--- /dev/null
+From 8ee661b505613ef2747b350ca2871a31b3781bee Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 26 Mar 2014 20:10:09 +0100
+Subject: drm/i915: Undo gtt scratch pte unmapping again
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 8ee661b505613ef2747b350ca2871a31b3781bee upstream.
+
+It apparently blows up on some machines. This functionally reverts
+
+commit 828c79087cec61eaf4c76bb32c222fbe35ac3930
+Author: Ben Widawsky <benjamin.widawsky@intel.com>
+Date: Wed Oct 16 09:21:30 2013 -0700
+
+ drm/i915: Disable GGTT PTEs on GEN6+ suspend
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64841
+Reported-and-Tested-by: Brad Jackson <bjackson0971@gmail.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Cc: Todd Previte <tprevite@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_gtt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -828,7 +828,7 @@ void i915_gem_suspend_gtt_mappings(struc
+ dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
+ dev_priv->gtt.base.start / PAGE_SIZE,
+ dev_priv->gtt.base.total / PAGE_SIZE,
+- false);
++ true);
+ }
+
+ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
--- /dev/null
+From 5f12c5eca6e6b7aeb4b2028d579f614b4fe7a81f Mon Sep 17 00:00:00 2001
+From: Scott Wood <scottwood@freescale.com>
+Date: Tue, 18 Mar 2014 16:10:24 -0500
+Subject: i2c: cpm: Fix build by adding of_address.h and of_irq.h
+
+From: Scott Wood <scottwood@freescale.com>
+
+commit 5f12c5eca6e6b7aeb4b2028d579f614b4fe7a81f upstream.
+
+Fixes a build break due to the undeclared use of irq_of_parse_and_map()
+and of_iomap(). This build break was apparently introduced while the
+driver was unbuildable due to the bug fixed by
+62c19c9d29e65086e5ae76df371ed2e6b23f00cd ("i2c: Remove usage of
+orphaned symbol OF_I2C"). When 62c19c was added in v3.14-rc7,
+the driver was enabled again, breaking the powerpc mpc85xx_defconfig
+and mpc85xx_smp_defconfig.
+
+62c19c is marked for stable, so this should go there as well.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Scott Wood <scottwood@freescale.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cpm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -40,7 +40,9 @@
+ #include <linux/i2c.h>
+ #include <linux/io.h>
+ #include <linux/dma-mapping.h>
++#include <linux/of_address.h>
+ #include <linux/of_device.h>
++#include <linux/of_irq.h>
+ #include <linux/of_platform.h>
+ #include <sysdev/fsl_soc.h>
+ #include <asm/cpm.h>
--- /dev/null
+From 6797b39e6f6f34c74177736e146406e894b9482b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 26 Mar 2014 13:30:52 -0700
+Subject: Input: cypress_ps2 - don't report as a button pads
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6797b39e6f6f34c74177736e146406e894b9482b upstream.
+
+The cypress PS/2 trackpad models supported by the cypress_ps2 driver
+emulate BTN_RIGHT events in firmware based on the finger position, as part
+of this no motion events are sent when the finger is in the button area.
+
+The INPUT_PROP_BUTTONPAD property is there to indicate to userspace that
+BTN_RIGHT events should be emulated in userspace, which is not necessary
+in this case.
+
+When INPUT_PROP_BUTTONPAD is advertised userspace will wait for a motion
+event before propagating the button event higher up the stack, as it needs
+current abs x + y data for its BTN_RIGHT emulation. Since in the
+cypress_ps2 pads don't report motion events in the button area, this means
+that clicks in the button area end up being ignored, so
+INPUT_PROP_BUTTONPAD actually causes problems for these touchpads, and
+removing it fixes:
+
+https://bugs.freedesktop.org/show_bug.cgi?id=76341
+
+Reported-by: Adam Williamson <awilliam@redhat.com>
+Tested-by: Adam Williamson <awilliam@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/cypress_ps2.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/input/mouse/cypress_ps2.c
++++ b/drivers/input/mouse/cypress_ps2.c
+@@ -410,7 +410,6 @@ static int cypress_set_input_params(stru
+ __clear_bit(REL_X, input->relbit);
+ __clear_bit(REL_Y, input->relbit);
+
+- __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
+ __set_bit(EV_KEY, input->evbit);
+ __set_bit(BTN_LEFT, input->keybit);
+ __set_bit(BTN_RIGHT, input->keybit);
--- /dev/null
+From e4dbedc7eac7da9db363a36f2bd4366962eeefcc Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 6 Mar 2014 12:57:24 -0800
+Subject: Input: mousedev - fix race when creating mixed device
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit e4dbedc7eac7da9db363a36f2bd4366962eeefcc upstream.
+
+We should not be using static variable mousedev_mix in methods that can be
+called before that singleton gets assigned. While at it let's add open and
+close methods to mousedev structure so that we do not need to test if we
+are dealing with multiplexor or normal device and simply call appropriate
+method directly.
+
+This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=71551
+
+Reported-by: GiulioDP <depasquale.giulio@gmail.com>
+Tested-by: GiulioDP <depasquale.giulio@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mousedev.c | 73 +++++++++++++++++++++++++++--------------------
+ 1 file changed, 42 insertions(+), 31 deletions(-)
+
+--- a/drivers/input/mousedev.c
++++ b/drivers/input/mousedev.c
+@@ -67,7 +67,6 @@ struct mousedev {
+ struct device dev;
+ struct cdev cdev;
+ bool exist;
+- bool is_mixdev;
+
+ struct list_head mixdev_node;
+ bool opened_by_mixdev;
+@@ -77,6 +76,9 @@ struct mousedev {
+ int old_x[4], old_y[4];
+ int frac_dx, frac_dy;
+ unsigned long touch;
++
++ int (*open_device)(struct mousedev *mousedev);
++ void (*close_device)(struct mousedev *mousedev);
+ };
+
+ enum mousedev_emul {
+@@ -116,9 +118,6 @@ static unsigned char mousedev_imex_seq[]
+ static struct mousedev *mousedev_mix;
+ static LIST_HEAD(mousedev_mix_list);
+
+-static void mixdev_open_devices(void);
+-static void mixdev_close_devices(void);
+-
+ #define fx(i) (mousedev->old_x[(mousedev->pkt_count - (i)) & 03])
+ #define fy(i) (mousedev->old_y[(mousedev->pkt_count - (i)) & 03])
+
+@@ -428,9 +427,7 @@ static int mousedev_open_device(struct m
+ if (retval)
+ return retval;
+
+- if (mousedev->is_mixdev)
+- mixdev_open_devices();
+- else if (!mousedev->exist)
++ if (!mousedev->exist)
+ retval = -ENODEV;
+ else if (!mousedev->open++) {
+ retval = input_open_device(&mousedev->handle);
+@@ -446,9 +443,7 @@ static void mousedev_close_device(struct
+ {
+ mutex_lock(&mousedev->mutex);
+
+- if (mousedev->is_mixdev)
+- mixdev_close_devices();
+- else if (mousedev->exist && !--mousedev->open)
++ if (mousedev->exist && !--mousedev->open)
+ input_close_device(&mousedev->handle);
+
+ mutex_unlock(&mousedev->mutex);
+@@ -459,21 +454,29 @@ static void mousedev_close_device(struct
+ * stream. Note that this function is called with mousedev_mix->mutex
+ * held.
+ */
+-static void mixdev_open_devices(void)
++static int mixdev_open_devices(struct mousedev *mixdev)
+ {
+- struct mousedev *mousedev;
++ int error;
++
++ error = mutex_lock_interruptible(&mixdev->mutex);
++ if (error)
++ return error;
+
+- if (mousedev_mix->open++)
+- return;
++ if (!mixdev->open++) {
++ struct mousedev *mousedev;
+
+- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
+- if (!mousedev->opened_by_mixdev) {
+- if (mousedev_open_device(mousedev))
+- continue;
++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
++ if (!mousedev->opened_by_mixdev) {
++ if (mousedev_open_device(mousedev))
++ continue;
+
+- mousedev->opened_by_mixdev = true;
++ mousedev->opened_by_mixdev = true;
++ }
+ }
+ }
++
++ mutex_unlock(&mixdev->mutex);
++ return 0;
+ }
+
+ /*
+@@ -481,19 +484,22 @@ static void mixdev_open_devices(void)
+ * device. Note that this function is called with mousedev_mix->mutex
+ * held.
+ */
+-static void mixdev_close_devices(void)
++static void mixdev_close_devices(struct mousedev *mixdev)
+ {
+- struct mousedev *mousedev;
++ mutex_lock(&mixdev->mutex);
+
+- if (--mousedev_mix->open)
+- return;
++ if (!--mixdev->open) {
++ struct mousedev *mousedev;
+
+- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
+- if (mousedev->opened_by_mixdev) {
+- mousedev->opened_by_mixdev = false;
+- mousedev_close_device(mousedev);
++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
++ if (mousedev->opened_by_mixdev) {
++ mousedev->opened_by_mixdev = false;
++ mousedev_close_device(mousedev);
++ }
+ }
+ }
++
++ mutex_unlock(&mixdev->mutex);
+ }
+
+
+@@ -522,7 +528,7 @@ static int mousedev_release(struct inode
+ mousedev_detach_client(mousedev, client);
+ kfree(client);
+
+- mousedev_close_device(mousedev);
++ mousedev->close_device(mousedev);
+
+ return 0;
+ }
+@@ -550,7 +556,7 @@ static int mousedev_open(struct inode *i
+ client->mousedev = mousedev;
+ mousedev_attach_client(mousedev, client);
+
+- error = mousedev_open_device(mousedev);
++ error = mousedev->open_device(mousedev);
+ if (error)
+ goto err_free_client;
+
+@@ -861,16 +867,21 @@ static struct mousedev *mousedev_create(
+
+ if (mixdev) {
+ dev_set_name(&mousedev->dev, "mice");
++
++ mousedev->open_device = mixdev_open_devices;
++ mousedev->close_device = mixdev_close_devices;
+ } else {
+ int dev_no = minor;
+ /* Normalize device number if it falls into legacy range */
+ if (dev_no < MOUSEDEV_MINOR_BASE + MOUSEDEV_MINORS)
+ dev_no -= MOUSEDEV_MINOR_BASE;
+ dev_set_name(&mousedev->dev, "mouse%d", dev_no);
++
++ mousedev->open_device = mousedev_open_device;
++ mousedev->close_device = mousedev_close_device;
+ }
+
+ mousedev->exist = true;
+- mousedev->is_mixdev = mixdev;
+ mousedev->handle.dev = input_get_device(dev);
+ mousedev->handle.name = dev_name(&mousedev->dev);
+ mousedev->handle.handler = handler;
+@@ -919,7 +930,7 @@ static void mousedev_destroy(struct mous
+ device_del(&mousedev->dev);
+ mousedev_cleanup(mousedev);
+ input_free_minor(MINOR(mousedev->dev.devt));
+- if (!mousedev->is_mixdev)
++ if (mousedev != mousedev_mix)
+ input_unregister_handle(&mousedev->handle);
+ put_device(&mousedev->dev);
+ }
--- /dev/null
+From 8a0435d958fb36d93b8df610124a0e91e5675c82 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 28 Mar 2014 01:01:38 -0700
+Subject: Input: synaptics - add manual min/max quirk for ThinkPad X240
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 8a0435d958fb36d93b8df610124a0e91e5675c82 upstream.
+
+This extends Benjamin Tissoires manual min/max quirk table with support for
+the ThinkPad X240.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1507,6 +1507,14 @@ static const struct dmi_system_id min_ma
+ .driver_data = (int []){1024, 5052, 2258, 4832},
+ },
+ {
++ /* Lenovo ThinkPad X240 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
++ },
++ .driver_data = (int []){1232, 5710, 1156, 4696},
++ },
++ {
+ /* Lenovo ThinkPad T440s */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--- /dev/null
+From 421e08c41fda1f0c2ff6af81a67b491389b653a5 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Fri, 28 Mar 2014 00:43:00 -0700
+Subject: Input: synaptics - add manual min/max quirk
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 421e08c41fda1f0c2ff6af81a67b491389b653a5 upstream.
+
+The new Lenovo Haswell series (-40's) contains a new Synaptics touchpad.
+However, these new Synaptics devices report bad axis ranges.
+Under Windows, it is not a problem because the Windows driver uses RMI4
+over SMBus to talk to the device. Under Linux, we are using the PS/2
+fallback interface and it occurs the reported ranges are wrong.
+
+Of course, it would be too easy to have only one range for the whole
+series, each touchpad seems to be calibrated in a different way.
+
+We can not use SMBus to get the actual range because I suspect the firmware
+will switch into the SMBus mode and stop talking through PS/2 (this is the
+case for hybrid HID over I2C / PS/2 Synaptics touchpads).
+
+So as a temporary solution (until RMI4 land into upstream), start a new
+list of quirks with the min/max manually set.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 47 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -265,11 +265,22 @@ static int synaptics_identify(struct psm
+ * Read touchpad resolution and maximum reported coordinates
+ * Resolution is left zero if touchpad does not support the query
+ */
++
++static const int *quirk_min_max;
++
+ static int synaptics_resolution(struct psmouse *psmouse)
+ {
+ struct synaptics_data *priv = psmouse->private;
+ unsigned char resp[3];
+
++ if (quirk_min_max) {
++ priv->x_min = quirk_min_max[0];
++ priv->x_max = quirk_min_max[1];
++ priv->y_min = quirk_min_max[2];
++ priv->y_max = quirk_min_max[3];
++ return 0;
++ }
++
+ if (SYN_ID_MAJOR(priv->identity) < 4)
+ return 0;
+
+@@ -1485,10 +1496,46 @@ static const struct dmi_system_id olpc_d
+ { }
+ };
+
++static const struct dmi_system_id min_max_dmi_table[] __initconst = {
++#if defined(CONFIG_DMI)
++ {
++ /* Lenovo ThinkPad Helix */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
++ },
++ .driver_data = (int []){1024, 5052, 2258, 4832},
++ },
++ {
++ /* Lenovo ThinkPad T440s */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
++ },
++ .driver_data = (int []){1024, 5112, 2024, 4832},
++ },
++ {
++ /* Lenovo ThinkPad T540p */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
++ },
++ .driver_data = (int []){1024, 5056, 2058, 4832},
++ },
++#endif
++ { }
++};
++
+ void __init synaptics_module_init(void)
+ {
++ const struct dmi_system_id *min_max_dmi;
++
+ impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
+ broken_olpc_ec = dmi_check_system(olpc_dmi_table);
++
++ min_max_dmi = dmi_first_match(min_max_dmi_table);
++ if (min_max_dmi)
++ quirk_min_max = min_max_dmi->driver_data;
+ }
+
+ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
--- /dev/null
+From e825196d48d2b89a6ec3a8eff280098d2a78207e Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 23 Mar 2014 00:28:40 -0400
+Subject: make prepend_name() work correctly when called with negative *buflen
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit e825196d48d2b89a6ec3a8eff280098d2a78207e upstream.
+
+In all callchains leading to prepend_name(), the value left in *buflen
+is eventually discarded unused if prepend_name() has returned a negative.
+So we are free to do what prepend() does, and subtract from *buflen
+*before* checking for underflow (which turns into checking the sign
+of subtraction result, of course).
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, i
+ u32 dlen = ACCESS_ONCE(name->len);
+ char *p;
+
+- if (*buflen < dlen + 1)
+- return -ENAMETOOLONG;
+ *buflen -= dlen + 1;
++ if (*buflen < 0)
++ return -ENAMETOOLONG;
+ p = *buffer -= dlen + 1;
+ *p++ = '/';
+ while (dlen--) {
--- /dev/null
+From b37199e626b31e1175fb06764c5d1d687723aac2 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 20 Mar 2014 15:18:22 -0400
+Subject: rcuwalk: recheck mount_lock after mountpoint crossing attempts
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit b37199e626b31e1175fb06764c5d1d687723aac2 upstream.
+
+We can get false negative from __lookup_mnt() if an unrelated vfsmount
+gets moved. In that case legitimize_mnt() is guaranteed to fail,
+and we will fall back to non-RCU walk... unless we end up running
+into a hard error on a filesystem object we wouldn't have reached
+if not for that false negative. IOW, delaying that check until
+the end of pathname resolution is wrong - we should recheck right
+after we attempt to cross the mountpoint. We don't need to recheck
+unless we see d_mountpoint() being true - in that case even if
+we have just raced with mount/umount, we can simply go on as if
+we'd come at the moment when the sucker wasn't a mountpoint; if we
+run into a hard error as the result, it was a legitimate outcome.
+__lookup_mnt() returning NULL is different in that respect, since
+it might've happened due to operation on completely unrelated
+mountpoint.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namei.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1098,7 +1098,7 @@ static bool __follow_mount_rcu(struct na
+ return false;
+
+ if (!d_mountpoint(path->dentry))
+- break;
++ return true;
+
+ mounted = __lookup_mnt(path->mnt, path->dentry);
+ if (!mounted)
+@@ -1114,20 +1114,7 @@ static bool __follow_mount_rcu(struct na
+ */
+ *inode = path->dentry->d_inode;
+ }
+- return true;
+-}
+-
+-static void follow_mount_rcu(struct nameidata *nd)
+-{
+- while (d_mountpoint(nd->path.dentry)) {
+- struct mount *mounted;
+- mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
+- if (!mounted)
+- break;
+- nd->path.mnt = &mounted->mnt;
+- nd->path.dentry = mounted->mnt.mnt_root;
+- nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+- }
++ return read_seqretry(&mount_lock, nd->m_seq);
+ }
+
+ static int follow_dotdot_rcu(struct nameidata *nd)
+@@ -1155,7 +1142,17 @@ static int follow_dotdot_rcu(struct name
+ break;
+ nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+ }
+- follow_mount_rcu(nd);
++ while (d_mountpoint(nd->path.dentry)) {
++ struct mount *mounted;
++ mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
++ if (!mounted)
++ break;
++ nd->path.mnt = &mounted->mnt;
++ nd->path.dentry = mounted->mnt.mnt_root;
++ nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
++ if (!read_seqretry(&mount_lock, nd->m_seq))
++ goto failed;
++ }
+ nd->inode = nd->path.dentry->d_inode;
+ return 0;
+
--- /dev/null
+From 5926f87fdaad4be3ed10cec563bf357915e55a86 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Tue, 25 Mar 2014 10:38:37 +0000
+Subject: Revert "xen: properly account for _PAGE_NUMA during xen pte translations"
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit 5926f87fdaad4be3ed10cec563bf357915e55a86 upstream.
+
+This reverts commit a9c8e4beeeb64c22b84c803747487857fe424b68.
+
+PTEs in Xen PV guests must contain machine addresses if _PAGE_PRESENT
+is set and pseudo-physical addresses is _PAGE_PRESENT is clear.
+
+This is because during a domain save/restore (migration) the page
+table entries are "canonicalised" and uncanonicalised". i.e., MFNs are
+converted to PFNs during domain save so that on a restore the page
+table entries may be rewritten with the new MFNs on the destination.
+This canonicalisation is only done for PTEs that are present.
+
+This change resulted in writing PTEs with MFNs if _PAGE_PROTNONE (or
+_PAGE_NUMA) was set but _PAGE_PRESENT was clear. These PTEs would be
+migrated as-is which would result in unexpected behaviour in the
+destination domain. Either a) the MFN would be translated to the
+wrong PFN/page; b) setting the _PAGE_PRESENT bit would clear the PTE
+because the MFN is no longer owned by the domain; or c) the present
+bit would not get set.
+
+Symptoms include "Bad page" reports when munmapping after migrating a
+domain.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/pgtable.h | 14 ++------------
+ arch/x86/xen/mmu.c | 4 ++--
+ 2 files changed, 4 insertions(+), 14 deletions(-)
+
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -445,20 +445,10 @@ static inline int pte_same(pte_t a, pte_
+ return a.pte == b.pte;
+ }
+
+-static inline int pteval_present(pteval_t pteval)
+-{
+- /*
+- * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this
+- * way clearly states that the intent is that protnone and numa
+- * hinting ptes are considered present for the purposes of
+- * pagetable operations like zapping, protection changes, gup etc.
+- */
+- return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA);
+-}
+-
+ static inline int pte_present(pte_t a)
+ {
+- return pteval_present(pte_flags(a));
++ return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE |
++ _PAGE_NUMA);
+ }
+
+ #define pte_accessible pte_accessible
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct
+ /* Assume pteval_t is equivalent to all the other *val_t types. */
+ static pteval_t pte_mfn_to_pfn(pteval_t val)
+ {
+- if (pteval_present(val)) {
++ if (val & _PAGE_PRESENT) {
+ unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+ unsigned long pfn = mfn_to_pfn(mfn);
+
+@@ -381,7 +381,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t
+
+ static pteval_t pte_pfn_to_mfn(pteval_t val)
+ {
+- if (pteval_present(val)) {
++ if (val & _PAGE_PRESENT) {
+ unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+ pteval_t flags = val & PTE_FLAGS_MASK;
+ unsigned long mfn;
ext4-atomically-set-inode-i_flags-in-ext4_set_inode_flags.patch
+rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch
+input-mousedev-fix-race-when-creating-mixed-device.patch
+input-synaptics-add-manual-min-max-quirk.patch
+input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch
+input-cypress_ps2-don-t-report-as-a-button-pads.patch
+xen-balloon-flush-persistent-kmaps-in-correct-position.patch
+revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch
+i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch
+drm-i915-undo-gtt-scratch-pte-unmapping-again.patch
+x86-fix-boot-on-uniprocessor-systems.patch
+make-prepend_name-work-correctly-when-called-with-negative-buflen.patch
--- /dev/null
+From 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 Mon Sep 17 00:00:00 2001
+From: Artem Fetishev <artem_fetishev@epam.com>
+Date: Fri, 28 Mar 2014 13:33:39 -0700
+Subject: x86: fix boot on uniprocessor systems
+
+From: Artem Fetishev <artem_fetishev@epam.com>
+
+commit 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 upstream.
+
+On x86 uniprocessor systems topology_physical_package_id() returns -1
+which causes rapl_cpu_prepare() to leave rapl_pmu variable uninitialized
+which leads to GPF in rapl_pmu_init().
+
+See arch/x86/kernel/cpu/perf_event_intel_rapl.c.
+
+It turns out that physical_package_id and core_id can actually be
+retreived for uniprocessor systems too. Enabling them also fixes
+rapl_pmu code.
+
+Signed-off-by: Artem Fetishev <artem_fetishev@epam.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/topology.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/topology.h
++++ b/arch/x86/include/asm/topology.h
+@@ -119,9 +119,10 @@ static inline void setup_node_to_cpumask
+
+ extern const struct cpumask *cpu_coregroup_mask(int cpu);
+
+-#ifdef ENABLE_TOPO_DEFINES
+ #define topology_physical_package_id(cpu) (cpu_data(cpu).phys_proc_id)
+ #define topology_core_id(cpu) (cpu_data(cpu).cpu_core_id)
++
++#ifdef ENABLE_TOPO_DEFINES
+ #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu))
+ #define topology_thread_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu))
+ #endif
--- /dev/null
+From 09ed3d5ba06137913960f9c9385f71fc384193ab Mon Sep 17 00:00:00 2001
+From: Wei Liu <wei.liu2@citrix.com>
+Date: Sat, 15 Mar 2014 16:11:47 +0000
+Subject: xen/balloon: flush persistent kmaps in correct position
+
+From: Wei Liu <wei.liu2@citrix.com>
+
+commit 09ed3d5ba06137913960f9c9385f71fc384193ab upstream.
+
+Xen balloon driver will update ballooned out pages' P2M entries to point
+to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc
+page while non-preemptible", kmap_flush_unused was moved after updating
+P2M table. In that case for 32 bit PV guest we might end up with
+
+ P2M X -----> S (S is mfn of balloon scratch page)
+ M2P Y -----> X (Y is mfn in persistent kmap entry)
+
+kmap_flush_unused() iterates through all the PTEs in the kmap address
+space, using pte_to_page() to obtain the page. If the p2m and the m2p
+are inconsistent the incorrect page is returned. This will clear
+page->address on the wrong page which may cause subsequent oopses if
+that page is currently kmap'ed.
+
+Move the flush back between get_page and __set_phys_to_machine to fix
+this.
+
+Signed-off-by: Wei Liu <wei.liu2@citrix.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/balloon.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -406,11 +406,25 @@ static enum bp_state decrease_reservatio
+ state = BP_EAGAIN;
+ break;
+ }
++ scrub_page(page);
+
+- pfn = page_to_pfn(page);
+- frame_list[i] = pfn_to_mfn(pfn);
++ frame_list[i] = page_to_pfn(page);
++ }
+
+- scrub_page(page);
++ /*
++ * Ensure that ballooned highmem pages don't have kmaps.
++ *
++ * Do this before changing the p2m as kmap_flush_unused()
++ * reads PTEs to obtain pages (and hence needs the original
++ * p2m entry).
++ */
++ kmap_flush_unused();
++
++ /* Update direct mapping, invalidate P2M, and add to balloon. */
++ for (i = 0; i < nr_pages; i++) {
++ pfn = frame_list[i];
++ frame_list[i] = pfn_to_mfn(pfn);
++ page = pfn_to_page(pfn);
+
+ #ifdef CONFIG_XEN_HAVE_PVMMU
+ /*
+@@ -436,11 +450,9 @@ static enum bp_state decrease_reservatio
+ }
+ #endif
+
+- balloon_append(pfn_to_page(pfn));
++ balloon_append(page);
+ }
+
+- /* Ensure that ballooned highmem pages don't have kmaps. */
+- kmap_flush_unused();
+ flush_tlb_all();
+
+ set_xen_guest_handle(reservation.extent_start, frame_list);
projects / thirdparty / kernel / stable-queue.git / commitdiff
