--- /dev/null
+From ca5106ae3da0179dcee3ae21f3ea94f62e9fdb0c Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 7 May 2014 16:20:24 +0200
+Subject: ASoC: dapm: Skip CODEC<->CODEC links in connect_dai_link_widgets()
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit ca5106ae3da0179dcee3ae21f3ea94f62e9fdb0c upstream.
+
+For CODEC to CODEC DAI links the paths are created in snd_soc_dapm_new_pcm().
+Also for CODEC to CODEC links the widgets are connected cross-over via a DAI
+link widget, meaning that the capture widget of one CODEC will be connected to
+the playback widget of the other and vice versa. Whereas
+snd_soc_dapm_connect_dai_link_widgets() directly connects the playback widget of
+the CPU DAI to the playback widget of the CODEC DAI and the capture widget of
+the CPU DAI to the capture widget of the CODEC DAI. So not skipping
+CODEC<->CODEC links in snd_soc_dapm_connect_dai_link_widgets() will create
+incorrect connections between the two CODECs which will cause DAPM to detect
+active paths where there are none and unnecessarily power up widgets.
+
+Fixes: b893ea5 ("ASoC: sapm: Automatically connect DAI link widgets in DAPM graph.")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3649,8 +3649,11 @@ void snd_soc_dapm_connect_dai_link_widge
+ cpu_dai = rtd->cpu_dai;
+ codec_dai = rtd->codec_dai;
+
+- /* dynamic FE links have no fixed DAI mapping */
+- if (rtd->dai_link->dynamic)
++ /*
++ * dynamic FE links have no fixed DAI mapping.
++ * CODEC<->CODEC links have no direct connection.
++ */
++ if (rtd->dai_link->dynamic || rtd->dai_link->params)
+ continue;
+
+ /* there is no point in connecting BE DAI links with dummies */
--- /dev/null
+From 44330ab516c15dda8a1e660eeaf0003f84e43e3f Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Tue, 13 May 2014 13:45:15 +0100
+Subject: ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 44330ab516c15dda8a1e660eeaf0003f84e43e3f upstream.
+
+The register CLASS_D_CONTROL_1 is marked as volatile because it contains
+a bit, DAC_MUTE, which is also mirrored in the ADC_DAC_CONTROL_1
+register. This causes problems for the "Speaker Switch" control, which
+will report an error if the CODEC is suspended because it relies on a
+volatile register.
+
+To resolve this issue mark CLASS_D_CONTROL_1 as non-volatile and
+manually keep the register cache in sync by updating both bits when
+changing the mute status.
+
+Reported-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Tested-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8962.c | 15 ++++++++++++---
+ sound/soc/codecs/wm8962.h | 4 ++++
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -154,6 +154,7 @@ static struct reg_default wm8962_reg[] =
+ { 40, 0x0000 }, /* R40 - SPKOUTL volume */
+ { 41, 0x0000 }, /* R41 - SPKOUTR volume */
+
++ { 49, 0x0010 }, /* R49 - Class D Control 1 */
+ { 51, 0x0003 }, /* R51 - Class D Control 2 */
+
+ { 56, 0x0506 }, /* R56 - Clocking 4 */
+@@ -795,7 +796,6 @@ static bool wm8962_volatile_register(str
+ case WM8962_ALC2:
+ case WM8962_THERMAL_SHUTDOWN_STATUS:
+ case WM8962_ADDITIONAL_CONTROL_4:
+- case WM8962_CLASS_D_CONTROL_1:
+ case WM8962_DC_SERVO_6:
+ case WM8962_INTERRUPT_STATUS_1:
+ case WM8962_INTERRUPT_STATUS_2:
+@@ -2922,13 +2922,22 @@ static int wm8962_set_fll(struct snd_soc
+ static int wm8962_mute(struct snd_soc_dai *dai, int mute)
+ {
+ struct snd_soc_codec *codec = dai->codec;
+- int val;
++ int val, ret;
+
+ if (mute)
+- val = WM8962_DAC_MUTE;
++ val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
+ else
+ val = 0;
+
++ /**
++ * The DAC mute bit is mirrored in two registers, update both to keep
++ * the register cache consistent.
++ */
++ ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
++ WM8962_DAC_MUTE_ALT, val);
++ if (ret < 0)
++ return ret;
++
+ return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
+ WM8962_DAC_MUTE, val);
+ }
+--- a/sound/soc/codecs/wm8962.h
++++ b/sound/soc/codecs/wm8962.h
+@@ -1954,6 +1954,10 @@
+ #define WM8962_SPKOUTL_ENA_MASK 0x0040 /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_SHIFT 6 /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_WIDTH 1 /* SPKOUTL_ENA */
++#define WM8962_DAC_MUTE_ALT 0x0010 /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_MASK 0x0010 /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_SHIFT 4 /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_WIDTH 1 /* DAC_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE 0x0002 /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_MASK 0x0002 /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_SHIFT 1 /* SPKOUTL_PGA_MUTE */
--- /dev/null
+From 1c4abec0baf25ffb92a28cc99d4231feeaa4d3f3 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 8 May 2014 09:48:10 +0300
+Subject: iwlwifi: mvm: fix setting channel in monitor mode
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 1c4abec0baf25ffb92a28cc99d4231feeaa4d3f3 upstream.
+
+There was a deadlock in monitor mode when we were setting the
+channel if the channel was not 1.
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.14.3 #4 Not tainted
+-------------------------------------------------------
+iw/3323 is trying to acquire lock:
+ (&local->chanctx_mtx){+.+.+.}, at: [<ffffffffa062e2f2>] ieee80211_vif_release_channel+0x42/0xb0 [mac80211]
+
+but task is already holding lock:
+ (&local->iflist_mtx){+.+...}, at: [<ffffffffa0609e0a>] ieee80211_set_monitor_channel+0x5a/0x1b0 [mac80211]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&local->iflist_mtx){+.+...}:
+ [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
+ [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
+ [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
+ [<ffffffffa06225cf>] ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
+ [<ffffffffa0518189>] iwl_mvm_recalc_multicast+0x49/0xa0 [iwlmvm]
+ [<ffffffffa051822e>] iwl_mvm_configure_filter+0x4e/0x70 [iwlmvm]
+ [<ffffffffa05e6d43>] ieee80211_configure_filter+0x153/0x5f0 [mac80211]
+ [<ffffffffa05e71f5>] ieee80211_reconfig_filter+0x15/0x20 [mac80211]
+ [snip]
+
+-> #1 (&mvm->mutex){+.+.+.}:
+ [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
+ [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
+ [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
+ [<ffffffffa0517246>] iwl_mvm_add_chanctx+0x56/0xe0 [iwlmvm]
+ [<ffffffffa062ca1e>] ieee80211_new_chanctx+0x13e/0x410 [mac80211]
+ [<ffffffffa062d953>] ieee80211_vif_use_channel+0x1c3/0x5a0 [mac80211]
+ [<ffffffffa06035ab>] ieee80211_add_virtual_monitor+0x1ab/0x6b0 [mac80211]
+ [<ffffffffa06052ea>] ieee80211_do_open+0xe6a/0x15a0 [mac80211]
+ [<ffffffffa0605a79>] ieee80211_open+0x59/0x60 [mac80211]
+ [snip]
+
+-> #0 (&local->chanctx_mtx){+.+.+.}:
+ [<ffffffff810d6cb7>] check_prevs_add+0x977/0x980
+ [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
+ [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
+ [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
+ [<ffffffffa062e2f2>] ieee80211_vif_release_channel+0x42/0xb0 [mac80211]
+ [<ffffffffa0609ec3>] ieee80211_set_monitor_channel+0x113/0x1b0 [mac80211]
+ [<ffffffffa058fb37>] cfg80211_set_monitor_channel+0x77/0x2b0 [cfg80211]
+ [<ffffffffa056e0b2>] __nl80211_set_channel+0x122/0x140 [cfg80211]
+ [<ffffffffa0581374>] nl80211_set_wiphy+0x284/0xaf0 [cfg80211]
+ [snip]
+
+other info that might help us debug this:
+
+Chain exists of:
+ &local->chanctx_mtx --> &mvm->mutex --> &local->iflist_mtx
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&local->iflist_mtx);
+ lock(&mvm->mutex);
+ lock(&local->iflist_mtx);
+ lock(&local->chanctx_mtx);
+
+ *** DEADLOCK ***
+
+This deadlock actually occurs:
+INFO: task iw:3323 blocked for more than 120 seconds.
+ Not tainted 3.14.3 #4
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+iw D ffff8800c8afcd80 4192 3323 3322 0x00000000
+ ffff880078fdb7e0 0000000000000046 ffff8800c8afcd80 ffff880078fdbfd8
+ 00000000001d5540 00000000001d5540 ffff8801141b0000 ffff8800c8afcd80
+ ffff880078ff9e38 ffff880078ff9e38 ffff880078ff9e40 0000000000000246
+Call Trace:
+ [<ffffffff817ea841>] schedule_preempt_disabled+0x31/0x80
+ [<ffffffff817ebaed>] mutex_lock_nested+0x19d/0x4f0
+ [<ffffffffa06225cf>] ? ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
+ [<ffffffffa06225cf>] ? ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
+ [<ffffffffa052a680>] ? iwl_mvm_power_mac_update_mode+0xc0/0xc0 [iwlmvm]
+ [<ffffffffa06225cf>] ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
+ [<ffffffffa0529357>] _iwl_mvm_power_update_binding+0x27/0x80 [iwlmvm]
+ [<ffffffffa0516eb1>] iwl_mvm_unassign_vif_chanctx+0x81/0xc0 [iwlmvm]
+ [<ffffffffa062d3ff>] __ieee80211_vif_release_channel+0xdf/0x470 [mac80211]
+ [<ffffffffa062e2fa>] ieee80211_vif_release_channel+0x4a/0xb0 [mac80211]
+ [<ffffffffa0609ec3>] ieee80211_set_monitor_channel+0x113/0x1b0 [mac80211]
+ [<ffffffffa058fb37>] cfg80211_set_monitor_channel+0x77/0x2b0 [cfg80211]
+ [<ffffffffa056e0b2>] __nl80211_set_channel+0x122/0x140 [cfg80211]
+ [<ffffffffa0581374>] nl80211_set_wiphy+0x284/0xaf0 [cfg80211]
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=75541
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -796,7 +796,7 @@ static void iwl_mvm_mc_iface_iterator(vo
+ memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
+ len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
+
+- ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC, len, cmd);
++ ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+ if (ret)
+ IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
+ }
+@@ -812,7 +812,7 @@ static void iwl_mvm_recalc_multicast(str
+ if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
+ return;
+
+- ieee80211_iterate_active_interfaces(
++ ieee80211_iterate_active_interfaces_atomic(
+ mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+ iwl_mvm_mc_iface_iterator, &iter_data);
+ }
--- /dev/null
+From 83f7a85f1134c6e914453f5747435415a23d516b Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 13 Apr 2014 16:03:11 +0300
+Subject: iwlwifi: pcie: disable interrupts upon PCIe alloc
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 83f7a85f1134c6e914453f5747435415a23d516b upstream.
+
+In case RFKILL is in KILL position, the NIC will issue an
+interrupt straight away. This interrupt won't be sent
+because it is masked in the hardware.
+But if our interrupt service routine is called for another
+reason (SHARED_IRQ), then we'll look at the interrupt cause
+and service it. This can cause bad things if we are not
+ready yet.
+Explicitly clean the interrupt cause register to make sure
+we won't service anything before we are ready to.
+
+Reported-and-tested-by: Alexander Monakov <amonakov@gmail.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -1563,6 +1563,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ * PCI Tx retries from interfering with C3 CPU state */
+ pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
+
++ trans->dev = &pdev->dev;
++ trans_pcie->pci_dev = pdev;
++ iwl_disable_interrupts(trans);
++
+ err = pci_enable_msi(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
+@@ -1574,8 +1578,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ }
+ }
+
+- trans->dev = &pdev->dev;
+- trans_pcie->pci_dev = pdev;
+ trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
+ trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
+ snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
+@@ -1601,8 +1603,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ goto out_pci_disable_msi;
+ }
+
+- trans_pcie->inta_mask = CSR_INI_SET_MASK;
+-
+ if (iwl_pcie_alloc_ict(trans))
+ goto out_free_cmd_pool;
+
+@@ -1614,6 +1614,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ goto out_free_ict;
+ }
+
++ trans_pcie->inta_mask = CSR_INI_SET_MASK;
++
+ return trans;
+
+ out_free_ict:
--- /dev/null
+From 2425ce84026c385b73ae72039f90d042d49e0394 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 8 May 2014 15:51:37 -0400
+Subject: metag: fix memory barriers
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 2425ce84026c385b73ae72039f90d042d49e0394 upstream.
+
+Volatile access doesn't really imply the compiler barrier. Volatile access
+is only ordered with respect to other volatile accesses, it isn't ordered
+with respect to general memory accesses. Gcc may reorder memory accesses
+around volatile access, as we can see in this simple example (if we
+compile it with optimization, both increments of *b will be collapsed to
+just one):
+
+void fn(volatile int *a, long *b)
+{
+ (*b)++;
+ *a = 10;
+ (*b)++;
+}
+
+Consequently, we need the compiler barrier after a write to the volatile
+variable, to make sure that the compiler doesn't reorder the volatile
+write with something else.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/metag/include/asm/barrier.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/metag/include/asm/barrier.h
++++ b/arch/metag/include/asm/barrier.h
+@@ -15,6 +15,7 @@ static inline void wr_fence(void)
+ volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_FENCE;
+ barrier();
+ *flushptr = 0;
++ barrier();
+ }
+
+ #else /* CONFIG_METAG_META21 */
+@@ -35,6 +36,7 @@ static inline void wr_fence(void)
+ *flushptr = 0;
+ *flushptr = 0;
+ *flushptr = 0;
++ barrier();
+ }
+
+ #endif /* !CONFIG_METAG_META21 */
+@@ -68,6 +70,7 @@ static inline void fence(void)
+ volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_ATOMIC_UNLOCK;
+ barrier();
+ *flushptr = 0;
++ barrier();
+ }
+ #define smp_mb() fence()
+ #define smp_rmb() fence()
--- /dev/null
+From d71f290b4e98a39f49f2595a13be3b4d5ce8e1f1 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Tue, 13 May 2014 23:58:24 +0100
+Subject: metag: Reduce maximum stack size to 256MB
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit d71f290b4e98a39f49f2595a13be3b4d5ce8e1f1 upstream.
+
+Specify the maximum stack size for arches where the stack grows upward
+(parisc and metag) in asm/processor.h rather than hard coding in
+fs/exec.c so that metag can specify a smaller value of 256MB rather than
+1GB.
+
+This fixes a BUG on metag if the RLIMIT_STACK hard limit is increased
+beyond a safe value by root. E.g. when starting a process after running
+"ulimit -H -s unlimited" it will then attempt to use a stack size of the
+maximum 1GB which is far too big for metag's limited user virtual
+address space (stack_top is usually 0x3ffff000):
+
+BUG: failure at fs/exec.c:589/shift_arg_pages()!
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Helge Deller <deller@gmx.de>
+Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
+Cc: linux-parisc@vger.kernel.org
+Cc: linux-metag@vger.kernel.org
+Cc: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/metag/include/asm/processor.h | 2 ++
+ arch/parisc/include/asm/processor.h | 2 ++
+ fs/exec.c | 6 +++---
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/metag/include/asm/processor.h
++++ b/arch/metag/include/asm/processor.h
+@@ -22,6 +22,8 @@
+ /* Add an extra page of padding at the top of the stack for the guard page. */
+ #define STACK_TOP (TASK_SIZE - PAGE_SIZE)
+ #define STACK_TOP_MAX STACK_TOP
++/* Maximum virtual space for stack */
++#define STACK_SIZE_MAX (1 << 28) /* 256 MB */
+
+ /* This decides where the kernel will search for a free chunk of vm
+ * space during mmap's.
+--- a/arch/parisc/include/asm/processor.h
++++ b/arch/parisc/include/asm/processor.h
+@@ -55,6 +55,8 @@
+ #define STACK_TOP TASK_SIZE
+ #define STACK_TOP_MAX DEFAULT_TASK_SIZE
+
++#define STACK_SIZE_MAX (1 << 30) /* 1 GB */
++
+ #endif
+
+ #ifndef __ASSEMBLY__
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -654,10 +654,10 @@ int setup_arg_pages(struct linux_binprm
+ unsigned long rlim_stack;
+
+ #ifdef CONFIG_STACK_GROWSUP
+- /* Limit stack size to 1GB */
++ /* Limit stack size */
+ stack_base = rlimit_max(RLIMIT_STACK);
+- if (stack_base > (1 << 30))
+- stack_base = 1 << 30;
++ if (stack_base > STACK_SIZE_MAX)
++ stack_base = STACK_SIZE_MAX;
+
+ /* Make sure we didn't let the argument array grow too large. */
+ if (vma->vm_end - vma->vm_start > stack_base)
--- /dev/null
+From c776cd89fc705fc8b5c2e5ad906bf5d791620fed Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sun, 11 May 2014 18:40:50 -0400
+Subject: parisc: Improve LWS-CAS performance
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit c776cd89fc705fc8b5c2e5ad906bf5d791620fed upstream.
+
+The attached change significantly improves the performance of the LWS-CAS code
+in syscall.S.
+This allows a number of packages to build (e.g., zeromq3, gtest and libxs)
+that previously failed because slow LWS-CAS performance under contention. In
+particular, interrupts taken while the lock was taken degraded performance
+significantly.
+
+The change does the following:
+
+1) Disables interrupts around the CAS operation, and
+2) Changes the loads and stores to use the ordered completer, "o", on
+PA 2.0. "o" and "ma" with a zero offset are equivalent. The latter is
+accepted on both PA 1.X and 2.0.
+
+The use of ordered loads and stores probably makes no difference on all
+existing hardware, but it seemed pedantically correct. In particular, the CAS
+operation must complete before LDCW lock is released. As written before, a
+processor could reorder the operations.
+
+I don't believe the period interrupts are disabled is long enough to
+significantly increase interrupt latency. For example, the TLB insert code is
+longer. Worst case is a memory fault in the CAS operation.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/syscall.S | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -589,10 +589,13 @@ cas_nocontend:
+ # endif
+ /* ENABLE_LWS_DEBUG */
+
++ rsm PSW_SM_I, %r0 /* Disable interrupts */
++ /* COW breaks can cause contention on UP systems */
+ LDCW 0(%sr2,%r20), %r28 /* Try to acquire the lock */
+ cmpb,<>,n %r0, %r28, cas_action /* Did we get it? */
+ cas_wouldblock:
+ ldo 2(%r0), %r28 /* 2nd case */
++ ssm PSW_SM_I, %r0
+ b lws_exit /* Contended... */
+ ldo -EAGAIN(%r0), %r21 /* Spin in userspace */
+
+@@ -619,15 +622,17 @@ cas_action:
+ stw %r1, 4(%sr2,%r20)
+ #endif
+ /* The load and store could fail */
+-1: ldw 0(%sr3,%r26), %r28
++1: ldw,ma 0(%sr3,%r26), %r28
+ sub,<> %r28, %r25, %r0
+-2: stw %r24, 0(%sr3,%r26)
++2: stw,ma %r24, 0(%sr3,%r26)
+ /* Free lock */
+- stw %r20, 0(%sr2,%r20)
++ stw,ma %r20, 0(%sr2,%r20)
+ #if ENABLE_LWS_DEBUG
+ /* Clear thread register indicator */
+ stw %r0, 4(%sr2,%r20)
+ #endif
++ /* Enable interrupts */
++ ssm PSW_SM_I, %r0
+ /* Return to userspace, set no error */
+ b lws_exit
+ copy %r0, %r21
+@@ -639,6 +644,7 @@ cas_action:
+ #if ENABLE_LWS_DEBUG
+ stw %r0, 4(%sr2,%r20)
+ #endif
++ ssm PSW_SM_I, %r0
+ b lws_exit
+ ldo -EFAULT(%r0),%r21 /* set errno */
+ nop
--- /dev/null
+From fef47e2a2e1e75fe50a10f634a80f16808348cc6 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Mon, 5 May 2014 18:07:12 +0200
+Subject: parisc: ratelimit userspace segfault printing
+
+From: Helge Deller <deller@gmx.de>
+
+commit fef47e2a2e1e75fe50a10f634a80f16808348cc6 upstream.
+
+Ratelimit printing of userspace segfaults and make it runtime
+configurable via the /proc/sys/debug/exception-trace variable. This
+should resolve syslog from growing way too fast and thus prevents
+possible system service attacks.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Kconfig | 1
+ arch/parisc/kernel/traps.c | 54 ++++++++++++++++++++-------------------------
+ arch/parisc/mm/fault.c | 44 +++++++++++++++++++++++++-----------
+ 3 files changed, 56 insertions(+), 43 deletions(-)
+
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -22,6 +22,7 @@ config PARISC
+ select GENERIC_SMP_IDLE_THREAD
+ select GENERIC_STRNCPY_FROM_USER
+ select SYSCTL_ARCH_UNALIGN_ALLOW
++ select SYSCTL_EXCEPTION_TRACE
+ select HAVE_MOD_ARCH_SPECIFIC
+ select VIRT_TO_BUS
+ select MODULES_USE_ELF_RELA
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -25,6 +25,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/console.h>
+ #include <linux/bug.h>
++#include <linux/ratelimit.h>
+
+ #include <asm/assembly.h>
+ #include <asm/uaccess.h>
+@@ -42,9 +43,6 @@
+
+ #include "../math-emu/math-emu.h" /* for handle_fpe() */
+
+-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
+- /* dumped to the console via printk) */
+-
+ #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+ DEFINE_SPINLOCK(pa_dbit_lock);
+ #endif
+@@ -160,6 +158,17 @@ void show_regs(struct pt_regs *regs)
+ }
+ }
+
++static DEFINE_RATELIMIT_STATE(_hppa_rs,
++ DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST);
++
++#define parisc_printk_ratelimited(critical, regs, fmt, ...) { \
++ if ((critical || show_unhandled_signals) && __ratelimit(&_hppa_rs)) { \
++ printk(fmt, ##__VA_ARGS__); \
++ show_regs(regs); \
++ } \
++}
++
++
+ static void do_show_stack(struct unwind_frame_info *info)
+ {
+ int i = 1;
+@@ -229,12 +238,10 @@ void die_if_kernel(char *str, struct pt_
+ if (err == 0)
+ return; /* STFU */
+
+- printk(KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
++ parisc_printk_ratelimited(1, regs,
++ KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
+ current->comm, task_pid_nr(current), str, err, regs->iaoq[0]);
+-#ifdef PRINT_USER_FAULTS
+- /* XXX for debugging only */
+- show_regs(regs);
+-#endif
++
+ return;
+ }
+
+@@ -321,14 +328,11 @@ static void handle_break(struct pt_regs
+ (tt == BUG_TRAP_TYPE_NONE) ? 9 : 0);
+ }
+
+-#ifdef PRINT_USER_FAULTS
+- if (unlikely(iir != GDB_BREAK_INSN)) {
+- printk(KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
++ if (unlikely(iir != GDB_BREAK_INSN))
++ parisc_printk_ratelimited(0, regs,
++ KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
+ iir & 31, (iir>>13) & ((1<<13)-1),
+ task_pid_nr(current), current->comm);
+- show_regs(regs);
+- }
+-#endif
+
+ /* send standard GDB signal */
+ handle_gdb_break(regs, TRAP_BRKPT);
+@@ -758,11 +762,9 @@ void notrace handle_interruption(int cod
+
+ default:
+ if (user_mode(regs)) {
+-#ifdef PRINT_USER_FAULTS
+- printk(KERN_DEBUG "\nhandle_interruption() pid=%d command='%s'\n",
+- task_pid_nr(current), current->comm);
+- show_regs(regs);
+-#endif
++ parisc_printk_ratelimited(0, regs, KERN_DEBUG
++ "handle_interruption() pid=%d command='%s'\n",
++ task_pid_nr(current), current->comm);
+ /* SIGBUS, for lack of a better one. */
+ si.si_signo = SIGBUS;
+ si.si_code = BUS_OBJERR;
+@@ -779,16 +781,10 @@ void notrace handle_interruption(int cod
+
+ if (user_mode(regs)) {
+ if ((fault_space >> SPACEID_SHIFT) != (regs->sr[7] >> SPACEID_SHIFT)) {
+-#ifdef PRINT_USER_FAULTS
+- if (fault_space == 0)
+- printk(KERN_DEBUG "User Fault on Kernel Space ");
+- else
+- printk(KERN_DEBUG "User Fault (long pointer) (fault %d) ",
+- code);
+- printk(KERN_CONT "pid=%d command='%s'\n",
+- task_pid_nr(current), current->comm);
+- show_regs(regs);
+-#endif
++ parisc_printk_ratelimited(0, regs, KERN_DEBUG
++ "User fault %d on space 0x%08lx, pid=%d command='%s'\n",
++ code, fault_space,
++ task_pid_nr(current), current->comm);
+ si.si_signo = SIGSEGV;
+ si.si_errno = 0;
+ si.si_code = SEGV_MAPERR;
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -19,10 +19,6 @@
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+
+-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
+- /* dumped to the console via printk) */
+-
+-
+ /* Various important other fields */
+ #define bit22set(x) (x & 0x00000200)
+ #define bits23_25set(x) (x & 0x000001c0)
+@@ -34,6 +30,8 @@
+
+ DEFINE_PER_CPU(struct exception_data, exception_data);
+
++int show_unhandled_signals = 1;
++
+ /*
+ * parisc_acctyp(unsigned int inst) --
+ * Given a PA-RISC memory access instruction, determine if the
+@@ -173,6 +171,32 @@ int fixup_exception(struct pt_regs *regs
+ return 0;
+ }
+
++/*
++ * Print out info about fatal segfaults, if the show_unhandled_signals
++ * sysctl is set:
++ */
++static inline void
++show_signal_msg(struct pt_regs *regs, unsigned long code,
++ unsigned long address, struct task_struct *tsk,
++ struct vm_area_struct *vma)
++{
++ if (!unhandled_signal(tsk, SIGSEGV))
++ return;
++
++ if (!printk_ratelimit())
++ return;
++
++ pr_warn("\n");
++ pr_warn("do_page_fault() command='%s' type=%lu address=0x%08lx",
++ tsk->comm, code, address);
++ print_vma_addr(KERN_CONT " in ", regs->iaoq[0]);
++ if (vma)
++ pr_warn(" vm_start = 0x%08lx, vm_end = 0x%08lx\n",
++ vma->vm_start, vma->vm_end);
++
++ show_regs(regs);
++}
++
+ void do_page_fault(struct pt_regs *regs, unsigned long code,
+ unsigned long address)
+ {
+@@ -270,16 +294,8 @@ bad_area:
+ if (user_mode(regs)) {
+ struct siginfo si;
+
+-#ifdef PRINT_USER_FAULTS
+- printk(KERN_DEBUG "\n");
+- printk(KERN_DEBUG "do_page_fault() pid=%d command='%s' type=%lu address=0x%08lx\n",
+- task_pid_nr(tsk), tsk->comm, code, address);
+- if (vma) {
+- printk(KERN_DEBUG "vm_start = 0x%08lx, vm_end = 0x%08lx\n",
+- vma->vm_start, vma->vm_end);
+- }
+- show_regs(regs);
+-#endif
++ show_signal_msg(regs, code, address, tsk, vma);
++
+ switch (code) {
+ case 15: /* Data TLB miss fault/Data page fault */
+ /* send SIGSEGV when outside of vma */
arm-mvebu-mvebu-soc-id-add-missing-clk_put-call.patch
arm-mvebu-mvebu-soc-id-keep-clock-enabled-if-pcie-unit-is-enabled.patch
percpu-make-pcpu_alloc_chunk-use-pcpu_mem_free-instead-of-kfree.patch
+iwlwifi-pcie-disable-interrupts-upon-pcie-alloc.patch
+iwlwifi-mvm-fix-setting-channel-in-monitor-mode.patch
+asoc-dapm-skip-codec-codec-links-in-connect_dai_link_widgets.patch
+asoc-wm8962-update-register-class_d_control_1-to-be-non-volatile.patch
+parisc-ratelimit-userspace-segfault-printing.patch
+parisc-improve-lws-cas-performance.patch
+metag-fix-memory-barriers.patch
+metag-reduce-maximum-stack-size-to-256mb.patch
+x86-64-modify_ldt-make-support-for-16-bit-segments-a-runtime-option.patch
--- /dev/null
+From fa81511bb0bbb2b1aace3695ce869da9762624ff Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 14 May 2014 16:33:54 -0700
+Subject: x86-64, modify_ldt: Make support for 16-bit segments a runtime option
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit fa81511bb0bbb2b1aace3695ce869da9762624ff upstream.
+
+Checkin:
+
+b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
+
+disabled 16-bit segments on 64-bit kernels due to an information
+leak. However, it does seem that people are genuinely using Wine to
+run old 16-bit Windows programs on Linux.
+
+A proper fix for this ("espfix64") is coming in the upcoming merge
+window, but as a temporary fix, create a sysctl to allow the
+administrator to re-enable support for 16-bit segments.
+
+It adds a "/proc/sys/abi/ldt16" sysctl that defaults to zero (off). If
+you hit this issue and care about your old Windows program more than
+you care about a kernel stack address information leak, you can do
+
+ echo 1 > /proc/sys/abi/ldt16
+
+as root (add it to your startup scripts), and you should be ok.
+
+The sysctl table is only added if you have COMPAT support enabled on
+x86-64, but I assume anybody who runs old windows binaries very much
+does that ;)
+
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/r/CA%2B55aFw9BPoD10U1LfHbOMpHWZkvJTkMcfCs9s3urPr1YyWBxw@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/ldt.c | 4 +++-
+ arch/x86/vdso/vdso32-setup.c | 8 ++++++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -20,6 +20,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, u
+ * IRET leaking the high bits of the kernel stack address.
+ */
+ #ifdef CONFIG_X86_64
+- if (!ldt_info.seg_32bit) {
++ if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ error = -EINVAL;
+ goto out_unlock;
+ }
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,6 +41,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled sysctl_vsyscall32
+ #define arch_setup_additional_pages syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+
+ /*
+@@ -379,6 +380,13 @@ static struct ctl_table abi_table2[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec
++ },
++ {
++ .procname = "ldt16",
++ .data = &sysctl_ldt16,
++ .maxlen = sizeof(int),
++ .mode = 0644,
++ .proc_handler = proc_dointvec
+ },
+ {}
+ };
projects / thirdparty / kernel / stable-queue.git / commitdiff
