2921..7c56c3d06943 100644
---- a/kernel/trace/ring_buffer.c
-+++ b/kernel/trace/ring_buffer.c
-@@ -543,7 +543,7 @@ static void rb_wake_up_waiters(struct irq_work *work)
- * as data is added to any of the @buffer's cpu buffers. Otherwise
- * it will wait for data to be added to a specific cpu buffer.
- */
--void ring_buffer_wait(struct ring_buffer *buffer, int cpu)
-+int ring_buffer_wait(struct ring_buffer *buffer, int cpu)
- {
- struct ring_buffer_per_cpu *cpu_buffer;
- DEFINE_WAIT(wait);
-@@ -557,6 +557,8 @@ void ring_buffer_wait(struct ring_buffer *buffer, int cpu)
- if (cpu == RING_BUFFER_ALL_CPUS)
- work = &buffer->irq_work;
- else {
-+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
-+ return -ENODEV;
- cpu_buffer = buffer->buffers[cpu];
- work = &cpu_buffer->irq_work;
- }
-@@ -591,6 +593,7 @@ void ring_buffer_wait(struct ring_buffer *buffer, int cpu)
- schedule();
-
- finish_wait(&work->waiters, &wait);
-+ return 0;
- }
-
- /**
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 16f7038d1f4d..56422f1decba 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -1085,13 +1085,13 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
- }
- #endif /* CONFIG_TRACER_MAX_TRACE */
-
--static void wait_on_pipe(struct trace_iterator *iter)
-+static int wait_on_pipe(struct trace_iterator *iter)
- {
- /* Iterators are static, they should be filled or empty */
- if (trace_buffer_iter(iter, iter->cpu_file))
-- return;
-+ return 0;
-
-- ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file);
-+ return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file);
- }
-
- #ifdef CONFIG_FTRACE_STARTUP_TEST
-@@ -4378,6 +4378,7 @@ tracing_poll_pipe(struct file *filp, poll_table *poll_table)
- static int tracing_wait_pipe(struct file *filp)
- {
- struct trace_iterator *iter = filp->private_data;
-+ int ret;
-
- while (trace_empty(iter)) {
-
-@@ -4399,10 +4400,13 @@ static int tracing_wait_pipe(struct file *filp)
-
- mutex_unlock(&iter->mutex);
-
-- wait_on_pipe(iter);
-+ ret = wait_on_pipe(iter);
-
- mutex_lock(&iter->mutex);
-
-+ if (ret)
-+ return ret;
-+
- if (signal_pending(current))
- return -EINTR;
- }
-@@ -5327,8 +5331,12 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
- goto out_unlock;
- }
- mutex_unlock(&trace_types_lock);
-- wait_on_pipe(iter);
-+ ret = wait_on_pipe(iter);
- mutex_lock(&trace_types_lock);
-+ if (ret) {
-+ size = ret;
-+ goto out_unlock;
-+ }
- if (signal_pending(current)) {
- size = -EINTR;
- goto out_unlock;
-@@ -5538,8 +5546,10 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
- goto out;
- }
- mutex_unlock(&trace_types_lock);
-- wait_on_pipe(iter);
-+ ret = wait_on_pipe(iter);
- mutex_lock(&trace_types_lock);
-+ if (ret)
-+ goto out;
- if (signal_pending(current)) {
- ret = -EINTR;
- goto out;
mac80211-fix-ibss-join-by-initializing-last_scan_completed.patch
mac80211-don-t-check-netdev-state-for-debugfs-read-write.patch
mac80211-fix-a-memory-leak-on-sta-rate-selection-table.patch
-ring-buffer-check-if-buffer-exists-before-polling.patch
+iwlwifi-pcie-try-to-get-ownership-several-times.patch
+hugetlb-fix-copy_hugetlb_page_range-to-handle-migration-hwpoisoned-entry.patch
+mm-pcp-allow-restoring-percpu_pagelist_fraction-default.patch
+arm64-mm-make-icache-synchronisation-logic-huge-page-aware.patch
+arm-omap2-fix-parser-bug-in-platform-muxing-code.patch
+arm64-bug-fix-in-stack-alignment-exception.patch
+net-allwinner-emac-add-missing-free_irq.patch
+b43-fix-frequency-reported-on-g-phy-with-new-firmware.patch
+fs-cifs-fix-regression-in-cifs_create_mf_symlink.patch
+cifs-fix-mount-failure-with-broken-pathnames-when-smb3-mount-with-mapchars-option.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
