From: Greg Kroah-Hartman Date: Mon, 31 Mar 2014 23:28:02 +0000 (-0700) Subject: 3.13-stable patches X-Git-Tag: v3.4.86~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2b2ae5e65e6ca47c7b696f7288fcfa54b8813901;p=thirdparty%2Fkernel%2Fstable-queue.git 3.13-stable patches added patches: drm-i915-undo-gtt-scratch-pte-unmapping-again.patch i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch input-cypress_ps2-don-t-report-as-a-button-pads.patch input-mousedev-fix-race-when-creating-mixed-device.patch input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch input-synaptics-add-manual-min-max-quirk.patch make-prepend_name-work-correctly-when-called-with-negative-buflen.patch rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch x86-fix-boot-on-uniprocessor-systems.patch xen-balloon-flush-persistent-kmaps-in-correct-position.patch --- diff --git a/queue-3.13/drm-i915-undo-gtt-scratch-pte-unmapping-again.patch b/queue-3.13/drm-i915-undo-gtt-scratch-pte-unmapping-again.patch new file mode 100644 index 00000000000..d974dd7a693 --- /dev/null +++ b/queue-3.13/drm-i915-undo-gtt-scratch-pte-unmapping-again.patch @@ -0,0 +1,41 @@ +From 8ee661b505613ef2747b350ca2871a31b3781bee Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Wed, 26 Mar 2014 20:10:09 +0100 +Subject: drm/i915: Undo gtt scratch pte unmapping again + +From: Daniel Vetter + +commit 8ee661b505613ef2747b350ca2871a31b3781bee upstream. + +It apparently blows up on some machines. This functionally reverts + +commit 828c79087cec61eaf4c76bb32c222fbe35ac3930 +Author: Ben Widawsky +Date: Wed Oct 16 09:21:30 2013 -0700 + + drm/i915: Disable GGTT PTEs on GEN6+ suspend + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64841 +Reported-and-Tested-by: Brad Jackson +Cc: Takashi Iwai +Cc: Paulo Zanoni +Cc: Todd Previte +Signed-off-by: Daniel Vetter +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_gtt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -828,7 +828,7 @@ void i915_gem_suspend_gtt_mappings(struc + dev_priv->gtt.base.clear_range(&dev_priv->gtt.base, + dev_priv->gtt.base.start / PAGE_SIZE, + dev_priv->gtt.base.total / PAGE_SIZE, +- false); ++ true); + } + + void i915_gem_restore_gtt_mappings(struct drm_device *dev) diff --git a/queue-3.13/i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch b/queue-3.13/i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch new file mode 100644 index 00000000000..069b4ee698d --- /dev/null +++ b/queue-3.13/i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch @@ -0,0 +1,40 @@ +From 5f12c5eca6e6b7aeb4b2028d579f614b4fe7a81f Mon Sep 17 00:00:00 2001 +From: Scott Wood +Date: Tue, 18 Mar 2014 16:10:24 -0500 +Subject: i2c: cpm: Fix build by adding of_address.h and of_irq.h + +From: Scott Wood + +commit 5f12c5eca6e6b7aeb4b2028d579f614b4fe7a81f upstream. + +Fixes a build break due to the undeclared use of irq_of_parse_and_map() +and of_iomap(). This build break was apparently introduced while the +driver was unbuildable due to the bug fixed by +62c19c9d29e65086e5ae76df371ed2e6b23f00cd ("i2c: Remove usage of +orphaned symbol OF_I2C"). When 62c19c was added in v3.14-rc7, +the driver was enabled again, breaking the powerpc mpc85xx_defconfig +and mpc85xx_smp_defconfig. + +62c19c is marked for stable, so this should go there as well. + +Reported-by: Geert Uytterhoeven +Signed-off-by: Scott Wood +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-cpm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -40,7 +40,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + #include diff --git a/queue-3.13/input-cypress_ps2-don-t-report-as-a-button-pads.patch b/queue-3.13/input-cypress_ps2-don-t-report-as-a-button-pads.patch new file mode 100644 index 00000000000..d847de83a54 --- /dev/null +++ b/queue-3.13/input-cypress_ps2-don-t-report-as-a-button-pads.patch @@ -0,0 +1,48 @@ +From 6797b39e6f6f34c74177736e146406e894b9482b Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 26 Mar 2014 13:30:52 -0700 +Subject: Input: cypress_ps2 - don't report as a button pads + +From: Hans de Goede + +commit 6797b39e6f6f34c74177736e146406e894b9482b upstream. + +The cypress PS/2 trackpad models supported by the cypress_ps2 driver +emulate BTN_RIGHT events in firmware based on the finger position, as part +of this no motion events are sent when the finger is in the button area. + +The INPUT_PROP_BUTTONPAD property is there to indicate to userspace that +BTN_RIGHT events should be emulated in userspace, which is not necessary +in this case. + +When INPUT_PROP_BUTTONPAD is advertised userspace will wait for a motion +event before propagating the button event higher up the stack, as it needs +current abs x + y data for its BTN_RIGHT emulation. Since in the +cypress_ps2 pads don't report motion events in the button area, this means +that clicks in the button area end up being ignored, so +INPUT_PROP_BUTTONPAD actually causes problems for these touchpads, and +removing it fixes: + +https://bugs.freedesktop.org/show_bug.cgi?id=76341 + +Reported-by: Adam Williamson +Tested-by: Adam Williamson +Reviewed-by: Peter Hutterer +Signed-off-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/cypress_ps2.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/input/mouse/cypress_ps2.c ++++ b/drivers/input/mouse/cypress_ps2.c +@@ -410,7 +410,6 @@ static int cypress_set_input_params(stru + __clear_bit(REL_X, input->relbit); + __clear_bit(REL_Y, input->relbit); + +- __set_bit(INPUT_PROP_BUTTONPAD, input->propbit); + __set_bit(EV_KEY, input->evbit); + __set_bit(BTN_LEFT, input->keybit); + __set_bit(BTN_RIGHT, input->keybit); diff --git a/queue-3.13/input-mousedev-fix-race-when-creating-mixed-device.patch b/queue-3.13/input-mousedev-fix-race-when-creating-mixed-device.patch new file mode 100644 index 00000000000..a6ba536d59f --- /dev/null +++ b/queue-3.13/input-mousedev-fix-race-when-creating-mixed-device.patch @@ -0,0 +1,198 @@ +From e4dbedc7eac7da9db363a36f2bd4366962eeefcc Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 6 Mar 2014 12:57:24 -0800 +Subject: Input: mousedev - fix race when creating mixed device + +From: Dmitry Torokhov + +commit e4dbedc7eac7da9db363a36f2bd4366962eeefcc upstream. + +We should not be using static variable mousedev_mix in methods that can be +called before that singleton gets assigned. While at it let's add open and +close methods to mousedev structure so that we do not need to test if we +are dealing with multiplexor or normal device and simply call appropriate +method directly. + +This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=71551 + +Reported-by: GiulioDP +Tested-by: GiulioDP +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mousedev.c | 73 +++++++++++++++++++++++++++-------------------- + 1 file changed, 42 insertions(+), 31 deletions(-) + +--- a/drivers/input/mousedev.c ++++ b/drivers/input/mousedev.c +@@ -67,7 +67,6 @@ struct mousedev { + struct device dev; + struct cdev cdev; + bool exist; +- bool is_mixdev; + + struct list_head mixdev_node; + bool opened_by_mixdev; +@@ -77,6 +76,9 @@ struct mousedev { + int old_x[4], old_y[4]; + int frac_dx, frac_dy; + unsigned long touch; ++ ++ int (*open_device)(struct mousedev *mousedev); ++ void (*close_device)(struct mousedev *mousedev); + }; + + enum mousedev_emul { +@@ -116,9 +118,6 @@ static unsigned char mousedev_imex_seq[] + static struct mousedev *mousedev_mix; + static LIST_HEAD(mousedev_mix_list); + +-static void mixdev_open_devices(void); +-static void mixdev_close_devices(void); +- + #define fx(i) (mousedev->old_x[(mousedev->pkt_count - (i)) & 03]) + #define fy(i) (mousedev->old_y[(mousedev->pkt_count - (i)) & 03]) + +@@ -428,9 +427,7 @@ static int mousedev_open_device(struct m + if (retval) + return retval; + +- if (mousedev->is_mixdev) +- mixdev_open_devices(); +- else if (!mousedev->exist) ++ if (!mousedev->exist) + retval = -ENODEV; + else if (!mousedev->open++) { + retval = input_open_device(&mousedev->handle); +@@ -446,9 +443,7 @@ static void mousedev_close_device(struct + { + mutex_lock(&mousedev->mutex); + +- if (mousedev->is_mixdev) +- mixdev_close_devices(); +- else if (mousedev->exist && !--mousedev->open) ++ if (mousedev->exist && !--mousedev->open) + input_close_device(&mousedev->handle); + + mutex_unlock(&mousedev->mutex); +@@ -459,21 +454,29 @@ static void mousedev_close_device(struct + * stream. Note that this function is called with mousedev_mix->mutex + * held. + */ +-static void mixdev_open_devices(void) ++static int mixdev_open_devices(struct mousedev *mixdev) + { +- struct mousedev *mousedev; ++ int error; ++ ++ error = mutex_lock_interruptible(&mixdev->mutex); ++ if (error) ++ return error; + +- if (mousedev_mix->open++) +- return; ++ if (!mixdev->open++) { ++ struct mousedev *mousedev; + +- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { +- if (!mousedev->opened_by_mixdev) { +- if (mousedev_open_device(mousedev)) +- continue; ++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { ++ if (!mousedev->opened_by_mixdev) { ++ if (mousedev_open_device(mousedev)) ++ continue; + +- mousedev->opened_by_mixdev = true; ++ mousedev->opened_by_mixdev = true; ++ } + } + } ++ ++ mutex_unlock(&mixdev->mutex); ++ return 0; + } + + /* +@@ -481,19 +484,22 @@ static void mixdev_open_devices(void) + * device. Note that this function is called with mousedev_mix->mutex + * held. + */ +-static void mixdev_close_devices(void) ++static void mixdev_close_devices(struct mousedev *mixdev) + { +- struct mousedev *mousedev; ++ mutex_lock(&mixdev->mutex); + +- if (--mousedev_mix->open) +- return; ++ if (!--mixdev->open) { ++ struct mousedev *mousedev; + +- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { +- if (mousedev->opened_by_mixdev) { +- mousedev->opened_by_mixdev = false; +- mousedev_close_device(mousedev); ++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { ++ if (mousedev->opened_by_mixdev) { ++ mousedev->opened_by_mixdev = false; ++ mousedev_close_device(mousedev); ++ } + } + } ++ ++ mutex_unlock(&mixdev->mutex); + } + + +@@ -522,7 +528,7 @@ static int mousedev_release(struct inode + mousedev_detach_client(mousedev, client); + kfree(client); + +- mousedev_close_device(mousedev); ++ mousedev->close_device(mousedev); + + return 0; + } +@@ -550,7 +556,7 @@ static int mousedev_open(struct inode *i + client->mousedev = mousedev; + mousedev_attach_client(mousedev, client); + +- error = mousedev_open_device(mousedev); ++ error = mousedev->open_device(mousedev); + if (error) + goto err_free_client; + +@@ -861,16 +867,21 @@ static struct mousedev *mousedev_create( + + if (mixdev) { + dev_set_name(&mousedev->dev, "mice"); ++ ++ mousedev->open_device = mixdev_open_devices; ++ mousedev->close_device = mixdev_close_devices; + } else { + int dev_no = minor; + /* Normalize device number if it falls into legacy range */ + if (dev_no < MOUSEDEV_MINOR_BASE + MOUSEDEV_MINORS) + dev_no -= MOUSEDEV_MINOR_BASE; + dev_set_name(&mousedev->dev, "mouse%d", dev_no); ++ ++ mousedev->open_device = mousedev_open_device; ++ mousedev->close_device = mousedev_close_device; + } + + mousedev->exist = true; +- mousedev->is_mixdev = mixdev; + mousedev->handle.dev = input_get_device(dev); + mousedev->handle.name = dev_name(&mousedev->dev); + mousedev->handle.handler = handler; +@@ -919,7 +930,7 @@ static void mousedev_destroy(struct mous + device_del(&mousedev->dev); + mousedev_cleanup(mousedev); + input_free_minor(MINOR(mousedev->dev.devt)); +- if (!mousedev->is_mixdev) ++ if (mousedev != mousedev_mix) + input_unregister_handle(&mousedev->handle); + put_device(&mousedev->dev); + } diff --git a/queue-3.13/input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch b/queue-3.13/input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch new file mode 100644 index 00000000000..d6fd2a0282b --- /dev/null +++ b/queue-3.13/input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch @@ -0,0 +1,37 @@ +From 8a0435d958fb36d93b8df610124a0e91e5675c82 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 28 Mar 2014 01:01:38 -0700 +Subject: Input: synaptics - add manual min/max quirk for ThinkPad X240 + +From: Hans de Goede + +commit 8a0435d958fb36d93b8df610124a0e91e5675c82 upstream. + +This extends Benjamin Tissoires manual min/max quirk table with support for +the ThinkPad X240. + +Signed-off-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1507,6 +1507,14 @@ static const struct dmi_system_id min_ma + .driver_data = (int []){1024, 5052, 2258, 4832}, + }, + { ++ /* Lenovo ThinkPad X240 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"), ++ }, ++ .driver_data = (int []){1232, 5710, 1156, 4696}, ++ }, ++ { + /* Lenovo ThinkPad T440s */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), diff --git a/queue-3.13/input-synaptics-add-manual-min-max-quirk.patch b/queue-3.13/input-synaptics-add-manual-min-max-quirk.patch new file mode 100644 index 00000000000..d63d944dd7f --- /dev/null +++ b/queue-3.13/input-synaptics-add-manual-min-max-quirk.patch @@ -0,0 +1,105 @@ +From 421e08c41fda1f0c2ff6af81a67b491389b653a5 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Fri, 28 Mar 2014 00:43:00 -0700 +Subject: Input: synaptics - add manual min/max quirk + +From: Benjamin Tissoires + +commit 421e08c41fda1f0c2ff6af81a67b491389b653a5 upstream. + +The new Lenovo Haswell series (-40's) contains a new Synaptics touchpad. +However, these new Synaptics devices report bad axis ranges. +Under Windows, it is not a problem because the Windows driver uses RMI4 +over SMBus to talk to the device. Under Linux, we are using the PS/2 +fallback interface and it occurs the reported ranges are wrong. + +Of course, it would be too easy to have only one range for the whole +series, each touchpad seems to be calibrated in a different way. + +We can not use SMBus to get the actual range because I suspect the firmware +will switch into the SMBus mode and stop talking through PS/2 (this is the +case for hybrid HID over I2C / PS/2 Synaptics touchpads). + +So as a temporary solution (until RMI4 land into upstream), start a new +list of quirks with the min/max manually set. + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 47 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -265,11 +265,22 @@ static int synaptics_identify(struct psm + * Read touchpad resolution and maximum reported coordinates + * Resolution is left zero if touchpad does not support the query + */ ++ ++static const int *quirk_min_max; ++ + static int synaptics_resolution(struct psmouse *psmouse) + { + struct synaptics_data *priv = psmouse->private; + unsigned char resp[3]; + ++ if (quirk_min_max) { ++ priv->x_min = quirk_min_max[0]; ++ priv->x_max = quirk_min_max[1]; ++ priv->y_min = quirk_min_max[2]; ++ priv->y_max = quirk_min_max[3]; ++ return 0; ++ } ++ + if (SYN_ID_MAJOR(priv->identity) < 4) + return 0; + +@@ -1485,10 +1496,46 @@ static const struct dmi_system_id olpc_d + { } + }; + ++static const struct dmi_system_id min_max_dmi_table[] __initconst = { ++#if defined(CONFIG_DMI) ++ { ++ /* Lenovo ThinkPad Helix */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"), ++ }, ++ .driver_data = (int []){1024, 5052, 2258, 4832}, ++ }, ++ { ++ /* Lenovo ThinkPad T440s */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { ++ /* Lenovo ThinkPad T540p */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"), ++ }, ++ .driver_data = (int []){1024, 5056, 2058, 4832}, ++ }, ++#endif ++ { } ++}; ++ + void __init synaptics_module_init(void) + { ++ const struct dmi_system_id *min_max_dmi; ++ + impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table); + broken_olpc_ec = dmi_check_system(olpc_dmi_table); ++ ++ min_max_dmi = dmi_first_match(min_max_dmi_table); ++ if (min_max_dmi) ++ quirk_min_max = min_max_dmi->driver_data; + } + + static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode) diff --git a/queue-3.13/make-prepend_name-work-correctly-when-called-with-negative-buflen.patch b/queue-3.13/make-prepend_name-work-correctly-when-called-with-negative-buflen.patch new file mode 100644 index 00000000000..79240d355c0 --- /dev/null +++ b/queue-3.13/make-prepend_name-work-correctly-when-called-with-negative-buflen.patch @@ -0,0 +1,36 @@ +From e825196d48d2b89a6ec3a8eff280098d2a78207e Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sun, 23 Mar 2014 00:28:40 -0400 +Subject: make prepend_name() work correctly when called with negative *buflen + +From: Al Viro + +commit e825196d48d2b89a6ec3a8eff280098d2a78207e upstream. + +In all callchains leading to prepend_name(), the value left in *buflen +is eventually discarded unused if prepend_name() has returned a negative. +So we are free to do what prepend() does, and subtract from *buflen +*before* checking for underflow (which turns into checking the sign +of subtraction result, of course). + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/dcache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, i + u32 dlen = ACCESS_ONCE(name->len); + char *p; + +- if (*buflen < dlen + 1) +- return -ENAMETOOLONG; + *buflen -= dlen + 1; ++ if (*buflen < 0) ++ return -ENAMETOOLONG; + p = *buffer -= dlen + 1; + *p++ = '/'; + while (dlen--) { diff --git a/queue-3.13/rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch b/queue-3.13/rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch new file mode 100644 index 00000000000..d422aabbcf4 --- /dev/null +++ b/queue-3.13/rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch @@ -0,0 +1,83 @@ +From b37199e626b31e1175fb06764c5d1d687723aac2 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Thu, 20 Mar 2014 15:18:22 -0400 +Subject: rcuwalk: recheck mount_lock after mountpoint crossing attempts + +From: Al Viro + +commit b37199e626b31e1175fb06764c5d1d687723aac2 upstream. + +We can get false negative from __lookup_mnt() if an unrelated vfsmount +gets moved. In that case legitimize_mnt() is guaranteed to fail, +and we will fall back to non-RCU walk... unless we end up running +into a hard error on a filesystem object we wouldn't have reached +if not for that false negative. IOW, delaying that check until +the end of pathname resolution is wrong - we should recheck right +after we attempt to cross the mountpoint. We don't need to recheck +unless we see d_mountpoint() being true - in that case even if +we have just raced with mount/umount, we can simply go on as if +we'd come at the moment when the sucker wasn't a mountpoint; if we +run into a hard error as the result, it was a legitimate outcome. +__lookup_mnt() returning NULL is different in that respect, since +it might've happened due to operation on completely unrelated +mountpoint. + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namei.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1098,7 +1098,7 @@ static bool __follow_mount_rcu(struct na + return false; + + if (!d_mountpoint(path->dentry)) +- break; ++ return true; + + mounted = __lookup_mnt(path->mnt, path->dentry); + if (!mounted) +@@ -1114,20 +1114,7 @@ static bool __follow_mount_rcu(struct na + */ + *inode = path->dentry->d_inode; + } +- return true; +-} +- +-static void follow_mount_rcu(struct nameidata *nd) +-{ +- while (d_mountpoint(nd->path.dentry)) { +- struct mount *mounted; +- mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); +- if (!mounted) +- break; +- nd->path.mnt = &mounted->mnt; +- nd->path.dentry = mounted->mnt.mnt_root; +- nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); +- } ++ return read_seqretry(&mount_lock, nd->m_seq); + } + + static int follow_dotdot_rcu(struct nameidata *nd) +@@ -1155,7 +1142,17 @@ static int follow_dotdot_rcu(struct name + break; + nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); + } +- follow_mount_rcu(nd); ++ while (d_mountpoint(nd->path.dentry)) { ++ struct mount *mounted; ++ mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); ++ if (!mounted) ++ break; ++ nd->path.mnt = &mounted->mnt; ++ nd->path.dentry = mounted->mnt.mnt_root; ++ nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); ++ if (!read_seqretry(&mount_lock, nd->m_seq)) ++ goto failed; ++ } + nd->inode = nd->path.dentry->d_inode; + return 0; + diff --git a/queue-3.13/revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch b/queue-3.13/revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch new file mode 100644 index 00000000000..35cbccc5906 --- /dev/null +++ b/queue-3.13/revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch @@ -0,0 +1,85 @@ +From 5926f87fdaad4be3ed10cec563bf357915e55a86 Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Tue, 25 Mar 2014 10:38:37 +0000 +Subject: Revert "xen: properly account for _PAGE_NUMA during xen pte translations" + +From: David Vrabel + +commit 5926f87fdaad4be3ed10cec563bf357915e55a86 upstream. + +This reverts commit a9c8e4beeeb64c22b84c803747487857fe424b68. + +PTEs in Xen PV guests must contain machine addresses if _PAGE_PRESENT +is set and pseudo-physical addresses is _PAGE_PRESENT is clear. + +This is because during a domain save/restore (migration) the page +table entries are "canonicalised" and uncanonicalised". i.e., MFNs are +converted to PFNs during domain save so that on a restore the page +table entries may be rewritten with the new MFNs on the destination. +This canonicalisation is only done for PTEs that are present. + +This change resulted in writing PTEs with MFNs if _PAGE_PROTNONE (or +_PAGE_NUMA) was set but _PAGE_PRESENT was clear. These PTEs would be +migrated as-is which would result in unexpected behaviour in the +destination domain. Either a) the MFN would be translated to the +wrong PFN/page; b) setting the _PAGE_PRESENT bit would clear the PTE +because the MFN is no longer owned by the domain; or c) the present +bit would not get set. + +Symptoms include "Bad page" reports when munmapping after migrating a +domain. + +Signed-off-by: David Vrabel +Acked-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/pgtable.h | 14 ++------------ + arch/x86/xen/mmu.c | 4 ++-- + 2 files changed, 4 insertions(+), 14 deletions(-) + +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -445,20 +445,10 @@ static inline int pte_same(pte_t a, pte_ + return a.pte == b.pte; + } + +-static inline int pteval_present(pteval_t pteval) +-{ +- /* +- * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this +- * way clearly states that the intent is that protnone and numa +- * hinting ptes are considered present for the purposes of +- * pagetable operations like zapping, protection changes, gup etc. +- */ +- return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA); +-} +- + static inline int pte_present(pte_t a) + { +- return pteval_present(pte_flags(a)); ++ return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE | ++ _PAGE_NUMA); + } + + #define pte_accessible pte_accessible +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct + /* Assume pteval_t is equivalent to all the other *val_t types. */ + static pteval_t pte_mfn_to_pfn(pteval_t val) + { +- if (pteval_present(val)) { ++ if (val & _PAGE_PRESENT) { + unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT; + unsigned long pfn = mfn_to_pfn(mfn); + +@@ -381,7 +381,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t + + static pteval_t pte_pfn_to_mfn(pteval_t val) + { +- if (pteval_present(val)) { ++ if (val & _PAGE_PRESENT) { + unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT; + pteval_t flags = val & PTE_FLAGS_MASK; + unsigned long mfn; diff --git a/queue-3.13/series b/queue-3.13/series index b285ddf5c81..7084f34871f 100644 --- a/queue-3.13/series +++ b/queue-3.13/series @@ -1 +1,12 @@ ext4-atomically-set-inode-i_flags-in-ext4_set_inode_flags.patch +rcuwalk-recheck-mount_lock-after-mountpoint-crossing-attempts.patch +input-mousedev-fix-race-when-creating-mixed-device.patch +input-synaptics-add-manual-min-max-quirk.patch +input-synaptics-add-manual-min-max-quirk-for-thinkpad-x240.patch +input-cypress_ps2-don-t-report-as-a-button-pads.patch +xen-balloon-flush-persistent-kmaps-in-correct-position.patch +revert-xen-properly-account-for-_page_numa-during-xen-pte-translations.patch +i2c-cpm-fix-build-by-adding-of_address.h-and-of_irq.h.patch +drm-i915-undo-gtt-scratch-pte-unmapping-again.patch +x86-fix-boot-on-uniprocessor-systems.patch +make-prepend_name-work-correctly-when-called-with-negative-buflen.patch diff --git a/queue-3.13/x86-fix-boot-on-uniprocessor-systems.patch b/queue-3.13/x86-fix-boot-on-uniprocessor-systems.patch new file mode 100644 index 00000000000..e8cd3510c10 --- /dev/null +++ b/queue-3.13/x86-fix-boot-on-uniprocessor-systems.patch @@ -0,0 +1,47 @@ +From 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 Mon Sep 17 00:00:00 2001 +From: Artem Fetishev +Date: Fri, 28 Mar 2014 13:33:39 -0700 +Subject: x86: fix boot on uniprocessor systems + +From: Artem Fetishev + +commit 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 upstream. + +On x86 uniprocessor systems topology_physical_package_id() returns -1 +which causes rapl_cpu_prepare() to leave rapl_pmu variable uninitialized +which leads to GPF in rapl_pmu_init(). + +See arch/x86/kernel/cpu/perf_event_intel_rapl.c. + +It turns out that physical_package_id and core_id can actually be +retreived for uniprocessor systems too. Enabling them also fixes +rapl_pmu code. + +Signed-off-by: Artem Fetishev +Cc: Stephane Eranian +Cc: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: Thomas Gleixner +Cc: Peter Zijlstra +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/topology.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/topology.h ++++ b/arch/x86/include/asm/topology.h +@@ -119,9 +119,10 @@ static inline void setup_node_to_cpumask + + extern const struct cpumask *cpu_coregroup_mask(int cpu); + +-#ifdef ENABLE_TOPO_DEFINES + #define topology_physical_package_id(cpu) (cpu_data(cpu).phys_proc_id) + #define topology_core_id(cpu) (cpu_data(cpu).cpu_core_id) ++ ++#ifdef ENABLE_TOPO_DEFINES + #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu)) + #define topology_thread_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu)) + #endif diff --git a/queue-3.13/xen-balloon-flush-persistent-kmaps-in-correct-position.patch b/queue-3.13/xen-balloon-flush-persistent-kmaps-in-correct-position.patch new file mode 100644 index 00000000000..37610b83d0b --- /dev/null +++ b/queue-3.13/xen-balloon-flush-persistent-kmaps-in-correct-position.patch @@ -0,0 +1,78 @@ +From 09ed3d5ba06137913960f9c9385f71fc384193ab Mon Sep 17 00:00:00 2001 +From: Wei Liu +Date: Sat, 15 Mar 2014 16:11:47 +0000 +Subject: xen/balloon: flush persistent kmaps in correct position + +From: Wei Liu + +commit 09ed3d5ba06137913960f9c9385f71fc384193ab upstream. + +Xen balloon driver will update ballooned out pages' P2M entries to point +to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc +page while non-preemptible", kmap_flush_unused was moved after updating +P2M table. In that case for 32 bit PV guest we might end up with + + P2M X -----> S (S is mfn of balloon scratch page) + M2P Y -----> X (Y is mfn in persistent kmap entry) + +kmap_flush_unused() iterates through all the PTEs in the kmap address +space, using pte_to_page() to obtain the page. If the p2m and the m2p +are inconsistent the incorrect page is returned. This will clear +page->address on the wrong page which may cause subsequent oopses if +that page is currently kmap'ed. + +Move the flush back between get_page and __set_phys_to_machine to fix +this. + +Signed-off-by: Wei Liu +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/balloon.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -406,11 +406,25 @@ static enum bp_state decrease_reservatio + state = BP_EAGAIN; + break; + } ++ scrub_page(page); + +- pfn = page_to_pfn(page); +- frame_list[i] = pfn_to_mfn(pfn); ++ frame_list[i] = page_to_pfn(page); ++ } + +- scrub_page(page); ++ /* ++ * Ensure that ballooned highmem pages don't have kmaps. ++ * ++ * Do this before changing the p2m as kmap_flush_unused() ++ * reads PTEs to obtain pages (and hence needs the original ++ * p2m entry). ++ */ ++ kmap_flush_unused(); ++ ++ /* Update direct mapping, invalidate P2M, and add to balloon. */ ++ for (i = 0; i < nr_pages; i++) { ++ pfn = frame_list[i]; ++ frame_list[i] = pfn_to_mfn(pfn); ++ page = pfn_to_page(pfn); + + #ifdef CONFIG_XEN_HAVE_PVMMU + /* +@@ -436,11 +450,9 @@ static enum bp_state decrease_reservatio + } + #endif + +- balloon_append(pfn_to_page(pfn)); ++ balloon_append(page); + } + +- /* Ensure that ballooned highmem pages don't have kmaps. */ +- kmap_flush_unused(); + flush_tlb_all(); + + set_xen_guest_handle(reservation.extent_start, frame_list);