--- /dev/null
+From 8e64806672466392acf19e14427d1c29df3e58b9 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 29 Jan 2015 16:41:46 +0100
+Subject: ARM: 8299/1: mm: ensure local active ASID is marked as allocated on rollover
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 8e64806672466392acf19e14427d1c29df3e58b9 upstream.
+
+Commit e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0
+when running with LPAE") removed the use of the reserved TTBR0 value
+for LPAE systems, since the ASID is held in the TTBR and can be updated
+atomicly with the pgd of the next mm.
+
+Unfortunately, this patch forgot to update flush_context, which
+deliberately avoids marking the local active ASID as allocated, since we
+used to switch via ASID zero and didn't need to allocate the ASID of
+the previous mm. The side-effect of this is that we can allocate the
+same ASID to the next mm and, between flushing the local TLB and updating
+TTBR0, we can perform speculative TLB fills for userspace nG mappings
+using the page table of the previous mm.
+
+The consequence of this is that the next mm can erroneously hit some
+mappings of the previous mm. Note that this was made significantly
+harder to hit by a391263cd84e ("ARM: 8203/1: mm: try to re-use old ASID
+assignments following a rollover") but is still theoretically possible.
+
+This patch fixes the problem by removing the code from flush_context
+that forces the allocated ASID to zero for the local CPU. Many thanks
+to the Broadcom guys for tracking this one down.
+
+Fixes: e1a5848e3398 ("ARM: 7924/1: mm: don't bother with reserved ttbr0 when running with LPAE")
+
+Reported-by: Raymond Ngun <rngun@broadcom.com>
+Tested-by: Raymond Ngun <rngun@broadcom.com>
+Reviewed-by: Gregory Fong <gregory.0xf0@gmail.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/context.c | 26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -144,21 +144,17 @@ static void flush_context(unsigned int c
+ /* Update the list of reserved ASIDs and the ASID bitmap. */
+ bitmap_clear(asid_map, 0, NUM_USER_ASIDS);
+ for_each_possible_cpu(i) {
+- if (i == cpu) {
+- asid = 0;
+- } else {
+- asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+- /*
+- * If this CPU has already been through a
+- * rollover, but hasn't run another task in
+- * the meantime, we must preserve its reserved
+- * ASID, as this is the only trace we have of
+- * the process it is still running.
+- */
+- if (asid == 0)
+- asid = per_cpu(reserved_asids, i);
+- __set_bit(asid & ~ASID_MASK, asid_map);
+- }
++ asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
++ /*
++ * If this CPU has already been through a
++ * rollover, but hasn't run another task in
++ * the meantime, we must preserve its reserved
++ * ASID, as this is the only trace we have of
++ * the process it is still running.
++ */
++ if (asid == 0)
++ asid = per_cpu(reserved_asids, i);
++ __set_bit(asid & ~ASID_MASK, asid_map);
+ per_cpu(reserved_asids, i) = asid;
+ }
+
--- /dev/null
+From ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 Mon Sep 17 00:00:00 2001
+From: Sachin Prabhu <sprabhu@redhat.com>
+Date: Thu, 15 Jan 2015 12:22:04 +0000
+Subject: Complete oplock break jobs before closing file handle
+
+From: Sachin Prabhu <sprabhu@redhat.com>
+
+commit ca7df8e0bb2a5ec79691de8a1a4c0e611fe04e60 upstream.
+
+Commit
+c11f1df5003d534fd067f0168bfad7befffb3b5c
+requires writers to wait for any pending oplock break handler to
+complete before proceeding to write. This is done by waiting on bit
+CIFS_INODE_PENDING_OPLOCK_BREAK in cifsFileInfo->flags. This bit is
+cleared by the oplock break handler job queued on the workqueue once it
+has completed handling the oplock break allowing writers to proceed with
+writing to the file.
+
+While testing, it was noticed that the filehandle could be closed while
+there is a pending oplock break which results in the oplock break
+handler on the cifsiod workqueue being cancelled before it has had a
+chance to execute and clear the CIFS_INODE_PENDING_OPLOCK_BREAK bit.
+Any subsequent attempt to write to this file hangs waiting for the
+CIFS_INODE_PENDING_OPLOCK_BREAK bit to be cleared.
+
+We fix this by ensuring that we also clear the bit
+CIFS_INODE_PENDING_OPLOCK_BREAK when we remove the oplock break handler
+from the workqueue.
+
+The bug was found by Red Hat QA while testing using ltp's fsstress
+command.
+
+Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
+Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@samba.org>
+Signed-off-by: Steve French <steve.french@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/file.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInf
+ struct cifsLockInfo *li, *tmp;
+ struct cifs_fid fid;
+ struct cifs_pending_open open;
++ bool oplock_break_cancelled;
+
+ spin_lock(&cifs_file_list_lock);
+ if (--cifs_file->count > 0) {
+@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInf
+ }
+ spin_unlock(&cifs_file_list_lock);
+
+- cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInf
+ _free_xid(xid);
+ }
+
++ if (oplock_break_cancelled)
++ cifs_done_oplock_break(cifsi);
++
+ cifs_del_pending_open(&open);
+
+ /*
--- /dev/null
+From 544143f9e01a60a93eb00ab4bfcb9bf4702a2a7d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 28 Jan 2015 14:36:26 -0500
+Subject: drm/radeon: don't init gpuvm if accel is disabled (v3)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 544143f9e01a60a93eb00ab4bfcb9bf4702a2a7d upstream.
+
+If acceleration is disabled, it does not make sense
+to init gpuvm since nothing will use it. Moreover,
+if radeon_vm_init() gets called it uses accel to try
+and clear the pde tables, etc. which results in a bug.
+
+v2: handle vm_fini as well
+v3: handle bo_open/close as well
+
+Bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=88786
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_gem.c | 6 ++++--
+ drivers/gpu/drm/radeon/radeon_kms.c | 16 ++++++++--------
+ 2 files changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_gem.c
++++ b/drivers/gpu/drm/radeon/radeon_gem.c
+@@ -146,7 +146,8 @@ int radeon_gem_object_open(struct drm_ge
+ struct radeon_bo_va *bo_va;
+ int r;
+
+- if (rdev->family < CHIP_CAYMAN) {
++ if ((rdev->family < CHIP_CAYMAN) ||
++ (!rdev->accel_working)) {
+ return 0;
+ }
+
+@@ -176,7 +177,8 @@ void radeon_gem_object_close(struct drm_
+ struct radeon_bo_va *bo_va;
+ int r;
+
+- if (rdev->family < CHIP_CAYMAN) {
++ if ((rdev->family < CHIP_CAYMAN) ||
++ (!rdev->accel_working)) {
+ return;
+ }
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -598,14 +598,14 @@ int radeon_driver_open_kms(struct drm_de
+ return -ENOMEM;
+ }
+
+- vm = &fpriv->vm;
+- r = radeon_vm_init(rdev, vm);
+- if (r) {
+- kfree(fpriv);
+- return r;
+- }
+-
+ if (rdev->accel_working) {
++ vm = &fpriv->vm;
++ r = radeon_vm_init(rdev, vm);
++ if (r) {
++ kfree(fpriv);
++ return r;
++ }
++
+ r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+ if (r) {
+ radeon_vm_fini(rdev, vm);
+@@ -663,9 +663,9 @@ void radeon_driver_postclose_kms(struct
+ radeon_vm_bo_rmv(rdev, vm->ib_bo_va);
+ radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+ }
++ radeon_vm_fini(rdev, vm);
+ }
+
+- radeon_vm_fini(rdev, vm);
+ kfree(fpriv);
+ file_priv->driver_priv = NULL;
+ }
--- /dev/null
+From 72edd83cc9e5819ed1ee771519143d7594e059f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 29 Jan 2015 16:01:03 +0100
+Subject: drm/radeon: fix PLLs on RS880 and older v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 72edd83cc9e5819ed1ee771519143d7594e059f0 upstream.
+
+This is a workaround for RS880 and older chips which seem to have
+an additional limit on the minimum PLL input frequency.
+
+v2: fix signed/unsigned warning
+
+bugs:
+https://bugzilla.kernel.org/show_bug.cgi?id=91861
+https://bugzilla.kernel.org/show_bug.cgi?id=83461
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -959,6 +959,9 @@ void radeon_compute_pll_avivo(struct rad
+ if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
+ pll->flags & RADEON_PLL_USE_REF_DIV)
+ ref_div_max = pll->reference_div;
++ else if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP)
++ /* fix for problems on RS880 */
++ ref_div_max = min(pll->max_ref_div, 7u);
+ else
+ ref_div_max = pll->max_ref_div;
+
--- /dev/null
+From 3f5e1b4f58b7b6480cccff4bf965436102db4346 Mon Sep 17 00:00:00 2001
+From: Ilija Hadzic <ilijahadzic@gmail.com>
+Date: Fri, 30 Jan 2015 00:38:43 -0500
+Subject: drm/radeon: fix the crash in benchmark functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilija Hadzic <ilijahadzic@gmail.com>
+
+commit 3f5e1b4f58b7b6480cccff4bf965436102db4346 upstream.
+
+radeon_copy_dma and radeon_copy_blit must be called with
+a valid reservation object. Otherwise a crash will be provoked.
+We borrow the object from destination BO.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=88464
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_benchmark.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -34,7 +34,8 @@
+
+ static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
+ uint64_t saddr, uint64_t daddr,
+- int flag, int n)
++ int flag, int n,
++ struct reservation_object *resv)
+ {
+ unsigned long start_jiffies;
+ unsigned long end_jiffies;
+@@ -47,12 +48,12 @@ static int radeon_benchmark_do_move(stru
+ case RADEON_BENCHMARK_COPY_DMA:
+ fence = radeon_copy_dma(rdev, saddr, daddr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ resv);
+ break;
+ case RADEON_BENCHMARK_COPY_BLIT:
+ fence = radeon_copy_blit(rdev, saddr, daddr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ resv);
+ break;
+ default:
+ DRM_ERROR("Unknown copy method\n");
+@@ -120,7 +121,8 @@ static void radeon_benchmark_move(struct
+
+ if (rdev->asic->copy.dma) {
+ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+- RADEON_BENCHMARK_COPY_DMA, n);
++ RADEON_BENCHMARK_COPY_DMA, n,
++ dobj->tbo.resv);
+ if (time < 0)
+ goto out_cleanup;
+ if (time > 0)
+@@ -130,7 +132,8 @@ static void radeon_benchmark_move(struct
+
+ if (rdev->asic->copy.blit) {
+ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+- RADEON_BENCHMARK_COPY_BLIT, n);
++ RADEON_BENCHMARK_COPY_BLIT, n,
++ dobj->tbo.resv);
+ if (time < 0)
+ goto out_cleanup;
+ if (time > 0)
--- /dev/null
+From 92b712b739811e4aa7c0e1af339d0098989ea024 Mon Sep 17 00:00:00 2001
+From: Ilija Hadzic <ilijahadzic@gmail.com>
+Date: Fri, 30 Jan 2015 00:38:44 -0500
+Subject: drm/radeon: fix the crash in test functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilija Hadzic <ilijahadzic@gmail.com>
+
+commit 92b712b739811e4aa7c0e1af339d0098989ea024 upstream.
+
+radeon_copy_dma and radeon_copy_blit must be called with
+a valid reservation object. Otherwise a crash will be provoked.
+We borrow the object from vram BO.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=88464
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_test.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_test.c
++++ b/drivers/gpu/drm/radeon/radeon_test.c
+@@ -119,11 +119,11 @@ static void radeon_do_test_moves(struct
+ if (ring == R600_RING_TYPE_DMA_INDEX)
+ fence = radeon_copy_dma(rdev, gtt_addr, vram_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ else
+ fence = radeon_copy_blit(rdev, gtt_addr, vram_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ if (IS_ERR(fence)) {
+ DRM_ERROR("Failed GTT->VRAM copy %d\n", i);
+ r = PTR_ERR(fence);
+@@ -170,11 +170,11 @@ static void radeon_do_test_moves(struct
+ if (ring == R600_RING_TYPE_DMA_INDEX)
+ fence = radeon_copy_dma(rdev, vram_addr, gtt_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ else
+ fence = radeon_copy_blit(rdev, vram_addr, gtt_addr,
+ size / RADEON_GPU_PAGE_SIZE,
+- NULL);
++ vram_obj->tbo.resv);
+ if (IS_ERR(fence)) {
+ DRM_ERROR("Failed VRAM->GTT copy %d\n", i);
+ r = PTR_ERR(fence);
--- /dev/null
+From a124d068bf5be6be2ff4b9fab77b1b7509107e68 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 30 Jan 2015 09:52:24 -0500
+Subject: drm/radeon: properly set vm fragment size for TN/RL
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a124d068bf5be6be2ff4b9fab77b1b7509107e68 upstream.
+
+Should be the same as cayman. We don't use VM by default
+on NI parts so this isn't critical.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_vm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -753,9 +753,11 @@ static void radeon_vm_frag_ptes(struct r
+ */
+
+ /* NI is optimized for 256KB fragments, SI and newer for 64KB */
+- uint64_t frag_flags = rdev->family == CHIP_CAYMAN ?
++ uint64_t frag_flags = ((rdev->family == CHIP_CAYMAN) ||
++ (rdev->family == CHIP_ARUBA)) ?
+ R600_PTE_FRAG_256KB : R600_PTE_FRAG_64KB;
+- uint64_t frag_align = rdev->family == CHIP_CAYMAN ? 0x200 : 0x80;
++ uint64_t frag_align = ((rdev->family == CHIP_CAYMAN) ||
++ (rdev->family == CHIP_ARUBA)) ? 0x200 : 0x80;
+
+ uint64_t frag_start = ALIGN(pe_start, frag_align);
+ uint64_t frag_end = pe_end & ~(frag_align - 1);
--- /dev/null
+From b184c388f773f30b6c707d3d4599b2db80f4390c Mon Sep 17 00:00:00 2001
+From: Sonic Zhang <sonic.zhang@analog.com>
+Date: Tue, 20 Jan 2015 17:00:08 +0800
+Subject: gpio: mcp23s08: handle default gpio base
+
+From: Sonic Zhang <sonic.zhang@analog.com>
+
+commit b184c388f773f30b6c707d3d4599b2db80f4390c upstream.
+
+Create default gpio base if neither device node nor
+platform data is defined.
+
+Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
+Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
+Tested-by: Antonio Fiol <antonio@fiol.es>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-mcp23s08.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpio/gpio-mcp23s08.c
++++ b/drivers/gpio/gpio-mcp23s08.c
+@@ -785,9 +785,11 @@ static int mcp230xx_probe(struct i2c_cli
+ client->irq = irq_of_parse_and_map(client->dev.of_node, 0);
+ } else {
+ pdata = dev_get_platdata(&client->dev);
+- if (!pdata || !gpio_is_valid(pdata->base)) {
+- dev_dbg(&client->dev, "invalid platform data\n");
+- return -EINVAL;
++ if (!pdata) {
++ pdata = devm_kzalloc(&client->dev,
++ sizeof(struct mcp23s08_platform_data),
++ GFP_KERNEL);
++ pdata->base = -1;
+ }
+ }
+
+@@ -908,10 +910,11 @@ static int mcp23s08_probe(struct spi_dev
+ } else {
+ type = spi_get_device_id(spi)->driver_data;
+ pdata = dev_get_platdata(&spi->dev);
+- if (!pdata || !gpio_is_valid(pdata->base)) {
+- dev_dbg(&spi->dev,
+- "invalid or missing platform data\n");
+- return -EINVAL;
++ if (!pdata) {
++ pdata = devm_kzalloc(&spi->dev,
++ sizeof(struct mcp23s08_platform_data),
++ GFP_KERNEL);
++ pdata->base = -1;
+ }
+
+ for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
--- /dev/null
+From 0f303db08df0df9bd0966443ad6001e63960af16 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Jan 2015 12:02:45 +0100
+Subject: gpio: sysfs: fix memory leak in gpiod_export_link
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0f303db08df0df9bd0966443ad6001e63960af16 upstream.
+
+Fix memory leak in the gpio sysfs interface due to failure to drop
+reference to device returned by class_find_device when creating a link.
+
+Fixes: a4177ee7f1a8 ("gpiolib: allow exported GPIO nodes to be named using sysfs links")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib-sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -630,6 +630,7 @@ int gpiod_export_link(struct device *dev
+ if (tdev != NULL) {
+ status = sysfs_create_link(&dev->kobj, &tdev->kobj,
+ name);
++ put_device(tdev);
+ } else {
+ status = -ENODEV;
+ }
--- /dev/null
+From 49d2ca84e433dab854c7a866bc6add09cfab682d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Jan 2015 12:02:46 +0100
+Subject: gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 49d2ca84e433dab854c7a866bc6add09cfab682d upstream.
+
+Fix memory leak in the gpio sysfs interface due to failure to drop
+reference to device returned by class_find_device when setting the
+gpio-line polarity.
+
+Fixes: 0769746183ca ("gpiolib: add support for changing value polarity in sysfs")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -678,7 +678,7 @@ int gpiod_sysfs_set_active_low(struct gp
+ }
+
+ status = sysfs_set_active_low(desc, dev, value);
+-
++ put_device(dev);
+ unlock:
+ mutex_unlock(&sysfs_lock);
+
--- /dev/null
+From 2d560306096739e2251329ab5c16059311a151b0 Mon Sep 17 00:00:00 2001
+From: Peter Kümmel <syntheticpp@gmx.net>
+Date: Tue, 4 Nov 2014 12:01:59 +0100
+Subject: kconfig: Fix warning "‘jump’ may be used uninitialized"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Kümmel <syntheticpp@gmx.net>
+
+commit 2d560306096739e2251329ab5c16059311a151b0 upstream.
+
+Warning:
+In file included from scripts/kconfig/zconf.tab.c:2537:0:
+scripts/kconfig/menu.c: In function ‘get_symbol_str’:
+scripts/kconfig/menu.c:590:18: warning: ‘jump’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ jump->offset = strlen(r->s);
+
+Simplifies the test logic because (head && local) means (jump != 0)
+and makes GCC happy when checking if the jump pointer was initialized.
+
+Signed-off-by: Peter Kümmel <syntheticpp@gmx.net>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Cc: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/kconfig/menu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/kconfig/menu.c
++++ b/scripts/kconfig/menu.c
+@@ -548,7 +548,7 @@ static void get_prompt_str(struct gstr *
+ {
+ int i, j;
+ struct menu *submenu[8], *menu, *location = NULL;
+- struct jump_key *jump;
++ struct jump_key *jump = NULL;
+
+ str_printf(r, _("Prompt: %s\n"), _(prop->text));
+ menu = prop->menu->parent;
+@@ -586,7 +586,7 @@ static void get_prompt_str(struct gstr *
+ str_printf(r, _(" Location:\n"));
+ for (j = 4; --i >= 0; j += 2) {
+ menu = submenu[i];
+- if (head && location && menu == location)
++ if (jump && menu == location)
+ jump->offset = strlen(r->s);
+ str_printf(r, "%*c-> %s", j, ' ',
+ _(menu_get_prompt(menu)));
--- /dev/null
+From 150ae0e94634714b23919f0c333fee28a5b199d5 Mon Sep 17 00:00:00 2001
+From: karl beldan <karl.beldan@gmail.com>
+Date: Wed, 28 Jan 2015 10:58:11 +0100
+Subject: lib/checksum.c: fix carry in csum_tcpudp_nofold
+
+From: karl beldan <karl.beldan@gmail.com>
+
+commit 150ae0e94634714b23919f0c333fee28a5b199d5 upstream.
+
+The carry from the 64->32bits folding was dropped, e.g with:
+saddr=0xFFFFFFFF daddr=0xFF0000FF len=0xFFFF proto=0 sum=1,
+csum_tcpudp_nofold returned 0 instead of 1.
+
+Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Mike Frysinger <vapier@gentoo.org>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/checksum.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/lib/checksum.c
++++ b/lib/checksum.c
+@@ -47,6 +47,15 @@ static inline unsigned short from32to16(
+ return x;
+ }
+
++static inline u32 from64to32(u64 x)
++{
++ /* add up 32-bit and 32-bit for 32+c bit */
++ x = (x & 0xffffffff) + (x >> 32);
++ /* add up carry.. */
++ x = (x & 0xffffffff) + (x >> 32);
++ return (u32)x;
++}
++
+ static unsigned int do_csum(const unsigned char *buff, int len)
+ {
+ int odd;
+@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr,
+ #else
+ s += (proto + len) << 8;
+ #endif
+- s += (s >> 32);
+- return (__force __wsum)s;
++ return (__force __wsum)from64to32(s);
+ }
+ EXPORT_SYMBOL(csum_tcpudp_nofold);
+ #endif
--- /dev/null
+From b1b02fe97f75b12ab34b2303bfd4e3526d903a58 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 2 Feb 2015 10:44:29 +1100
+Subject: md/raid5: fix another livelock caused by non-aligned writes.
+
+From: NeilBrown <neilb@suse.de>
+
+commit b1b02fe97f75b12ab34b2303bfd4e3526d903a58 upstream.
+
+If a non-page-aligned write is destined for a device which
+is missing/faulty, we can deadlock.
+
+As the target device is missing, a read-modify-write cycle
+is not possible.
+As the write is not for a full-page, a recontruct-write cycle
+is not possible.
+
+This should be handled by logic in fetch_block() which notices
+there is a non-R5_OVERWRITE write to a missing device, and so
+loads all blocks.
+
+However since commit 67f455486d2ea2, that code requires
+STRIPE_PREREAD_ACTIVE before it will active, and those circumstances
+never set STRIPE_PREREAD_ACTIVE.
+
+So: in handle_stripe_dirtying, if neither rmw or rcw was possible,
+set STRIPE_DELAYED, which will cause STRIPE_PREREAD_ACTIVE be set
+after a suitable delay.
+
+Fixes: 67f455486d2ea20b2d94d6adf5b9b783d079e321
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Tested-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3195,6 +3195,11 @@ static void handle_stripe_dirtying(struc
+ (unsigned long long)sh->sector,
+ rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
+ }
++
++ if (rcw > disks && rmw > disks &&
++ !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
++ set_bit(STRIPE_DELAYED, &sh->state);
++
+ /* now if nothing is locked, and if we have enough data,
+ * we can start a write request
+ */
--- /dev/null
+From f5e03a4989e80a86f8b514659dca8539132e6e09 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Thu, 5 Feb 2015 12:25:14 -0800
+Subject: memcg, shmem: fix shmem migration to use lrucare
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit f5e03a4989e80a86f8b514659dca8539132e6e09 upstream.
+
+It has been reported that 965GM might trigger
+
+ VM_BUG_ON_PAGE(!lrucare && PageLRU(oldpage), oldpage)
+
+in mem_cgroup_migrate when shmem wants to replace a swap cache page
+because of shmem_should_replace_page (the page is allocated from an
+inappropriate zone). shmem_replace_page expects that the oldpage is not
+on LRU list and calls mem_cgroup_migrate without lrucare. This is
+obviously incorrect because swapcache pages might be on the LRU list
+(e.g. swapin readahead page).
+
+Fix this by enabling lrucare for the migration in shmem_replace_page.
+Also clarify that lrucare should be used even if one of the pages might
+be on LRU list.
+
+The BUG_ON will trigger only when CONFIG_DEBUG_VM is enabled but even
+without that the migration code might leave the old page on an
+inappropriate memcg' LRU which is not that critical because the page
+would get removed with its last reference but it is still confusing.
+
+Fixes: 0a31bc97c80c ("mm: memcontrol: rewrite uncharge API")
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reported-by: Dave Airlie <airlied@gmail.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 2 +-
+ mm/shmem.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6589,7 +6589,7 @@ void mem_cgroup_uncharge_list(struct lis
+ * mem_cgroup_migrate - migrate a charge to another page
+ * @oldpage: currently charged page
+ * @newpage: page to transfer the charge to
+- * @lrucare: both pages might be on the LRU already
++ * @lrucare: either or both pages might be on the LRU already
+ *
+ * Migrate the charge from @oldpage to @newpage.
+ *
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1013,7 +1013,7 @@ static int shmem_replace_page(struct pag
+ */
+ oldpage = newpage;
+ } else {
+- mem_cgroup_migrate(oldpage, newpage, false);
++ mem_cgroup_migrate(oldpage, newpage, true);
+ lru_cache_add_anon(newpage);
+ *pagep = newpage;
+ }
--- /dev/null
+From 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 Mon Sep 17 00:00:00 2001
+From: David Daney <david.daney@cavium.com>
+Date: Tue, 6 Jan 2015 10:42:23 -0800
+Subject: MIPS: Fix C0_Pagegrain[IEC] support.
+
+From: David Daney <david.daney@cavium.com>
+
+commit 9ead8632bbf454cfc709b6205dc9cd8582fb0d64 upstream.
+
+The following commits:
+
+ 5890f70f15c52d (MIPS: Use dedicated exception handler if CPU supports RI/XI exceptions)
+ 6575b1d4173eae (MIPS: kernel: cpu-probe: Detect unique RI/XI exceptions)
+
+break the kernel for *all* existing MIPS CPUs that implement the
+CP0_PageGrain[IEC] bit. They cause the TLB exception handlers to be
+generated without the legacy execute-inhibit handling, but never set
+the CP0_PageGrain[IEC] bit to activate the use of dedicated exception
+vectors for execute-inhibit exceptions. The result is that upon
+detection of an execute-inhibit violation, we loop forever in the TLB
+exception handlers instead of sending SIGSEGV to the task.
+
+If we are generating TLB exception handlers expecting separate
+vectors, we must also enable the CP0_PageGrain[IEC] feature.
+
+The bug was introduced in kernel version 3.17.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Cc: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: http://patchwork.linux-mips.org/patch/8880/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/tlb-r4k.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -489,6 +489,8 @@ static void r4k_tlb_configure(void)
+ #ifdef CONFIG_64BIT
+ pg |= PG_ELPA;
+ #endif
++ if (cpu_has_rixiex)
++ pg |= PG_IEC;
+ write_c0_pagegrain(pg);
+ }
+
--- /dev/null
+From c7754e75100ed5e3068ac5085747f2bfc386c8d6 Mon Sep 17 00:00:00 2001
+From: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Date: Thu, 15 Jan 2015 23:01:59 +0200
+Subject: MIPS: Fix kernel lockup or crash after CPU offline/online
+
+From: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+
+commit c7754e75100ed5e3068ac5085747f2bfc386c8d6 upstream.
+
+As printk() invocation can cause e.g. a TLB miss, printk() cannot be
+called before the exception handlers have been properly initialized.
+This can happen e.g. when netconsole has been loaded as a kernel module
+and the TLB table has been cleared when a CPU was offline.
+
+Call cpu_report() in start_secondary() only after the exception handlers
+have been initialized to fix this.
+
+Without the patch the kernel will randomly either lockup or crash
+after a CPU is onlined and the console driver is a module.
+
+Signed-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: David Daney <david.daney@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/8953/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -123,10 +123,10 @@ asmlinkage void start_secondary(void)
+ unsigned int cpu;
+
+ cpu_probe();
+- cpu_report();
+ per_cpu_trap_init(false);
+ mips_clockevent_init();
+ mp_ops->init_secondary();
++ cpu_report();
+
+ /*
+ * XXX parity protection should be folded in here when it's converted
--- /dev/null
+From a3e6c1eff54878506b2dddcc202df9cc8180facb Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 15 Jan 2015 19:05:28 +0100
+Subject: MIPS: IRQ: Fix disable_irq on CPU IRQs
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit a3e6c1eff54878506b2dddcc202df9cc8180facb upstream.
+
+If the irq_chip does not define .irq_disable, any call to disable_irq
+will defer disabling the IRQ until it fires while marked as disabled.
+This assumes that the handler function checks for this condition, which
+handle_percpu_irq does not. In this case, calling disable_irq leads to
+an IRQ storm, if the interrupt fires while disabled.
+
+This optimization is only useful when disabling the IRQ is slow, which
+is not true for the MIPS CPU IRQ.
+
+Disable this optimization by implementing .irq_disable and .irq_enable
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8949/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/irq_cpu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/irq_cpu.c
++++ b/arch/mips/kernel/irq_cpu.c
+@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_cont
+ .irq_mask_ack = mask_mips_irq,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ /*
+@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_c
+ .irq_mask_ack = mips_mt_cpu_irq_ack,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ void __init mips_cpu_irq_init(void)
--- /dev/null
+From 63a87fe0d0de2ce126a8cec9a299a133cfd5658e Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Thu, 15 Jan 2015 23:01:58 +0200
+Subject: MIPS: OCTEON: fix kernel crash when offlining a CPU
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+commit 63a87fe0d0de2ce126a8cec9a299a133cfd5658e upstream.
+
+octeon_cpu_disable() will unconditionally enable interrupts when called.
+We can assume that the routine is always called with interrupts disabled,
+so just delete the incorrect local_irq_disable/enable().
+
+The patch fixes the following crash when offlining a CPU:
+
+[ 93.818785] ------------[ cut here ]------------
+[ 93.823421] WARNING: CPU: 1 PID: 10 at kernel/smp.c:231 flush_smp_call_function_queue+0x1c4/0x1d0()
+[ 93.836215] Modules linked in:
+[ 93.839287] CPU: 1 PID: 10 Comm: migration/1 Not tainted 3.19.0-rc4-octeon-los_b5f0 #1
+[ 93.847212] Stack : 0000000000000001 ffffffff81b2cf90 0000000000000004 ffffffff81630000
+ 0000000000000000 0000000000000000 0000000000000000 000000000000004a
+ 0000000000000006 ffffffff8117e550 0000000000000000 0000000000000000
+ ffffffff81b30000 ffffffff81b26808 8000000032c77748 ffffffff81627e07
+ ffffffff81595ec8 ffffffff81b26808 000000000000000a 0000000000000001
+ 0000000000000001 0000000000000003 0000000010008ce1 ffffffff815030c8
+ 8000000032cbbb38 ffffffff8113d42c 0000000010008ce1 ffffffff8117f36c
+ 8000000032c77300 8000000032cbba50 0000000000000001 ffffffff81503984
+ 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+ 0000000000000000 ffffffff81121668 0000000000000000 0000000000000000
+ ...
+[ 93.912819] Call Trace:
+[ 93.915273] [<ffffffff81121668>] show_stack+0x68/0x80
+[ 93.920335] [<ffffffff81503984>] dump_stack+0x6c/0x90
+[ 93.925395] [<ffffffff8113d58c>] warn_slowpath_common+0x94/0xd8
+[ 93.931324] [<ffffffff811a402c>] flush_smp_call_function_queue+0x1c4/0x1d0
+[ 93.938208] [<ffffffff811a4128>] hotplug_cfd+0xf0/0x108
+[ 93.943444] [<ffffffff8115bacc>] notifier_call_chain+0x5c/0xb8
+[ 93.949286] [<ffffffff8113d704>] cpu_notify+0x24/0x60
+[ 93.954348] [<ffffffff81501738>] take_cpu_down+0x38/0x58
+[ 93.959670] [<ffffffff811b343c>] multi_cpu_stop+0x154/0x180
+[ 93.965250] [<ffffffff811b3768>] cpu_stopper_thread+0xd8/0x160
+[ 93.971093] [<ffffffff8115ea4c>] smpboot_thread_fn+0x1ec/0x1f8
+[ 93.976936] [<ffffffff8115ab04>] kthread+0xd4/0xf0
+[ 93.981735] [<ffffffff8111c4f0>] ret_from_kernel_thread+0x14/0x1c
+[ 93.987835]
+[ 93.989326] ---[ end trace c9e3815ee655bda9 ]---
+[ 93.993951] Kernel bug detected[#1]:
+[ 93.997533] CPU: 1 PID: 10 Comm: migration/1 Tainted: G W 3.19.0-rc4-octeon-los_b5f0 #1
+[ 94.006591] task: 8000000032c77300 ti: 8000000032cb8000 task.ti: 8000000032cb8000
+[ 94.014081] $ 0 : 0000000000000000 0000000010000ce1 0000000000000001 ffffffff81620000
+[ 94.022146] $ 4 : 8000000002c72ac0 0000000000000000 00000000000001a7 ffffffff813b06f0
+[ 94.030210] $ 8 : ffffffff813b20d8 0000000000000000 0000000000000000 ffffffff81630000
+[ 94.038275] $12 : 0000000000000087 0000000000000000 0000000000000086 0000000000000000
+[ 94.046339] $16 : ffffffff81623168 0000000000000001 0000000000000000 0000000000000008
+[ 94.054405] $20 : 0000000000000001 0000000000000001 0000000000000001 0000000000000003
+[ 94.062470] $24 : 0000000000000038 ffffffff813b7f10
+[ 94.070536] $28 : 8000000032cb8000 8000000032cbbc20 0000000010008ce1 ffffffff811bcaf4
+[ 94.078601] Hi : 0000000000f188e8
+[ 94.082179] Lo : d4fdf3b646c09d55
+[ 94.085760] epc : ffffffff811bc9d0 irq_work_run_list+0x8/0xf8
+[ 94.091686] Tainted: G W
+[ 94.095613] ra : ffffffff811bcaf4 irq_work_run+0x34/0x60
+[ 94.101192] Status: 10000ce3 KX SX UX KERNEL EXL IE
+[ 94.106235] Cause : 40808034
+[ 94.109119] PrId : 000d9301 (Cavium Octeon II)
+[ 94.113653] Modules linked in:
+[ 94.116721] Process migration/1 (pid: 10, threadinfo=8000000032cb8000, task=8000000032c77300, tls=0000000000000000)
+[ 94.127168] Stack : 8000000002c74c80 ffffffff811a4128 0000000000000001 ffffffff81635720
+ fffffffffffffff2 ffffffff8115bacc 80000000320fbce0 80000000320fbca4
+ 80000000320fbc80 0000000000000002 0000000000000004 ffffffff8113d704
+ 80000000320fbce0 ffffffff81501738 0000000000000003 ffffffff811b343c
+ 8000000002c72aa0 8000000002c72aa8 ffffffff8159cae8 ffffffff8159caa0
+ ffffffff81650000 80000000320fbbf0 80000000320fbc80 ffffffff811b32e8
+ 0000000000000000 ffffffff811b3768 ffffffff81622b80 ffffffff815148a8
+ 8000000032c77300 8000000002c73e80 ffffffff815148a8 8000000032c77300
+ ffffffff81622b80 ffffffff815148a8 8000000032c77300 ffffffff81503f48
+ ffffffff8115ea0c ffffffff81620000 0000000000000000 ffffffff81174d64
+ ...
+[ 94.192771] Call Trace:
+[ 94.195222] [<ffffffff811bc9d0>] irq_work_run_list+0x8/0xf8
+[ 94.200802] [<ffffffff811bcaf4>] irq_work_run+0x34/0x60
+[ 94.206036] [<ffffffff811a4128>] hotplug_cfd+0xf0/0x108
+[ 94.211269] [<ffffffff8115bacc>] notifier_call_chain+0x5c/0xb8
+[ 94.217111] [<ffffffff8113d704>] cpu_notify+0x24/0x60
+[ 94.222171] [<ffffffff81501738>] take_cpu_down+0x38/0x58
+[ 94.227491] [<ffffffff811b343c>] multi_cpu_stop+0x154/0x180
+[ 94.233072] [<ffffffff811b3768>] cpu_stopper_thread+0xd8/0x160
+[ 94.238914] [<ffffffff8115ea4c>] smpboot_thread_fn+0x1ec/0x1f8
+[ 94.244757] [<ffffffff8115ab04>] kthread+0xd4/0xf0
+[ 94.249555] [<ffffffff8111c4f0>] ret_from_kernel_thread+0x14/0x1c
+[ 94.255654]
+[ 94.257146]
+Code: a2423c40 40026000 30420001 <00020336> dc820000 10400037 00000000 0000010f 0000010f
+[ 94.267183] ---[ end trace c9e3815ee655bdaa ]---
+[ 94.271804] Fatal exception: panic in 5 seconds
+
+Reported-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Acked-by: David Daney <david.daney@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/8952/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/cavium-octeon/smp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/mips/cavium-octeon/smp.c
++++ b/arch/mips/cavium-octeon/smp.c
+@@ -240,9 +240,7 @@ static int octeon_cpu_disable(void)
+
+ set_cpu_online(cpu, false);
+ cpu_clear(cpu, cpu_callin_map);
+- local_irq_disable();
+ octeon_fixup_irqs();
+- local_irq_enable();
+
+ flush_cache_all();
+ local_flush_tlb_all();
--- /dev/null
+From d76e9b9fc5de7e8fc4fd0e72a94e8c723929ffea Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Fri, 30 Jan 2015 15:40:20 +0000
+Subject: MIPS: traps: Fix inline asm ctc1 missing .set hardfloat
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit d76e9b9fc5de7e8fc4fd0e72a94e8c723929ffea upstream.
+
+Commit 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+") in v3.18
+enabled -msoft-float and sprinkled ".set hardfloat" where necessary to
+use FP instructions. However it missed enable_restore_fp_context() which
+since v3.17 does a ctc1 with inline assembly, causing the following
+assembler errors on Mentor's 2014.05 toolchain:
+
+{standard input}: Assembler messages:
+{standard input}:2913: Error: opcode not supported on this processor: mips32r2 (mips32r2) `ctc1 $2,$31'
+scripts/Makefile.build:257: recipe for target 'arch/mips/kernel/traps.o' failed
+
+Fix that to use the new write_32bit_cp1_register() macro so that ".set
+hardfloat" is automatically added when -msoft-float is in use.
+
+Fixes 842dfc11ea9a ("MIPS: Fix build with binutils 2.24.51+")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9173/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/traps.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -1184,7 +1184,8 @@ static int enable_restore_fp_context(int
+
+ /* Restore the scalar FP control & status register */
+ if (!was_fpu_owner)
+- asm volatile("ctc1 %0, $31" : : "r"(current->thread.fpu.fcr31));
++ write_32bit_cp1_register(CP1_STATUS,
++ current->thread.fpu.fcr31);
+ }
+
+ out:
--- /dev/null
+From 23aaed6659df9adfabe9c583e67a36b54e21df46 Mon Sep 17 00:00:00 2001
+From: Shiraz Hashim <shashim@codeaurora.org>
+Date: Thu, 5 Feb 2015 12:25:06 -0800
+Subject: mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range
+
+From: Shiraz Hashim <shashim@codeaurora.org>
+
+commit 23aaed6659df9adfabe9c583e67a36b54e21df46 upstream.
+
+walk_page_range() silently skips vma having VM_PFNMAP set, which leads
+to undesirable behaviour at client end (who called walk_page_range).
+Userspace applications get the wrong data, so the effect is like just
+confusing users (if the applications just display the data) or sometimes
+killing the processes (if the applications do something with
+misunderstanding virtual addresses due to the wrong data.)
+
+For example for pagemap_read, when no callbacks are called against
+VM_PFNMAP vma, pagemap_read may prepare pagemap data for next virtual
+address range at wrong index.
+
+Eventually userspace may get wrong pagemap data for a task.
+Corresponding to a VM_PFNMAP marked vma region, kernel may report
+mappings from subsequent vma regions. User space in turn may account
+more pages (than really are) to the task.
+
+In my case I was using procmem, procrack (Android utility) which uses
+pagemap interface to account RSS pages of a task. Due to this bug it
+was giving a wrong picture for vmas (with VM_PFNMAP set).
+
+Fixes: a9ff785e4437 ("mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas")
+Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>
+Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/pagewalk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr,
+ */
+ if ((vma->vm_start <= addr) &&
+ (vma->vm_flags & VM_PFNMAP)) {
+- next = vma->vm_end;
++ if (walk->pte_hole)
++ err = walk->pte_hole(addr, next, walk);
++ if (err)
++ break;
+ pgd = pgd_offset(walk->mm, next);
+ continue;
+ }
--- /dev/null
+From 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Date: Thu, 5 Feb 2015 12:25:20 -0800
+Subject: nilfs2: fix deadlock of segment constructor over I_SYNC flag
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream.
+
+Nilfs2 eventually hangs in a stress test with fsstress program. This
+issue was caused by the following deadlock over I_SYNC flag between
+nilfs_segctor_thread() and writeback_sb_inodes():
+
+ nilfs_segctor_thread()
+ nilfs_segctor_thread_construct()
+ nilfs_segctor_unlock()
+ nilfs_dispose_list()
+ iput()
+ iput_final()
+ evict()
+ inode_wait_for_writeback() * wait for I_SYNC flag
+
+ writeback_sb_inodes()
+ * set I_SYNC flag on inode->i_state
+ __writeback_single_inode()
+ do_writepages()
+ nilfs_writepages()
+ nilfs_construct_dsync_segment()
+ nilfs_segctor_sync()
+ * wait for completion of segment constructor
+ inode_sync_complete()
+ * clear I_SYNC flag after __writeback_single_inode() completed
+
+writeback_sb_inodes() calls do_writepages() for dirty inodes after
+setting I_SYNC flag on inode->i_state. do_writepages() in turn calls
+nilfs_writepages(), which can run segment constructor and wait for its
+completion. On the other hand, segment constructor calls iput(), which
+can call evict() and wait for the I_SYNC flag on
+inode_wait_for_writeback().
+
+Since segment constructor doesn't know when I_SYNC will be set, it
+cannot know whether iput() will block or not unless inode->i_nlink has a
+non-zero count. We can prevent evict() from being called in iput() by
+implementing sop->drop_inode(), but it's not preferable to leave inodes
+with i_nlink == 0 for long periods because it even defers file
+truncation and inode deallocation. So, this instead resolves the
+deadlock by calling iput() asynchronously with a workqueue for inodes
+with i_nlink == 0.
+
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/nilfs.h | 2 --
+ fs/nilfs2/segment.c | 44 +++++++++++++++++++++++++++++++++++++++-----
+ fs/nilfs2/segment.h | 5 +++++
+ 3 files changed, 44 insertions(+), 7 deletions(-)
+
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -141,7 +141,6 @@ enum {
+ * @ti_save: Backup of journal_info field of task_struct
+ * @ti_flags: Flags
+ * @ti_count: Nest level
+- * @ti_garbage: List of inode to be put when releasing semaphore
+ */
+ struct nilfs_transaction_info {
+ u32 ti_magic;
+@@ -150,7 +149,6 @@ struct nilfs_transaction_info {
+ one of other filesystems has a bug. */
+ unsigned short ti_flags;
+ unsigned short ti_count;
+- struct list_head ti_garbage;
+ };
+
+ /* ti_magic */
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struc
+ ti->ti_count = 0;
+ ti->ti_save = cur_ti;
+ ti->ti_magic = NILFS_TI_MAGIC;
+- INIT_LIST_HEAD(&ti->ti_garbage);
+ current->journal_info = ti;
+
+ for (;;) {
+@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(str
+
+ up_write(&nilfs->ns_segctor_sem);
+ current->journal_info = ti->ti_save;
+- if (!list_empty(&ti->ti_garbage))
+- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
+ }
+
+ static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
+@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct th
+ }
+ }
+
++static void nilfs_iput_work_func(struct work_struct *work)
++{
++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
++ sc_iput_work);
++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
++
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
++}
++
+ static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
+ struct nilfs_root *root)
+ {
+@@ -1900,8 +1906,8 @@ static int nilfs_segctor_collect_dirty_f
+ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ struct the_nilfs *nilfs)
+ {
+- struct nilfs_transaction_info *ti = current->journal_info;
+ struct nilfs_inode_info *ii, *n;
++ int defer_iput = false;
+
+ spin_lock(&nilfs->ns_inode_lock);
+ list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
+@@ -1912,9 +1918,24 @@ static void nilfs_segctor_drop_written_f
+ clear_bit(NILFS_I_BUSY, &ii->i_state);
+ brelse(ii->i_bh);
+ ii->i_bh = NULL;
+- list_move_tail(&ii->i_dirty, &ti->ti_garbage);
++ list_del_init(&ii->i_dirty);
++ if (!ii->vfs_inode.i_nlink) {
++ /*
++ * Defer calling iput() to avoid a deadlock
++ * over I_SYNC flag for inodes with i_nlink == 0
++ */
++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
++ defer_iput = true;
++ } else {
++ spin_unlock(&nilfs->ns_inode_lock);
++ iput(&ii->vfs_inode);
++ spin_lock(&nilfs->ns_inode_lock);
++ }
+ }
+ spin_unlock(&nilfs->ns_inode_lock);
++
++ if (defer_iput)
++ schedule_work(&sci->sc_iput_work);
+ }
+
+ /*
+@@ -2583,6 +2604,8 @@ static struct nilfs_sc_info *nilfs_segct
+ INIT_LIST_HEAD(&sci->sc_segbufs);
+ INIT_LIST_HEAD(&sci->sc_write_logs);
+ INIT_LIST_HEAD(&sci->sc_gc_inodes);
++ INIT_LIST_HEAD(&sci->sc_iput_queue);
++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
+ init_timer(&sci->sc_timer);
+
+ sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
+@@ -2609,6 +2632,8 @@ static void nilfs_segctor_write_out(stru
+ ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
+ nilfs_transaction_unlock(sci->sc_super);
+
++ flush_work(&sci->sc_iput_work);
++
+ } while (ret && retrycount-- > 0);
+ }
+
+@@ -2633,6 +2658,9 @@ static void nilfs_segctor_destroy(struct
+ || sci->sc_seq_request != sci->sc_seq_done);
+ spin_unlock(&sci->sc_state_lock);
+
++ if (flush_work(&sci->sc_iput_work))
++ flag = true;
++
+ if (flag || !nilfs_segctor_confirm(sci))
+ nilfs_segctor_write_out(sci);
+
+@@ -2642,6 +2670,12 @@ static void nilfs_segctor_destroy(struct
+ nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
+ }
+
++ if (!list_empty(&sci->sc_iput_queue)) {
++ nilfs_warning(sci->sc_super, __func__,
++ "iput queue is not empty\n");
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
++ }
++
+ WARN_ON(!list_empty(&sci->sc_segbufs));
+ WARN_ON(!list_empty(&sci->sc_write_logs));
+
+--- a/fs/nilfs2/segment.h
++++ b/fs/nilfs2/segment.h
+@@ -26,6 +26,7 @@
+ #include <linux/types.h>
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/workqueue.h>
+ #include <linux/nilfs2_fs.h>
+ #include "nilfs.h"
+
+@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer {
+ * @sc_nblk_inc: Block count of current generation
+ * @sc_dirty_files: List of files to be written
+ * @sc_gc_inodes: List of GC inodes having blocks to be written
++ * @sc_iput_queue: list of inodes for which iput should be done
++ * @sc_iput_work: work struct to defer iput call
+ * @sc_freesegs: array of segment numbers to be freed
+ * @sc_nfreesegs: number of segments on @sc_freesegs
+ * @sc_dsync_inode: inode whose data pages are written for a sync operation
+@@ -135,6 +138,8 @@ struct nilfs_sc_info {
+
+ struct list_head sc_dirty_files;
+ struct list_head sc_gc_inodes;
++ struct list_head sc_iput_queue;
++ struct work_struct sc_iput_work;
+
+ __u64 *sc_freesegs;
+ size_t sc_nfreesegs;
--- /dev/null
+From 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 Mon Sep 17 00:00:00 2001
+From: Charlotte Richardson <charlotte.richardson@stratus.com>
+Date: Mon, 2 Feb 2015 09:36:23 -0600
+Subject: PCI: Add NEC variants to Stratus ftServer PCIe DMI check
+
+From: Charlotte Richardson <charlotte.richardson@stratus.com>
+
+commit 51ac3d2f0c505ca36ffc9715ffd518d756589ef8 upstream.
+
+NEC OEMs the same platforms as Stratus does, which have multiple devices on
+some PCIe buses under downstream ports.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=51331
+Fixes: 1278998f8ff6 ("PCI: Work around Stratus ftServer broken PCIe hierarchy (fix DMI check)")
+Signed-off-by: Charlotte Richardson <charlotte.richardson@stratus.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Myron Stowe <myron.stowe@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/pci/common.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -448,6 +448,22 @@ static const struct dmi_system_id pcipro
+ DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"),
+ },
+ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"),
++ },
++ },
++ {
++ .callback = set_scan_all,
++ .ident = "Stratus/NEC ftServer",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+From 19c5392eb1c1e81188e898400c0e8258827eb160 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Tue, 27 Jan 2015 10:24:53 -0600
+Subject: PCI: designware: Reject MSI-X IRQs
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 19c5392eb1c1e81188e898400c0e8258827eb160 upstream.
+
+The DesignWare PCIe MSI hardware does not support MSI-X IRQs. Setting
+those up failed as a side effect of a bug which was fixed by 91f8ae823f2b
+("PCI: designware: Setup and clear exactly one MSI at a time").
+
+Now that this bug is fixed, MSI-X IRQs need to be rejected explicitly;
+otherwise devices trying to use them may end up with incorrectly working
+interrupts.
+
+Fixes: 91f8ae823f2b ("PCI: designware: Setup and clear exactly one MSI at a time")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Jingoo Han <jg1.han@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-designware.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -283,6 +283,9 @@ static int dw_msi_setup_irq(struct msi_c
+ struct msi_msg msg;
+ struct pcie_port *pp = sys_to_pcie(pdev->bus->sysdata);
+
++ if (desc->msi_attrib.is_msix)
++ return -EINVAL;
++
+ irq = assign_irq(1, desc, &pos);
+ if (irq < 0)
+ return irq;
--- /dev/null
+From 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb Mon Sep 17 00:00:00 2001
+From: Myron Stowe <myron.stowe@redhat.com>
+Date: Tue, 3 Feb 2015 16:01:24 -0700
+Subject: PCI: Handle read-only BARs on AMD CS553x devices
+
+From: Myron Stowe <myron.stowe@redhat.com>
+
+commit 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb upstream.
+
+Some AMD CS553x devices have read-only BARs because of a firmware or
+hardware defect. There's a workaround in quirk_cs5536_vsa(), but it no
+longer works after 36e8164882ca ("PCI: Restore detection of read-only
+BARs"). Prior to 36e8164882ca, we filled in res->start; afterwards we
+leave it zeroed out. The quirk only updated the size, so the driver tried
+to use a region starting at zero, which didn't work.
+
+Expand quirk_cs5536_vsa() to read the base addresses from the BARs and
+hard-code the sizes.
+
+On Nix's system BAR 2's read-only value is 0x6200. Prior to 36e8164882ca,
+we interpret that as a 512-byte BAR based on the lowest-order bit set. Per
+datasheet sec 5.6.1, that BAR (MFGPT) requires only 64 bytes; use that to
+avoid clearing any address bits if a platform uses only 64-byte alignment.
+
+[bhelgaas: changelog, reduce BAR 2 size to 64]
+Fixes: 36e8164882ca ("PCI: Restore detection of read-only BARs")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=85991#c4
+Link: http://support.amd.com/TechDocs/31506_cs5535_databook.pdf
+Link: http://support.amd.com/TechDocs/33238G_cs5536_db.pdf
+Reported-and-tested-by: Nix <nix@esperi.org.uk>
+Signed-off-by: Myron Stowe <myron.stowe@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -324,18 +324,52 @@ static void quirk_s3_64M(struct pci_dev
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M);
+
++static void quirk_io(struct pci_dev *dev, int pos, unsigned size,
++ const char *name)
++{
++ u32 region;
++ struct pci_bus_region bus_region;
++ struct resource *res = dev->resource + pos;
++
++ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion);
++
++ if (!region)
++ return;
++
++ res->name = pci_name(dev);
++ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK;
++ res->flags |=
++ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN);
++ region &= ~(size - 1);
++
++ /* Convert from PCI bus to resource space */
++ bus_region.start = region;
++ bus_region.end = region + size - 1;
++ pcibios_bus_to_resource(dev->bus, res, &bus_region);
++
++ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n",
++ name, PCI_BASE_ADDRESS_0 + (pos << 2), res);
++}
++
+ /*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33 20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
++ *
++ * CS553x's ISA PCI BARs may also be read-only (ref:
++ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward).
+ */
+ static void quirk_cs5536_vsa(struct pci_dev *dev)
+ {
++ static char *name = "CS5536 ISA bridge";
++
+ if (pci_resource_len(dev, 0) != 8) {
+- struct resource *res = &dev->resource[0];
+- res->end = res->start + 8 - 1;
+- dev_info(&dev->dev, "CS5536 ISA bridge bug detected (incorrect header); workaround applied\n");
++ quirk_io(dev, 0, 8, name); /* SMB */
++ quirk_io(dev, 1, 256, name); /* GPIO */
++ quirk_io(dev, 2, 64, name); /* MFGPT */
++ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n",
++ name);
+ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
--- /dev/null
+From 3a9794d32984b67a6d8992226918618f0e51e5d5 Mon Sep 17 00:00:00 2001
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Thu, 29 Jan 2015 15:54:40 -0600
+Subject: sd: Fix max transfer length for 4k disks
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 3a9794d32984b67a6d8992226918618f0e51e5d5 upstream.
+
+The following patch fixes an issue observed with 4k sector disks
+where the max_hw_sectors attribute was getting set too large in
+sd_revalidate_disk. Since sdkp->max_xfer_blocks is in units
+of SCSI logical blocks and queue_max_hw_sectors is in units of
+512 byte blocks, on a 4k sector disk, every time we went through
+sd_revalidate_disk, we were taking the current value of
+queue_max_hw_sectors and increasing it by a factor of 8. Fix
+this by only shifting sdkp->max_xfer_blocks.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2818,9 +2818,11 @@ static int sd_revalidate_disk(struct gen
+ */
+ sd_set_flush_flag(sdkp);
+
+- max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+- sdkp->max_xfer_blocks);
++ max_xfer = sdkp->max_xfer_blocks;
+ max_xfer <<= ilog2(sdp->sector_size) - 9;
++
++ max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
++ max_xfer);
+ blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
+ set_capacity(disk, sdkp->capacity);
+ sd_config_write_same(sdkp);
--- /dev/null
+From a02bb401f8ae264be782ee57d98bdd99f14c8022 Mon Sep 17 00:00:00 2001
+From: Robin Gong <b38343@freescale.com>
+Date: Tue, 3 Feb 2015 10:25:53 +0800
+Subject: spi: imx: use pio mode for i.mx6dl
+
+From: Robin Gong <b38343@freescale.com>
+
+commit a02bb401f8ae264be782ee57d98bdd99f14c8022 upstream.
+
+For TKT238285 hardware issue which may cause txfifo store data twice can only
+be caught on i.mx6dl, we use pio mode instead of DMA mode on i.mx6dl.
+
+Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support)
+Signed-off-by: Robin Gong <b38343@freescale.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-imx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -823,6 +823,10 @@ static int spi_imx_sdma_init(struct devi
+ struct dma_slave_config slave_config = {};
+ int ret;
+
++ /* use pio mode for i.mx6dl chip TKT238285 */
++ if (of_machine_is_compatible("fsl,imx6dl"))
++ return 0;
++
+ /* Prepare for TX DMA: */
+ master->dma_tx = dma_request_slave_channel(dev, "tx");
+ if (!master->dma_tx) {
--- /dev/null
+From 973fbce69ed8e79b5fe3ad19cfecb581a7ef8048 Mon Sep 17 00:00:00 2001
+From: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+Date: Tue, 27 Jan 2015 16:27:20 +0530
+Subject: spi: spi-fsl-dspi: Remove usage of devm_kzalloc
+
+From: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+
+commit 973fbce69ed8e79b5fe3ad19cfecb581a7ef8048 upstream.
+
+devm_* API was supposed to be used only in probe function call.
+Memory is allocated at 'probe' and free automatically at 'remove'.
+Usage of devm_* functions outside probe sometimes leads to memory leak.
+Avoid using devm_kzalloc in dspi_setup_transfer and use kzalloc instead.
+Also add the dspi_cleanup function to free the controller data upon
+cleanup.
+
+Acked-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-dspi.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -342,8 +342,7 @@ static int dspi_setup_transfer(struct sp
+ /* Only alloc on first setup */
+ chip = spi_get_ctldata(spi);
+ if (chip == NULL) {
+- chip = devm_kzalloc(&spi->dev, sizeof(struct chip_data),
+- GFP_KERNEL);
++ chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+ }
+@@ -382,6 +381,16 @@ static int dspi_setup(struct spi_device
+ return dspi_setup_transfer(spi, NULL);
+ }
+
++static void dspi_cleanup(struct spi_device *spi)
++{
++ struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
++
++ dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n",
++ spi->master->bus_num, spi->chip_select);
++
++ kfree(chip);
++}
++
+ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
+ {
+ struct fsl_dspi *dspi = (struct fsl_dspi *)dev_id;
+@@ -467,6 +476,7 @@ static int dspi_probe(struct platform_de
+ dspi->bitbang.master->setup = dspi_setup;
+ dspi->bitbang.master->dev.of_node = pdev->dev.of_node;
+
++ master->cleanup = dspi_cleanup;
+ master->mode_bits = SPI_CPOL | SPI_CPHA;
+ master->bits_per_word_mask = SPI_BPW_MASK(4) | SPI_BPW_MASK(8) |
+ SPI_BPW_MASK(16);
projects / thirdparty / kernel / stable-queue.git / commitdiff
