--- /dev/null
+From e0b760ff71be168d4e623f7c3612e98902ab93e9 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@primarydata.com>
+Date: Fri, 22 Aug 2014 09:58:22 -0400
+Subject: locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease
+
+From: Jeff Layton <jlayton@primarydata.com>
+
+commit e0b760ff71be168d4e623f7c3612e98902ab93e9 upstream.
+
+The argument to locks_unlink_lock can't be just any pointer to a
+pointer. It must be a pointer to the fl_next field in the previous
+lock in the list.
+
+Signed-off-by: Jeff Layton <jlayton@primarydata.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/locks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1595,7 +1595,7 @@ static int generic_add_lease(struct file
+ smp_mb();
+ error = check_conflicting_open(dentry, arg);
+ if (error)
+- locks_unlink_lock(flp);
++ locks_unlink_lock(before);
+ out:
+ if (is_deleg)
+ mutex_unlock(&inode->i_mutex);
drm-radeon-don-t-reset-dma-on-r6xx-evergreen-init.patch
drm-radeon-dpm-fix-resume-on-mullins.patch
drm-radeon-cik-use-a-separate-counter-for-cp-init-timeout.patch
+xtensa-replace-ioctl-code-definitions-with-constants.patch
+xtensa-fix-address-checks-in-dma_-alloc-free-_coherent.patch
+xtensa-fix-access-to-thread_ra-thread_sp-thread_ds.patch
+xtensa-fix-tlbtemp_base_2-region-handling-in-fast_second_level_miss.patch
+xtensa-fix-a6-and-a7-handling-in-fast_syscall_xtensa.patch
+locks-pass-correct-before-pointer-to-locks_unlink_lock-in-generic_add_lease.patch
+ufs-fix-deadlocks-introduced-by-sb-mutex-merge.patch
--- /dev/null
+From 9ef7db7f38d0472dd9c444e42d5c5175ccbe5451 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Tue, 2 Sep 2014 11:40:17 +0400
+Subject: ufs: fix deadlocks introduced by sb mutex merge
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit 9ef7db7f38d0472dd9c444e42d5c5175ccbe5451 upstream.
+
+Commit 0244756edc4b ("ufs: sb mutex merge + mutex_destroy") introduces
+deadlocks in ufs_new_inode() and ufs_free_inode().
+Most callers of that functions acqure the mutex by themselves and
+ufs_{new,free}_inode() do that via lock_ufs(),
+i.e we have an unavoidable double lock.
+
+The patch proposes to resolve the issue by making sure that
+ufs_{new,free}_inode() are not called with the mutex held.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ufs/inode.c | 7 ++-----
+ fs/ufs/namei.c | 14 ++++++--------
+ 2 files changed, 8 insertions(+), 13 deletions(-)
+
+--- a/fs/ufs/inode.c
++++ b/fs/ufs/inode.c
+@@ -902,9 +902,6 @@ void ufs_evict_inode(struct inode * inod
+ invalidate_inode_buffers(inode);
+ clear_inode(inode);
+
+- if (want_delete) {
+- lock_ufs(inode->i_sb);
+- ufs_free_inode (inode);
+- unlock_ufs(inode->i_sb);
+- }
++ if (want_delete)
++ ufs_free_inode(inode);
+ }
+--- a/fs/ufs/namei.c
++++ b/fs/ufs/namei.c
+@@ -126,12 +126,12 @@ static int ufs_symlink (struct inode * d
+ if (l > sb->s_blocksize)
+ goto out_notlocked;
+
+- lock_ufs(dir->i_sb);
+ inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
+ err = PTR_ERR(inode);
+ if (IS_ERR(inode))
+- goto out;
++ goto out_notlocked;
+
++ lock_ufs(dir->i_sb);
+ if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) {
+ /* slow symlink */
+ inode->i_op = &ufs_symlink_inode_operations;
+@@ -181,13 +181,9 @@ static int ufs_mkdir(struct inode * dir,
+ struct inode * inode;
+ int err;
+
+- lock_ufs(dir->i_sb);
+- inode_inc_link_count(dir);
+-
+ inode = ufs_new_inode(dir, S_IFDIR|mode);
+- err = PTR_ERR(inode);
+ if (IS_ERR(inode))
+- goto out_dir;
++ return PTR_ERR(inode);
+
+ inode->i_op = &ufs_dir_inode_operations;
+ inode->i_fop = &ufs_dir_operations;
+@@ -195,6 +191,9 @@ static int ufs_mkdir(struct inode * dir,
+
+ inode_inc_link_count(inode);
+
++ lock_ufs(dir->i_sb);
++ inode_inc_link_count(dir);
++
+ err = ufs_make_empty(inode, dir);
+ if (err)
+ goto out_fail;
+@@ -212,7 +211,6 @@ out_fail:
+ inode_dec_link_count(inode);
+ inode_dec_link_count(inode);
+ iput (inode);
+-out_dir:
+ inode_dec_link_count(dir);
+ unlock_ufs(dir->i_sb);
+ goto out;
--- /dev/null
+From d1b6ba82a50cecf94be540a3a153aa89d97511a0 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Thu, 31 Jul 2014 22:40:57 +0400
+Subject: xtensa: fix a6 and a7 handling in fast_syscall_xtensa
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.
+
+Remove restoring a6 on some return paths and instead modify and restore
+it in a single place, using symbolic name.
+Correctly restore a7 from PT_AREG7 in case of illegal a6 value.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/kernel/entry.S | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -1001,9 +1001,8 @@ ENTRY(fast_syscall_xtensa)
+ movi a7, 4 # sizeof(unsigned int)
+ access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp
+
+- addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1
+- _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill
+- _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp
++ _bgeui a6, SYS_XTENSA_COUNT, .Lill
++ _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp
+
+ /* Fall through for ATOMIC_CMP_SWP. */
+
+@@ -1015,27 +1014,26 @@ TRY s32i a5, a3, 0 # different, modify
+ l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, 1 # and return 1
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ 1: l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, 0 # return 0 (note that we cannot set
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ .Lnswp: /* Atomic set, add, and exg_add. */
+
+ TRY l32i a7, a3, 0 # orig
++ addi a6, a6, -SYS_XTENSA_ATOMIC_SET
+ add a0, a4, a7 # + arg
+ moveqz a0, a4, a6 # set
++ addi a6, a6, SYS_XTENSA_ATOMIC_SET
+ TRY s32i a0, a3, 0 # write new value
+
+ mov a0, a2
+ mov a2, a7
+ l32i a7, a0, PT_AREG7 # restore a7
+ l32i a0, a0, PT_AREG0 # restore a0
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ CATCH
+@@ -1044,7 +1042,7 @@ CATCH
+ movi a2, -EFAULT
+ rfe
+
+-.Lill: l32i a7, a2, PT_AREG0 # restore a7
++.Lill: l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, -EINVAL
+ rfe
--- /dev/null
+From 52247123749cc3cbc30168b33ad8c69515c96d23 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Sun, 27 Jul 2014 07:23:41 +0400
+Subject: xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.
+
+With SMP and a lot of debug options enabled task_struct::thread gets out
+of reach of s32i/l32i instructions with base pointing at task_struct,
+breaking build with the following messages:
+
+ arch/xtensa/kernel/entry.S: Assembler messages:
+ arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048'
+ arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040'
+ arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'
+
+Change base to point to task_struct::thread in such cases.
+Don't use a10 in _switch_to to save/restore prev pointer as a2 is not
+clobbered.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/include/asm/uaccess.h | 5 +++++
+ arch/xtensa/kernel/entry.S | 12 ++++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/arch/xtensa/include/asm/uaccess.h
++++ b/arch/xtensa/include/asm/uaccess.h
+@@ -52,7 +52,12 @@
+ */
+ .macro get_fs ad, sp
+ GET_CURRENT(\ad,\sp)
++#if THREAD_CURRENT_DS > 1020
++ addi \ad, \ad, TASK_THREAD
++ l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD
++#else
+ l32i \ad, \ad, THREAD_CURRENT_DS
++#endif
+ .endm
+
+ /*
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -1820,7 +1820,6 @@ ENTRY(_switch_to)
+
+ entry a1, 16
+
+- mov a10, a2 # preserve 'prev' (a2)
+ mov a11, a3 # and 'next' (a3)
+
+ l32i a4, a2, TASK_THREAD_INFO
+@@ -1828,8 +1827,14 @@ ENTRY(_switch_to)
+
+ save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
+
+- s32i a0, a10, THREAD_RA # save return address
+- s32i a1, a10, THREAD_SP # save stack pointer
++#if THREAD_RA > 1020 || THREAD_SP > 1020
++ addi a10, a2, TASK_THREAD
++ s32i a0, a10, THREAD_RA - TASK_THREAD # save return address
++ s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer
++#else
++ s32i a0, a2, THREAD_RA # save return address
++ s32i a1, a2, THREAD_SP # save stack pointer
++#endif
+
+ /* Disable ints while we manipulate the stack pointer. */
+
+@@ -1870,7 +1875,6 @@ ENTRY(_switch_to)
+ load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
+
+ wsr a14, ps
+- mov a2, a10 # return 'prev'
+ rsync
+
+ retw
--- /dev/null
+From 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e Mon Sep 17 00:00:00 2001
+From: Alan Douglas <adouglas@cadence.com>
+Date: Wed, 23 Jul 2014 14:06:40 +0400
+Subject: xtensa: fix address checks in dma_{alloc,free}_coherent
+
+From: Alan Douglas <adouglas@cadence.com>
+
+commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.
+
+Virtual address is translated to the XCHAL_KSEG_CACHED region in the
+dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE
+range.
+
+Change check for end of the range from 'addr >= X' to 'addr > X - 1' to
+handle the case of X == 0.
+
+Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.
+
+Signed-off-by: Alan Douglas <adouglas@cadence.com>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/kernel/pci-dma.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/xtensa/kernel/pci-dma.c
++++ b/arch/xtensa/kernel/pci-dma.c
+@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si
+
+ /* We currently don't support coherent memory outside KSEG */
+
+- if (ret < XCHAL_KSEG_CACHED_VADDR
+- || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE)
+- BUG();
++ BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
++ ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
+
+
+ if (ret != 0) {
+@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);
+ void dma_free_coherent(struct device *hwdev, size_t size,
+ void *vaddr, dma_addr_t dma_handle)
+ {
+- long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR;
++ unsigned long addr = (unsigned long)vaddr +
++ XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
+
+- if (addr < 0 || addr >= XCHAL_KSEG_SIZE)
+- BUG();
++ BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
++ addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
+
+ free_pages(addr, get_order(size));
+ }
--- /dev/null
+From 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Mon, 21 Jul 2014 22:01:51 +0400
+Subject: xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.
+
+Current definition of TLBTEMP_BASE_2 is always 32K above the
+TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP
+region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER)
+to determine TLBTEMP region where the fault happened. The size of the
+TLBTEMP region is also checked incorrectly: not 64K, but twice data
+cache way size (whicht may as well be less than the instruction cache
+way size).
+
+Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size.
+Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or
+the instruction cache way size, and use it to determine if the second
+level TLB miss occured in the TLBTEMP region.
+
+Practical occurence of page faults in the TLBTEMP area is extremely
+rare, this code can be tested by deletion of all w[di]tlb instructions
+in the tlbtemp_mapping region.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/include/asm/pgtable.h | 7 ++++++-
+ arch/xtensa/kernel/entry.S | 2 +-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/xtensa/include/asm/pgtable.h
++++ b/arch/xtensa/include/asm/pgtable.h
+@@ -67,7 +67,12 @@
+ #define VMALLOC_START 0xC0000000
+ #define VMALLOC_END 0xC7FEFFFF
+ #define TLBTEMP_BASE_1 0xC7FF0000
+-#define TLBTEMP_BASE_2 0xC7FF8000
++#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
++#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
++#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE)
++#else
++#define TLBTEMP_SIZE ICACHE_WAY_SIZE
++#endif
+
+ /*
+ * For the Xtensa architecture, the PTE layout is as follows:
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -1565,7 +1565,7 @@ ENTRY(fast_second_level_miss)
+ rsr a0, excvaddr
+ bltu a0, a3, 2f
+
+- addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT))
++ addi a1, a0, -TLBTEMP_SIZE
+ bgeu a1, a3, 2f
+
+ /* Check if we have to restore an ITLB mapping. */
--- /dev/null
+From f61bf8e7d19e0a3456a7a9ed97c399e4353698dc Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Sun, 20 Jul 2014 03:38:53 +0400
+Subject: xtensa: replace IOCTL code definitions with constants
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.
+
+This fixes userspace code that builds on other architectures but fails
+on xtensa due to references to structures that other architectures don't
+refer to. E.g. this fixes the following issue with python-2.7.8:
+
+ python-2.7.8/Modules/termios.c:861:25: error: invalid application
+ of 'sizeof' to incomplete type 'struct serial_multiport_struct'
+ {"TIOCSERGETMULTI", TIOCSERGETMULTI},
+ python-2.7.8/Modules/termios.c:870:25: error: invalid application
+ of 'sizeof' to incomplete type 'struct serial_multiport_struct'
+ {"TIOCSERSETMULTI", TIOCSERSETMULTI},
+ python-2.7.8/Modules/termios.c:900:24: error: invalid application
+ of 'sizeof' to incomplete type 'struct tty_struct'
+ {"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/arch/xtensa/include/uapi/asm/ioctls.h
++++ b/arch/xtensa/include/uapi/asm/ioctls.h
+@@ -28,17 +28,17 @@
+ #define TCSETSW 0x5403
+ #define TCSETSF 0x5404
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x80127417 /* _IOR('t', 23, struct termio) */
++#define TCSETA 0x40127418 /* _IOW('t', 24, struct termio) */
++#define TCSETAW 0x40127419 /* _IOW('t', 25, struct termio) */
++#define TCSETAF 0x4012741C /* _IOW('t', 28, struct termio) */
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+ #define TCFLSH _IO('t', 31)
+
+-#define TIOCSWINSZ _IOW('t', 103, struct winsize)
+-#define TIOCGWINSZ _IOR('t', 104, struct winsize)
++#define TIOCSWINSZ 0x40087467 /* _IOW('t', 103, struct winsize) */
++#define TIOCGWINSZ 0x80087468 /* _IOR('t', 104, struct winsize) */
+ #define TIOCSTART _IO('t', 110) /* start output, like ^Q */
+ #define TIOCSTOP _IO('t', 111) /* stop output, like ^S */
+ #define TIOCOUTQ _IOR('t', 115, int) /* output queue size */
+@@ -88,7 +88,6 @@
+ #define TIOCSETD _IOW('T', 35, int)
+ #define TIOCGETD _IOR('T', 36, int)
+ #define TCSBRKP _IOW('T', 37, int) /* Needed for POSIX tcsendbreak()*/
+-#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct) /* For debugging only*/
+ #define TIOCSBRK _IO('T', 39) /* BSD compatibility */
+ #define TIOCCBRK _IO('T', 40) /* BSD compatibility */
+ #define TIOCGSID _IOR('T', 41, pid_t) /* Return the session ID of FD*/
+@@ -114,8 +113,10 @@
+ #define TIOCSERGETLSR _IOR('T', 89, unsigned int) /* Get line status reg. */
+ /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+ # define TIOCSER_TEMT 0x01 /* Transmitter physically empty */
+-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config */
+-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
++#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config */
++ /* _IOR('T', 90, struct serial_multiport_struct) */
++#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */
++ /* _IOW('T', 91, struct serial_multiport_struct) */
+
+ #define TIOCMIWAIT _IO('T', 92) /* wait for a change on serial input line(s) */
+ #define TIOCGICOUNT 0x545D /* read serial port inline interrupt counts */
projects / thirdparty / kernel / stable-queue.git / commitdiff
