--- /dev/null
+From 2cf532f5e67c0cfe38c8c100e49280cdadacd2be Mon Sep 17 00:00:00 2001
+From: Alexander Gordeev <agordeev@redhat.com>
+Date: Thu, 17 Apr 2014 18:06:15 +0200
+Subject: ahci: Do not receive interrupts sent by dummy ports
+
+From: Alexander Gordeev <agordeev@redhat.com>
+
+commit 2cf532f5e67c0cfe38c8c100e49280cdadacd2be upstream.
+
+In multiple MSI mode all AHCI ports (including dummy) get assigned
+separate MSI vectors and (as result of execution
+pci_enable_msi_exact() function) separate IRQ numbers, (mapped to the
+MSI vectors).
+
+Therefore, although interrupts from dummy ports are not desired they
+are still enabled. We do not request IRQs for dummy ports, but that
+only means we do not assign AHCI-specific ISRs to corresponding IRQ
+numbers.
+
+As result, dummy port interrupts still could come and traverse all the
+way from the PCI device to the kernel, causing unnecessary overhead.
+
+This update disables IRQs for dummy ports and prevents the described
+issue.
+
+Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Tested-by: David Milburn <dmilburn@redhat.com>
+Cc: linux-ide@vger.kernel.org
+Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ahci.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1242,12 +1242,16 @@ int ahci_host_activate(struct ata_host *
+ for (i = 0; i < host->n_ports; i++) {
+ struct ahci_port_priv *pp = host->ports[i]->private_data;
+
+- /* pp is NULL for dummy ports */
+- if (pp)
+- rc = devm_request_threaded_irq(host->dev,
+- irq + i, ahci_hw_interrupt,
+- ahci_thread_fn, IRQF_SHARED,
+- pp->irq_desc, host->ports[i]);
++ /* Do not receive interrupts sent by dummy ports */
++ if (!pp) {
++ disable_irq(irq + i);
++ continue;
++ }
++
++ rc = devm_request_threaded_irq(host->dev, irq + i,
++ ahci_hw_interrupt,
++ ahci_thread_fn, IRQF_SHARED,
++ pp->irq_desc, host->ports[i]);
+ if (rc)
+ goto out_free_irqs;
+ }
--- /dev/null
+From 9ae794ac5e407d3bc3fec785db481d5a2c0fa275 Mon Sep 17 00:00:00 2001
+From: David Milburn <dmilburn@redhat.com>
+Date: Wed, 16 Apr 2014 11:43:46 -0500
+Subject: ahci: do not request irq for dummy port
+
+From: David Milburn <dmilburn@redhat.com>
+
+commit 9ae794ac5e407d3bc3fec785db481d5a2c0fa275 upstream.
+
+System may crash in ahci_hw_interrupt() or ahci_thread_fn() when
+accessing the interrupt status in a port's private_data if the port is
+actually a DUMMY port.
+
+00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA AHCI Controller
+
+<snip console output for linux-3.15-rc1>
+[ 9.352080] ahci 0000:00:1f.2: AHCI 0001.0200 32 slots 6 ports 3 Gbps 0x1 impl SATA mode
+[ 9.352084] ahci 0000:00:1f.2: flags: 64bit ncq sntf pm led clo pio slum part ccc
+[ 9.368155] Console: switching to colour frame buffer device 128x48
+[ 9.439759] mgag200 0000:11:00.0: fb0: mgadrmfb frame buffer device
+[ 9.446765] mgag200 0000:11:00.0: registered panic notifier
+[ 9.470166] scsi1 : ahci
+[ 9.479166] scsi2 : ahci
+[ 9.488172] scsi3 : ahci
+[ 9.497174] scsi4 : ahci
+[ 9.506175] scsi5 : ahci
+[ 9.515174] scsi6 : ahci
+[ 9.518181] ata1: SATA max UDMA/133 abar m2048@0x95c00000 port 0x95c00100 irq 91
+[ 9.526448] ata2: DUMMY
+[ 9.529182] ata3: DUMMY
+[ 9.531916] ata4: DUMMY
+[ 9.534650] ata5: DUMMY
+[ 9.537382] ata6: DUMMY
+[ 9.576196] [drm] Initialized mgag200 1.0.0 20110418 for 0000:11:00.0 on minor 0
+[ 9.845257] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
+[ 9.865161] ata1.00: ATAPI: Optiarc DVD RW AD-7580S, FX04, max UDMA/100
+[ 9.891407] ata1.00: configured for UDMA/100
+[ 9.900525] scsi 1:0:0:0: CD-ROM Optiarc DVD RW AD-7580S FX04 PQ: 0 ANSI: 5
+[ 10.247399] iTCO_vendor_support: vendor-support=0
+[ 10.261572] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
+[ 10.269764] iTCO_wdt: unable to reset NO_REBOOT flag, device disabled by hardware/BIOS
+[ 10.301932] sd 0:2:0:0: [sda] 570310656 512-byte logical blocks: (291 GB/271 GiB)
+[ 10.317085] sd 0:2:0:0: [sda] Write Protect is off
+[ 10.328326] sd 0:2:0:0: [sda] Write cache: disabled, read cache: disabled, supports DPO and FUA
+[ 10.375452] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c
+[ 10.384217] IP: [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
+[ 10.392101] PGD 0
+[ 10.394353] Oops: 0000 [#1] SMP
+[ 10.397978] Modules linked in: sr_mod(+) cdrom sd_mod iTCO_wdt crc_t10dif iTCO_vendor_support crct10dif_common ahci libahci libata lpc_ich mfd_core mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm drm i2c_core megaraid_sas dm_mirror dm_region_hash
+dm_log dm_mod
+[ 10.426499] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.15.0-rc1 #1
+[ 10.433495] Hardware name: QCI QSSC-S4R/QSSC-S4R, BIOS QSSC-S4R.QCI.01.00.S013.032920111005 03/29/2011
+[ 10.443886] task: ffffffff81906460 ti: ffffffff818f0000 task.ti: ffffffff818f0000
+[ 10.452239] RIP: 0010:[<ffffffffa0133df0>] [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
+[ 10.462838] RSP: 0018:ffff880033c03d98 EFLAGS: 00010046
+[ 10.468767] RAX: 0000000000a400a4 RBX: ffff880029a6bc18 RCX: 00000000fffffffa
+[ 10.476731] RDX: 00000000000000a4 RSI: ffff880029bb0000 RDI: ffff880029a6bc18
+[ 10.484696] RBP: ffff880033c03dc8 R08: 0000000000000000 R09: ffff88002f800490
+[ 10.492661] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000000
+[ 10.500625] R13: ffff880029a6bd98 R14: 0000000000000000 R15: ffffc90000194000
+[ 10.508590] FS: 0000000000000000(0000) GS:ffff880033c00000(0000) knlGS:0000000000000000
+[ 10.517623] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 10.524035] CR2: 000000000000003c CR3: 00000000328ff000 CR4: 00000000000007b0
+[ 10.531999] Stack:
+[ 10.534241] 0000000000000017 ffff880031ba7d00 000000000000005c ffff880031ba7d00
+[ 10.542535] 0000000000000000 000000000000005c ffff880033c03e10 ffffffff810c2a1e
+[ 10.550827] ffff880031ae2900 000000008108fb4f ffff880031ae2900 ffff880031ae2984
+[ 10.559121] Call Trace:
+[ 10.561849] <IRQ>
+[ 10.563994] [<ffffffff810c2a1e>] handle_irq_event_percpu+0x3e/0x1a0
+[ 10.571309] [<ffffffff810c2bbd>] handle_irq_event+0x3d/0x60
+[ 10.577631] [<ffffffff810c4fdd>] try_one_irq.isra.6+0x8d/0xf0
+[ 10.584142] [<ffffffff810c5313>] note_interrupt+0x173/0x1f0
+[ 10.590460] [<ffffffff810c2a8e>] handle_irq_event_percpu+0xae/0x1a0
+[ 10.597554] [<ffffffff810c2bbd>] handle_irq_event+0x3d/0x60
+[ 10.603872] [<ffffffff810c5727>] handle_edge_irq+0x77/0x130
+[ 10.610199] [<ffffffff81014b8f>] handle_irq+0xbf/0x150
+[ 10.616040] [<ffffffff8109ff4e>] ? vtime_account_idle+0xe/0x50
+[ 10.622654] [<ffffffff815fca1a>] ? atomic_notifier_call_chain+0x1a/0x20
+[ 10.630140] [<ffffffff816038cf>] do_IRQ+0x4f/0xf0
+[ 10.635490] [<ffffffff815f8aed>] common_interrupt+0x6d/0x6d
+[ 10.641805] <EOI>
+[ 10.643950] [<ffffffff8149ca9f>] ? cpuidle_enter_state+0x4f/0xc0
+[ 10.650972] [<ffffffff8149ca98>] ? cpuidle_enter_state+0x48/0xc0
+[ 10.657775] [<ffffffff8149cb47>] cpuidle_enter+0x17/0x20
+[ 10.663807] [<ffffffff810b0070>] cpu_startup_entry+0x2c0/0x3d0
+[ 10.670423] [<ffffffff815dfcc7>] rest_init+0x77/0x80
+[ 10.676065] [<ffffffff81a60f47>] start_kernel+0x40f/0x41a
+[ 10.682190] [<ffffffff81a60941>] ? repair_env_string+0x5c/0x5c
+[ 10.688799] [<ffffffff81a60120>] ? early_idt_handlers+0x120/0x120
+[ 10.695699] [<ffffffff81a605ee>] x86_64_start_reservations+0x2a/0x2c
+[ 10.702889] [<ffffffff81a60733>] x86_64_start_kernel+0x143/0x152
+[ 10.709689] Code: a0 fc ff 85 c0 8b 4d d4 74 c3 48 8b 7b 08 89 ca 48 c7 c6 60 66 13 a0 31 c0 e8 9d 70 28 e1 8b 4d d4 eb aa 0f 1f 84 00 00 00 00 00 <45> 8b 64 24 3c 48 89 df e8 23 47 4c e1 41 83 fc 01 19 c0 48 83
+[ 10.731470] RIP [<ffffffffa0133df0>] ahci_hw_interrupt+0x100/0x130 [libahci]
+[ 10.739441] RSP <ffff880033c03d98>
+[ 10.743333] CR2: 000000000000003c
+[ 10.747032] ---[ end trace b6e82636970e2690 ]---
+[ 10.760190] Kernel panic - not syncing: Fatal exception in interrupt
+[ 10.767291] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
+
+Cc: Alexander Gordeev <agordeev@redhat.com>
+Cc: Tejun Heo <tj@kernel.org>
+Signed-of-by: David Milburn <dmilburn@redhat.com>
+Fixes: 5ca72c4f7c41 ("AHCI: Support multiple MSIs")
+
+---
+ drivers/ata/ahci.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1233,18 +1233,14 @@ int ahci_host_activate(struct ata_host *
+ return rc;
+
+ for (i = 0; i < host->n_ports; i++) {
+- const char* desc;
+ struct ahci_port_priv *pp = host->ports[i]->private_data;
+
+ /* pp is NULL for dummy ports */
+ if (pp)
+- desc = pp->irq_desc;
+- else
+- desc = dev_driver_string(host->dev);
+-
+- rc = devm_request_threaded_irq(host->dev,
+- irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
+- desc, host->ports[i]);
++ rc = devm_request_threaded_irq(host->dev,
++ irq + i, ahci_hw_interrupt,
++ ahci_thread_fn, IRQF_SHARED,
++ pp->irq_desc, host->ports[i]);
+ if (rc)
+ goto out_free_irqs;
+ }
--- /dev/null
+From ab0f9e78b97f5193dd38b3757b42b6fbded05fb7 Mon Sep 17 00:00:00 2001
+From: Alexander Gordeev <agordeev@redhat.com>
+Date: Thu, 17 Apr 2014 14:13:49 +0200
+Subject: ahci: Ensure "MSI Revert to Single Message" mode is not enforced
+
+From: Alexander Gordeev <agordeev@redhat.com>
+
+commit ab0f9e78b97f5193dd38b3757b42b6fbded05fb7 upstream.
+
+The AHCI specification allows hardware to choose to revert to
+single MSI mode when fewer messages are allocated than requested.
+Yet, at least ICH10 chipset reverts to single MSI mode even when
+enough messages are allocated in some cases (see below).
+
+This update forces the driver to not rely on initialization of
+multiple MSIs mode alone and always check if "MSI Revert to
+Single Message" (MRSM) mode was enforced by the controller and
+fallback to the single MSI mode in case it did.
+
+That prevents a situation when the driver configured multiple
+per-port IRQ handlers, but the controller sends all port's
+interrupts to a single IRQ, which could easily screw up the
+interrupt handling and lead to delays and possibly crashes.
+
+The fix was tested on a 6-port controller that successfully
+reverted to the single MSI mode:
+
+00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA
+AHCI Controller (prog-if 01 [AHCI 1.0])
+ Subsystem: Super Micro Computer Inc Device 10a7
+ Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 101
+ I/O ports at f110 [size=8]
+ I/O ports at f100 [size=4]
+ I/O ports at f0f0 [size=8]
+ I/O ports at f0e0 [size=4]
+ I/O ports at f020 [size=32]
+ Memory at fbf00000 (32-bit, non-prefetchable) [size=2K]
+ Capabilities: [80] MSI: Enable+ Count=1/16 Maskable- 64bit-
+ Capabilities: [70] Power Management version 3
+ Capabilities: [a8] SATA HBA v1.0
+ Capabilities: [b0] PCI Advanced Features
+ Kernel driver in use: ahci
+
+With 6 ports just 8 MSI vectors should be enough, but the adapter
+enforces the MRSM mode when less than 16 vectors are written to
+the Multiple Messages Enable PCI register. I instigated MRSM mode
+by forcing @nvec to 8 in ahci_init_interrupts().
+
+Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
+Cc: linux-ide@vger.kernel.org
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ahci.c | 9 ++++++++-
+ drivers/ata/ahci.h | 1 +
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1163,7 +1163,7 @@ static inline void ahci_gtf_filter_worka
+ #endif
+
+ static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
+- struct ahci_host_priv *hpriv)
++ struct ahci_host_priv *hpriv)
+ {
+ int rc, nvec;
+
+@@ -1189,6 +1189,13 @@ static int ahci_init_interrupts(struct p
+ else if (rc > 0)
+ goto single_msi;
+
++ /* fallback to single MSI mode if the controller enforced MRSM mode */
++ if (readl(hpriv->mmio + HOST_CTL) & HOST_MRSM) {
++ pci_disable_msi(pdev);
++ printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n");
++ goto single_msi;
++ }
++
+ return nvec;
+
+ single_msi:
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -91,6 +91,7 @@ enum {
+ /* HOST_CTL bits */
+ HOST_RESET = (1 << 0), /* reset controller; self-clear */
+ HOST_IRQ_EN = (1 << 1), /* global IRQ enable */
++ HOST_MRSM = (1 << 2), /* MSI Revert to Single Message */
+ HOST_AHCI_EN = (1 << 31), /* AHCI enabled */
+
+ /* HOST_CAP bits */
--- /dev/null
+From 8aa9e85adac609588eeec356e5a85059b3b819ba Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+Date: Wed, 30 Apr 2014 15:26:45 +0530
+Subject: ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe
+
+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+
+commit 8aa9e85adac609588eeec356e5a85059b3b819ba upstream.
+
+There was a very small race window where resume to kernel mode from a
+Exception Path (or pure kernel mode which is true for most of ARC
+exceptions anyways), was not disabling interrupts in restore_regs,
+clobbering the exception regs
+
+Anton found the culprit call flow (after many sleepless nights)
+
+| 1. we got a Trap from user land
+| 2. started to service it.
+| 3. While doing some stuff on user-land memory (I think it is padzero()),
+| we got a DataTlbMiss
+| 4. On return from it we are taking "resume_kernel_mode" path
+| 5. NEED_RESHED is not set, so we go to "return from exception" path in
+| restore regs.
+| 6. there seems to be IRQ happening
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Cc: Anton Kolesov <Anton.Kolesov@synopsys.com>
+Cc: Francois Bedard <Francois.Bedard@synopsys.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/entry.S | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -614,11 +614,13 @@ resume_user_mode_begin:
+
+ resume_kernel_mode:
+
+-#ifdef CONFIG_PREEMPT
+-
+- ; This is a must for preempt_schedule_irq()
++ ; Disable Interrupts from this point on
++ ; CONFIG_PREEMPT: This is a must for preempt_schedule_irq()
++ ; !CONFIG_PREEMPT: To ensure restore_regs is intr safe
+ IRQ_DISABLE r9
+
++#ifdef CONFIG_PREEMPT
++
+ ; Can't preempt if preemption disabled
+ GET_CURR_THR_INFO_FROM_SP r10
+ ld r8, [r10, THREAD_INFO_PREEMPT_COUNT]
--- /dev/null
+From d345ea2892ae7a2b70f84cf881c20731e43e4993 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Sun, 9 Feb 2014 19:48:05 +0100
+Subject: ARC: Remove ARC_HAS_COH_RTSC
+
+From: Richard Weinberger <richard@nod.at>
+
+commit d345ea2892ae7a2b70f84cf881c20731e43e4993 upstream.
+
+The symbol is an orphan, get rid of it.
+
+Fixes: 7d0857a54aed ("ARC: [SMP] Disallow RTSC")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/plat-arcfpga/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arc/plat-arcfpga/Kconfig
++++ b/arch/arc/plat-arcfpga/Kconfig
+@@ -33,7 +33,6 @@ config ISS_SMP_EXTN
+ bool "ARC SMP Extensions (ISS Models only)"
+ default n
+ depends on SMP
+- select ARC_HAS_COH_RTSC
+ help
+ SMP Extensions to ARC700, in a "simulation only" Model, supported in
+ ARC ISS (Instruction Set Simulator).
--- /dev/null
+From 2697e4fb9209dfe1d1b24c92d254158f63d4bc8e Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Tue, 15 Apr 2014 16:58:09 +0300
+Subject: ASoC: dapm: Fix widget double free with auto-disable DAPM kcontrol
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 2697e4fb9209dfe1d1b24c92d254158f63d4bc8e upstream.
+
+Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable")
+is trying to free the widget it allocated by snd_soc_dapm_new_control()
+call in dapm_kcontrol_data_alloc() by adding kfree(data->widget) to
+dapm_kcontrol_free().
+
+This is causing a widget double free with auto-disabled DAPM kcontrols
+in sound card unregistration because widgets are already freed before
+dapm_kcontrol_free() is called.
+
+Reason for that is all widgets are added into dapm->card->widgets list
+in snd_soc_dapm_new_control() and freed in dapm_free_widgets() during
+execution of snd_soc_dapm_free().
+
+Now snd_soc_dapm_free() calls for different DAPM contexts happens before
+snd_card_free() call from where the call chain to dapm_kcontrol_free()
+begins:
+
+soc_cleanup_card_resources()
+ soc_remove_dai_links()
+ soc_remove_link_dais()
+ snd_soc_dapm_free(&cpu_dai->dapm)
+ soc_remove_link_components()
+ soc_remove_platform()
+ snd_soc_dapm_free(&platform->dapm)
+ soc_remove_codec()
+ snd_soc_dapm_free(&codec->dapm)
+ snd_soc_dapm_free(&card->dapm)
+ snd_card_free()
+ snd_card_do_free()
+ snd_device_free_all()
+ snd_device_free()
+ snd_ctl_dev_free()
+ snd_ctl_remove()
+ snd_ctl_free_one()
+ dapm_kcontrol_free()
+
+This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for
+them.
+
+Fixes: 9e1fda4ae158 (ASoC: dapm: Implement mixer input auto-disable)
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -251,7 +251,6 @@ static int dapm_kcontrol_data_alloc(stru
+ static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
+ {
+ struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
+- kfree(data->widget);
+ kfree(data->wlist);
+ kfree(data);
+ }
--- /dev/null
+From 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b Mon Sep 17 00:00:00 2001
+From: Rafał Miłecki <zajec5@gmail.com>
+Date: Sat, 5 Apr 2014 18:08:25 +0200
+Subject: b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <zajec5@gmail.com>
+
+commit 12cd43c6ed6da7bf7c5afbd74da6959cda6d056b upstream.
+
+Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b
+functions isn't safe. On my machine it causes delayed (!) CPU exception:
+
+Disabling lock debugging due to kernel taint
+mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f
+mce: [Hardware Error]: TSC 164083803dc
+mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0
+mce: [Hardware Error]: Run the above through 'mcelog --ascii'
+mce: [Hardware Error]: Machine check: Processor context corrupt
+Kernel panic - not syncing: Fatal machine check on current CPU
+Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/phy_n.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/phy_n.c
++++ b/drivers/net/wireless/b43/phy_n.c
+@@ -5176,22 +5176,22 @@ static void b43_nphy_channel_setup(struc
+ int ch = new_channel->hw_value;
+
+ u16 old_band_5ghz;
+- u32 tmp32;
++ u16 tmp16;
+
+ old_band_5ghz =
+ b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
+ if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
+- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
+- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
+ b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000);
+- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
+ b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
+ } else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) {
+ b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
+- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
+- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR);
++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4);
+ b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF);
+- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16);
+ }
+
+ b43_chantab_phy_upload(dev, e);
--- /dev/null
+From 00a9d699bc85052d2d3ed56251cd928024ce06a3 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 23 Jan 2014 14:39:29 -0500
+Subject: framebuffer: fix cfb_copyarea
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.
+
+The function cfb_copyarea is buggy when the copy operation is not aligned on
+long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).
+
+How to reproduce:
+- use x86-64 machine
+- use a framebuffer driver without acceleration (for example uvesafb)
+- set the framebuffer to 8-bit depth
+ (for example fbset -a 1024x768-60 -depth 8)
+- load a font with character width that is not a multiple of 8 pixels
+ note: the console-tools package cannot load a font that has
+ width different from 8 pixels. You need to install the packages
+ "kbd" and "console-terminus" and use the program "setfont" to
+ set font width (for example: setfont Uni2-Terminus20x10)
+- move some text left and right on the bash command line and you get a
+ screen corruption
+
+To expose more bugs, put this line to the end of uvesafb_init_info:
+info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;
+- Now framebuffer console will use cfb_copyarea for console scrolling.
+You get a screen corruption when console is scrolled.
+
+This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this
+patch, console scrolling in 8-bit depth with a font width that is not a
+multiple of 8 pixels works fine.
+
+The cfb_copyarea code was very buggy and it looks like it was written
+and never tried with non-8-pixel font.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/cfbcopyarea.c | 153 ++++++++++++++++++++++----------------------
+ 1 file changed, 78 insertions(+), 75 deletions(-)
+
+--- a/drivers/video/cfbcopyarea.c
++++ b/drivers/video/cfbcopyarea.c
+@@ -43,13 +43,22 @@
+ */
+
+ static void
+-bitcpy(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
+- const unsigned long __iomem *src, int src_idx, int bits,
++bitcpy(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx,
++ const unsigned long __iomem *src, unsigned src_idx, int bits,
+ unsigned n, u32 bswapmask)
+ {
+ unsigned long first, last;
+ int const shift = dst_idx-src_idx;
+- int left, right;
++
++#if 0
++ /*
++ * If you suspect bug in this function, compare it with this simple
++ * memmove implementation.
++ */
++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8,
++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8);
++ return;
++#endif
+
+ first = fb_shifted_pixels_mask_long(p, dst_idx, bswapmask);
+ last = ~fb_shifted_pixels_mask_long(p, (dst_idx+n) % bits, bswapmask);
+@@ -98,9 +107,8 @@ bitcpy(struct fb_info *p, unsigned long
+ unsigned long d0, d1;
+ int m;
+
+- right = shift & (bits - 1);
+- left = -shift & (bits - 1);
+- bswapmask &= shift;
++ int const left = shift & (bits - 1);
++ int const right = -shift & (bits - 1);
+
+ if (dst_idx+n <= bits) {
+ // Single destination word
+@@ -110,15 +118,15 @@ bitcpy(struct fb_info *p, unsigned long
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ if (shift > 0) {
+ // Single source word
+- d0 >>= right;
++ d0 <<= left;
+ } else if (src_idx+n <= bits) {
+ // Single source word
+- d0 <<= left;
++ d0 >>= right;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src + 1);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+- d0 = d0<<left | d1>>right;
++ d0 = d0 >> right | d1 << left;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
+@@ -135,60 +143,59 @@ bitcpy(struct fb_info *p, unsigned long
+ if (shift > 0) {
+ // Single source word
+ d1 = d0;
+- d0 >>= right;
+- dst++;
++ d0 <<= left;
+ n -= bits - dst_idx;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src++);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+
+- d0 = d0<<left | d1>>right;
+- dst++;
++ d0 = d0 >> right | d1 << left;
+ n -= bits - dst_idx;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
+ d0 = d1;
++ dst++;
+
+ // Main chunk
+ m = n % bits;
+ n /= bits;
+ while ((n >= 4) && !bswapmask) {
+ d1 = FB_READL(src++);
+- FB_WRITEL(d0 << left | d1 >> right, dst++);
++ FB_WRITEL(d0 >> right | d1 << left, dst++);
+ d0 = d1;
+ d1 = FB_READL(src++);
+- FB_WRITEL(d0 << left | d1 >> right, dst++);
++ FB_WRITEL(d0 >> right | d1 << left, dst++);
+ d0 = d1;
+ d1 = FB_READL(src++);
+- FB_WRITEL(d0 << left | d1 >> right, dst++);
++ FB_WRITEL(d0 >> right | d1 << left, dst++);
+ d0 = d1;
+ d1 = FB_READL(src++);
+- FB_WRITEL(d0 << left | d1 >> right, dst++);
++ FB_WRITEL(d0 >> right | d1 << left, dst++);
+ d0 = d1;
+ n -= 4;
+ }
+ while (n--) {
+ d1 = FB_READL(src++);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+- d0 = d0 << left | d1 >> right;
++ d0 = d0 >> right | d1 << left;
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(d0, dst++);
+ d0 = d1;
+ }
+
+ // Trailing bits
+- if (last) {
+- if (m <= right) {
++ if (m) {
++ if (m <= bits - right) {
+ // Single source word
+- d0 <<= left;
++ d0 >>= right;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src);
+ d1 = fb_rev_pixels_in_long(d1,
+ bswapmask);
+- d0 = d0<<left | d1>>right;
++ d0 = d0 >> right | d1 << left;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
+@@ -202,43 +209,46 @@ bitcpy(struct fb_info *p, unsigned long
+ */
+
+ static void
+-bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
+- const unsigned long __iomem *src, int src_idx, int bits,
++bitcpy_rev(struct fb_info *p, unsigned long __iomem *dst, unsigned dst_idx,
++ const unsigned long __iomem *src, unsigned src_idx, int bits,
+ unsigned n, u32 bswapmask)
+ {
+ unsigned long first, last;
+ int shift;
+
+- dst += (n-1)/bits;
+- src += (n-1)/bits;
+- if ((n-1) % bits) {
+- dst_idx += (n-1) % bits;
+- dst += dst_idx >> (ffs(bits) - 1);
+- dst_idx &= bits - 1;
+- src_idx += (n-1) % bits;
+- src += src_idx >> (ffs(bits) - 1);
+- src_idx &= bits - 1;
+- }
++#if 0
++ /*
++ * If you suspect bug in this function, compare it with this simple
++ * memmove implementation.
++ */
++ fb_memmove((char *)dst + ((dst_idx & (bits - 1))) / 8,
++ (char *)src + ((src_idx & (bits - 1))) / 8, n / 8);
++ return;
++#endif
++
++ dst += (dst_idx + n - 1) / bits;
++ src += (src_idx + n - 1) / bits;
++ dst_idx = (dst_idx + n - 1) % bits;
++ src_idx = (src_idx + n - 1) % bits;
+
+ shift = dst_idx-src_idx;
+
+- first = fb_shifted_pixels_mask_long(p, bits - 1 - dst_idx, bswapmask);
+- last = ~fb_shifted_pixels_mask_long(p, bits - 1 - ((dst_idx-n) % bits),
+- bswapmask);
++ first = ~fb_shifted_pixels_mask_long(p, (dst_idx + 1) % bits, bswapmask);
++ last = fb_shifted_pixels_mask_long(p, (bits + dst_idx + 1 - n) % bits, bswapmask);
+
+ if (!shift) {
+ // Same alignment for source and dest
+
+ if ((unsigned long)dst_idx+1 >= n) {
+ // Single word
+- if (last)
+- first &= last;
+- FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst);
++ if (first)
++ last &= first;
++ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst);
+ } else {
+ // Multiple destination words
+
+ // Leading bits
+- if (first != ~0UL) {
++ if (first) {
+ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), first), dst);
+ dst--;
+ src--;
+@@ -262,7 +272,7 @@ bitcpy_rev(struct fb_info *p, unsigned l
+ FB_WRITEL(FB_READL(src--), dst--);
+
+ // Trailing bits
+- if (last)
++ if (last != -1UL)
+ FB_WRITEL( comp( FB_READL(src), FB_READL(dst), last), dst);
+ }
+ } else {
+@@ -270,29 +280,28 @@ bitcpy_rev(struct fb_info *p, unsigned l
+ unsigned long d0, d1;
+ int m;
+
+- int const left = -shift & (bits-1);
+- int const right = shift & (bits-1);
+- bswapmask &= shift;
++ int const left = shift & (bits-1);
++ int const right = -shift & (bits-1);
+
+ if ((unsigned long)dst_idx+1 >= n) {
+ // Single destination word
+- if (last)
+- first &= last;
++ if (first)
++ last &= first;
+ d0 = FB_READL(src);
+ if (shift < 0) {
+ // Single source word
+- d0 <<= left;
++ d0 >>= right;
+ } else if (1+(unsigned long)src_idx >= n) {
+ // Single source word
+- d0 >>= right;
++ d0 <<= left;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src - 1);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+- d0 = d0>>right | d1<<left;
++ d0 = d0 << left | d1 >> right;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+- FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
++ FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
+ } else {
+ // Multiple destination words
+ /** We must always remember the last value read, because in case
+@@ -307,12 +316,12 @@ bitcpy_rev(struct fb_info *p, unsigned l
+ if (shift < 0) {
+ // Single source word
+ d1 = d0;
+- d0 <<= left;
++ d0 >>= right;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src--);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+- d0 = d0>>right | d1<<left;
++ d0 = d0 << left | d1 >> right;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(comp(d0, FB_READL(dst), first), dst);
+@@ -325,39 +334,39 @@ bitcpy_rev(struct fb_info *p, unsigned l
+ n /= bits;
+ while ((n >= 4) && !bswapmask) {
+ d1 = FB_READL(src--);
+- FB_WRITEL(d0 >> right | d1 << left, dst--);
++ FB_WRITEL(d0 << left | d1 >> right, dst--);
+ d0 = d1;
+ d1 = FB_READL(src--);
+- FB_WRITEL(d0 >> right | d1 << left, dst--);
++ FB_WRITEL(d0 << left | d1 >> right, dst--);
+ d0 = d1;
+ d1 = FB_READL(src--);
+- FB_WRITEL(d0 >> right | d1 << left, dst--);
++ FB_WRITEL(d0 << left | d1 >> right, dst--);
+ d0 = d1;
+ d1 = FB_READL(src--);
+- FB_WRITEL(d0 >> right | d1 << left, dst--);
++ FB_WRITEL(d0 << left | d1 >> right, dst--);
+ d0 = d1;
+ n -= 4;
+ }
+ while (n--) {
+ d1 = FB_READL(src--);
+ d1 = fb_rev_pixels_in_long(d1, bswapmask);
+- d0 = d0 >> right | d1 << left;
++ d0 = d0 << left | d1 >> right;
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(d0, dst--);
+ d0 = d1;
+ }
+
+ // Trailing bits
+- if (last) {
+- if (m <= left) {
++ if (m) {
++ if (m <= bits - left) {
+ // Single source word
+- d0 >>= right;
++ d0 <<= left;
+ } else {
+ // 2 source words
+ d1 = FB_READL(src);
+ d1 = fb_rev_pixels_in_long(d1,
+ bswapmask);
+- d0 = d0>>right | d1<<left;
++ d0 = d0 << left | d1 >> right;
+ }
+ d0 = fb_rev_pixels_in_long(d0, bswapmask);
+ FB_WRITEL(comp(d0, FB_READL(dst), last), dst);
+@@ -371,9 +380,9 @@ void cfb_copyarea(struct fb_info *p, con
+ u32 dx = area->dx, dy = area->dy, sx = area->sx, sy = area->sy;
+ u32 height = area->height, width = area->width;
+ unsigned long const bits_per_line = p->fix.line_length*8u;
+- unsigned long __iomem *dst = NULL, *src = NULL;
++ unsigned long __iomem *base = NULL;
+ int bits = BITS_PER_LONG, bytes = bits >> 3;
+- int dst_idx = 0, src_idx = 0, rev_copy = 0;
++ unsigned dst_idx = 0, src_idx = 0, rev_copy = 0;
+ u32 bswapmask = fb_compute_bswapmask(p);
+
+ if (p->state != FBINFO_STATE_RUNNING)
+@@ -389,7 +398,7 @@ void cfb_copyarea(struct fb_info *p, con
+
+ // split the base of the framebuffer into a long-aligned address and the
+ // index of the first bit
+- dst = src = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
++ base = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
+ dst_idx = src_idx = 8*((unsigned long)p->screen_base & (bytes-1));
+ // add offset of source and target area
+ dst_idx += dy*bits_per_line + dx*p->var.bits_per_pixel;
+@@ -402,20 +411,14 @@ void cfb_copyarea(struct fb_info *p, con
+ while (height--) {
+ dst_idx -= bits_per_line;
+ src_idx -= bits_per_line;
+- dst += dst_idx >> (ffs(bits) - 1);
+- dst_idx &= (bytes - 1);
+- src += src_idx >> (ffs(bits) - 1);
+- src_idx &= (bytes - 1);
+- bitcpy_rev(p, dst, dst_idx, src, src_idx, bits,
++ bitcpy_rev(p, base + (dst_idx / bits), dst_idx % bits,
++ base + (src_idx / bits), src_idx % bits, bits,
+ width*p->var.bits_per_pixel, bswapmask);
+ }
+ } else {
+ while (height--) {
+- dst += dst_idx >> (ffs(bits) - 1);
+- dst_idx &= (bytes - 1);
+- src += src_idx >> (ffs(bits) - 1);
+- src_idx &= (bytes - 1);
+- bitcpy(p, dst, dst_idx, src, src_idx, bits,
++ bitcpy(p, base + (dst_idx / bits), dst_idx % bits,
++ base + (src_idx / bits), src_idx % bits, bits,
+ width*p->var.bits_per_pixel, bswapmask);
+ dst_idx += bits_per_line;
+ src_idx += bits_per_line;
--- /dev/null
+From 82e5a649453a3cf23516277abb84273768a1592b Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 10 Mar 2014 15:22:03 +0200
+Subject: iwlwifi: dvm: take mutex when sending SYNC BT config command
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 82e5a649453a3cf23516277abb84273768a1592b upstream.
+
+There is a flow in which we send the host command in SYNC
+mode, but we don't take priv->mutex.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1046495
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/iwlwifi/dvm/main.c
+@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(str
+ struct iwl_priv *priv =
+ container_of(work, struct iwl_priv, bt_runtime_config);
+
++ mutex_lock(&priv->mutex);
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+- return;
++ goto out;
+
+ /* dont send host command if rf-kill is on */
+ if (!iwl_is_ready_rf(priv))
+- return;
++ goto out;
++
+ iwlagn_send_advance_bt_config(priv);
++out:
++ mutex_unlock(&priv->mutex);
+ }
+
+ static void iwl_bg_bt_full_concurrency(struct work_struct *work)
--- /dev/null
+From a82dda6cd492b8c88952be6f6527f3656f7ac585 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 18 Mar 2014 16:32:45 +0200
+Subject: iwlwifi: mvm: disable uAPSD due to bugs in the firmware
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit a82dda6cd492b8c88952be6f6527f3656f7ac585 upstream.
+
+The current firmware advertises support for uAPSD, but
+critical bugs force us to disable the feature.
+When a fixed firmware will be available, we will be able to
+re-enable uAPSD.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -179,7 +179,7 @@ int iwl_mvm_mac_setup_register(struct iw
+ !iwlwifi_mod_params.sw_crypto)
+ hw->flags |= IEEE80211_HW_MFP_CAPABLE;
+
+- if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) {
++ if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) {
+ hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
+ hw->uapsd_queues = IWL_UAPSD_AC_INFO;
+ hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
--- /dev/null
+From 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 17 Apr 2014 11:48:21 -0700
+Subject: libata/ahci: accommodate tag ordered controllers
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 8a4aeec8d2d6a3edeffbdfae451cdf05cbf0fefd upstream.
+
+The AHCI spec allows implementations to issue commands in tag order
+rather than FIFO order:
+
+ 5.3.2.12 P:SelectCmd
+ HBA sets pSlotLoc = (pSlotLoc + 1) mod (CAP.NCS + 1)
+ or HBA selects the command to issue that has had the
+ PxCI bit set to '1' longer than any other command
+ pending to be issued.
+
+The result is that commands posted sequentially (time-wise) may play out
+of sequence when issued by hardware.
+
+This behavior has likely been hidden by drives that arrange for commands
+to complete in issue order. However, it appears recent drives (two from
+different vendors that we have found so far) inflict out-of-order
+completions as a matter of course. So, we need to take care to maintain
+ordered submission, otherwise we risk triggering a drive to fall out of
+sequential-io automation and back to random-io processing, which incurs
+large latency and degrades throughput.
+
+This issue was found in simple benchmarks where QD=2 seq-write
+performance was 30-50% *greater* than QD=32 seq-write performance.
+
+Tagging for -stable and making the change globally since it has a low
+risk-to-reward ratio. Also, word is that recent versions of an unnamed
+OS also does it this way now. So, drives in the field are already
+experienced with this tag ordering scheme.
+
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Ed Ciechanowski <ed.ciechanowski@intel.com>
+Reviewed-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 21 +++++++++++++--------
+ include/linux/libata.h | 1 +
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4792,21 +4792,26 @@ void swap_buf_le16(u16 *buf, unsigned in
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ struct ata_queued_cmd *qc = NULL;
+- unsigned int i;
++ unsigned int i, tag;
+
+ /* no command while frozen */
+ if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ return NULL;
+
+- /* the last tag is reserved for internal command. */
+- for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
+- if (!test_and_set_bit(i, &ap->qc_allocated)) {
+- qc = __ata_qc_from_tag(ap, i);
++ for (i = 0; i < ATA_MAX_QUEUE; i++) {
++ tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++
++ /* the last tag is reserved for internal command. */
++ if (tag == ATA_TAG_INTERNAL)
++ continue;
++
++ if (!test_and_set_bit(tag, &ap->qc_allocated)) {
++ qc = __ata_qc_from_tag(ap, tag);
++ qc->tag = tag;
++ ap->last_tag = tag;
+ break;
+ }
+-
+- if (qc)
+- qc->tag = i;
++ }
+
+ return qc;
+ }
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -822,6 +822,7 @@ struct ata_port {
+ unsigned long qc_allocated;
+ unsigned int qc_active;
+ int nr_active_links; /* #links with active qcs */
++ unsigned int last_tag; /* track next tag hw expects */
+
+ struct ata_link link; /* host default link */
+ struct ata_link *slave_link; /* see ata_slave_link_init() */
--- /dev/null
+From d121f7d0cbb875abce249dbf7eb191f9bafe80b7 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Tue, 1 Apr 2014 20:42:37 -0400
+Subject: libata: Update queued trim blacklist for M5x0 drives
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit d121f7d0cbb875abce249dbf7eb191f9bafe80b7 upstream.
+
+Crucial/Micron M500 drives properly support queued DSM TRIM starting
+with firmware MU05. Update the blacklist so we only disable queued trim
+for older firmware releases.
+
+Early M550 series drives suffer from the same issue as M500. A bugfix
+firmware is in the pipeline but not ready yet. Until then, blacklist
+queued trim for M550.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Chris Samuel <chris@csamuel.org>
+Cc: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4224,8 +4224,10 @@ static const struct ata_blacklist_entry
+ { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
+
+ /* devices that don't properly handle queued TRIM commands */
+- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
++ { "Micron_M500*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, },
++ { "Crucial_CT???M500SSD*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, },
++ { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
++ { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+
+ /*
+ * Some WD SATA-I drives spin up and down erratically when the link
--- /dev/null
+From 43751a1b8ee2e70ce392bf31ef3133da324e68b3 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 23 Jan 2014 14:41:59 -0500
+Subject: mach64: fix cursor when character width is not a multiple of 8 pixels
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 43751a1b8ee2e70ce392bf31ef3133da324e68b3 upstream.
+
+This patch fixes the hardware cursor on mach64 when font width is not a
+multiple of 8 pixels.
+
+If you load such a font, the cursor is expanded to the next 8-byte
+boundary and a part of the next character after the cursor is not
+visible.
+For example, when you load a font with 12-pixel width, the cursor width
+is 16 pixels and when the cursor is displayed, 4 pixels of the next
+character are not visible.
+
+The reason is this: atyfb_cursor is called with proper parameters to
+load an image that is 12-pixel wide. However, the number is aligned on
+the next 8-pixel boundary on the line
+"unsigned int width = (cursor->image.width + 7) >> 3;" and the whole
+function acts as it is was loading a 16-pixel image.
+
+This patch fixes it so that the value written to the framebuffer is
+padded with 0xaaaa (the transparent pattern) when the image size it not
+a multiple of 8 pixels. The transparent pattern causes that the cursor
+will not interfere with the next character.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/aty/mach64_cursor.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/video/aty/mach64_cursor.c
++++ b/drivers/video/aty/mach64_cursor.c
+@@ -5,6 +5,7 @@
+ #include <linux/fb.h>
+ #include <linux/init.h>
+ #include <linux/string.h>
++#include "../fb_draw.h"
+
+ #include <asm/io.h>
+
+@@ -157,24 +158,33 @@ static int atyfb_cursor(struct fb_info *
+
+ for (i = 0; i < height; i++) {
+ for (j = 0; j < width; j++) {
++ u16 l = 0xaaaa;
+ b = *src++;
+ m = *msk++;
+ switch (cursor->rop) {
+ case ROP_XOR:
+ // Upper 4 bits of mask data
+- fb_writeb(cursor_bits_lookup[(b ^ m) >> 4], dst++);
++ l = cursor_bits_lookup[(b ^ m) >> 4] |
+ // Lower 4 bits of mask
+- fb_writeb(cursor_bits_lookup[(b ^ m) & 0x0f],
+- dst++);
++ (cursor_bits_lookup[(b ^ m) & 0x0f] << 8);
+ break;
+ case ROP_COPY:
+ // Upper 4 bits of mask data
+- fb_writeb(cursor_bits_lookup[(b & m) >> 4], dst++);
++ l = cursor_bits_lookup[(b & m) >> 4] |
+ // Lower 4 bits of mask
+- fb_writeb(cursor_bits_lookup[(b & m) & 0x0f],
+- dst++);
++ (cursor_bits_lookup[(b & m) & 0x0f] << 8);
+ break;
+ }
++ /*
++ * If cursor size is not a multiple of 8 characters
++ * we must pad it with transparent pattern (0xaaaa).
++ */
++ if ((j + 1) * 8 > cursor->image.width) {
++ l = comp(l, 0xaaaa,
++ (1 << ((cursor->image.width & 7) * 2)) - 1);
++ }
++ fb_writeb(l & 0xff, dst++);
++ fb_writeb(l >> 8, dst++);
+ }
+ dst += offset;
+ }
--- /dev/null
+From c29dd8696dc5dbd50b3ac441b8a26751277ba520 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 23 Jan 2014 14:41:09 -0500
+Subject: mach64: use unaligned access
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit c29dd8696dc5dbd50b3ac441b8a26751277ba520 upstream.
+
+This patch fixes mach64 to use unaligned access to the font bitmap.
+
+This fixes unaligned access warning on sparc64 when 14x8 font is loaded.
+
+On x86(64), unaligned access is handled in hardware, so both functions
+le32_to_cpup and get_unaligned_le32 perform the same operation.
+
+On RISC machines, unaligned access is not handled in hardware, so we
+better use get_unaligned_le32 to avoid the unaligned trap and warning.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/aty/mach64_accel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/aty/mach64_accel.c
++++ b/drivers/video/aty/mach64_accel.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/delay.h>
++#include <asm/unaligned.h>
+ #include <linux/fb.h>
+ #include <video/mach64.h>
+ #include "atyfb.h"
+@@ -419,7 +420,7 @@ void atyfb_imageblit(struct fb_info *inf
+ u32 *pbitmap, dwords = (src_bytes + 3) / 4;
+ for (pbitmap = (u32*)(image->data); dwords; dwords--, pbitmap++) {
+ wait_for_fifo(1, par);
+- aty_st_le32(HOST_DATA0, le32_to_cpup(pbitmap), par);
++ aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par);
+ }
+ }
+
--- /dev/null
+From a772d4736641ec1b421ad965e13457c17379fc86 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 23 Jan 2014 14:39:04 -0500
+Subject: matroxfb: restore the registers M_ACCESS and M_PITCH
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit a772d4736641ec1b421ad965e13457c17379fc86 upstream.
+
+When X11 is running and the user switches back to console, the card
+modifies the content of registers M_MACCESS and M_PITCH in periodic
+intervals.
+
+This patch fixes it by restoring the content of these registers before
+issuing any accelerator command.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/matrox/matroxfb_accel.c | 38 +++++++++++++++++++++++++---------
+ drivers/video/matrox/matroxfb_base.h | 2 +
+ 2 files changed, 30 insertions(+), 10 deletions(-)
+
+--- a/drivers/video/matrox/matroxfb_accel.c
++++ b/drivers/video/matrox/matroxfb_accel.c
+@@ -192,10 +192,18 @@ void matrox_cfbX_init(struct matrox_fb_i
+ minfo->accel.m_dwg_rect = M_DWG_TRAP | M_DWG_SOLID | M_DWG_ARZERO | M_DWG_SGNZERO | M_DWG_SHIFTZERO;
+ if (isMilleniumII(minfo)) minfo->accel.m_dwg_rect |= M_DWG_TRANSC;
+ minfo->accel.m_opmode = mopmode;
++ minfo->accel.m_access = maccess;
++ minfo->accel.m_pitch = mpitch;
+ }
+
+ EXPORT_SYMBOL(matrox_cfbX_init);
+
++static void matrox_accel_restore_maccess(struct matrox_fb_info *minfo)
++{
++ mga_outl(M_MACCESS, minfo->accel.m_access);
++ mga_outl(M_PITCH, minfo->accel.m_pitch);
++}
++
+ static void matrox_accel_bmove(struct matrox_fb_info *minfo, int vxres, int sy,
+ int sx, int dy, int dx, int height, int width)
+ {
+@@ -207,7 +215,8 @@ static void matrox_accel_bmove(struct ma
+ CRITBEGIN
+
+ if ((dy < sy) || ((dy == sy) && (dx <= sx))) {
+- mga_fifo(2);
++ mga_fifo(4);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_SGNZERO |
+ M_DWG_BFCOL | M_DWG_REPLACE);
+ mga_outl(M_AR5, vxres);
+@@ -215,7 +224,8 @@ static void matrox_accel_bmove(struct ma
+ start = sy*vxres+sx+curr_ydstorg(minfo);
+ end = start+width;
+ } else {
+- mga_fifo(3);
++ mga_fifo(5);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_BFCOL | M_DWG_REPLACE);
+ mga_outl(M_SGN, 5);
+ mga_outl(M_AR5, -vxres);
+@@ -224,7 +234,8 @@ static void matrox_accel_bmove(struct ma
+ start = end+width;
+ dy += height-1;
+ }
+- mga_fifo(4);
++ mga_fifo(6);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_AR0, end);
+ mga_outl(M_AR3, start);
+ mga_outl(M_FXBNDRY, ((dx+width)<<16) | dx);
+@@ -246,7 +257,8 @@ static void matrox_accel_bmove_lin(struc
+ CRITBEGIN
+
+ if ((dy < sy) || ((dy == sy) && (dx <= sx))) {
+- mga_fifo(2);
++ mga_fifo(4);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_SGNZERO |
+ M_DWG_BFCOL | M_DWG_REPLACE);
+ mga_outl(M_AR5, vxres);
+@@ -254,7 +266,8 @@ static void matrox_accel_bmove_lin(struc
+ start = sy*vxres+sx+curr_ydstorg(minfo);
+ end = start+width;
+ } else {
+- mga_fifo(3);
++ mga_fifo(5);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, M_DWG_BITBLT | M_DWG_SHIFTZERO | M_DWG_BFCOL | M_DWG_REPLACE);
+ mga_outl(M_SGN, 5);
+ mga_outl(M_AR5, -vxres);
+@@ -263,7 +276,8 @@ static void matrox_accel_bmove_lin(struc
+ start = end+width;
+ dy += height-1;
+ }
+- mga_fifo(5);
++ mga_fifo(7);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_AR0, end);
+ mga_outl(M_AR3, start);
+ mga_outl(M_FXBNDRY, ((dx+width)<<16) | dx);
+@@ -298,7 +312,8 @@ static void matroxfb_accel_clear(struct
+
+ CRITBEGIN
+
+- mga_fifo(5);
++ mga_fifo(7);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, minfo->accel.m_dwg_rect | M_DWG_REPLACE);
+ mga_outl(M_FCOL, color);
+ mga_outl(M_FXBNDRY, ((sx + width) << 16) | sx);
+@@ -341,7 +356,8 @@ static void matroxfb_cfb4_clear(struct m
+ width >>= 1;
+ sx >>= 1;
+ if (width) {
+- mga_fifo(5);
++ mga_fifo(7);
++ matrox_accel_restore_maccess(minfo);
+ mga_outl(M_DWGCTL, minfo->accel.m_dwg_rect | M_DWG_REPLACE2);
+ mga_outl(M_FCOL, bgx);
+ mga_outl(M_FXBNDRY, ((sx + width) << 16) | sx);
+@@ -415,7 +431,8 @@ static void matroxfb_1bpp_imageblit(stru
+
+ CRITBEGIN
+
+- mga_fifo(3);
++ mga_fifo(5);
++ matrox_accel_restore_maccess(minfo);
+ if (easy)
+ mga_outl(M_DWGCTL, M_DWG_ILOAD | M_DWG_SGNZERO | M_DWG_SHIFTZERO | M_DWG_BMONOWF | M_DWG_LINEAR | M_DWG_REPLACE);
+ else
+@@ -425,7 +442,8 @@ static void matroxfb_1bpp_imageblit(stru
+ fxbndry = ((xx + width - 1) << 16) | xx;
+ mmio = minfo->mmio.vbase;
+
+- mga_fifo(6);
++ mga_fifo(8);
++ matrox_accel_restore_maccess(minfo);
+ mga_writel(mmio, M_FXBNDRY, fxbndry);
+ mga_writel(mmio, M_AR0, ar0);
+ mga_writel(mmio, M_AR3, 0);
+--- a/drivers/video/matrox/matroxfb_base.h
++++ b/drivers/video/matrox/matroxfb_base.h
+@@ -307,6 +307,8 @@ struct matrox_accel_data {
+ #endif
+ u_int32_t m_dwg_rect;
+ u_int32_t m_opmode;
++ u_int32_t m_access;
++ u_int32_t m_pitch;
+ };
+
+ struct v4l2_queryctrl;
--- /dev/null
+From 4fb8d027dca0236c811272d342cf185569d91311 Mon Sep 17 00:00:00 2001
+From: Li Zhong <zhong@linux.vnet.ibm.com>
+Date: Mon, 28 Apr 2014 08:29:51 +0800
+Subject: powerpc: Fix Oops in rtas_stop_self()
+
+From: Li Zhong <zhong@linux.vnet.ibm.com>
+
+commit 4fb8d027dca0236c811272d342cf185569d91311 upstream.
+
+commit 41dd03a9 may cause Oops in rtas_stop_self().
+
+The reason is that the rtas_args was moved into stack space. For a box
+with more that 4GB RAM, the stack could easily be outside 32bit range,
+but RTAS is 32bit.
+
+So the patch moves rtas_args away from stack by adding static before
+it.
+
+Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -88,13 +88,14 @@ void set_default_offline_state(int cpu)
+
+ static void rtas_stop_self(void)
+ {
+- struct rtas_args args = {
+- .token = cpu_to_be32(rtas_stop_self_token),
++ static struct rtas_args args = {
+ .nargs = 0,
+ .nret = 1,
+ .rets = &args.args[0],
+ };
+
++ args.token = cpu_to_be32(rtas_stop_self_token);
++
+ local_irq_disable();
+
+ BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE);
--- /dev/null
+From e6b8fd028b584ffca7a7255b8971f254932c9fce Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Fri, 4 Apr 2014 20:19:48 +1100
+Subject: powerpc/tm: Disable IRQ in tm_recheckpoint
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit e6b8fd028b584ffca7a7255b8971f254932c9fce upstream.
+
+We can't take an IRQ when we're about to do a trechkpt as our GPR state is set
+to user GPR values.
+
+We've hit this when running some IBM Java stress tests in the lab resulting in
+the following dump:
+
+ cpu 0x3f: Vector: 700 (Program Check) at [c000000007eb3d40]
+ pc: c000000000050074: restore_gprs+0xc0/0x148
+ lr: 00000000b52a8184
+ sp: ac57d360
+ msr: 8000000100201030
+ current = 0xc00000002c500000
+ paca = 0xc000000007dbfc00 softe: 0 irq_happened: 0x00
+ pid = 34535, comm = Pooled Thread #
+ R00 = 00000000b52a8184 R16 = 00000000b3e48fda
+ R01 = 00000000ac57d360 R17 = 00000000ade79bd8
+ R02 = 00000000ac586930 R18 = 000000000fac9bcc
+ R03 = 00000000ade60000 R19 = 00000000ac57f930
+ R04 = 00000000f6624918 R20 = 00000000ade79be8
+ R05 = 00000000f663f238 R21 = 00000000ac218a54
+ R06 = 0000000000000002 R22 = 000000000f956280
+ R07 = 0000000000000008 R23 = 000000000000007e
+ R08 = 000000000000000a R24 = 000000000000000c
+ R09 = 00000000b6e69160 R25 = 00000000b424cf00
+ R10 = 0000000000000181 R26 = 00000000f66256d4
+ R11 = 000000000f365ec0 R27 = 00000000b6fdcdd0
+ R12 = 00000000f66400f0 R28 = 0000000000000001
+ R13 = 00000000ada71900 R29 = 00000000ade5a300
+ R14 = 00000000ac2185a8 R30 = 00000000f663f238
+ R15 = 0000000000000004 R31 = 00000000f6624918
+ pc = c000000000050074 restore_gprs+0xc0/0x148
+ cfar= c00000000004fe28 dont_restore_vec+0x1c/0x1a4
+ lr = 00000000b52a8184
+ msr = 8000000100201030 cr = 24804888
+ ctr = 0000000000000000 xer = 0000000000000000 trap = 700
+
+This moves tm_recheckpoint to a C function and moves the tm_restore_sprs into
+that function. It then adds IRQ disabling over the trechkpt critical section.
+It also sets the TEXASR FS in the signals code to ensure this is never set now
+that we explictly write the TM sprs in tm_recheckpoint.
+
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 34 ++++++++++++++++++++++++++++------
+ arch/powerpc/kernel/signal_32.c | 2 ++
+ arch/powerpc/kernel/signal_64.c | 2 ++
+ arch/powerpc/kernel/tm.S | 2 +-
+ 4 files changed, 33 insertions(+), 7 deletions(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -610,6 +610,31 @@ out_and_saveregs:
+ tm_save_sprs(thr);
+ }
+
++extern void __tm_recheckpoint(struct thread_struct *thread,
++ unsigned long orig_msr);
++
++void tm_recheckpoint(struct thread_struct *thread,
++ unsigned long orig_msr)
++{
++ unsigned long flags;
++
++ /* We really can't be interrupted here as the TEXASR registers can't
++ * change and later in the trecheckpoint code, we have a userspace R1.
++ * So let's hard disable over this region.
++ */
++ local_irq_save(flags);
++ hard_irq_disable();
++
++ /* The TM SPRs are restored here, so that TEXASR.FS can be set
++ * before the trecheckpoint and no explosion occurs.
++ */
++ tm_restore_sprs(thread);
++
++ __tm_recheckpoint(thread, orig_msr);
++
++ local_irq_restore(flags);
++}
++
+ static inline void tm_recheckpoint_new_task(struct task_struct *new)
+ {
+ unsigned long msr;
+@@ -628,13 +653,10 @@ static inline void tm_recheckpoint_new_t
+ if (!new->thread.regs)
+ return;
+
+- /* The TM SPRs are restored here, so that TEXASR.FS can be set
+- * before the trecheckpoint and no explosion occurs.
+- */
+- tm_restore_sprs(&new->thread);
+-
+- if (!MSR_TM_ACTIVE(new->thread.regs->msr))
++ if (!MSR_TM_ACTIVE(new->thread.regs->msr)){
++ tm_restore_sprs(&new->thread);
+ return;
++ }
+ msr = new->thread.tm_orig_msr;
+ /* Recheckpoint to restore original checkpointed register state. */
+ TM_DEBUG("*** tm_recheckpoint of pid %d "
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -881,6 +881,8 @@ static long restore_tm_user_regs(struct
+ * transactional versions should be loaded.
+ */
+ tm_enable();
++ /* Make sure the transaction is marked as failed */
++ current->thread.tm_texasr |= TEXASR_FS;
+ /* This loads the checkpointed FP/VEC state, if used */
+ tm_recheckpoint(¤t->thread, msr);
+ /* Get the top half of the MSR */
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -527,6 +527,8 @@ static long restore_tm_sigcontexts(struc
+ }
+ #endif
+ tm_enable();
++ /* Make sure the transaction is marked as failed */
++ current->thread.tm_texasr |= TEXASR_FS;
+ /* This loads the checkpointed FP/VEC state, if used */
+ tm_recheckpoint(¤t->thread, msr);
+
+--- a/arch/powerpc/kernel/tm.S
++++ b/arch/powerpc/kernel/tm.S
+@@ -307,7 +307,7 @@ dont_backup_fp:
+ * Call with IRQs off, stacks get all out of sync for
+ * some periods in here!
+ */
+-_GLOBAL(tm_recheckpoint)
++_GLOBAL(__tm_recheckpoint)
+ mfcr r5
+ mflr r0
+ stw r5, 8(r1)
--- /dev/null
+From cc6ca3023f2c2bbcd062e9d4cf6afc2ba2821ada Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Sun, 13 Apr 2014 11:15:33 +0200
+Subject: Revert "net: mvneta: fix usage as a module on RGMII configurations"
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit cc6ca3023f2c2bbcd062e9d4cf6afc2ba2821ada upstream.
+
+This reverts commit e3a8786c10e75903f1269474e21fe8cb49c3a670. While
+this commit allows to use the mvneta driver as a module on some
+configurations, it breaks other configurations even if mvneta is used
+built-in.
+
+This breakage is due to the fact that on some RGMII platforms, the PCS
+bit has to be set, and on some other platforms, it has to be
+cleared. At the moment, we lack informations to know exactly the
+significance of this bit (the datasheet only says "enables PCS"), and
+so we can't produce a patch that will work on all platforms at this
+point. And since this change is breaking the network completely for
+many users, it's much better to revert it for now. We'll come back
+later with a proper fix that takes into account all platforms.
+
+Basically:
+
+ * Armada XP GP is configured as RGMII-ID, and needs the PCS bit to be
+ set.
+ * Armada 370 Mirabox is configured as RGMII-ID, and needs the PCS bit
+ to be cleared.
+
+And at the moment, we don't know how to make the distinction between
+those two cases. One hint is that the Armada XP GP appears in fact to
+be using a QSGMII connection with the PHY (Quad-SGMII), but
+configuring it as SGMII doesn't work, while RGMII-ID works. This needs
+more investigation, but in the mean time, let's unbreak the network
+for all those users.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Reported-by: Arnaud Ebalard <arno@natisbad.org>
+Reported-by: Alexander Reuter <Alexander.Reuter@gmx.net>
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=73401
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mvneta.c | 41 +++++++++++++++++++++++++++-------
+ 1 file changed, 33 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -89,9 +89,8 @@
+ #define MVNETA_TX_IN_PRGRS BIT(1)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
+-#define MVNETA_SERDES_CFG 0x24A0
++#define MVNETA_SGMII_SERDES_CFG 0x24A0
+ #define MVNETA_SGMII_SERDES_PROTO 0x0cc7
+-#define MVNETA_RGMII_SERDES_PROTO 0x0667
+ #define MVNETA_TYPE_PRIO 0x24bc
+ #define MVNETA_FORCE_UNI BIT(21)
+ #define MVNETA_TXQ_CMD_1 0x24e4
+@@ -712,6 +711,35 @@ static void mvneta_rxq_bm_disable(struct
+ mvreg_write(pp, MVNETA_RXQ_CONFIG_REG(rxq->id), val);
+ }
+
++
++
++/* Sets the RGMII Enable bit (RGMIIEn) in port MAC control register */
++static void mvneta_gmac_rgmii_set(struct mvneta_port *pp, int enable)
++{
++ u32 val;
++
++ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
++
++ if (enable)
++ val |= MVNETA_GMAC2_PORT_RGMII;
++ else
++ val &= ~MVNETA_GMAC2_PORT_RGMII;
++
++ mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
++}
++
++/* Config SGMII port */
++static void mvneta_port_sgmii_config(struct mvneta_port *pp)
++{
++ u32 val;
++
++ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
++ val |= MVNETA_GMAC2_PCS_ENABLE;
++ mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
++
++ mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
++}
++
+ /* Start the Ethernet port RX and TX activity */
+ static void mvneta_port_up(struct mvneta_port *pp)
+ {
+@@ -2729,15 +2757,12 @@ static void mvneta_port_power_up(struct
+ mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
+
+ if (phy_mode == PHY_INTERFACE_MODE_SGMII)
+- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
+- else
+- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_RGMII_SERDES_PROTO);
++ mvneta_port_sgmii_config(pp);
+
+- val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
+-
+- val |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
++ mvneta_gmac_rgmii_set(pp, 1);
+
+ /* Cancel Port Reset */
++ val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
+ val &= ~MVNETA_GMAC2_PORT_RESET;
+ mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+
--- /dev/null
+From 6e0de817594c61f3b392a9245deeb09609ec707d Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Fri, 25 Apr 2014 10:53:44 +0200
+Subject: s390/bpf,jit: initialize A register if 1st insn is BPF_S_LDX_B_MSH
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 6e0de817594c61f3b392a9245deeb09609ec707d upstream.
+
+The A register needs to be initialized to zero in the prolog if the
+first instruction of the BPF program is BPF_S_LDX_B_MSH to prevent
+leaking the content of %r5 to user space.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/net/bpf_jit_comp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -276,7 +276,6 @@ static void bpf_jit_noleaks(struct bpf_j
+ case BPF_S_LD_W_IND:
+ case BPF_S_LD_H_IND:
+ case BPF_S_LD_B_IND:
+- case BPF_S_LDX_B_MSH:
+ case BPF_S_LD_IMM:
+ case BPF_S_LD_MEM:
+ case BPF_S_MISC_TXA:
--- /dev/null
+From 06cd7a874ec6e09d151aeb1fa8600e14f1ff89f6 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Tue, 15 Apr 2014 20:08:01 +0200
+Subject: s390/chsc: fix SEI usage on old FW levels
+
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+
+commit 06cd7a874ec6e09d151aeb1fa8600e14f1ff89f6 upstream.
+
+Using a notification type mask for the store event information chsc
+is unsupported on some firmware levels. Retry SEI with that mask set
+to zero (which is the old way of requesting only channel subsystem
+related events).
+
+Reported-and-tested-by: Stefan Haberland <stefan.haberland@de.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/cio/chsc.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -541,18 +541,27 @@ static void chsc_process_sei_nt0(struct
+
+ static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
+ {
+- do {
++ static int ntsm_unsupported;
++
++ while (true) {
+ memset(sei, 0, sizeof(*sei));
+ sei->request.length = 0x0010;
+ sei->request.code = 0x000e;
+- sei->ntsm = ntsm;
++ if (!ntsm_unsupported)
++ sei->ntsm = ntsm;
+
+ if (chsc(sei))
+ break;
+
+ if (sei->response.code != 0x0001) {
+- CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
+- sei->response.code);
++ CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x, ntsm=%llx)\n",
++ sei->response.code, sei->ntsm);
++
++ if (sei->response.code == 3 && sei->ntsm) {
++ /* Fallback for old firmware. */
++ ntsm_unsupported = 1;
++ continue;
++ }
+ break;
+ }
+
+@@ -568,7 +577,10 @@ static void chsc_process_event_informati
+ CIO_CRW_EVENT(2, "chsc: unhandled nt: %d\n", sei->nt);
+ break;
+ }
+- } while (sei->u.nt0_area.flags & 0x80);
++
++ if (!(sei->u.nt0_area.flags & 0x80))
++ break;
++ }
+ }
+
+ /*
virtio-scsi-skip-setting-affinity-on-uninitialized-vq.patch
mpt2sas-don-t-disable-device-twice-at-suspend.patch
powerpc-compat-32-bit-little-endian-machine-name-is-ppcle-not-ppc.patch
+powerpc-tm-disable-irq-in-tm_recheckpoint.patch
+powerpc-fix-oops-in-rtas_stop_self.patch
+s390-chsc-fix-sei-usage-on-old-fw-levels.patch
+s390-bpf-jit-initialize-a-register-if-1st-insn-is-bpf_s_ldx_b_msh.patch
+asoc-dapm-fix-widget-double-free-with-auto-disable-dapm-kcontrol.patch
+arc-remove-arc_has_coh_rtsc.patch
+sunrpc-ensure-that-call_connect-times-out-correctly.patch
+sunrpc-ensure-call_connect_status-deals-correctly-with-softconn-tasks.patch
+arc-preempt-ensure-return-to-kernel-mode-is-irq-safe.patch
+framebuffer-fix-cfb_copyarea.patch
+matroxfb-restore-the-registers-m_access-and-m_pitch.patch
+mach64-use-unaligned-access.patch
+mach64-fix-cursor-when-character-width-is-not-a-multiple-of-8-pixels.patch
+b43-fix-machine-check-error-due-to-improper-access-of-b43_mmio_psm_phy_hdr.patch
+revert-net-mvneta-fix-usage-as-a-module-on-rgmii-configurations.patch
+ahci-do-not-request-irq-for-dummy-port.patch
+libata-ahci-accommodate-tag-ordered-controllers.patch
+ahci-ensure-msi-revert-to-single-message-mode-is-not-enforced.patch
+ahci-do-not-receive-interrupts-sent-by-dummy-ports.patch
+libata-update-queued-trim-blacklist-for-m5x0-drives.patch
+iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch
+iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch
--- /dev/null
+From 1fa3e2eb9db07f30a605c66d1a2fdde4b24e74d5 Mon Sep 17 00:00:00 2001
+From: Steve Dickson <steved@redhat.com>
+Date: Thu, 20 Mar 2014 11:23:03 -0400
+Subject: SUNRPC: Ensure call_connect_status() deals correctly with SOFTCONN tasks
+
+From: Steve Dickson <steved@redhat.com>
+
+commit 1fa3e2eb9db07f30a605c66d1a2fdde4b24e74d5 upstream.
+
+Don't schedule an rpc_delay before checking to see if the task
+is a SOFTCONN because the tk_callback from the delay (__rpc_atrun)
+clears the task status before the rpc_exit_task can be run.
+
+Signed-off-by: Steve Dickson <steved@redhat.com>
+Fixes: 561ec1603171c (SUNRPC: call_connect_status should recheck...)
+Link: http://lkml.kernel.org/r/5329CF7C.7090308@RedHat.com
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1803,10 +1803,10 @@ call_connect_status(struct rpc_task *tas
+ case -ECONNABORTED:
+ case -ENETUNREACH:
+ case -EHOSTUNREACH:
+- /* retry with existing socket, after a delay */
+- rpc_delay(task, 3*HZ);
+ if (RPC_IS_SOFTCONN(task))
+ break;
++ /* retry with existing socket, after a delay */
++ rpc_delay(task, 3*HZ);
+ case -EAGAIN:
+ /* Check for timeouts before looping back to call_bind */
+ case -ETIMEDOUT:
--- /dev/null
+From 485f2251782f7c44299c491d4676a8a01428d191 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Mon, 17 Mar 2014 12:51:44 -0400
+Subject: SUNRPC: Ensure that call_connect times out correctly
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 485f2251782f7c44299c491d4676a8a01428d191 upstream.
+
+When the server is unavailable due to a networking error, etc, we want
+the RPC client to respect the timeout delays when attempting to reconnect.
+
+Reported-by: Neil Brown <neilb@suse.de>
+Fixes: 561ec1603171 (SUNRPC: call_connect_status should recheck bind..)
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1798,10 +1798,6 @@ call_connect_status(struct rpc_task *tas
+ trace_rpc_connect_status(task, status);
+ task->tk_status = 0;
+ switch (status) {
+- /* if soft mounted, test if we've timed out */
+- case -ETIMEDOUT:
+- task->tk_action = call_timeout;
+- return;
+ case -ECONNREFUSED:
+ case -ECONNRESET:
+ case -ECONNABORTED:
+@@ -1812,7 +1808,9 @@ call_connect_status(struct rpc_task *tas
+ if (RPC_IS_SOFTCONN(task))
+ break;
+ case -EAGAIN:
+- task->tk_action = call_bind;
++ /* Check for timeouts before looping back to call_bind */
++ case -ETIMEDOUT:
++ task->tk_action = call_timeout;
+ return;
+ case 0:
+ clnt->cl_stats->netreconn++;
projects / thirdparty / kernel / stable-queue.git / commitdiff
