--- /dev/null
+From 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Thu, 21 Aug 2014 14:41:26 +0800
+Subject: ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream.
+
+There is platform refusing to respond QR_EC when SCI_EVT isn't set
+which is Acer Aspire V5-573G.
+
+By disallowing QR_EC to be issued before the previous one has been
+completed we are able to reduce the possibilities to trigger issues on
+such platforms.
+
+Note that this fix can only reduce the occurrence rate of this issue, but
+this issue may still occur when such a platform doesn't clear SCI_EVT
+before or immediately after completing the previous QR_EC transaction.
+This patch cannot fix the CLEAR_ON_RESUME quirk which also relies on
+the assumption that the platforms are able to respond even when SCI_EVT
+isn't set.
+
+But this patch is still useful as it can help to reduce the number of
+scheduled QR_EC work items.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611
+Reported-and-tested-by: Alexander Mezin <mezin.alexander@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/acpi/ec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -299,11 +299,11 @@ static int acpi_ec_transaction_unlocked(
+ /* following two actions should be kept atomic */
+ ec->curr = t;
+ start_transaction(ec);
++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
++ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+ spin_unlock_irqrestore(&ec->lock, tmp);
+ ret = ec_poll(ec);
+ spin_lock_irqsave(&ec->lock, tmp);
+- if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
+- clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+ ec->curr = NULL;
+ spin_unlock_irqrestore(&ec->lock, tmp);
+ return ret;
--- /dev/null
+From 78579b7c7eb45f0e7ec5e9437087ed21749f9a9c Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 19 Nov 2014 01:44:11 +0100
+Subject: ACPI / PM: Ignore wakeup setting if the ACPI companion can't wake up
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit 78579b7c7eb45f0e7ec5e9437087ed21749f9a9c upstream.
+
+As reported by Dmitry, on some Chromebooks there are devices with
+corresponding ACPI objects and with unusual system wakeup
+configuration. Namely, they technically are wakeup-capable, but the
+wakeup is handled via a platform-specific out-of-band mechanism and
+the ACPI PM layer has no information on the wakeup capability. As
+a result, device_may_wakeup(dev) called from acpi_dev_suspend_late()
+returns 'true' for those devices, but the wakeup.flags.valid flag is
+unset for the corresponding ACPI device objects, so acpi_device_wakeup()
+reproducibly fails for them causing acpi_dev_suspend_late() to return
+an error code. The entire system suspend is then aborted and the
+machines in question cannot suspend at all.
+
+Address the problem by ignoring the device_may_wakeup(dev) return
+value in acpi_dev_suspend_late() if the ACPI companion of the device
+being handled has wakeup.flags.valid unset (in which case it is clear
+that the wakeup is supposed to be handled by other means).
+
+This fixes a regression introduced by commit a76e9bd89ae7 (i2c:
+attach/detach I2C client device to the ACPI power domain) as the
+affected systems could suspend and resume successfully before that
+commit.
+
+Fixes: a76e9bd89ae7 (i2c: attach/detach I2C client device to the ACPI power domain)
+Reported-by: Dmitry Torokhov <dtor@chromium.org>
+Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/device_pm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -877,7 +877,7 @@ int acpi_dev_suspend_late(struct device
+ return 0;
+
+ target_state = acpi_target_system_state();
+- wakeup = device_may_wakeup(dev);
++ wakeup = device_may_wakeup(dev) && acpi_device_can_wakeup(adev);
+ error = acpi_device_wakeup(adev, target_state, wakeup);
+ if (wakeup && error)
+ return error;
--- /dev/null
+From ef59a20ba375aeb97b3150a118318884743452a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Fri, 21 Nov 2014 15:29:00 +0100
+Subject: ARM: 8216/1: xscale: correct auxiliary register in suspend/resume
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit ef59a20ba375aeb97b3150a118318884743452a8 upstream.
+
+According to the manuals I have, XScale auxiliary register should be
+reached with opc_2 = 1 instead of crn = 1. cpu_xscale_proc_init
+correctly uses c1, c0, 1 arguments, but cpu_xscale_do_suspend and
+cpu_xscale_do_resume use c1, c1, 0. Correct suspend/resume functions to
+also use c1, c0, 1.
+
+The issue was primarily noticed thanks to qemu reporing "unsupported
+instruction" on the pxa suspend path. Confirmed in PXA210/250 and PXA255
+XScale Core manuals and in PXA270 and PXA320 Developers Guides.
+
+Harware tested by me on tosa (pxa255). Robert confirmed on pxa270 board.
+
+Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-xscale.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -535,7 +535,7 @@ ENTRY(cpu_xscale_do_suspend)
+ mrc p15, 0, r5, c15, c1, 0 @ CP access reg
+ mrc p15, 0, r6, c13, c0, 0 @ PID
+ mrc p15, 0, r7, c3, c0, 0 @ domain ID
+- mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg
++ mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg
+ mrc p15, 0, r9, c1, c0, 0 @ control reg
+ bic r4, r4, #2 @ clear frequency change bit
+ stmia r0, {r4 - r9} @ store cp regs
+@@ -552,7 +552,7 @@ ENTRY(cpu_xscale_do_resume)
+ mcr p15, 0, r6, c13, c0, 0 @ PID
+ mcr p15, 0, r7, c3, c0, 0 @ domain ID
+ mcr p15, 0, r1, c2, c0, 0 @ translation table base addr
+- mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg
++ mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg
+ mov r0, r9 @ control register
+ b cpu_resume_mmu
+ ENDPROC(cpu_xscale_do_resume)
--- /dev/null
+From 995ab5189d1d7264e79e665dfa032a19b3ac646e Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 25 Nov 2014 18:43:15 +0100
+Subject: ARM: 8222/1: mvebu: enable strex backoff delay
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 995ab5189d1d7264e79e665dfa032a19b3ac646e upstream.
+
+Under extremely rare conditions, in an MPCore node consisting of at
+least 3 CPUs, two CPUs trying to perform a STREX to data on the same
+shared cache line can enter a livelock situation.
+
+This patch enables the HW mechanism that overcomes the bug. This fixes
+the incorrect setup of the STREX backoff delay bit due to a wrong
+description in the specification.
+
+Note that enabling the STREX backoff delay mechanism is done by
+leaving the bit *cleared*, while the bit was currently being set by
+the proc-v7.S code.
+
+[Thomas: adapt to latest mainline, slightly reword the commit log, add
+stable markers.]
+
+Fixes: de4901933f6d ("arm: mm: Add support for PJ4B cpu and init routines")
+
+Signed-off-by: Nadav Haklai <nadavh@marvell.com>
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Acked-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-v7.S | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -270,7 +270,6 @@ __v7_pj4b_setup:
+ /* Auxiliary Debug Modes Control 1 Register */
+ #define PJ4B_STATIC_BP (1 << 2) /* Enable Static BP */
+ #define PJ4B_INTER_PARITY (1 << 8) /* Disable Internal Parity Handling */
+-#define PJ4B_BCK_OFF_STREX (1 << 5) /* Enable the back off of STREX instr */
+ #define PJ4B_CLEAN_LINE (1 << 16) /* Disable data transfer for clean line */
+
+ /* Auxiliary Debug Modes Control 2 Register */
+@@ -293,7 +292,6 @@ __v7_pj4b_setup:
+ /* Auxiliary Debug Modes Control 1 Register */
+ mrc p15, 1, r0, c15, c1, 1
+ orr r0, r0, #PJ4B_CLEAN_LINE
+- orr r0, r0, #PJ4B_BCK_OFF_STREX
+ orr r0, r0, #PJ4B_INTER_PARITY
+ bic r0, r0, #PJ4B_STATIC_BP
+ mcr p15, 1, r0, c15, c1, 1
--- /dev/null
+From 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 Mon Sep 17 00:00:00 2001
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+Date: Thu, 27 Nov 2014 11:39:04 +0100
+Subject: ARM: 8226/1: cacheflush: get rid of restarting block
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+commit 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 upstream.
+
+We cannot restart cacheflush safely if a process provides user-defined
+signal handler and signal is pending. In this case -EINTR is returned
+and it is expected that process re-invokes syscall. However, there are
+a few problems with that:
+ * looks like nobody bothers checking return value from cacheflush
+ * but if it did, we don't provide the restart address for that, so the
+ process has to use the same range again
+ * ...and again, what might lead to looping forever
+
+So, remove cacheflush restarting code and terminate cache flushing
+as early as fatal signal is pending.
+
+Reported-by: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/thread_info.h | 11 -----------
+ arch/arm/kernel/traps.c | 31 ++-----------------------------
+ 2 files changed, 2 insertions(+), 40 deletions(-)
+
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -44,16 +44,6 @@ struct cpu_context_save {
+ __u32 extra[2]; /* Xscale 'acc' register, etc */
+ };
+
+-struct arm_restart_block {
+- union {
+- /* For user cache flushing */
+- struct {
+- unsigned long start;
+- unsigned long end;
+- } cache;
+- };
+-};
+-
+ /*
+ * low level task data that entry.S needs immediate access to.
+ * __switch_to() assumes cpu_context follows immediately after cpu_domain.
+@@ -79,7 +69,6 @@ struct thread_info {
+ unsigned long thumbee_state; /* ThumbEE Handler Base register */
+ #endif
+ struct restart_block restart_block;
+- struct arm_restart_block arm_restart_block;
+ };
+
+ #define INIT_THREAD_INFO(tsk) \
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -513,8 +513,6 @@ static int bad_syscall(int n, struct pt_
+ return regs->ARM_r0;
+ }
+
+-static long do_cache_op_restart(struct restart_block *);
+-
+ static inline int
+ __do_cache_op(unsigned long start, unsigned long end)
+ {
+@@ -523,24 +521,8 @@ __do_cache_op(unsigned long start, unsig
+ do {
+ unsigned long chunk = min(PAGE_SIZE, end - start);
+
+- if (signal_pending(current)) {
+- struct thread_info *ti = current_thread_info();
+-
+- ti->restart_block = (struct restart_block) {
+- .fn = do_cache_op_restart,
+- };
+-
+- ti->arm_restart_block = (struct arm_restart_block) {
+- {
+- .cache = {
+- .start = start,
+- .end = end,
+- },
+- },
+- };
+-
+- return -ERESTART_RESTARTBLOCK;
+- }
++ if (fatal_signal_pending(current))
++ return 0;
+
+ ret = flush_cache_user_range(start, start + chunk);
+ if (ret)
+@@ -553,15 +535,6 @@ __do_cache_op(unsigned long start, unsig
+ return 0;
+ }
+
+-static long do_cache_op_restart(struct restart_block *unused)
+-{
+- struct arm_restart_block *restart_block;
+-
+- restart_block = ¤t_thread_info()->arm_restart_block;
+- return __do_cache_op(restart_block->cache.start,
+- restart_block->cache.end);
+-}
+-
+ static inline int
+ do_cache_op(unsigned long start, unsigned long end, int flags)
+ {
--- /dev/null
+From 2eb04ae010a8fb165ba7aa56e9aa8e7980887dee Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Mon, 27 Oct 2014 16:32:35 +0100
+Subject: ARM: mvebu: add missing of_node_put() call in coherency.c
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 2eb04ae010a8fb165ba7aa56e9aa8e7980887dee upstream.
+
+There is a missing of_node_put() to decrement the device_node
+reference counter after a of_find_matching_node() in coherency_init().
+
+Fixes: 501f928e0097 ("ARM: mvebu: add a coherency_available() call")
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Link: https://lkml.kernel.org/r/1414423955-5933-4-git-send-email-thomas.petazzoni@free-electrons.com
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/coherency.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -400,6 +400,8 @@ int __init coherency_init(void)
+ type == COHERENCY_FABRIC_TYPE_ARMADA_380)
+ armada_375_380_coherency_init(np);
+
++ of_node_put(np);
++
+ return 0;
+ }
+
--- /dev/null
+From a1d69c60c44134f64945bbf6a6dfda22eaf4a214 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 19 Nov 2014 22:13:10 +0100
+Subject: brcmfmac: don't include linux/unaligned/access_ok.h
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit a1d69c60c44134f64945bbf6a6dfda22eaf4a214 upstream.
+
+This is a specific implementation, <asm/unaligned.h> is the
+multiplexer that has the arch-specific knowledge of which
+of the implementations needs to be used, so include that.
+
+This issue was revealed by kbuild testing
+when <asm/unaligned.h> was added in <linux/ieee80211.h>
+resulting in redefinition of get_unaligned_be16 (and
+probably others).
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+@@ -19,10 +19,10 @@
+ #include <linux/pci.h>
+ #include <linux/vmalloc.h>
+ #include <linux/delay.h>
+-#include <linux/unaligned/access_ok.h>
+ #include <linux/interrupt.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/sched.h>
++#include <asm/unaligned.h>
+
+ #include <soc.h>
+ #include <chipcommon.h>
--- /dev/null
+From 0cd75b19899fd86b51a6480fb8c00dcd85a54591 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend@broadcom.com>
+Date: Tue, 11 Nov 2014 13:58:44 +0100
+Subject: brcmfmac: fix conversion of channel width 20MHZ_NOHT
+
+From: Arend van Spriel <arend@broadcom.com>
+
+commit 0cd75b19899fd86b51a6480fb8c00dcd85a54591 upstream.
+
+The function chandef_to_chanspec() failed when converting a
+chandef with bandwidth set to NL80211_CHAN_WIDTH_20_NOHT. This
+was reported by user running the device in AP mode.
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 304 at
+ drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c:381
+ chandef_to_chanspec.isra.11+0x158/0x184()
+
+Modules linked in:
+
+CPU: 0 PID: 304 Comm: hostapd Not tainted 3.16.0-rc7-abb+g64aa90f #8
+
+[<c0014bb4>] (unwind_backtrace) from [<c0012314>] (show_stack+0x10/0x14)
+[<c0012314>] (show_stack) from [<c001d3f8>] (warn_slowpath_common+0x6c/0x8c)
+[<c001d3f8>] (warn_slowpath_common) from [<c001d4b4>] (warn_slowpath_null+0x1c/0x24)
+[<c001d4b4>] (warn_slowpath_null) from [<c03449a4>] (chandef_to_chanspec.isra.11+0x158/0x184)
+[<c03449a4>] (chandef_to_chanspec.isra.11) from [<c0348e00>] (brcmf_cfg80211_start_ap+0x1e4/0x614)
+[<c0348e00>] (brcmf_cfg80211_start_ap) from [<c04d1468>] (nl80211_start_ap+0x288/0x414)
+[<c04d1468>] (nl80211_start_ap) from [<c043d144>] (genl_rcv_msg+0x21c/0x38c)
+[<c043d144>] (genl_rcv_msg) from [<c043c740>] (netlink_rcv_skb+0xac/0xc0)
+[<c043c740>] (netlink_rcv_skb) from [<c043cf14>] (genl_rcv+0x20/0x34)
+[<c043cf14>] (genl_rcv) from [<c043c0a0>] (netlink_unicast+0x150/0x20c)
+[<c043c0a0>] (netlink_unicast) from [<c043c4b8>] (netlink_sendmsg+0x2b8/0x398)
+[<c043c4b8>] (netlink_sendmsg) from [<c04066a4>] (sock_sendmsg+0x84/0xa8)
+[<c04066a4>] (sock_sendmsg) from [<c0407c5c>] (___sys_sendmsg.part.29+0x268/0x278)
+[<c0407c5c>] (___sys_sendmsg.part.29) from [<c0408bdc>] (__sys_sendmsg+0x4c/0x7c)
+[<c0408bdc>] (__sys_sendmsg) from [<c000ec60>] (ret_fast_syscall+0x0/0x44)
+---[ end trace 965ee2158c9905a2 ]---
+
+Reported-by: Pontus Fuchs <pontusf@broadcom.com>
+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+@@ -298,6 +298,7 @@ static u16 chandef_to_chanspec(struct br
+ primary_offset = ch->center_freq1 - ch->chan->center_freq;
+ switch (ch->width) {
+ case NL80211_CHAN_WIDTH_20:
++ case NL80211_CHAN_WIDTH_20_NOHT:
+ ch_inf.bw = BRCMU_CHAN_BW_20;
+ WARN_ON(primary_offset != 0);
+ break;
+@@ -322,6 +323,10 @@ static u16 chandef_to_chanspec(struct br
+ ch_inf.sb = BRCMU_CHAN_SB_LU;
+ }
+ break;
++ case NL80211_CHAN_WIDTH_80P80:
++ case NL80211_CHAN_WIDTH_160:
++ case NL80211_CHAN_WIDTH_5:
++ case NL80211_CHAN_WIDTH_10:
+ default:
+ WARN_ON_ONCE(1);
+ }
+@@ -332,6 +337,7 @@ static u16 chandef_to_chanspec(struct br
+ case IEEE80211_BAND_5GHZ:
+ ch_inf.band = BRCMU_CHAN_BAND_5G;
+ break;
++ case IEEE80211_BAND_60GHZ:
+ default:
+ WARN_ON_ONCE(1);
+ }
--- /dev/null
+From 4c69f05eaa428e37890daf88b86a567ce615570b Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@chromium.org>
+Date: Fri, 14 Nov 2014 14:12:21 -0800
+Subject: brcmfmac: fix error handling of irq_of_parse_and_map
+
+From: Dmitry Torokhov <dtor@chromium.org>
+
+commit 4c69f05eaa428e37890daf88b86a567ce615570b upstream.
+
+Return value of irq_of_parse_and_map() is unsigned int, with 0
+indicating failure, so testing for negative result never works.
+
+Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
+Acked-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/of.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
+@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_de
+ return;
+
+ irq = irq_of_parse_and_map(np, 0);
+- if (irq < 0) {
+- brcmf_err("interrupt could not be mapped: err=%d\n", irq);
++ if (!irq) {
++ brcmf_err("interrupt could not be mapped\n");
+ devm_kfree(dev, sdiodev->pdata);
+ return;
+ }
--- /dev/null
+From 5247a589c24022ab34e780039cc8000c48f2035e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20K=C3=B6rper?= <thomas.koerper@esd.eu>
+Date: Fri, 31 Oct 2014 07:33:54 +0100
+Subject: can: dev: avoid calling kfree_skb() from interrupt context
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Thomas=20K=C3=B6rper?= <thomas.koerper@esd.eu>
+
+commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.
+
+ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
+Error) interrupt, which triggers the folloing warning:
+
+[ 1153.360705] ------------[ cut here ]------------
+[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
+[ 1153.360772] Call Trace:
+[ 1153.360778] [<c167906f>] dump_stack+0x41/0x52
+[ 1153.360782] [<c105bb7e>] warn_slowpath_common+0x7e/0xa0
+[ 1153.360784] [<c158b909>] ? skb_release_head_state+0xb9/0xd0
+[ 1153.360786] [<c158b909>] ? skb_release_head_state+0xb9/0xd0
+[ 1153.360788] [<c105bc42>] warn_slowpath_null+0x22/0x30
+[ 1153.360791] [<c158b909>] skb_release_head_state+0xb9/0xd0
+[ 1153.360793] [<c158be90>] skb_release_all+0x10/0x30
+[ 1153.360795] [<c158bf06>] kfree_skb+0x36/0x80
+[ 1153.360799] [<f8486938>] ? can_free_echo_skb+0x28/0x40 [can_dev]
+[ 1153.360802] [<f8486938>] can_free_echo_skb+0x28/0x40 [can_dev]
+[ 1153.360805] [<f849a12c>] esd_pci402_interrupt+0x34c/0x57a [esd402]
+[ 1153.360809] [<c10a75b5>] handle_irq_event_percpu+0x35/0x180
+[ 1153.360811] [<c10a7623>] ? handle_irq_event_percpu+0xa3/0x180
+[ 1153.360813] [<c10a7731>] handle_irq_event+0x31/0x50
+[ 1153.360816] [<c10a9c7f>] handle_fasteoi_irq+0x6f/0x120
+[ 1153.360818] [<c10a9c10>] ? handle_edge_irq+0x110/0x110
+[ 1153.360822] [<c1011b61>] handle_irq+0x71/0x90
+[ 1153.360823] <IRQ> [<c168152c>] do_IRQ+0x3c/0xd0
+[ 1153.360829] [<c1680b6c>] common_interrupt+0x2c/0x34
+[ 1153.360834] [<c107d277>] ? finish_task_switch+0x47/0xf0
+[ 1153.360836] [<c167c27b>] __schedule+0x35b/0x7e0
+[ 1153.360839] [<c10a5334>] ? console_unlock+0x2c4/0x4d0
+[ 1153.360842] [<c13df500>] ? n_tty_receive_buf_common+0x890/0x890
+[ 1153.360845] [<c10707b6>] ? process_one_work+0x196/0x370
+[ 1153.360847] [<c167c723>] schedule+0x23/0x60
+[ 1153.360849] [<c1070de1>] worker_thread+0x161/0x460
+[ 1153.360852] [<c1090fcf>] ? __wake_up_locked+0x1f/0x30
+[ 1153.360854] [<c1070c80>] ? rescuer_thread+0x2f0/0x2f0
+[ 1153.360856] [<c1074f01>] kthread+0xa1/0xc0
+[ 1153.360859] [<c1680401>] ret_from_kernel_thread+0x21/0x30
+[ 1153.360861] [<c1074e60>] ? kthread_create_on_node+0x110/0x110
+[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---
+
+This patch replaces the kfree_skb() by dev_kfree_skb_any().
+
+Signed-off-by: Thomas Körper <thomas.koerper@esd.eu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -383,7 +383,7 @@ void can_free_echo_skb(struct net_device
+ BUG_ON(idx >= priv->echo_skb_max);
+
+ if (priv->echo_skb[idx]) {
+- kfree_skb(priv->echo_skb[idx]);
++ dev_kfree_skb_any(priv->echo_skb[idx]);
+ priv->echo_skb[idx] = NULL;
+ }
+ }
--- /dev/null
+From 1f9cd915b64bb95f7b41667b4bf8b22f0a0a557b Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Tue, 11 Nov 2014 19:35:52 +0100
+Subject: dmaengine: sun6i: Fix memcpy operation
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit 1f9cd915b64bb95f7b41667b4bf8b22f0a0a557b upstream.
+
+The prep_memcpy call was not setting any meaningful burst and width because it
+was relying on the dma_slave_config was not set already.
+
+Rework the needed conversion functions, and hardcode the width and burst to
+use.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/sun6i-dma.c | 67 +++++++++++++++++++++++-------------------------
+ 1 file changed, 33 insertions(+), 34 deletions(-)
+
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -230,30 +230,25 @@ static inline void sun6i_dma_dump_chan_r
+ readl(pchan->base + DMA_CHAN_CUR_PARA));
+ }
+
+-static inline int convert_burst(u32 maxburst, u8 *burst)
++static inline s8 convert_burst(u32 maxburst)
+ {
+ switch (maxburst) {
+ case 1:
+- *burst = 0;
+- break;
++ return 0;
+ case 8:
+- *burst = 2;
+- break;
++ return 2;
+ default:
+ return -EINVAL;
+ }
+-
+- return 0;
+ }
+
+-static inline int convert_buswidth(enum dma_slave_buswidth addr_width, u8 *width)
++static inline s8 convert_buswidth(enum dma_slave_buswidth addr_width)
+ {
+ if ((addr_width < DMA_SLAVE_BUSWIDTH_1_BYTE) ||
+ (addr_width > DMA_SLAVE_BUSWIDTH_4_BYTES))
+ return -EINVAL;
+
+- *width = addr_width >> 1;
+- return 0;
++ return addr_width >> 1;
+ }
+
+ static void *sun6i_dma_lli_add(struct sun6i_dma_lli *prev,
+@@ -284,26 +279,25 @@ static inline int sun6i_dma_cfg_lli(stru
+ struct dma_slave_config *config)
+ {
+ u8 src_width, dst_width, src_burst, dst_burst;
+- int ret;
+
+ if (!config)
+ return -EINVAL;
+
+- ret = convert_burst(config->src_maxburst, &src_burst);
+- if (ret)
+- return ret;
+-
+- ret = convert_burst(config->dst_maxburst, &dst_burst);
+- if (ret)
+- return ret;
+-
+- ret = convert_buswidth(config->src_addr_width, &src_width);
+- if (ret)
+- return ret;
+-
+- ret = convert_buswidth(config->dst_addr_width, &dst_width);
+- if (ret)
+- return ret;
++ src_burst = convert_burst(config->src_maxburst);
++ if (src_burst)
++ return src_burst;
++
++ dst_burst = convert_burst(config->dst_maxburst);
++ if (dst_burst)
++ return dst_burst;
++
++ src_width = convert_buswidth(config->src_addr_width);
++ if (src_width)
++ return src_width;
++
++ dst_width = convert_buswidth(config->dst_addr_width);
++ if (dst_width)
++ return dst_width;
+
+ lli->cfg = DMA_CHAN_CFG_SRC_BURST(src_burst) |
+ DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+@@ -542,11 +536,10 @@ static struct dma_async_tx_descriptor *s
+ {
+ struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device);
+ struct sun6i_vchan *vchan = to_sun6i_vchan(chan);
+- struct dma_slave_config *sconfig = &vchan->cfg;
+ struct sun6i_dma_lli *v_lli;
+ struct sun6i_desc *txd;
+ dma_addr_t p_lli;
+- int ret;
++ s8 burst, width;
+
+ dev_dbg(chan2dev(chan),
+ "%s; chan: %d, dest: %pad, src: %pad, len: %zu. flags: 0x%08lx\n",
+@@ -565,14 +558,21 @@ static struct dma_async_tx_descriptor *s
+ goto err_txd_free;
+ }
+
+- ret = sun6i_dma_cfg_lli(v_lli, src, dest, len, sconfig);
+- if (ret)
+- goto err_dma_free;
++ v_lli->src = src;
++ v_lli->dst = dest;
++ v_lli->len = len;
++ v_lli->para = NORMAL_WAIT;
+
++ burst = convert_burst(8);
++ width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
+ DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
+ DMA_CHAN_CFG_DST_LINEAR_MODE |
+- DMA_CHAN_CFG_SRC_LINEAR_MODE;
++ DMA_CHAN_CFG_SRC_LINEAR_MODE |
++ DMA_CHAN_CFG_SRC_BURST(burst) |
++ DMA_CHAN_CFG_SRC_WIDTH(width) |
++ DMA_CHAN_CFG_DST_BURST(burst) |
++ DMA_CHAN_CFG_DST_WIDTH(width);
+
+ sun6i_dma_lli_add(NULL, v_lli, p_lli, txd);
+
+@@ -580,8 +580,6 @@ static struct dma_async_tx_descriptor *s
+
+ return vchan_tx_prep(&vchan->vc, &txd->vd, flags);
+
+-err_dma_free:
+- dma_pool_free(sdev->pool, v_lli, p_lli);
+ err_txd_free:
+ kfree(txd);
+ return NULL;
+@@ -938,6 +936,7 @@ static int sun6i_dma_probe(struct platfo
+ sdc->slave.device_prep_dma_memcpy = sun6i_dma_prep_dma_memcpy;
+ sdc->slave.device_control = sun6i_dma_control;
+ sdc->slave.chancnt = NR_MAX_VCHANS;
++ sdc->slave.copy_align = 4;
+
+ sdc->slave.dev = &pdev->dev;
+
--- /dev/null
+From 6b19b66013cfe608d63f0dab38834bbaceb0217a Mon Sep 17 00:00:00 2001
+From: Arnaud Ebalard <arno@natisbad.org>
+Date: Wed, 19 Nov 2014 22:52:36 +0100
+Subject: hwmon: (g762) fix call to devm_hwmon_device_register_with_groups()
+
+From: Arnaud Ebalard <arno@natisbad.org>
+
+commit 6b19b66013cfe608d63f0dab38834bbaceb0217a upstream.
+
+g762_remove() needs to first call hwmon_device_unregister() and then
+g762_of_clock_disable(). For that reason, it is not possible to
+convert it to devm_hwmon_device_register_with_groups() and the
+the non device managed version must be used.
+
+This is correctly stated in commit message for 398e16db6262 ("hwmon:
+(g762) Convert to hwmon_device_register_with_groups") but the
+associated changes do in fact introduce a call to the device managed
+version of the function.
+
+This patch fixes that typo by switching to the non devm_ version.
+
+Fixes: 398e16db6262 ("hwmon: (g762) Convert to hwmon_device_register_with_groups")
+Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/g762.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/g762.c
++++ b/drivers/hwmon/g762.c
+@@ -1084,10 +1084,8 @@ static int g762_probe(struct i2c_client
+ if (ret)
+ goto clock_dis;
+
+- data->hwmon_dev = devm_hwmon_device_register_with_groups(dev,
+- client->name,
+- data,
+- g762_groups);
++ data->hwmon_dev = hwmon_device_register_with_groups(dev, client->name,
++ data, g762_groups);
+ if (IS_ERR(data->hwmon_dev)) {
+ ret = PTR_ERR(data->hwmon_dev);
+ goto clock_dis;
--- /dev/null
+From bce4f9e764c36bc35dd5c9cf9e057c09f422397d Mon Sep 17 00:00:00 2001
+From: Ben Sagal <bensagal@gmail.com>
+Date: Sun, 16 Nov 2014 17:23:40 -0800
+Subject: Input: synaptics - adjust min/max on Thinkpad E540
+
+From: Ben Sagal <bensagal@gmail.com>
+
+commit bce4f9e764c36bc35dd5c9cf9e057c09f422397d upstream.
+
+The LEN2006 Synaptics touchpad (as found in Thinkpad E540) returns wrong
+min max values.
+
+touchpad-edge-detector output:
+> Touchpad SynPS/2 Synaptics TouchPad on /dev/input/event6
+> Move one finger around the touchpad to detect the actual edges
+> Kernel says: x [1472..5674], y [1408..4684]
+> Touchpad sends: x [1264..5675], y [1171..4688]
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88211
+Signed-off-by: Binyamin Sagal <bensagal@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -143,6 +143,10 @@ static const struct min_max_quirk min_ma
+ (const char * const []){"LEN2001", NULL},
+ 1024, 5022, 2508, 4832
+ },
++ {
++ (const char * const []){"LEN2006", NULL},
++ 1264, 5675, 1171, 4688
++ },
+ { }
+ };
+
--- /dev/null
+From a1f9a4072655843fc03186acbad65990cc05dd2d Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 25 Nov 2014 00:38:17 -0800
+Subject: Input: xpad - use proper endpoint type
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit a1f9a4072655843fc03186acbad65990cc05dd2d upstream.
+
+The xpad wireless endpoint is not a bulk endpoint on my devices, but
+rather an interrupt one, so the USB core complains when it is submitted.
+I'm guessing that the author really did mean that this should be an
+interrupt urb, but as there are a zillion different xpad devices out
+there, let's cover out bases and handle both bulk and interrupt
+endpoints just as easily.
+
+Signed-off-by: "Pierre-Loup A. Griffais" <pgriffais@valvesoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/joystick/xpad.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -1143,9 +1143,19 @@ static int xpad_probe(struct usb_interfa
+ }
+
+ ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
+- usb_fill_bulk_urb(xpad->bulk_out, udev,
+- usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
+- xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
++ if (usb_endpoint_is_bulk_out(ep_irq_in)) {
++ usb_fill_bulk_urb(xpad->bulk_out, udev,
++ usb_sndbulkpipe(udev,
++ ep_irq_in->bEndpointAddress),
++ xpad->bdata, XPAD_PKT_LEN,
++ xpad_bulk_out, xpad);
++ } else {
++ usb_fill_int_urb(xpad->bulk_out, udev,
++ usb_sndintpipe(udev,
++ ep_irq_in->bEndpointAddress),
++ xpad->bdata, XPAD_PKT_LEN,
++ xpad_bulk_out, xpad, 0);
++ }
+
+ /*
+ * Submit the int URB immediately rather than waiting for open
--- /dev/null
+From 3b726ae2de02a406cc91903f80132daee37b6f1b Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagig@dev.mellanox.co.il>
+Date: Tue, 28 Oct 2014 13:45:03 -0700
+Subject: iser-target: Handle DEVICE_REMOVAL event on network portal listener correctly
+
+From: Sagi Grimberg <sagig@dev.mellanox.co.il>
+
+commit 3b726ae2de02a406cc91903f80132daee37b6f1b upstream.
+
+In this case the cm_id->context is the isert_np, and the cm_id->qp
+is NULL, so use that to distinct the cases.
+
+Since we don't expect any other events on this cm_id we can
+just return -1 for explicit termination of the cm_id by the
+cma layer.
+
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 29 +++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -810,14 +810,25 @@ wake_up:
+ complete(&isert_conn->conn_wait);
+ }
+
+-static void
++static int
+ isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
+ {
+- struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
++ struct isert_conn *isert_conn;
++
++ if (!cma_id->qp) {
++ struct isert_np *isert_np = cma_id->context;
++
++ isert_np->np_cm_id = NULL;
++ return -1;
++ }
++
++ isert_conn = (struct isert_conn *)cma_id->context;
+
+ isert_conn->disconnect = disconnect;
+ INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
+ schedule_work(&isert_conn->conn_logout_work);
++
++ return 0;
+ }
+
+ static int
+@@ -832,6 +843,9 @@ isert_cma_handler(struct rdma_cm_id *cma
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST:
+ ret = isert_connect_request(cma_id, event);
++ if (ret)
++ pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
++ event->event, ret);
+ break;
+ case RDMA_CM_EVENT_ESTABLISHED:
+ isert_connected_handler(cma_id);
+@@ -841,7 +855,7 @@ isert_cma_handler(struct rdma_cm_id *cma
+ case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
+ disconnect = true;
+ case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */
+- isert_disconnected_handler(cma_id, disconnect);
++ ret = isert_disconnected_handler(cma_id, disconnect);
+ break;
+ case RDMA_CM_EVENT_CONNECT_ERROR:
+ default:
+@@ -849,12 +863,6 @@ isert_cma_handler(struct rdma_cm_id *cma
+ break;
+ }
+
+- if (ret != 0) {
+- pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
+- event->event, ret);
+- dump_stack();
+- }
+-
+ return ret;
+ }
+
+@@ -3210,7 +3218,8 @@ isert_free_np(struct iscsi_np *np)
+ {
+ struct isert_np *isert_np = (struct isert_np *)np->np_context;
+
+- rdma_destroy_id(isert_np->np_cm_id);
++ if (isert_np->np_cm_id)
++ rdma_destroy_id(isert_np->np_cm_id);
+
+ np->np_context = NULL;
+ kfree(isert_np);
--- /dev/null
+From 87dd634ae72bb8f6d0dd12f1cbbc67c7da6dba3b Mon Sep 17 00:00:00 2001
+From: Liad Kaufman <liad.kaufman@intel.com>
+Date: Mon, 10 Nov 2014 19:25:22 +0200
+Subject: iwlwifi: pcie: fix prph dump length
+
+From: Liad Kaufman <liad.kaufman@intel.com>
+
+commit 87dd634ae72bb8f6d0dd12f1cbbc67c7da6dba3b upstream.
+
+The length counting previously done had an error in it, causing
+the length down the data dumping function to be shorter than it
+should be, causing the end of the data to get truncated off and
+lost.
+
+Fixes: 67c65f2cf710 ("iwlwifi: dump periphery registers to fw-error-dump")
+Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -1891,8 +1891,7 @@ static u32 iwl_trans_pcie_dump_prph(stru
+ int reg;
+ __le32 *val;
+
+- prph_len += sizeof(*data) + sizeof(*prph) +
+- num_bytes_in_chunk;
++ prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
+
+ (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
+ (*data)->len = cpu_to_le32(sizeof(*prph) +
--- /dev/null
+From 4556dc591691fca743518edb24f15fbc83b5c8ef Mon Sep 17 00:00:00 2001
+From: Vlad Yasevich <vyasevich@gmail.com>
+Date: Fri, 21 Nov 2014 23:52:52 -0800
+Subject: ixgbe: Correctly disable VLAN filter in promiscuous mode
+
+From: Vlad Yasevich <vyasevich@gmail.com>
+
+commit 4556dc591691fca743518edb24f15fbc83b5c8ef upstream.
+
+IXGBE adapter seems to require that VLAN filtering be enabled if
+VMDQ or SRIOV are enabled. When those functions are disabled,
+VLAN filtering may be disabled in promiscuous mode.
+
+Prior to commit a9b8943ee129 ("ixgbe: remove vlan_filter_disable
+and enable functions")
+
+The logic was correct. However, after the commit the logic
+got reversed and VLAN filtered in now turned on when VMDQ/SRIOV
+is disabled.
+
+This patch changes the condition to enable hw vlan filtered
+when VMDQ or SRIOV is enabled.
+
+Fixes: a9b8943ee129 ("ixgbe: remove vlan_filter_disable and enable functions")
+CC: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
+Acked-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -4059,8 +4059,8 @@ void ixgbe_set_rx_mode(struct net_device
+ * if SR-IOV and VMDQ are disabled - otherwise ensure
+ * that hardware VLAN filters remain enabled.
+ */
+- if (!(adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
+- IXGBE_FLAG_SRIOV_ENABLED)))
++ if (adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
++ IXGBE_FLAG_SRIOV_ENABLED))
+ vlnctrl |= (IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
+ } else {
+ if (netdev->flags & IFF_ALLMULTI) {
--- /dev/null
+From b5b2ffc0574e1f271d79b6b992ee382dc9d5eaa8 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <dborkman@redhat.com>
+Date: Fri, 21 Nov 2014 23:52:53 -0800
+Subject: ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe
+
+From: Daniel Borkmann <dborkman@redhat.com>
+
+commit b5b2ffc0574e1f271d79b6b992ee382dc9d5eaa8 upstream.
+
+While working on a different issue, I noticed an annoying use
+after free bug on my machine when unloading the ixgbe driver:
+
+[ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2
+[ 8642.742716] ixgbe 0000:02:00.1: complete
+[ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90
+[ 8642.744828] IP: [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
+[ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060
+[ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
+[ 8642.748039] Modules linked in: [...]
+[ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49
+[ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013
+[ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000
+[ 8642.756831] RIP: 0010:[<ffffffffa01c77dc>] [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
+[...]
+[ 8642.774335] Stack:
+[ 8642.775805] ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000
+[ 8642.777326] ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098
+[ 8642.778848] ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f
+[ 8642.780365] Call Trace:
+[ 8642.781869] [<ffffffff8137720f>] pci_device_remove+0x3f/0xc0
+[ 8642.783395] [<ffffffff8144180f>] __device_release_driver+0x7f/0xf0
+[ 8642.784876] [<ffffffff814421f8>] driver_detach+0xb8/0xc0
+[ 8642.786352] [<ffffffff814414a9>] bus_remove_driver+0x59/0xe0
+[ 8642.787783] [<ffffffff814429d0>] driver_unregister+0x30/0x70
+[ 8642.789202] [<ffffffff81375c65>] pci_unregister_driver+0x25/0xa0
+[ 8642.790657] [<ffffffffa01eb38e>] ixgbe_exit_module+0x1c/0xc8e [ixgbe]
+[ 8642.792064] [<ffffffff810f93a2>] SyS_delete_module+0x132/0x1c0
+[ 8642.793450] [<ffffffff81012c61>] ? do_notify_resume+0x61/0xa0
+[ 8642.794837] [<ffffffff816d2029>] system_call_fastpath+0x12/0x17
+
+The issue is that test_and_set_bit() done on adapter->state is being
+performed *after* the netdevice has been freed via free_netdev().
+
+When netdev is being allocated on initialization time, it allocates
+a private area, here struct ixgbe_adapter, that resides after the
+net_device structure. In ixgbe_probe(), the device init routine,
+we set up the adapter after alloc_etherdev_mq() on the private area
+and add a reference for the pci_dev as well via pci_set_drvdata().
+
+Both in the error path of ixgbe_probe(), but also on module unload
+when ixgbe_remove() is being called, commit 41c62843eb6a ("ixgbe:
+Fix rcu warnings induced by LER") accesses adapter after free_netdev().
+The patch stores the result in a bool and thus fixes above oops on my
+side.
+
+Fixes: 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER")
+Cc: Mark Rustad <mark.d.rustad@intel.com>
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8084,6 +8084,7 @@ static int ixgbe_probe(struct pci_dev *p
+ int i, err, pci_using_dac, expected_gts;
+ unsigned int indices = MAX_TX_QUEUES;
+ u8 part_str[IXGBE_PBANUM_LENGTH];
++ bool disable_dev = false;
+ #ifdef IXGBE_FCOE
+ u16 device_caps;
+ #endif
+@@ -8477,13 +8478,14 @@ err_sw_init:
+ iounmap(adapter->io_addr);
+ kfree(adapter->mac_table);
+ err_ioremap:
++ disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
+ free_netdev(netdev);
+ err_alloc_etherdev:
+ pci_release_selected_regions(pdev,
+ pci_select_bars(pdev, IORESOURCE_MEM));
+ err_pci_reg:
+ err_dma:
+- if (!adapter || !test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
++ if (!adapter || disable_dev)
+ pci_disable_device(pdev);
+ return err;
+ }
+@@ -8501,6 +8503,7 @@ static void ixgbe_remove(struct pci_dev
+ {
+ struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+ struct net_device *netdev = adapter->netdev;
++ bool disable_dev;
+
+ ixgbe_dbg_adapter_exit(adapter);
+
+@@ -8550,11 +8553,12 @@ static void ixgbe_remove(struct pci_dev
+ e_dev_info("complete\n");
+
+ kfree(adapter->mac_table);
++ disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
+ free_netdev(netdev);
+
+ pci_disable_pcie_error_reporting(pdev);
+
+- if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
++ if (disable_dev)
+ pci_disable_device(pdev);
+ }
+
--- /dev/null
+From 4f031fa9f188b2b0641ac20087d9e16bcfb4e49d Mon Sep 17 00:00:00 2001
+From: Ronald Wahl <ronald.wahl@raritan.com>
+Date: Thu, 6 Nov 2014 11:52:13 +0100
+Subject: mac80211: Fix regression that triggers a kernel BUG with CCMP
+
+From: Ronald Wahl <ronald.wahl@raritan.com>
+
+commit 4f031fa9f188b2b0641ac20087d9e16bcfb4e49d upstream.
+
+Commit 7ec7c4a9a686c608315739ab6a2b0527a240883c (mac80211: port CCMP to
+cryptoapi's CCM driver) introduced a regression when decrypting empty
+packets (data_len == 0). This will lead to backtraces like:
+
+(scatterwalk_start) from [<c01312f4>] (scatterwalk_map_and_copy+0x2c/0xa8)
+(scatterwalk_map_and_copy) from [<c013a5a0>] (crypto_ccm_decrypt+0x7c/0x25c)
+(crypto_ccm_decrypt) from [<c032886c>] (ieee80211_aes_ccm_decrypt+0x160/0x170)
+(ieee80211_aes_ccm_decrypt) from [<c031c628>] (ieee80211_crypto_ccmp_decrypt+0x1ac/0x238)
+(ieee80211_crypto_ccmp_decrypt) from [<c032ef28>] (ieee80211_rx_handlers+0x870/0x1d24)
+(ieee80211_rx_handlers) from [<c0330c7c>] (ieee80211_prepare_and_rx_handle+0x8a0/0x91c)
+(ieee80211_prepare_and_rx_handle) from [<c0331260>] (ieee80211_rx+0x568/0x730)
+(ieee80211_rx) from [<c01d3054>] (__carl9170_rx+0x94c/0xa20)
+(__carl9170_rx) from [<c01d3324>] (carl9170_rx_stream+0x1fc/0x320)
+(carl9170_rx_stream) from [<c01cbccc>] (carl9170_usb_tasklet+0x80/0xc8)
+(carl9170_usb_tasklet) from [<c00199dc>] (tasklet_hi_action+0x88/0xcc)
+(tasklet_hi_action) from [<c00193c8>] (__do_softirq+0xcc/0x200)
+(__do_softirq) from [<c0019734>] (irq_exit+0x80/0xe0)
+(irq_exit) from [<c0009c10>] (handle_IRQ+0x64/0x80)
+(handle_IRQ) from [<c000c3a0>] (__irq_svc+0x40/0x4c)
+(__irq_svc) from [<c0009d44>] (arch_cpu_idle+0x2c/0x34)
+
+Such packets can appear for example when using the carl9170 wireless driver
+because hardware sometimes generates garbage when the internal FIFO overruns.
+
+This patch adds an additional length check.
+
+Fixes: 7ec7c4a9a686 ("mac80211: port CCMP to cryptoapi's CCM driver")
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/aes_ccm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/aes_ccm.c
++++ b/net/mac80211/aes_ccm.c
+@@ -53,6 +53,9 @@ int ieee80211_aes_ccm_decrypt(struct cry
+ __aligned(__alignof__(struct aead_request));
+ struct aead_request *aead_req = (void *) aead_req_data;
+
++ if (data_len == 0)
++ return -EINVAL;
++
+ memset(aead_req, 0, sizeof(aead_req_data));
+
+ sg_init_one(&pt, data, data_len);
--- /dev/null
+From 91a0b603469069cdcce4d572b7525ffc9fd352a6 Mon Sep 17 00:00:00 2001
+From: Jane Zhou <a17711@motorola.com>
+Date: Mon, 24 Nov 2014 11:44:08 -0800
+Subject: net/ping: handle protocol mismatching scenario
+
+From: Jane Zhou <a17711@motorola.com>
+
+commit 91a0b603469069cdcce4d572b7525ffc9fd352a6 upstream.
+
+ping_lookup() may return a wrong sock if sk_buff's and sock's protocols
+dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's
+sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong
+sock will be returned.
+the fix is to "continue" the searching, if no matching, return NULL.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
+Cc: James Morris <jmorris@namei.org>
+Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: netdev@vger.kernel.org
+Signed-off-by: Jane Zhou <a17711@motorola.com>
+Signed-off-by: Yiwei Zhao <gbjc64@motorola.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ping.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct n
+ &ipv6_hdr(skb)->daddr))
+ continue;
+ #endif
++ } else {
++ continue;
+ }
+
+ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
--- /dev/null
+From 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Sat, 8 Nov 2014 13:11:03 +0100
+Subject: nfsd: correctly define v4.2 support attributes
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 upstream.
+
+Even when security labels are disabled we support at least the same
+attributes as v4.1.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfsd.h | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -335,12 +335,15 @@ void nfsd_lockd_shutdown(void);
+ (NFSD4_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SUPPATTR_EXCLCREAT)
+
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
+- (NFSD4_1_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SECURITY_LABEL)
++#define NFSD4_2_SECURITY_ATTRS FATTR4_WORD2_SECURITY_LABEL
+ #else
+-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0
++#define NFSD4_2_SECURITY_ATTRS 0
+ #endif
+
++#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
++ (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \
++ NFSD4_2_SECURITY_ATTRS)
++
+ static inline u32 nfsd_suppattrs0(u32 minorversion)
+ {
+ return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0
--- /dev/null
+From c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Wed, 19 Nov 2014 12:47:50 -0500
+Subject: nfsd: Fix slot wake up race in the nfsv4.1 callback code
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream.
+
+The currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no
+locking in order to guarantee atomicity, and so allows for races of
+the form.
+
+Task 1 Task 2
+====== ======
+if (test_and_set_bit(0) != 0) {
+ clear_bit(0)
+ rpc_wake_up_next(queue)
+ rpc_sleep_on(queue)
+ return false;
+}
+
+This patch breaks the race condition by adding a retest of the bit
+after the call to rpc_sleep_on().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4callback.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -801,8 +801,12 @@ static bool nfsd41_cb_get_slot(struct nf
+ {
+ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+ rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
+- dprintk("%s slot is busy\n", __func__);
+- return false;
++ /* Race breaker */
++ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
++ dprintk("%s slot is busy\n", __func__);
++ return false;
++ }
++ rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
+ }
+ return true;
+ }
--- /dev/null
+From ab74d00a39f70e1bc34a01322bb59f3750ca7a8c Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@gmail.com>
+Date: Sun, 9 Nov 2014 00:55:47 -0800
+Subject: of: Fix crash if an earlycon driver is not found
+
+From: Kevin Cernekee <cernekee@gmail.com>
+
+commit ab74d00a39f70e1bc34a01322bb59f3750ca7a8c upstream.
+
+__earlycon_of_table_sentinel.compatible is a char[128], not a pointer, so
+it will never be NULL. Checking it against NULL causes the match loop to
+run past the end of the array, and eventually match a bogus entry, under
+the following conditions:
+
+ - Kernel command line specifies "earlycon" with no parameters
+ - DT has a stdout-path pointing to a UART node
+ - The UART driver doesn't use OF_EARLYCON_DECLARE (or maybe the console
+ driver is compiled out)
+
+Fix this by checking to see if match->compatible is a non-empty string.
+
+Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/fdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_ser
+ if (offset < 0)
+ return -ENODEV;
+
+- while (match->compatible) {
++ while (match->compatible[0]) {
+ unsigned long addr;
+ if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
+ match++;
--- /dev/null
+From 66865de4314caca30598244b86817e774c188afa Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Sat, 1 Nov 2014 17:35:31 -0600
+Subject: of/irq: Drop obsolete 'interrupts' vs 'interrupts-extended' text
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 66865de4314caca30598244b86817e774c188afa upstream.
+
+a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property
+first") updated the description to say that:
+
+ - Both 'interrupts' and 'interrupts-extended' may be present
+ - Software should prefer 'interrupts-extended'
+ - Software that doesn't comprehend 'interrupts-extended' may use
+ 'interrupts'
+
+But there is still a paragraph at the end that prohibits having both and
+says 'interrupts' should be preferred.
+
+Remove the contradictory text.
+
+Fixes: a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property first")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Brian Norris <computersforpeace@gmail.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/interrupt-controller/interrupts.txt | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
++++ b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
+@@ -30,10 +30,6 @@ should only be used when a device has mu
+ Example:
+ interrupts-extended = <&intc1 5 1>, <&intc2 1 0>;
+
+-A device node may contain either "interrupts" or "interrupts-extended", but not
+-both. If both properties are present, then the operating system should log an
+-error and use only the data in "interrupts".
+-
+ 2) Interrupt controller nodes
+ -----------------------------
+
--- /dev/null
+From c1a2086e2d8c4eb4e8630ba752e911ec180dec67 Mon Sep 17 00:00:00 2001
+From: Grant Likely <grant.likely@linaro.org>
+Date: Wed, 19 Nov 2014 16:22:32 +0000
+Subject: of/selftest: Fix off-by-one error in removal path
+
+From: Grant Likely <grant.likely@linaro.org>
+
+commit c1a2086e2d8c4eb4e8630ba752e911ec180dec67 upstream.
+
+The removal path for selftest data has an off by one error that causes
+the code to dereference beyond the end of the nodes[] array on the first
+pass through. The old code only worked by chance on a lot of platforms,
+but the bug was recently exposed on aarch64.
+
+The fix is simple. Decrement the node count before dereferencing, not
+after.
+
+Reported-by: Kevin Hilman <khilman@linaro.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>
+
+---
+ drivers/of/selftest.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/of/selftest.c
++++ b/drivers/of/selftest.c
+@@ -799,7 +799,7 @@ static void selftest_data_remove(void)
+ return;
+ }
+
+- while (last_node_index >= 0) {
++ while (last_node_index-- > 0) {
+ if (nodes[last_node_index]) {
+ np = of_find_node_by_path(nodes[last_node_index]->full_name);
+ if (strcmp(np->full_name, "/aliases") != 0) {
+@@ -812,7 +812,6 @@ static void selftest_data_remove(void)
+ }
+ }
+ }
+- last_node_index--;
+ }
+ }
+
--- /dev/null
+From 9b41ebd3cf0f68d8cad779d3eeba336f78262e43 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Tue, 18 Nov 2014 11:27:13 +0200
+Subject: Revert "xhci: clear root port wake on bits if controller isn't wake-up capable"
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit 9b41ebd3cf0f68d8cad779d3eeba336f78262e43 upstream.
+
+commit ff8cbf250b44 ("xhci: clear root port wake on bits if controller isn't")
+can cause device detection error if runtime PM is enabled, and S3 wake
+is disabled. Revert it.
+https://bugzilla.kernel.org/show_bug.cgi?id=85701
+
+This commit got into stable and should be reverted from there as well.
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reported-by: Dmitry Nezhevenko <dion@inhex.net>
+[Mathias Nyman: reword commit message]
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -22,7 +22,6 @@
+
+
+ #include <linux/slab.h>
+-#include <linux/device.h>
+ #include <asm/unaligned.h>
+
+ #include "xhci.h"
+@@ -1142,9 +1141,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd
+ * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME
+ * is enabled, so also enable remote wake here.
+ */
+- if (hcd->self.root_hub->do_remote_wakeup
+- && device_may_wakeup(hcd->self.controller)) {
+-
++ if (hcd->self.root_hub->do_remote_wakeup) {
+ if (t1 & PORT_CONNECT) {
+ t2 |= PORT_WKOC_E | PORT_WKDISC_E;
+ t2 &= ~PORT_WKCONN_E;
--- /dev/null
+From cfd9167af14eb4ec21517a32911d460083ee3d59 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 11 Nov 2014 14:28:47 +0100
+Subject: rt2x00: do not align payload on modern H/W
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream.
+
+RT2800 and newer hardware require padding between header and payload if
+header length is not multiple of 4.
+
+For historical reasons we also align payload to to 4 bytes boundary, but
+such alignment is not needed on modern H/W.
+
+Patch fixes skb_under_panic problems reported from time to time:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=84911
+https://bugzilla.kernel.org/show_bug.cgi?id=72471
+http://marc.info/?l=linux-wireless&m=139108549530402&w=2
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591
+
+Panic happened because we eat 4 bytes of skb headroom on each
+(re)transmission when sending frame without the payload and the header
+length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
+case because paylad_aling=2 is bigger than header_align=0 we increase
+header_align by 4 bytes. To prevent that we could change the check to:
+
+ if (payload_length && payload_align > header_align)
+ header_align += 4;
+
+but not aligning payload at all is more effective and alignment is not
+really needed by H/W (that has been tested on OpenWrt project for few
+years now).
+
+Reported-and-tested-by: Antti S. Lankila <alankila@bel.fi>
+Debugged-by: Antti S. Lankila <alankila@bel.fi>
+Reported-by: Henrik Asp <solenskiner@gmail.com>
+Originally-From: Helmut Schaa <helmut.schaa@googlemail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00queue.c | 50 +++++++-----------------------
+ 1 file changed, 12 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_b
+ skb_trim(skb, frame_length);
+ }
+
+-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
++/*
++ * H/W needs L2 padding between the header and the paylod if header size
++ * is not 4 bytes aligned.
++ */
++void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+- unsigned int payload_length = skb->len - header_length;
+- unsigned int header_align = ALIGN_SIZE(skb, 0);
+- unsigned int payload_align = ALIGN_SIZE(skb, header_length);
+- unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+-
+- /*
+- * Adjust the header alignment if the payload needs to be moved more
+- * than the header.
+- */
+- if (payload_align > header_align)
+- header_align += 4;
++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+
+- /* There is nothing to do if no alignment is needed */
+- if (!header_align)
++ if (!l2pad)
+ return;
+
+- /* Reserve the amount of space needed in front of the frame */
+- skb_push(skb, header_align);
+-
+- /*
+- * Move the header.
+- */
+- memmove(skb->data, skb->data + header_align, header_length);
+-
+- /* Move the payload, if present and if required */
+- if (payload_length && payload_align)
+- memmove(skb->data + header_length + l2pad,
+- skb->data + header_length + l2pad + payload_align,
+- payload_length);
+-
+- /* Trim the skb to the correct size */
+- skb_trim(skb, header_length + l2pad + payload_length);
++ skb_push(skb, l2pad);
++ memmove(skb->data, skb->data + l2pad, hdr_len);
+ }
+
+-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
++void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+- /*
+- * L2 padding is only present if the skb contains more than just the
+- * IEEE 802.11 header.
+- */
+- unsigned int l2pad = (skb->len > header_length) ?
+- L2PAD_SIZE(header_length) : 0;
++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+
+ if (!l2pad)
+ return;
+
+- memmove(skb->data + l2pad, skb->data, header_length);
++ memmove(skb->data + l2pad, skb->data, hdr_len);
+ skb_pull(skb, l2pad);
+ }
+
--- /dev/null
+From 1899045510ff109980d9cc34e330fd8ca3631871 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?=
+ <christian.suenkenberg@hfg-karlsruhe.de>
+Date: Tue, 18 Nov 2014 20:23:32 +0100
+Subject: scsi: add Intel Multi-Flex to scsi scan blacklist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?=
+
+commit 1899045510ff109980d9cc34e330fd8ca3631871 upstream.
+
+Intel Multi-Flex LUNs choke on REPORT SUPPORTED OPERATION CODES
+resulting in sd_mod hanging for several minutes on startup.
+The issue was introduced with WRITE SAME discovery heuristics.
+
+Fixes: 5db44863b6eb ("[SCSI] sd: Implement support for WRITE SAME")
+Signed-off-by: Christian Sünkenberg <christian.suenkenberg@hfg-karlsruhe.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_devinfo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -202,6 +202,7 @@ static struct {
+ {"IOMEGA", "Io20S *F", NULL, BLIST_KEY},
+ {"INSITE", "Floptical F*8I", NULL, BLIST_KEY},
+ {"INSITE", "I325VM", NULL, BLIST_KEY},
++ {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
+ {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
+ {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+ {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
alsa-hda-one-more-hp-machine-needs-to-change-mute-led-quirk.patch
aio-fix-uncorrent-dirty-pages-accouting-when-truncating-aio-ring-buffer.patch
btrfs-fix-lockups-from-btrfs_clear_path_blocking.patch
+acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch
+acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch
+brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch
+brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch
+brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch
+of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch
+of-fix-crash-if-an-earlycon-driver-is-not-found.patch
+of-selftest-fix-off-by-one-error-in-removal-path.patch
+arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch
+arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch
+arm-8222-1-mvebu-enable-strex-backoff-delay.patch
+arm-8226-1-cacheflush-get-rid-of-restarting-block.patch
+input-synaptics-adjust-min-max-on-thinkpad-e540.patch
+input-xpad-use-proper-endpoint-type.patch
+srp-target-retry-when-qp-creation-fails-with-enomem.patch
+target-don-t-call-tfo-write_pending-if-data_length-0.patch
+iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch
+spi-dw-fix-dynamic-speed-change.patch
+spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch
+spi-sirf-fix-word-width-configuration.patch
+mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch
+vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch
+scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch
+can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch
+dmaengine-sun6i-fix-memcpy-operation.patch
+rt2x00-do-not-align-payload-on-modern-h-w.patch
+iwlwifi-pcie-fix-prph-dump-length.patch
+nfsd-correctly-define-v4.2-support-attributes.patch
+nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch
+sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch
+hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch
+net-ping-handle-protocol-mismatching-scenario.patch
+revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch
+ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch
+ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch
--- /dev/null
+From db79afa1e57925ba96ab18514c0ebe42a28e393e Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Mon, 24 Nov 2014 14:17:08 +1100
+Subject: sound/radeon: Move 64-bit MSI quirk from arch to driver
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit db79afa1e57925ba96ab18514c0ebe42a28e393e upstream.
+
+A number of radeon cards have a HW limitation causing them to be
+unable to generate the full 64-bit of address bits for MSIs. This
+breaks MSIs on some platforms such as POWER machines.
+
+We used to have a powerpc specific quirk to address that on a
+single card, but this doesn't scale very well, this is better
+put under control of the drivers who know precisely what a given
+HW revision can do.
+
+We now have a generic quirk in the PCI code. We should set it
+appropriately for all radeon's from the audio driver.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 10 ++++++++--
+ sound/pci/hda/hda_priv.h | 1 +
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -296,7 +296,8 @@ enum {
+
+ /* quirks for ATI/AMD HDMI */
+ #define AZX_DCAPS_PRESET_ATI_HDMI \
+- (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB)
++ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB|\
++ AZX_DCAPS_NO_MSI64)
+
+ /* quirks for Nvidia */
+ #define AZX_DCAPS_PRESET_NVIDIA \
+@@ -1508,9 +1509,14 @@ static int azx_first_init(struct azx *ch
+ return -ENXIO;
+ }
+
+- if (chip->msi)
++ if (chip->msi) {
++ if (chip->driver_caps & AZX_DCAPS_NO_MSI64) {
++ dev_dbg(card->dev, "Disabling 64bit MSI\n");
++ pci->no_64bit_msi = true;
++ }
+ if (pci_enable_msi(pci) < 0)
+ chip->msi = 0;
++ }
+
+ if (azx_acquire_irq(chip, 0) < 0)
+ return -EBUSY;
+--- a/sound/pci/hda/hda_priv.h
++++ b/sound/pci/hda/hda_priv.h
+@@ -171,6 +171,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO
+ #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */
+ #define AZX_DCAPS_I915_POWERWELL (1 << 27) /* HSW i915 powerwell support */
+ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */
++#define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */
+
+ /* HD Audio class code */
+ #define PCI_CLASS_MULTIMEDIA_HD_AUDIO 0x0403
--- /dev/null
+From 0a8727e69778683495058852f783eeda141a754e Mon Sep 17 00:00:00 2001
+From: Thor Thayer <tthayer@opensource.altera.com>
+Date: Thu, 6 Nov 2014 13:54:27 -0600
+Subject: spi: dw: Fix dynamic speed change.
+
+From: Thor Thayer <tthayer@opensource.altera.com>
+
+commit 0a8727e69778683495058852f783eeda141a754e upstream.
+
+An IOCTL call that calls spi_setup() and then dw_spi_setup() will
+overwrite the persisted last transfer speed. On each transfer, the
+SPI speed is compared to the last transfer speed to determine if the
+clock divider registers need to be updated (did the speed change?).
+This bug was observed with the spidev driver using spi-config to
+update the max transfer speed.
+
+This fix: Don't overwrite the persisted last transaction clock speed
+when updating the SPI parameters in dw_spi_setup(). On the next
+transaction, the new speed won't match the persisted last speed
+and the hardware registers will be updated.
+On initialization, the persisted last transaction clock
+speed will be 0 but will be updated after the first SPI
+transaction.
+
+Move zeroed clock divider check into clock change test because
+chip->clk_div is zero on startup and would cause a divide-by-zero
+error. The calculation was wrong as well (can't support odd #).
+
+Reported-by: Vlastimil Setka <setka@vsis.cz>
+Signed-off-by: Vlastimil Setka <setka@vsis.cz>
+Signed-off-by: Thor Thayer <tthayer@opensource.altera.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-dw.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -382,9 +382,6 @@ static void pump_transfers(unsigned long
+ chip = dws->cur_chip;
+ spi = message->spi;
+
+- if (unlikely(!chip->clk_div))
+- chip->clk_div = dws->max_freq / chip->speed_hz;
+-
+ if (message->state == ERROR_STATE) {
+ message->status = -EIO;
+ goto early_exit;
+@@ -425,7 +422,7 @@ static void pump_transfers(unsigned long
+ if (transfer->speed_hz) {
+ speed = chip->speed_hz;
+
+- if (transfer->speed_hz != speed) {
++ if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
+ speed = transfer->speed_hz;
+
+ /* clk_div doesn't support odd number */
+@@ -586,7 +583,6 @@ static int dw_spi_setup(struct spi_devic
+ dev_err(&spi->dev, "No max speed HZ parameter\n");
+ return -EINVAL;
+ }
+- chip->speed_hz = spi->max_speed_hz;
+
+ chip->tmode = 0; /* Tx & Rx */
+ /* Default SPI mode is SCPOL = 0, SCPH = 0 */
--- /dev/null
+From c1aefbdd050e1fb15e92bcaf34d95b17ea952097 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Mon, 17 Nov 2014 09:14:31 +0000
+Subject: spi: Fix mapping from vmalloc-ed buffer to scatter list
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit c1aefbdd050e1fb15e92bcaf34d95b17ea952097 upstream.
+
+We can only use page_address on memory that has been mapped using kmap,
+when the buffer passed to the SPI has been allocated by vmalloc the page
+has not necessarily been mapped through kmap. This means sometimes
+page_address will return NULL causing the pointer we pass to sg_set_buf
+to be invalid.
+
+As we only call page_address so that we can pass a virtual address to
+sg_set_buf which will then immediately call virt_to_page on it, fix this
+by calling sg_set_page directly rather then relying on the sg_set_buf
+helper.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -609,13 +609,13 @@ static int spi_map_buf(struct spi_master
+ sg_free_table(sgt);
+ return -ENOMEM;
+ }
+- sg_buf = page_address(vm_page) +
+- ((size_t)buf & ~PAGE_MASK);
++ sg_set_page(&sgt->sgl[i], vm_page,
++ min, offset_in_page(buf));
+ } else {
+ sg_buf = buf;
++ sg_set_buf(&sgt->sgl[i], sg_buf, min);
+ }
+
+- sg_set_buf(&sgt->sgl[i], sg_buf, min);
+
+ buf += min;
+ len -= min;
--- /dev/null
+From 9c4b19a07dddda3ba35a2eb9b4134d485908e2f5 Mon Sep 17 00:00:00 2001
+From: Qipan Li <Qipan.Li@csr.com>
+Date: Mon, 17 Nov 2014 23:17:02 +0800
+Subject: spi: sirf: fix word width configuration
+
+From: Qipan Li <Qipan.Li@csr.com>
+
+commit 9c4b19a07dddda3ba35a2eb9b4134d485908e2f5 upstream.
+
+commit 8c328a262f ("spi: sirf: Avoid duplicate code in various
+bits_per_word cases") is wrong in setting data width register of
+fifo is not right, it should use sspi->word_width >> 1 to set
+related bits. According to hardware spec, the mapping between
+register value and data width:
+0 - byte
+1 - WORD
+2 - DWORD
+
+Fixes: 8c328a262f ("spi: sirf: Avoid duplicate code in various bits_per_word cases") is wrong in setting data width register of
+Signed-off-by: Qipan Li <Qipan.Li@csr.com>
+Signed-off-by: Barry Song <Baohua.Song@csr.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-sirf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-sirf.c
++++ b/drivers/spi/spi-sirf.c
+@@ -565,9 +565,9 @@ spi_sirfsoc_setup_transfer(struct spi_de
+
+ sspi->word_width = DIV_ROUND_UP(bits_per_word, 8);
+ txfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
+- sspi->word_width;
++ (sspi->word_width >> 1);
+ rxfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
+- sspi->word_width;
++ (sspi->word_width >> 1);
+
+ if (!(spi->mode & SPI_CS_HIGH))
+ regval |= SIRFSOC_SPI_CS_IDLE_STAT;
--- /dev/null
+From ab477c1ff5e0a744c072404bf7db51bfe1f05b6e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sun, 19 Oct 2014 18:05:33 +0300
+Subject: srp-target: Retry when QP creation fails with ENOMEM
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit ab477c1ff5e0a744c072404bf7db51bfe1f05b6e upstream.
+
+It is not guaranteed to that srp_sq_size is supported
+by the HCA. So if we failed to create the QP with ENOMEM,
+try with a smaller srp_sq_size. Keep it up until we hit
+MIN_SRPT_SQ_SIZE, then fail the connection.
+
+Reported-by: Mark Lehrer <lehrer@gmail.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2092,6 +2092,7 @@ static int srpt_create_ch_ib(struct srpt
+ if (!qp_init)
+ goto out;
+
++retry:
+ ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
+ ch->rq_size + srp_sq_size, 0);
+ if (IS_ERR(ch->cq)) {
+@@ -2115,6 +2116,13 @@ static int srpt_create_ch_ib(struct srpt
+ ch->qp = ib_create_qp(sdev->pd, qp_init);
+ if (IS_ERR(ch->qp)) {
+ ret = PTR_ERR(ch->qp);
++ if (ret == -ENOMEM) {
++ srp_sq_size /= 2;
++ if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
++ ib_destroy_cq(ch->cq);
++ goto retry;
++ }
++ }
+ printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
+ goto err_destroy_cq;
+ }
--- /dev/null
+From 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 14 Oct 2014 14:16:24 -0700
+Subject: target: Don't call TFO->write_pending if data_length == 0
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.
+
+If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
+sets the transfer direction in the transport layer to indicate a
+data-out phase, we still shouldn't try to transfer data. At best it's
+a NOP, and depending on the transport, we might crash on an
+uninitialized sg list.
+
+Reported-by: Craig Watson <craig.watson@vanguard-rugged.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2295,7 +2295,7 @@ transport_generic_new_cmd(struct se_cmd
+ * and let it call back once the write buffers are ready.
+ */
+ target_add_to_state_list(cmd);
+- if (cmd->data_direction != DMA_TO_DEVICE) {
++ if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
+ target_execute_cmd(cmd);
+ return 0;
+ }
--- /dev/null
+From ab8edab132829b26dd13db6caca3c242cce35dc1 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 8 Oct 2014 06:19:20 +0000
+Subject: vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit ab8edab132829b26dd13db6caca3c242cce35dc1 upstream.
+
+This patch addresses a bug where individual vhost-scsi configfs endpoint
+groups can be removed from below while active exports to QEMU userspace
+still exist, resulting in an OOPs.
+
+It adds a configfs_depend_item() in vhost_scsi_set_endpoint() to obtain
+an explicit dependency on se_tpg->tpg_group in order to prevent individual
+vhost-scsi WWPN endpoints from being released via normal configfs methods
+while an QEMU ioctl reference still exists.
+
+Also, add matching configfs_undepend_item() in vhost_scsi_clear_endpoint()
+to release the dependency, once QEMU's reference to the individual group
+at /sys/kernel/config/target/vhost/$WWPN/$TPGT is released.
+
+(Fix up vhost_scsi_clear_endpoint() error path - DanC)
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vhost/scsi.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1312,6 +1312,7 @@ static int
+ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ struct vhost_scsi_target *t)
+ {
++ struct se_portal_group *se_tpg;
+ struct tcm_vhost_tport *tv_tport;
+ struct tcm_vhost_tpg *tpg;
+ struct tcm_vhost_tpg **vs_tpg;
+@@ -1359,6 +1360,21 @@ vhost_scsi_set_endpoint(struct vhost_scs
+ ret = -EEXIST;
+ goto out;
+ }
++ /*
++ * In order to ensure individual vhost-scsi configfs
++ * groups cannot be removed while in use by vhost ioctl,
++ * go ahead and take an explicit se_tpg->tpg_group.cg_item
++ * dependency now.
++ */
++ se_tpg = &tpg->se_tpg;
++ ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
++ &se_tpg->tpg_group.cg_item);
++ if (ret) {
++ pr_warn("configfs_depend_item() failed: %d\n", ret);
++ kfree(vs_tpg);
++ mutex_unlock(&tpg->tv_tpg_mutex);
++ goto out;
++ }
+ tpg->tv_tpg_vhost_count++;
+ tpg->vhost_scsi = vs;
+ vs_tpg[tpg->tport_tpgt] = tpg;
+@@ -1401,6 +1417,7 @@ static int
+ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
+ struct vhost_scsi_target *t)
+ {
++ struct se_portal_group *se_tpg;
+ struct tcm_vhost_tport *tv_tport;
+ struct tcm_vhost_tpg *tpg;
+ struct vhost_virtqueue *vq;
+@@ -1449,6 +1466,13 @@ vhost_scsi_clear_endpoint(struct vhost_s
+ vs->vs_tpg[target] = NULL;
+ match = true;
+ mutex_unlock(&tpg->tv_tpg_mutex);
++ /*
++ * Release se_tpg->tpg_group.cg_item configfs dependency now
++ * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur.
++ */
++ se_tpg = &tpg->se_tpg;
++ configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
++ &se_tpg->tpg_group.cg_item);
+ }
+ if (match) {
+ for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
