--- /dev/null
+From 4c533c801d1c9b5c38458a0e7516e0cf50643782 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Sat, 18 Apr 2015 01:25:46 +0200
+Subject: ACPI / scan: Annotate physical_node_lock in acpi_scan_is_offline()
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit 4c533c801d1c9b5c38458a0e7516e0cf50643782 upstream.
+
+acpi_scan_is_offline() may be called under the physical_node_lock
+lock of the given device object's parent, so prevent lockdep from
+complaining about that by annotating that instance with
+SINGLE_DEPTH_NESTING.
+
+Fixes: caa73ea158de (ACPI / hotplug / driver core: Handle containers in a special way)
+Reported-and-tested-by: Xie XiuQi <xiexiuqi@huawei.com>
+Reviewed-by: Toshi Kani <toshi.kani@hp.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/scan.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -192,7 +192,11 @@ bool acpi_scan_is_offline(struct acpi_de
+ struct acpi_device_physical_node *pn;
+ bool offline = true;
+
+- mutex_lock(&adev->physical_node_lock);
++ /*
++ * acpi_container_offline() calls this for all of the container's
++ * children under the container's physical_node_lock lock.
++ */
++ mutex_lock_nested(&adev->physical_node_lock, SINGLE_DEPTH_NESTING);
+
+ list_for_each_entry(pn, &adev->physical_node_list, node)
+ if (device_supports_offline(pn->dev) && !pn->dev->offline) {
--- /dev/null
+From 2b8760100e1de69b6ff004c986328a82947db4ad Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Mon, 13 Apr 2015 11:48:58 +0800
+Subject: ACPICA: Utilities: split IO address types from data type models.
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 2b8760100e1de69b6ff004c986328a82947db4ad upstream.
+
+ACPICA commit aacf863cfffd46338e268b7415f7435cae93b451
+
+It is reported that on a physically 64-bit addressed machine, 32-bit kernel
+can trigger crashes in accessing the memory regions that are beyond the
+32-bit boundary. The region field's start address should still be 32-bit
+compliant, but after a calculation (adding some offsets), it may exceed the
+32-bit boundary. This case is rare and buggy, but there are real BIOSes
+leaked with such issues (see References below).
+
+This patch fixes this gap by always defining IO addresses as 64-bit, and
+allows OSPMs to optimize it for a real 32-bit machine to reduce the size of
+the internal objects.
+
+Internal acpi_physical_address usages in the structures that can be fixed
+by this change include:
+ 1. struct acpi_object_region:
+ acpi_physical_address address;
+ 2. struct acpi_address_range:
+ acpi_physical_address start_address;
+ acpi_physical_address end_address;
+ 3. struct acpi_mem_space_context;
+ acpi_physical_address address;
+ 4. struct acpi_table_desc
+ acpi_physical_address address;
+See known issues 1 for other usages.
+
+Note that acpi_io_address which is used for ACPI_PROCESSOR may also suffer
+from same problem, so this patch changes it accordingly.
+
+For iasl, it will enforce acpi_physical_address as 32-bit to generate
+32-bit OSPM compatible tables on 32-bit platforms, we need to define
+ACPI_32BIT_PHYSICAL_ADDRESS for it in acenv.h.
+
+Known issues:
+ 1. Cleanup of mapped virtual address
+ In struct acpi_mem_space_context, acpi_physical_address is used as a virtual
+ address:
+ acpi_physical_address mapped_physical_address;
+ It is better to introduce acpi_virtual_address or use acpi_size instead.
+ This patch doesn't make such a change. Because this should be done along
+ with a change to acpi_os_map_memory()/acpi_os_unmap_memory().
+ There should be no functional problem to leave this unchanged except
+ that only this structure is enlarged unexpectedly.
+
+Link: https://github.com/acpica/acpica/commit/aacf863c
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=87971
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=79501
+Reported-and-tested-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Reported-and-tested-by: Sial Nije <sialnije@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/acpi/actypes.h | 20 ++++++++++++++++++++
+ include/acpi/platform/acenv.h | 1 +
+ 2 files changed, 21 insertions(+)
+
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+
++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX ACPI_UINT32_MAX
+
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -76,6 +76,7 @@
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
+ #define ACPI_SINGLE_THREADED
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+
+ /* acpi_exec configuration. Multithreaded with full AML debugger */
--- /dev/null
+From a57069e33fbc6625f39e1b09c88ea44629a35206 Mon Sep 17 00:00:00 2001
+From: Manish Badarkhe <manishvb@ti.com>
+Date: Thu, 26 Mar 2015 15:38:25 +0200
+Subject: ASoC: davinci-evm: drop un-necessary remove function
+
+From: Manish Badarkhe <manishvb@ti.com>
+
+commit a57069e33fbc6625f39e1b09c88ea44629a35206 upstream.
+
+As davinci card gets registered using 'devm_' api
+there is no need to unregister the card in 'remove'
+function.
+Hence drop the 'remove' function.
+
+Fixes: ee2f615d6e59c (ASoC: davinci-evm: Add device tree binding)
+Signed-off-by: Manish Badarkhe <manishvb@ti.com>
+Signed-off-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/davinci/davinci-evm.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/sound/soc/davinci/davinci-evm.c
++++ b/sound/soc/davinci/davinci-evm.c
+@@ -384,18 +384,8 @@ static int davinci_evm_probe(struct plat
+ return ret;
+ }
+
+-static int davinci_evm_remove(struct platform_device *pdev)
+-{
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+-
+- snd_soc_unregister_card(card);
+-
+- return 0;
+-}
+-
+ static struct platform_driver davinci_evm_driver = {
+ .probe = davinci_evm_probe,
+- .remove = davinci_evm_remove,
+ .driver = {
+ .name = "davinci_evm",
+ .owner = THIS_MODULE,
--- /dev/null
+From 2eeff0b4317a02f0e281df891d990194f0737aae Mon Sep 17 00:00:00 2001
+From: Alexander Ploumistos <alex.ploumistos@gmail.com>
+Date: Fri, 13 Feb 2015 21:05:11 +0200
+Subject: Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card
+
+From: Alexander Ploumistos <alex.ploumistos@gmail.com>
+
+commit 2eeff0b4317a02f0e281df891d990194f0737aae upstream.
+
+Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so
+that the device can load the ath3k firmware and re-enumerate itself as an
+AR3011 device.
+
+T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=04f2 ProdID=aff1 Rev= 0.01
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Alexander Ploumistos <alexpl@fedoraproject.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/ath3k.c | 1 +
+ drivers/bluetooth/btusb.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -64,6 +64,7 @@ static const struct usb_device_id ath3k_
+ /* Atheros AR3011 with sflash firmware*/
+ { USB_DEVICE(0x0489, 0xE027) },
+ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x04F2, 0xAFF1) },
+ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -142,6 +142,7 @@ static const struct usb_device_id blackl
+ /* Atheros 3011 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
--- /dev/null
+From 0b21503dbbfa669dbd847b33578d4041513cddb2 Mon Sep 17 00:00:00 2001
+From: Archit Taneja <architt@codeaurora.org>
+Date: Wed, 4 Mar 2015 15:19:35 +0530
+Subject: clk: qcom: fix RCG M/N counter configuration
+
+From: Archit Taneja <architt@codeaurora.org>
+
+commit 0b21503dbbfa669dbd847b33578d4041513cddb2 upstream.
+
+Currently, a RCG's M/N counter (used for fraction division) is
+set to either 'bypass' (counter disabled) or 'dual edge' (counter
+enabled) based on whether the corresponding rcg struct has a mnd
+field specified and a non-zero N.
+
+In the case where M and N are the same value, the M/N counter is
+still enabled by code even though no division takes place.
+Leaving the RCG in such a state can result in improper behavior.
+This was observed with the DSI pixel clock RCG when M and N were
+both set to 1.
+
+Add an additional check (M != N) to enable the M/N counter only
+when it's needed for fraction division.
+
+Signed-off-by: Archit Taneja <architt@codeaurora.org>
+Fixes: bcd61c0f535a (clk: qcom: Add support for root clock
+generators (RCGs))
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/clk-rcg2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -257,7 +257,7 @@ static int __clk_rcg2_set_rate(struct cl
+ mask |= CFG_SRC_SEL_MASK | CFG_MODE_MASK;
+ cfg = f->pre_div << CFG_SRC_DIV_SHIFT;
+ cfg |= rcg->parent_map[f->src] << CFG_SRC_SEL_SHIFT;
+- if (rcg->mnd_width && f->n)
++ if (rcg->mnd_width && f->n && (f->m != f->n))
+ cfg |= CFG_MODE_DUAL_EDGE;
+ ret = regmap_update_bits(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG, mask,
+ cfg);
--- /dev/null
+From 5e43e259171e1eee8bc074d9c44be434e685087b Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Mon, 23 Mar 2015 10:57:46 +0100
+Subject: clk: tegra: Register the proper number of resets
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit 5e43e259171e1eee8bc074d9c44be434e685087b upstream.
+
+The number of resets controls is 32 times the number of peripheral
+register banks rather than 32 times the number of clocks. This reduces
+(drastically) the number of reset controls registered from 10080 (315
+clocks * 32) to 224 (6 peripheral register banks * 32).
+
+This also fixes a potential crash because trying to use any of the
+excess reset controls (224-10079) would have caused accesses beyond
+the array bounds of the peripheral register banks definition array.
+
+Cc: Peter De Schrijver <pdeschrijver@nvidia.com>
+Cc: Prashant Gaikwad <pgaikwad@nvidia.com>
+Fixes: 6d5b988e7dc5 ("clk: tegra: implement a reset driver")
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/tegra/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/tegra/clk.c
++++ b/drivers/clk/tegra/clk.c
+@@ -266,7 +266,7 @@ void __init tegra_add_of_provider(struct
+ of_clk_add_provider(np, of_clk_src_onecell_get, &clk_data);
+
+ rst_ctlr.of_node = np;
+- rst_ctlr.nr_resets = clk_num * 32;
++ rst_ctlr.nr_resets = periph_banks * 32;
+ reset_controller_register(&rst_ctlr);
+ }
+
--- /dev/null
+From 0618764cb25f6fa9fb31152995de42a8a0496475 Mon Sep 17 00:00:00 2001
+From: Ben Collins <ben.c@servergy.com>
+Date: Fri, 3 Apr 2015 16:09:46 +0000
+Subject: dm crypt: fix deadlock when async crypto algorithm returns -EBUSY
+
+From: Ben Collins <ben.c@servergy.com>
+
+commit 0618764cb25f6fa9fb31152995de42a8a0496475 upstream.
+
+I suspect this doesn't show up for most anyone because software
+algorithms typically don't have a sense of being too busy. However,
+when working with the Freescale CAAM driver it will return -EBUSY on
+occasion under heavy -- which resulted in dm-crypt deadlock.
+
+After checking the logic in some other drivers, the scheme for
+crypt_convert() and it's callback, kcryptd_async_done(), were not
+correctly laid out to properly handle -EBUSY or -EINPROGRESS.
+
+Fix this by using the completion for both -EBUSY and -EINPROGRESS. Now
+crypt_convert()'s use of completion is comparable to
+af_alg_wait_for_completion(). Similarly, kcryptd_async_done() follows
+the pattern used in af_alg_complete().
+
+Before this fix dm-crypt would lockup within 1-2 minutes running with
+the CAAM driver. Fix was regression tested against software algorithms
+on PPC32 and x86_64, and things seem perfectly happy there as well.
+
+Signed-off-by: Ben Collins <ben.c@servergy.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -915,11 +915,10 @@ static int crypt_convert(struct crypt_co
+
+ switch (r) {
+ /* async */
++ case -EINPROGRESS:
+ case -EBUSY:
+ wait_for_completion(&ctx->restart);
+ reinit_completion(&ctx->restart);
+- /* fall through*/
+- case -EINPROGRESS:
+ ctx->req = NULL;
+ ctx->cc_sector++;
+ continue;
+@@ -1314,10 +1313,8 @@ static void kcryptd_async_done(struct cr
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->cc;
+
+- if (error == -EINPROGRESS) {
+- complete(&ctx->restart);
++ if (error == -EINPROGRESS)
+ return;
+- }
+
+ if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
+ error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
+@@ -1328,12 +1325,15 @@ static void kcryptd_async_done(struct cr
+ mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);
+
+ if (!atomic_dec_and_test(&ctx->cc_pending))
+- return;
++ goto done;
+
+ if (bio_data_dir(io->base_bio) == READ)
+ kcryptd_crypt_read_done(io);
+ else
+ kcryptd_crypt_write_io_submit(io, 1);
++done:
++ if (!completion_done(&ctx->restart))
++ complete(&ctx->restart);
+ }
+
+ static void kcryptd_crypt(struct work_struct *work)
--- /dev/null
+From 23600969ff137cf4c3bc9098f77e381de334e3f7 Mon Sep 17 00:00:00 2001
+From: Alexandre Courbot <acourbot@nvidia.com>
+Date: Tue, 11 Mar 2014 15:52:09 +0900
+Subject: gpio: clamp returned values to the boolean range
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+commit 23600969ff137cf4c3bc9098f77e381de334e3f7 upstream.
+
+Nothing prevents GPIO drivers from returning values outside the
+boolean range, and as it turns out a few drivers are actually doing so.
+These values were passed as-is to unsuspecting consumers and created
+confusion.
+
+This patch makes the internal _gpiod_get_raw_value() function return a
+bool, effectively clamping the GPIO value to the boolean range no
+matter what the driver does.
+
+While we are at it, we also change the value parameter of
+_gpiod_set_raw_value() to bool type before drivers start doing funny
+things with it as well.
+
+Another way to fix this would be to change the prototypes of the driver
+interface to use bool directly, but this would require a huge
+cross-systems patch so this simpler solution is preferred.
+
+Changes since v1:
+- Change local variable type to bool as well, use boolean values in
+ code
+- Also change prototype of open drain/open source setting functions
+ since they are only called from _gpiod_set_raw_value()
+
+This probably calls for a larger booleanization of gpiolib, but let's
+keep that for a latter change - right now we need to address the issue
+of non-boolean values returned by drivers.
+
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1928,15 +1928,15 @@ EXPORT_SYMBOL_GPL(gpiod_is_active_low);
+ * that the GPIO was actually requested.
+ */
+
+-static int _gpiod_get_raw_value(const struct gpio_desc *desc)
++static bool _gpiod_get_raw_value(const struct gpio_desc *desc)
+ {
+ struct gpio_chip *chip;
+- int value;
++ bool value;
+ int offset;
+
+ chip = desc->chip;
+ offset = gpio_chip_hwgpio(desc);
+- value = chip->get ? chip->get(chip, offset) : 0;
++ value = chip->get ? chip->get(chip, offset) : false;
+ trace_gpio_value(desc_to_gpio(desc), 1, value);
+ return value;
+ }
+@@ -1992,7 +1992,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_value);
+ * @desc: gpio descriptor whose state need to be set.
+ * @value: Non-zero for setting it HIGH otherise it will set to LOW.
+ */
+-static void _gpio_set_open_drain_value(struct gpio_desc *desc, int value)
++static void _gpio_set_open_drain_value(struct gpio_desc *desc, bool value)
+ {
+ int err = 0;
+ struct gpio_chip *chip = desc->chip;
+@@ -2019,7 +2019,7 @@ static void _gpio_set_open_drain_value(s
+ * @desc: gpio descriptor whose state need to be set.
+ * @value: Non-zero for setting it HIGH otherise it will set to LOW.
+ */
+-static void _gpio_set_open_source_value(struct gpio_desc *desc, int value)
++static void _gpio_set_open_source_value(struct gpio_desc *desc, bool value)
+ {
+ int err = 0;
+ struct gpio_chip *chip = desc->chip;
+@@ -2041,7 +2041,7 @@ static void _gpio_set_open_source_value(
+ __func__, err);
+ }
+
+-static void _gpiod_set_raw_value(struct gpio_desc *desc, int value)
++static void _gpiod_set_raw_value(struct gpio_desc *desc, bool value)
+ {
+ struct gpio_chip *chip;
+
--- /dev/null
+From 61819549f572edd7fce53f228c0d8420cdc85f71 Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Thu, 2 Apr 2015 17:11:11 +0200
+Subject: gpio: mvebu: Fix mask/unmask managment per irq chip type
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit 61819549f572edd7fce53f228c0d8420cdc85f71 upstream.
+
+Level IRQ handlers and edge IRQ handler are managed by tow different
+sets of registers. But currently the driver uses the same mask for the
+both registers. It lead to issues with the following scenario:
+
+First, an IRQ is requested on a GPIO to be triggered on front. After,
+this an other IRQ is requested for a GPIO of the same bank but
+triggered on level. Then the first one will be also setup to be
+triggered on level. It leads to an interrupt storm.
+
+The different kind of handler are already associated with two
+different irq chip type. With this patch the driver uses a private
+mask for each one which solves this issue.
+
+It has been tested on an Armada XP based board and on an Armada 375
+board. For the both boards, with this patch is applied, there is no
+such interrupt storm when running the previous scenario.
+
+This bug was already fixed but in a different way in the legacy
+version of this driver by Evgeniy Dushistov:
+9ece8839b1277fb9128ff6833411614ab6c88d68 "ARM: orion: Fix for certain
+sequence of request_irq can cause irq storm". The fact the new version
+of the gpio drive could be affected had been discussed there:
+http://thread.gmane.org/gmane.linux.ports.arm.kernel/344670/focus=364012
+
+Reported-by: Evgeniy A. Dushistov <dushistov@mail.ru>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-mvebu.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -304,11 +304,13 @@ static void mvebu_gpio_edge_irq_mask(str
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache &= ~mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip));
++ ct->mask_cache_priv &= ~mask;
++
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -316,11 +318,13 @@ static void mvebu_gpio_edge_irq_unmask(s
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache |= mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip));
++ ct->mask_cache_priv |= mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -328,11 +332,13 @@ static void mvebu_gpio_level_irq_mask(st
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache &= ~mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip));
++ ct->mask_cache_priv &= ~mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
+@@ -340,11 +346,13 @@ static void mvebu_gpio_level_irq_unmask(
+ {
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct mvebu_gpio_chip *mvchip = gc->private;
++ struct irq_chip_type *ct = irq_data_get_chip_type(d);
++
+ u32 mask = 1 << (d->irq - gc->irq_base);
+
+ irq_gc_lock(gc);
+- gc->mask_cache |= mask;
+- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip));
++ ct->mask_cache_priv |= mask;
++ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip));
+ irq_gc_unlock(gc);
+ }
+
--- /dev/null
+From 7261b956b276aa97fbf60d00f1d7717d2ea6ee78 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Fri, 3 Apr 2015 14:11:54 +1100
+Subject: powerpc/cell: Fix cell iommu after it_page_shift changes
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 7261b956b276aa97fbf60d00f1d7717d2ea6ee78 upstream.
+
+The patch to add it_page_shift incorrectly changed the increment of
+uaddr to use it_page_shift, rather then (1 << it_page_shift).
+
+This broke booting on at least some Cell blades, as the iommu was
+basically non-functional.
+
+Fixes: 3a553170d35d ("powerpc/iommu: Add it_page_shift field to determine iommu page size")
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/cell/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/cell/iommu.c
++++ b/arch/powerpc/platforms/cell/iommu.c
+@@ -197,7 +197,7 @@ static int tce_build_cell(struct iommu_t
+
+ io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset);
+
+- for (i = 0; i < npages; i++, uaddr += tbl->it_page_shift)
++ for (i = 0; i < npages; i++, uaddr += (1 << tbl->it_page_shift))
+ io_pte[i] = base_pte | (__pa(uaddr) & CBE_IOPTE_RPN_Mask);
+
+ mb();
--- /dev/null
+From f7e9e358362557c3aa2c1ec47490f29fe880a09e Mon Sep 17 00:00:00 2001
+From: Dave Olson <olson@cumulusnetworks.com>
+Date: Thu, 2 Apr 2015 21:28:45 -0700
+Subject: powerpc: Fix missing L2 cache size in /sys/devices/system/cpu
+
+From: Dave Olson <olson@cumulusnetworks.com>
+
+commit f7e9e358362557c3aa2c1ec47490f29fe880a09e upstream.
+
+This problem appears to have been introduced in 2.6.29 by commit
+93197a36a9c1 "Rewrite sysfs processor cache info code".
+
+This caused lscpu to error out on at least e500v2 devices, eg:
+
+ error: cannot open /sys/devices/system/cpu/cpu0/cache/index2/size: No such file or directory
+
+Some embedded powerpc systems use cache-size in DTS for the unified L2
+cache size, not d-cache-size, so we need to allow for both DTS names.
+Added a new CACHE_TYPE_UNIFIED_D cache_type_info structure to handle
+this.
+
+Fixes: 93197a36a9c1 ("powerpc: Rewrite sysfs processor cache info code")
+Signed-off-by: Dave Olson <olson@cumulusnetworks.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/cacheinfo.c | 44 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
+
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -61,12 +61,22 @@ struct cache_type_info {
+ };
+
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED 0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA 2
++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA 3
+
+ static const struct cache_type_info cache_type_info[] = {
+ {
++ /* Embedded systems that use cache-size, cache-block-size,
++ * etc. for the Unified (typically L2) cache. */
++ .name = "Unified",
++ .size_prop = "cache-size",
++ .line_size_props = { "cache-line-size",
++ "cache-block-size", },
++ .nr_sets_prop = "cache-sets",
++ },
++ {
+ /* PowerPC Processor binding says the [di]-cache-*
+ * must be equal on unified caches, so just use
+ * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_si
+ {
+ struct cache *iter;
+
+- if (cache->type == CACHE_TYPE_UNIFIED)
++ if (cache->type == CACHE_TYPE_UNIFIED ||
++ cache->type == CACHE_TYPE_UNIFIED_D)
+ return cache;
+
+ list_for_each_entry(iter, &cache_list, list)
+@@ -324,16 +335,29 @@ static bool cache_node_is_unified(const
+ return of_get_property(np, "cache-unified", NULL);
+ }
+
+-static struct cache *cache_do_one_devnode_unified(struct device_node *node,
+- int level)
++/*
++ * Unified caches can have two different sets of tags. Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc. Check on initialization for which type we have, and
++ * return the appropriate structure type. Assume it's embedded if it isn't
++ * open firmware. If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+- struct cache *cache;
++ return of_get_property(np,
++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+
++/*
++ */
++static struct cache *cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+
+- cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+- return cache;
++ return new_cache(cache_is_unified_d(node), level, node);
+ }
+
+ static struct cache *cache_do_one_devnode_split(struct device_node *node,
--- /dev/null
+From 9a5cbce421a283e6aea3c4007f141735bf9da8c3 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Tue, 14 Apr 2015 07:51:03 +1000
+Subject: powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 9a5cbce421a283e6aea3c4007f141735bf9da8c3 upstream.
+
+We cap 32bit userspace backtraces to PERF_MAX_STACK_DEPTH
+(currently 127), but we forgot to do the same for 64bit backtraces.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/perf/callchain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/perf/callchain.c
++++ b/arch/powerpc/perf/callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struc
+ sp = regs->gpr[1];
+ perf_callchain_store(entry, next_ip);
+
+- for (;;) {
++ while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ fp = (unsigned long __user *) sp;
+ if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ return;
--- /dev/null
+From 8de580742fee8bc34d116f57a20b22b9a5f08403 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 27 Mar 2015 00:27:18 -0700
+Subject: scsi: storvsc: Fix a bug in copy_from_bounce_buffer()
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream.
+
+We may exit this function without properly freeing up the maapings
+we may have acquired. Fix the bug.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Reviewed-by: Long Li <longli@microsoft.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffe
+ if (bounce_sgl[j].length == PAGE_SIZE) {
+ /* full..move to next entry */
+ sg_kunmap_atomic(bounce_addr);
++ bounce_addr = 0;
+ j++;
++ }
+
+- /* if we need to use another bounce buffer */
+- if (srclen || i != orig_sgl_count - 1)
+- bounce_addr = sg_kmap_atomic(bounce_sgl,j);
++ /* if we need to use another bounce buffer */
++ if (srclen && bounce_addr == 0)
++ bounce_addr = sg_kmap_atomic(bounce_sgl, j);
+
+- } else if (srclen == 0 && i == orig_sgl_count - 1) {
+- /* unmap the last bounce that is < PAGE_SIZE */
+- sg_kunmap_atomic(bounce_addr);
+- }
+ }
+
+ sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
+ }
+
++ if (bounce_addr)
++ sg_kunmap_atomic(bounce_addr);
++
+ local_irq_restore(flags);
+
+ return total_copied;
bfa-replace-large-udelay-with-mdelay.patch
drm-msm-use-componentised-device-support.patch
ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch
+powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch
+tools-lib-traceevent-kbuffer-remove-extra-update-to-data-pointer-in-padding.patch
+tools-power-turbostat-use-curdir-instead-of-pwd-and-add-support-for-o-option-in-makefile.patch
+ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch
+ubi-fix-out-of-bounds-write.patch
+ubi-initialize-leb-number-variable.patch
+ubi-fix-check-for-too-many-bytes.patch
+scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch
+target-fix-compare_and_write-with-sg_to_mem_noalloc-handling.patch
+target-file-fix-bug-when-config_debug_sg-y-and-dif-protection-enabled.patch
+target-file-fix-sg-table-for-prot_buf-initialization.patch
+bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch
+powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch
+powerpc-cell-fix-cell-iommu-after-it_page_shift-changes.patch
+asoc-davinci-evm-drop-un-necessary-remove-function.patch
+acpica-utilities-split-io-address-types-from-data-type-models.patch
+acpi-scan-annotate-physical_node_lock-in-acpi_scan_is_offline.patch
+xtensa-xtfpga-fix-hardware-lockup-caused-by-lcd-driver.patch
+xtensa-provide-__nr_sync_file_range2-instead-of-__nr_sync_file_range.patch
+xtensa-iss-fix-locking-in-tap-network-adapter.patch
+gpio-mvebu-fix-mask-unmask-managment-per-irq-chip-type.patch
+gpio-clamp-returned-values-to-the-boolean-range.patch
+clk-tegra-register-the-proper-number-of-resets.patch
+clk-qcom-fix-rcg-m-n-counter-configuration.patch
+dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch
--- /dev/null
+From 38da0f49e8aa1649af397d53f88e163d0e60c058 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Mon, 13 Apr 2015 23:21:56 +0900
+Subject: target/file: Fix BUG() when CONFIG_DEBUG_SG=y and DIF protection enabled
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit 38da0f49e8aa1649af397d53f88e163d0e60c058 upstream.
+
+When CONFIG_DEBUG_SG=y and DIF protection support enabled, kernel
+BUG()s are triggered due to the following two issues:
+
+1) prot_sg is not initialized by sg_init_table().
+
+When CONFIG_DEBUG_SG=y, scatterlist helpers check sg entry has a
+correct magic value.
+
+2) vmalloc'ed buffer is passed to sg_set_buf().
+
+sg_set_buf() uses virt_to_page() to convert virtual address to struct
+page, but it doesn't work with vmalloc address. vmalloc_to_page()
+should be used instead. As prot_buf isn't usually too large, so
+fix it by allocating prot_buf by kmalloc instead of vmalloc.
+
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_file.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -273,7 +273,7 @@ static int fd_do_prot_rw(struct se_cmd *
+ se_dev->prot_length;
+
+ if (!is_write) {
+- fd_prot->prot_buf = vzalloc(prot_size);
++ fd_prot->prot_buf = kzalloc(prot_size, GFP_KERNEL);
+ if (!fd_prot->prot_buf) {
+ pr_err("Unable to allocate fd_prot->prot_buf\n");
+ return -ENOMEM;
+@@ -285,9 +285,10 @@ static int fd_do_prot_rw(struct se_cmd *
+ fd_prot->prot_sg_nents, GFP_KERNEL);
+ if (!fd_prot->prot_sg) {
+ pr_err("Unable to allocate fd_prot->prot_sg\n");
+- vfree(fd_prot->prot_buf);
++ kfree(fd_prot->prot_buf);
+ return -ENOMEM;
+ }
++ sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);
+ size = prot_size;
+
+ for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) {
+@@ -317,7 +318,7 @@ static int fd_do_prot_rw(struct se_cmd *
+
+ if (is_write || ret < 0) {
+ kfree(fd_prot->prot_sg);
+- vfree(fd_prot->prot_buf);
++ kfree(fd_prot->prot_buf);
+ }
+
+ return ret;
+@@ -652,11 +653,11 @@ fd_execute_rw(struct se_cmd *cmd, struct
+ 0, fd_prot.prot_sg, 0);
+ if (rc) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return rc;
+ }
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ }
+ } else {
+ memset(&fd_prot, 0, sizeof(struct fd_prot));
+@@ -672,7 +673,7 @@ fd_execute_rw(struct se_cmd *cmd, struct
+ 0, fd_prot.prot_sg, 0);
+ if (rc) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return rc;
+ }
+ }
+@@ -703,7 +704,7 @@ fd_execute_rw(struct se_cmd *cmd, struct
+
+ if (ret < 0) {
+ kfree(fd_prot.prot_sg);
+- vfree(fd_prot.prot_buf);
++ kfree(fd_prot.prot_buf);
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+
--- /dev/null
+From c836777830428372074d5129ac513e1472c99791 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Mon, 13 Apr 2015 23:21:57 +0900
+Subject: target/file: Fix SG table for prot_buf initialization
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit c836777830428372074d5129ac513e1472c99791 upstream.
+
+In fd_do_prot_rw(), it allocates prot_buf which is used to copy from
+se_cmd->t_prot_sg by sbc_dif_copy_prot(). The SG table for prot_buf
+is also initialized by allocating 'se_cmd->t_prot_nents' entries of
+scatterlist and setting the data length of each entry to PAGE_SIZE
+at most.
+
+However if se_cmd->t_prot_sg contains a clustered entry (i.e.
+sg->length > PAGE_SIZE), the SG table for prot_buf can't be
+initialized correctly and sbc_dif_copy_prot() can't copy to prot_buf.
+(This actually happened with TCM loopback fabric module)
+
+As prot_buf is allocated by kzalloc() and it's physically contiguous,
+we only need a single scatterlist entry.
+
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_file.c | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -263,11 +263,10 @@ static int fd_do_prot_rw(struct se_cmd *
+ struct se_device *se_dev = cmd->se_dev;
+ struct fd_dev *dev = FD_DEV(se_dev);
+ struct file *prot_fd = dev->fd_prot_file;
+- struct scatterlist *sg;
+ loff_t pos = (cmd->t_task_lba * se_dev->prot_length);
+ unsigned char *buf;
+- u32 prot_size, len, size;
+- int rc, ret = 1, i;
++ u32 prot_size;
++ int rc, ret = 1;
+
+ prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) *
+ se_dev->prot_length;
+@@ -280,24 +279,16 @@ static int fd_do_prot_rw(struct se_cmd *
+ }
+ buf = fd_prot->prot_buf;
+
+- fd_prot->prot_sg_nents = cmd->t_prot_nents;
+- fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist) *
+- fd_prot->prot_sg_nents, GFP_KERNEL);
++ fd_prot->prot_sg_nents = 1;
++ fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist),
++ GFP_KERNEL);
+ if (!fd_prot->prot_sg) {
+ pr_err("Unable to allocate fd_prot->prot_sg\n");
+ kfree(fd_prot->prot_buf);
+ return -ENOMEM;
+ }
+ sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);
+- size = prot_size;
+-
+- for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) {
+-
+- len = min_t(u32, PAGE_SIZE, size);
+- sg_set_buf(sg, buf, len);
+- size -= len;
+- buf += len;
+- }
++ sg_set_buf(fd_prot->prot_sg, buf, prot_size);
+ }
+
+ if (is_write) {
--- /dev/null
+From c8e639852ad720499912acedfd6b072325fd2807 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Tue, 7 Apr 2015 21:53:27 +0000
+Subject: target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit c8e639852ad720499912acedfd6b072325fd2807 upstream.
+
+This patch fixes a bug for COMPARE_AND_WRITE handling with
+fabrics using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC.
+
+It adds the missing allocation for cmd->t_bidi_data_sg within
+transport_generic_new_cmd() that is used by COMPARE_AND_WRITE
+for the initial READ payload, even if the fabric is already
+providing a pre-allocated buffer for cmd->t_data_sg.
+
+Also, fix zero-length COMPARE_AND_WRITE handling within the
+compare_and_write_callback() and target_complete_ok_work()
+to queue the response, skipping the initial READ.
+
+This fixes COMPARE_AND_WRITE emulation with loopback, vhost,
+and xen-backend fabric drivers using SG_TO_MEM_NOALLOC.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_sbc.c | 15 ++++++++-----
+ drivers/target/target_core_transport.c | 37 +++++++++++++++++++++++++++++----
+ include/target/target_core_base.h | 2 -
+ 3 files changed, 44 insertions(+), 10 deletions(-)
+
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -314,7 +314,7 @@ sbc_setup_write_same(struct se_cmd *cmd,
+ return 0;
+ }
+
+-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd)
++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
+ {
+ unsigned char *buf, *addr;
+ struct scatterlist *sg;
+@@ -378,7 +378,7 @@ sbc_execute_rw(struct se_cmd *cmd)
+ cmd->data_direction);
+ }
+
+-static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ {
+ struct se_device *dev = cmd->se_dev;
+
+@@ -401,7 +401,7 @@ static sense_reason_t compare_and_write_
+ return TCM_NO_SENSE;
+ }
+
+-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
+ {
+ struct se_device *dev = cmd->se_dev;
+ struct scatterlist *write_sg = NULL, *sg;
+@@ -416,11 +416,16 @@ static sense_reason_t compare_and_write_
+
+ /*
+ * Handle early failure in transport_generic_request_failure(),
+- * which will not have taken ->caw_mutex yet..
++ * which will not have taken ->caw_sem yet..
+ */
+- if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)
++ if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg))
+ return TCM_NO_SENSE;
+ /*
++ * Handle special case for zero-length COMPARE_AND_WRITE
++ */
++ if (!cmd->data_length)
++ goto out;
++ /*
+ * Immediately exit + release dev->caw_sem if command has already
+ * been failed with a non-zero SCSI status.
+ */
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1600,11 +1600,11 @@ void transport_generic_request_failure(s
+ transport_complete_task_attr(cmd);
+ /*
+ * Handle special case for COMPARE_AND_WRITE failure, where the
+- * callback is expected to drop the per device ->caw_mutex.
++ * callback is expected to drop the per device ->caw_sem.
+ */
+ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+ cmd->transport_complete_callback)
+- cmd->transport_complete_callback(cmd);
++ cmd->transport_complete_callback(cmd, false);
+
+ switch (sense_reason) {
+ case TCM_NON_EXISTENT_LUN:
+@@ -1941,8 +1941,12 @@ static void target_complete_ok_work(stru
+ if (cmd->transport_complete_callback) {
+ sense_reason_t rc;
+
+- rc = cmd->transport_complete_callback(cmd);
++ rc = cmd->transport_complete_callback(cmd, true);
+ if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
++ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
++ !cmd->data_length)
++ goto queue_rsp;
++
+ return;
+ } else if (rc) {
+ ret = transport_send_check_condition_and_sense(cmd,
+@@ -1956,6 +1960,7 @@ static void target_complete_ok_work(stru
+ }
+ }
+
++queue_rsp:
+ switch (cmd->data_direction) {
+ case DMA_FROM_DEVICE:
+ spin_lock(&cmd->se_lun->lun_sep_lock);
+@@ -2044,6 +2049,16 @@ static inline void transport_reset_sgl_o
+ static inline void transport_free_pages(struct se_cmd *cmd)
+ {
+ if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) {
++ /*
++ * Release special case READ buffer payload required for
++ * SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE
++ */
++ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) {
++ transport_free_sgl(cmd->t_bidi_data_sg,
++ cmd->t_bidi_data_nents);
++ cmd->t_bidi_data_sg = NULL;
++ cmd->t_bidi_data_nents = 0;
++ }
+ transport_reset_sgl_orig(cmd);
+ return;
+ }
+@@ -2192,6 +2207,7 @@ sense_reason_t
+ transport_generic_new_cmd(struct se_cmd *cmd)
+ {
+ int ret = 0;
++ bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB);
+
+ /*
+ * Determine is the TCM fabric module has already allocated physical
+@@ -2200,7 +2216,6 @@ transport_generic_new_cmd(struct se_cmd
+ */
+ if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) &&
+ cmd->data_length) {
+- bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB);
+
+ if ((cmd->se_cmd_flags & SCF_BIDI) ||
+ (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE)) {
+@@ -2223,6 +2238,20 @@ transport_generic_new_cmd(struct se_cmd
+ cmd->data_length, zero_flag);
+ if (ret < 0)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
++ } else if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
++ cmd->data_length) {
++ /*
++ * Special case for COMPARE_AND_WRITE with fabrics
++ * using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC.
++ */
++ u32 caw_length = cmd->t_task_nolb *
++ cmd->se_dev->dev_attrib.block_size;
++
++ ret = target_alloc_sgl(&cmd->t_bidi_data_sg,
++ &cmd->t_bidi_data_nents,
++ caw_length, zero_flag);
++ if (ret < 0)
++ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+ /*
+ * If this command is not a write we can execute it right here,
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -513,7 +513,7 @@ struct se_cmd {
+ sense_reason_t (*execute_cmd)(struct se_cmd *);
+ sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *,
+ u32, enum dma_data_direction);
+- sense_reason_t (*transport_complete_callback)(struct se_cmd *);
++ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
+
+ unsigned char *t_task_cdb;
+ unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE];
--- /dev/null
+From c5e691928bf166ac03430e957038b60adba3cf6c Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 24 Mar 2015 09:57:55 -0400
+Subject: tools lib traceevent kbuffer: Remove extra update to data pointer in PADDING
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit c5e691928bf166ac03430e957038b60adba3cf6c upstream.
+
+When a event PADDING is hit (a deleted event that is still in the ring
+buffer), translate_data() sets the length of the padding and also updates
+the data pointer which is passed back to the caller.
+
+This is unneeded because the caller also updates the data pointer with
+the passed back length. translate_data() should not update the pointer,
+only set the length.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lkml.kernel.org/r/20150324135923.461431960@goodmis.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/lib/traceevent/kbuffer-parse.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/tools/lib/traceevent/kbuffer-parse.c
++++ b/tools/lib/traceevent/kbuffer-parse.c
+@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, voi
+ switch (type_len) {
+ case KBUFFER_TYPE_PADDING:
+ *length = read_4(kbuf, data);
+- data += *length;
+ break;
+
+ case KBUFFER_TYPE_TIME_EXTEND:
--- /dev/null
+From f82263c6989c31ae9b94cecddffb29dcbec38710 Mon Sep 17 00:00:00 2001
+From: Thomas D <whissi@whissi.de>
+Date: Mon, 5 Jan 2015 21:37:23 +0100
+Subject: tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile
+
+From: Thomas D <whissi@whissi.de>
+
+commit f82263c6989c31ae9b94cecddffb29dcbec38710 upstream.
+
+Since commit ee0778a30153
+("tools/power: turbostat: make Makefile a bit more capable")
+turbostat's Makefile is using
+
+ [...]
+ BUILD_OUTPUT := $(PWD)
+ [...]
+
+which obviously causes trouble when building "turbostat" with
+
+ make -C /usr/src/linux/tools/power/x86/turbostat ARCH=x86 turbostat
+
+because GNU make does not update nor guarantee that $PWD is set.
+
+This patch changes the Makefile to use $CURDIR instead, which GNU make
+guarantees to set and update (i.e. when using "make -C ...") and also
+adds support for the O= option (see "make help" in your root of your
+kernel source tree for more details).
+
+Link: https://bugs.gentoo.org/show_bug.cgi?id=533918
+Fixes: ee0778a30153 ("tools/power: turbostat: make Makefile a bit more capable")
+Signed-off-by: Thomas D. <whissi@whissi.de>
+Cc: Mark Asselstine <mark.asselstine@windriver.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/power/x86/turbostat/Makefile | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/tools/power/x86/turbostat/Makefile
++++ b/tools/power/x86/turbostat/Makefile
+@@ -1,8 +1,12 @@
+ CC = $(CROSS_COMPILE)gcc
+-BUILD_OUTPUT := $(PWD)
++BUILD_OUTPUT := $(CURDIR)
+ PREFIX := /usr
+ DESTDIR :=
+
++ifeq ("$(origin O)", "command line")
++ BUILD_OUTPUT := $(O)
++endif
++
+ turbostat : turbostat.c
+ CFLAGS += -Wall
+ CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"'
--- /dev/null
+From 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Sat, 28 Feb 2015 02:23:25 -0800
+Subject: UBI: account for bitflips in both the VID header and data
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 upstream.
+
+We are completely discarding the earlier value of 'bitflips', which
+could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the
+bitwise OR of header and data 'bitflip' statuses instead.
+
+Coverity CID #1226856
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/attach.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/ubi/attach.c
++++ b/drivers/mtd/ubi/attach.c
+@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *
+ second_is_newer = !second_is_newer;
+ } else {
+ dbg_bld("PEB %d CRC is OK", pnum);
+- bitflips = !!err;
++ bitflips |= !!err;
+ }
+ mutex_unlock(&ubi->buf_mutex);
+
--- /dev/null
+From 299d0c5b27346a77a0777c993372bf8777d4f2e5 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Sat, 28 Feb 2015 02:23:28 -0800
+Subject: UBI: fix check for "too many bytes"
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream.
+
+The comparison from the previous line seems to have been erroneously
+(partially) copied-and-pasted onto the next. The second line should be
+checking req.bytes, not req.lnum.
+
+Coverity CID #139400
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+[rw: Fixed comparison]
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/cdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -451,7 +451,7 @@ static long vol_cdev_ioctl(struct file *
+ /* Validate the request */
+ err = -EINVAL;
+ if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+- req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++ req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ break;
+
+ err = get_exclusive(desc);
--- /dev/null
+From d74adbdb9abf0d2506a6c4afa534d894f28b763f Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Sat, 28 Feb 2015 02:23:26 -0800
+Subject: UBI: fix out of bounds write
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream.
+
+If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the
+PEB->LEB mapping.
+
+Caught by Coverity, CID #711212.
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/eba.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi,
+ * during re-size.
+ */
+ ubi_move_aeb_to_list(av, aeb, &ai->erase);
+- vol->eba_tbl[aeb->lnum] = aeb->pnum;
++ else
++ vol->eba_tbl[aeb->lnum] = aeb->pnum;
+ }
+ }
+
--- /dev/null
+From f16db8071ce18819fbd705ddcc91c6f392fb61f8 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Sat, 28 Feb 2015 02:23:27 -0800
+Subject: UBI: initialize LEB number variable
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream.
+
+In some of the 'out_not_moved' error paths, lnum may be used
+uninitialized. Don't ignore the warning; let's fix it.
+
+This uninitialized variable doesn't have much visible effect in the end,
+since we just schedule the PEB for erasure, and its LEB number doesn't
+really matter (it just gets printed in debug messages). But let's get it
+straight anyway.
+
+Coverity CID #113449
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/wl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -995,7 +995,7 @@ static int wear_leveling_worker(struct u
+ int cancel)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, uninitialized_var(lnum);
++ int vol_id = -1, lnum = -1;
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+ int anchor = wrk->anchor;
+ #endif
--- /dev/null
+From 24e94454c8cb6a13634f5a2f5a01da53a546a58d Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 3 Apr 2015 09:56:21 +0300
+Subject: xtensa: ISS: fix locking in TAP network adapter
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 24e94454c8cb6a13634f5a2f5a01da53a546a58d upstream.
+
+- don't lock lp->lock in the iss_net_timer for the call of iss_net_poll,
+ it will lock it itself;
+- invert order of lp->lock and opened_lock acquisition in the
+ iss_net_open to make it consistent with iss_net_poll;
+- replace spin_lock with spin_lock_bh when acquiring locks used in
+ iss_net_timer from non-atomic context;
+- replace spin_lock_irqsave with spin_lock_bh in the iss_net_start_xmit
+ as the driver doesn't use lp->lock in the hard IRQ context;
+- replace __SPIN_LOCK_UNLOCKED(lp.lock) with spin_lock_init, otherwise
+ lockdep is unhappy about using non-static key.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/platforms/iss/network.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+--- a/arch/xtensa/platforms/iss/network.c
++++ b/arch/xtensa/platforms/iss/network.c
+@@ -349,8 +349,8 @@ static void iss_net_timer(unsigned long
+ {
+ struct iss_net_private *lp = (struct iss_net_private *)priv;
+
+- spin_lock(&lp->lock);
+ iss_net_poll();
++ spin_lock(&lp->lock);
+ mod_timer(&lp->timer, jiffies + lp->timer_val);
+ spin_unlock(&lp->lock);
+ }
+@@ -361,7 +361,7 @@ static int iss_net_open(struct net_devic
+ struct iss_net_private *lp = netdev_priv(dev);
+ int err;
+
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+
+ err = lp->tp.open(lp);
+ if (err < 0)
+@@ -376,9 +376,11 @@ static int iss_net_open(struct net_devic
+ while ((err = iss_net_rx(dev)) > 0)
+ ;
+
+- spin_lock(&opened_lock);
++ spin_unlock_bh(&lp->lock);
++ spin_lock_bh(&opened_lock);
+ list_add(&lp->opened_list, &opened);
+- spin_unlock(&opened_lock);
++ spin_unlock_bh(&opened_lock);
++ spin_lock_bh(&lp->lock);
+
+ init_timer(&lp->timer);
+ lp->timer_val = ISS_NET_TIMER_VALUE;
+@@ -387,7 +389,7 @@ static int iss_net_open(struct net_devic
+ mod_timer(&lp->timer, jiffies + lp->timer_val);
+
+ out:
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return err;
+ }
+
+@@ -395,7 +397,7 @@ static int iss_net_close(struct net_devi
+ {
+ struct iss_net_private *lp = netdev_priv(dev);
+ netif_stop_queue(dev);
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+
+ spin_lock(&opened_lock);
+ list_del(&opened);
+@@ -405,18 +407,17 @@ static int iss_net_close(struct net_devi
+
+ lp->tp.close(lp);
+
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return 0;
+ }
+
+ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct iss_net_private *lp = netdev_priv(dev);
+- unsigned long flags;
+ int len;
+
+ netif_stop_queue(dev);
+- spin_lock_irqsave(&lp->lock, flags);
++ spin_lock_bh(&lp->lock);
+
+ len = lp->tp.write(lp, &skb);
+
+@@ -438,7 +439,7 @@ static int iss_net_start_xmit(struct sk_
+ pr_err("%s: %s failed(%d)\n", dev->name, __func__, len);
+ }
+
+- spin_unlock_irqrestore(&lp->lock, flags);
++ spin_unlock_bh(&lp->lock);
+
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+@@ -466,9 +467,9 @@ static int iss_net_set_mac(struct net_de
+
+ if (!is_valid_ether_addr(hwaddr->sa_data))
+ return -EADDRNOTAVAIL;
+- spin_lock(&lp->lock);
++ spin_lock_bh(&lp->lock);
+ memcpy(dev->dev_addr, hwaddr->sa_data, ETH_ALEN);
+- spin_unlock(&lp->lock);
++ spin_unlock_bh(&lp->lock);
+ return 0;
+ }
+
+@@ -520,11 +521,11 @@ static int iss_net_configure(int index,
+ *lp = (struct iss_net_private) {
+ .device_list = LIST_HEAD_INIT(lp->device_list),
+ .opened_list = LIST_HEAD_INIT(lp->opened_list),
+- .lock = __SPIN_LOCK_UNLOCKED(lp.lock),
+ .dev = dev,
+ .index = index,
+- };
++ };
+
++ spin_lock_init(&lp->lock);
+ /*
+ * If this name ends up conflicting with an existing registered
+ * netdevice, that is OK, register_netdev{,ice}() will notice this
--- /dev/null
+From 01e84c70fe40c8111f960987bcf7f931842e6d07 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 27 Feb 2015 11:02:38 +0300
+Subject: xtensa: provide __NR_sync_file_range2 instead of __NR_sync_file_range
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 01e84c70fe40c8111f960987bcf7f931842e6d07 upstream.
+
+xtensa actually uses sync_file_range2 implementation, so it should
+define __NR_sync_file_range2 as other architectures that use that
+function. That fixes userspace interface (that apparently never worked)
+and avoids special-casing xtensa in libc implementations.
+See the thread ending at
+http://lists.busybox.net/pipermail/uclibc/2015-February/048833.html
+for more details.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/include/uapi/asm/unistd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/xtensa/include/uapi/asm/unistd.h
++++ b/arch/xtensa/include/uapi/asm/unistd.h
+@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6)
+ __SYSCALL(324, sys_name_to_handle_at, 5)
+ #define __NR_open_by_handle_at 325
+ __SYSCALL(325, sys_open_by_handle_at, 3)
+-#define __NR_sync_file_range 326
++#define __NR_sync_file_range2 326
+ __SYSCALL(326, sys_sync_file_range2, 6)
+ #define __NR_perf_event_open 327
+ __SYSCALL(327, sys_perf_event_open, 5)
--- /dev/null
+From 4949009eb8d40a441dcddcd96e101e77d31cf1b2 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 27 Feb 2015 06:28:00 +0300
+Subject: xtensa: xtfpga: fix hardware lockup caused by LCD driver
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 4949009eb8d40a441dcddcd96e101e77d31cf1b2 upstream.
+
+LCD driver is always built for the XTFPGA platform, but its base address
+is not configurable, and is wrong for ML605/KC705. Its initialization
+locks up KC705 board hardware.
+
+Make the whole driver optional, and its base address and bus width
+configurable. Implement 4-bit bus access method.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/Kconfig | 30 ++++++++
+ arch/xtensa/platforms/xtfpga/Makefile | 3
+ arch/xtensa/platforms/xtfpga/include/platform/hardware.h | 3
+ arch/xtensa/platforms/xtfpga/include/platform/lcd.h | 15 ++++
+ arch/xtensa/platforms/xtfpga/lcd.c | 55 +++++++++------
+ 5 files changed, 81 insertions(+), 25 deletions(-)
+
+--- a/arch/xtensa/Kconfig
++++ b/arch/xtensa/Kconfig
+@@ -336,6 +336,36 @@ menu "Executable file formats"
+
+ source "fs/Kconfig.binfmt"
+
++config XTFPGA_LCD
++ bool "Enable XTFPGA LCD driver"
++ depends on XTENSA_PLATFORM_XTFPGA
++ default n
++ help
++ There's a 2x16 LCD on most of XTFPGA boards, kernel may output
++ progress messages there during bootup/shutdown. It may be useful
++ during board bringup.
++
++ If unsure, say N.
++
++config XTFPGA_LCD_BASE_ADDR
++ hex "XTFPGA LCD base address"
++ depends on XTFPGA_LCD
++ default "0x0d0c0000"
++ help
++ Base address of the LCD controller inside KIO region.
++ Different boards from XTFPGA family have LCD controller at different
++ addresses. Please consult prototyping user guide for your board for
++ the correct address. Wrong address here may lead to hardware lockup.
++
++config XTFPGA_LCD_8BIT_ACCESS
++ bool "Use 8-bit access to XTFPGA LCD"
++ depends on XTFPGA_LCD
++ default n
++ help
++ LCD may be connected with 4- or 8-bit interface, 8-bit access may
++ only be used with 8-bit interface. Please consult prototyping user
++ guide for your board for the correct interface width.
++
+ endmenu
+
+ source "net/Kconfig"
+--- a/arch/xtensa/platforms/xtfpga/Makefile
++++ b/arch/xtensa/platforms/xtfpga/Makefile
+@@ -6,4 +6,5 @@
+ #
+ # Note 2! The CFLAGS definitions are in the main makefile...
+
+-obj-y = setup.o lcd.o
++obj-y += setup.o
++obj-$(CONFIG_XTFPGA_LCD) += lcd.o
+--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
++++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+@@ -40,9 +40,6 @@
+
+ /* UART */
+ #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020)
+-/* LCD instruction and data addresses. */
+-#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000))
+-#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004))
+
+ /* Misc. */
+ #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000)
+--- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
++++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h
+@@ -11,10 +11,25 @@
+ #ifndef __XTENSA_XTAVNET_LCD_H
+ #define __XTENSA_XTAVNET_LCD_H
+
++#ifdef CONFIG_XTFPGA_LCD
+ /* Display string STR at position POS on the LCD. */
+ void lcd_disp_at_pos(char *str, unsigned char pos);
+
+ /* Shift the contents of the LCD display left or right. */
+ void lcd_shiftleft(void);
+ void lcd_shiftright(void);
++#else
++static inline void lcd_disp_at_pos(char *str, unsigned char pos)
++{
++}
++
++static inline void lcd_shiftleft(void)
++{
++}
++
++static inline void lcd_shiftright(void)
++{
++}
++#endif
++
+ #endif
+--- a/arch/xtensa/platforms/xtfpga/lcd.c
++++ b/arch/xtensa/platforms/xtfpga/lcd.c
+@@ -1,50 +1,63 @@
+ /*
+- * Driver for the LCD display on the Tensilica LX60 Board.
++ * Driver for the LCD display on the Tensilica XTFPGA board family.
++ * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License. See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2001, 2006 Tensilica Inc.
++ * Copyright (C) 2015 Cadence Design Systems Inc.
+ */
+
+-/*
+- *
+- * FIXME: this code is from the examples from the LX60 user guide.
+- *
+- * The lcd_pause function does busy waiting, which is probably not
+- * great. Maybe the code could be changed to use kernel timers, or
+- * change the hardware to not need to wait.
+- */
+-
++#include <linux/delay.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+
+ #include <platform/hardware.h>
+ #include <platform/lcd.h>
+-#include <linux/delay.h>
+
+-#define LCD_PAUSE_ITERATIONS 4000
++/* LCD instruction and data addresses. */
++#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR))
++#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4)
++
+ #define LCD_CLEAR 0x1
+ #define LCD_DISPLAY_ON 0xc
+
+ /* 8bit and 2 lines display */
+ #define LCD_DISPLAY_MODE8BIT 0x38
++#define LCD_DISPLAY_MODE4BIT 0x28
+ #define LCD_DISPLAY_POS 0x80
+ #define LCD_SHIFT_LEFT 0x18
+ #define LCD_SHIFT_RIGHT 0x1c
+
++static void lcd_put_byte(u8 *addr, u8 data)
++{
++#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS
++ ACCESS_ONCE(*addr) = data;
++#else
++ ACCESS_ONCE(*addr) = data & 0xf0;
++ ACCESS_ONCE(*addr) = (data << 4) & 0xf0;
++#endif
++}
++
+ static int __init lcd_init(void)
+ {
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
+ mdelay(5);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
+ udelay(200);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT;
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT;
++ udelay(50);
++#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS
++ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT;
++ udelay(50);
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT);
+ udelay(50);
+- *LCD_INSTR_ADDR = LCD_DISPLAY_ON;
++#endif
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON);
+ udelay(50);
+- *LCD_INSTR_ADDR = LCD_CLEAR;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR);
+ mdelay(10);
+ lcd_disp_at_pos("XTENSA LINUX", 0);
+ return 0;
+@@ -52,10 +65,10 @@ static int __init lcd_init(void)
+
+ void lcd_disp_at_pos(char *str, unsigned char pos)
+ {
+- *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos);
+ udelay(100);
+ while (*str != 0) {
+- *LCD_DATA_ADDR = *str;
++ lcd_put_byte(LCD_DATA_ADDR, *str);
+ udelay(200);
+ str++;
+ }
+@@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned
+
+ void lcd_shiftleft(void)
+ {
+- *LCD_INSTR_ADDR = LCD_SHIFT_LEFT;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT);
+ udelay(50);
+ }
+
+ void lcd_shiftright(void)
+ {
+- *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT;
++ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT);
+ udelay(50);
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
