--- /dev/null
+From 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 18 Feb 2015 13:50:16 +0200
+Subject: ACPI / LPSS: Always disable I2C host controllers
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 upstream.
+
+On Baytrail and Braswell the BIOS might leave the I2C host controllers
+enabled, probably because it uses them for its own purposes. This is fine
+in normal cases because the I2C driver will disable the hardware when it
+is probed anyway.
+
+However, in case of suspend to disk it is different story. If the driver
+happens to be compiled as a module the boot kernel never loads the driver
+thus leaving host controllers enabled upon loading the hibernation image.
+
+The I2C host controller interrupt mask register has default value of 0x8ff,
+in other words it has most of the interrupts unmasked. When combined with
+the fact that the host controller is enabled, the driver immediately starts
+getting interrupts even before its resume hook is called (once IO-APIC is
+resumed). Since the driver is not prepared for this it will crash the
+kernel due to NULL pointer derefence because dev->msgs is NULL.
+
+Unfortunately we were not able to get full backtrace to from the console
+which could be reproduced here.
+
+In order to fix this even when the driver is compiled as module, we disable
+the I2C host controllers in byt_i2c_setup() before devices are created.
+
+Reported-by: Yu Chen <yu.c.chen@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -105,6 +105,8 @@ static void lpss_uart_setup(struct lpss_
+ }
+ }
+
++#define LPSS_I2C_ENABLE 0x6c
++
+ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ {
+ unsigned int offset;
+@@ -117,6 +119,8 @@ static void byt_i2c_setup(struct lpss_pr
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+ pdata->fixed_clk_rate = 133000000;
++
++ writel(0, pdata->mmio_base + LPSS_I2C_ENABLE);
+ }
+
+ static struct lpss_device_desc lpt_dev_desc = {
--- /dev/null
+From 3095794ae972bc6fc76af6cb3b864d6686b96094 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 18 Feb 2015 13:50:17 +0200
+Subject: ACPI / LPSS: Deassert resets for SPI host controllers on Braswell
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 3095794ae972bc6fc76af6cb3b864d6686b96094 upstream.
+
+On some Braswell systems BIOS leaves resets for SPI host controllers
+active. This prevents the SPI driver from transferring messages on wire.
+
+Fix this in similar way that we do for I2C already by deasserting resets
+for the SPI host controllers.
+
+Reported-by: Yang A Fang <yang.a.fang@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -105,9 +105,7 @@ static void lpss_uart_setup(struct lpss_
+ }
+ }
+
+-#define LPSS_I2C_ENABLE 0x6c
+-
+-static void byt_i2c_setup(struct lpss_private_data *pdata)
++static void lpss_deassert_reset(struct lpss_private_data *pdata)
+ {
+ unsigned int offset;
+ u32 val;
+@@ -116,6 +114,13 @@ static void byt_i2c_setup(struct lpss_pr
+ val = readl(pdata->mmio_base + offset);
+ val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC;
+ writel(val, pdata->mmio_base + offset);
++}
++
++#define LPSS_I2C_ENABLE 0x6c
++
++static void byt_i2c_setup(struct lpss_private_data *pdata)
++{
++ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+ pdata->fixed_clk_rate = 133000000;
+@@ -170,6 +175,12 @@ static struct lpss_device_desc byt_i2c_d
+ .setup = byt_i2c_setup,
+ };
+
++static struct lpss_device_desc bsw_spi_dev_desc = {
++ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
++ .prv_offset = 0x400,
++ .setup = lpss_deassert_reset,
++};
++
+ #else
+
+ #define LPSS_ADDR(desc) (0UL)
+@@ -202,7 +213,7 @@ static const struct acpi_device_id acpi_
+ /* Braswell LPSS devices */
+ { "80862288", LPSS_ADDR(byt_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(byt_uart_dev_desc) },
+- { "8086228E", LPSS_ADDR(byt_spi_dev_desc) },
++ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
+ { "808622C1", LPSS_ADDR(byt_i2c_dev_desc) },
+
+ { "INT3430", LPSS_ADDR(lpt_dev_desc) },
--- /dev/null
+From 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 13 Feb 2015 11:14:41 +0800
+Subject: ALSA: hda - enable mute led quirk for one more hp machine.
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 upstream.
+
+Otherwise, the mute led can't work at all.
+
+Tested-by: Taihsiang Ho <taihsiang.ho@canonical.com>
+BugLink: https://bugs.launchpad.net/bugs/1410704
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4844,6 +4844,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+ /* ALC282 */
++ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
--- /dev/null
+From 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 5 Feb 2015 12:23:33 +0100
+Subject: ALSA: hda - Set up GPIO for Toshiba Satellite S50D
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 upstream.
+
+Toshiba Satellite S50D laptop with an IDT codec uses the GPIO4 (0x10)
+as the master EAPD.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=915858
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -99,6 +99,7 @@ enum {
+ STAC_HP_ENVY_BASS,
+ STAC_HP_BNB13_EQ,
+ STAC_HP_ENVY_TS_BASS,
++ STAC_92HD83XXX_GPIO10_EAPD,
+ STAC_92HD83XXX_MODELS
+ };
+
+@@ -2141,6 +2142,19 @@ static void stac92hd83xxx_fixup_headset_
+ spec->headset_jack = 1;
+ }
+
++static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++ spec->eapd_mask = spec->gpio_mask = spec->gpio_dir =
++ spec->gpio_data = 0x10;
++ spec->eapd_switch = 0;
++}
++
+ static const struct hda_verb hp_bnb13_eq_verbs[] = {
+ /* 44.1KHz base */
+ { 0x22, 0x7A6, 0x3E },
+@@ -2656,6 +2670,10 @@ static const struct hda_fixup stac92hd83
+ {}
+ },
+ },
++ [STAC_92HD83XXX_GPIO10_EAPD] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = stac92hd83xxx_fixup_gpio10_eapd,
++ },
+ };
+
+ static const struct hda_model_fixup stac92hd83xxx_models[] = {
+@@ -2861,6 +2879,8 @@ static const struct snd_pci_quirk stac92
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ "HP Mini", STAC_92HD83XXX_HP_LED),
+ SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++ "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ {} /* terminator */
+ };
+
--- /dev/null
+From f0153c3d948c1764f6c920a0675d86fc1d75813e Mon Sep 17 00:00:00 2001
+From: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+Date: Tue, 10 Feb 2015 11:33:50 +0100
+Subject: ALSA: hdspm - Constrain periods to 2 on older cards
+
+From: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+
+commit f0153c3d948c1764f6c920a0675d86fc1d75813e upstream.
+
+RME RayDAT and AIO use a fixed buffer size of 16384 samples. With period
+sizes of 32-4096, this translates to 4-512 periods.
+
+The older RME cards have a variable buffer size but require exactly two
+periods.
+
+This patch enforces nperiods=2 on those cards.
+
+Signed-off-by: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/rme9652/hdspm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -6086,6 +6086,9 @@ static int snd_hdspm_playback_open(struc
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+@@ -6160,6 +6163,9 @@ static int snd_hdspm_capture_open(struct
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
--- /dev/null
+From e4940626defdf6c92da1052ad3f12741c1a28c90 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 9 Feb 2015 16:51:40 +0300
+Subject: ALSA: off by one bug in snd_riptide_joystick_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e4940626defdf6c92da1052ad3f12741c1a28c90 upstream.
+
+The problem here is that we check:
+
+ if (dev >= SNDRV_CARDS)
+
+Then we increment "dev".
+
+ if (!joystick_port[dev++])
+
+Then we use it as an offset into a array with SNDRV_CARDS elements.
+
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+
+This has 3 effects:
+1) If you use the module option to specify the joystick port then it has
+ to be shifted one space over.
+2) The wrong error message will be printed on failure if you have over
+ 32 cards.
+3) Static checkers will correctly complain that are off by one.
+
+Fixes: db1005ec6ff8 ('ALSA: riptide - Fix joystick resource handling')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/riptide/riptide.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/riptide/riptide.c
++++ b/sound/pci/riptide/riptide.c
+@@ -2030,32 +2030,43 @@ snd_riptide_joystick_probe(struct pci_de
+ {
+ static int dev;
+ struct gameport *gameport;
++ int ret;
+
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
++
+ if (!enable[dev]) {
+- dev++;
+- return -ENOENT;
++ ret = -ENOENT;
++ goto inc_dev;
+ }
+
+- if (!joystick_port[dev++])
+- return 0;
++ if (!joystick_port[dev]) {
++ ret = 0;
++ goto inc_dev;
++ }
+
+ gameport = gameport_allocate_port();
+- if (!gameport)
+- return -ENOMEM;
++ if (!gameport) {
++ ret = -ENOMEM;
++ goto inc_dev;
++ }
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+ snd_printk(KERN_WARNING
+ "Riptide: cannot grab gameport 0x%x\n",
+ joystick_port[dev]);
+ gameport_free_port(gameport);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto inc_dev;
+ }
+
+ gameport->io = joystick_port[dev];
+ gameport_register_port(gameport);
+ pci_set_drvdata(pci, gameport);
+- return 0;
++
++ ret = 0;
++inc_dev:
++ dev++;
++ return ret;
+ }
+
+ static void snd_riptide_joystick_remove(struct pci_dev *pci)
--- /dev/null
+From 3cd1ce0420ce89937bef9096d5bdb13fbdf0f8b0 Mon Sep 17 00:00:00 2001
+From: Frank C Guenther <bugzilla.frnkcg@spamgourmet.com>
+Date: Tue, 17 Feb 2015 22:13:32 +0100
+Subject: ALSA: usb: Fix support for Denon DA-300USB DAC (ID 154e:1003)
+
+From: Frank C Guenther <bugzilla.frnkcg@spamgourmet.com>
+
+commit 3cd1ce0420ce89937bef9096d5bdb13fbdf0f8b0 upstream.
+
+Fix problem where playback of Denon DA-300USB DAC sometimes does not
+start and leads to error messages like "clock source 41 is not valid,
+cannot use".
+
+Solution: Treat this device the same as other Denon/Marantz devices in
+sound/usb/quirks.c.
+
+Tested with both PCM and DSD formats.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=93261
+Signed-off-by: Frank C Guenther <bugzilla.frnkcg@spamgourmet.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1122,6 +1122,7 @@ int snd_usb_select_mode_quirk(struct snd
+ int err;
+
+ switch (subs->stream->chip->usb_id) {
++ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
+
+@@ -1201,6 +1202,7 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) {
+
+ switch (le16_to_cpu(dev->descriptor.idProduct)) {
++ case 0x1003: /* Denon DA300-USB */
+ case 0x3005: /* Marantz HD-DAC1 */
+ case 0x3006: /* Marantz SA-14S1 */
+ mdelay(20);
+@@ -1262,6 +1264,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+
+ /* Denon/Marantz devices with USB DAC functionality */
+ switch (chip->usb_id) {
++ case USB_ID(0x154e, 0x1003): /* Denon DA300-USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
+ if (fp->altsetting == 2)
--- /dev/null
+From 61882b63171736571e1139ab5aa929e3bb336016 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 18 Feb 2015 21:55:03 +0100
+Subject: cpufreq: s3c: remove incorrect __init annotations
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 61882b63171736571e1139ab5aa929e3bb336016 upstream.
+
+The two functions s3c2416_cpufreq_driver_init and s3c_cpufreq_register
+are marked init but are called from a context that might be run after
+the __init sections are discarded, as the compiler points out:
+
+WARNING: vmlinux.o(.data+0x1ad9dc): Section mismatch in reference from the variable s3c2416_cpufreq_driver to the function .init.text:s3c2416_cpufreq_driver_init()
+WARNING: drivers/built-in.o(.text+0x35b5dc): Section mismatch in reference from the function s3c2410a_cpufreq_add() to the function .init.text:s3c_cpufreq_register()
+
+This removes the __init markings.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/s3c2416-cpufreq.c | 4 ++--
+ drivers/cpufreq/s3c24xx-cpufreq.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/s3c2416-cpufreq.c
++++ b/drivers/cpufreq/s3c2416-cpufreq.c
+@@ -263,7 +263,7 @@ out:
+ }
+
+ #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE
+-static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
++static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
+ {
+ int count, v, i, found;
+ struct cpufreq_frequency_table *pos;
+@@ -333,7 +333,7 @@ static struct notifier_block s3c2416_cpu
+ .notifier_call = s3c2416_cpufreq_reboot_notifier_evt,
+ };
+
+-static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
++static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
+ {
+ struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
+ struct cpufreq_frequency_table *pos;
+--- a/drivers/cpufreq/s3c24xx-cpufreq.c
++++ b/drivers/cpufreq/s3c24xx-cpufreq.c
+@@ -454,7 +454,7 @@ static struct cpufreq_driver s3c24xx_dri
+ };
+
+
+-int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info)
++int s3c_cpufreq_register(struct s3c_cpufreq_info *info)
+ {
+ if (!info || !info->name) {
+ printk(KERN_ERR "%s: failed to pass valid information\n",
--- /dev/null
+From 67fadaa2768716209ee19a8b8bf05bc3ac399445 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 18 Feb 2015 21:55:53 +0100
+Subject: cpufreq: s3c: remove last use of resume_clocks callback
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 67fadaa2768716209ee19a8b8bf05bc3ac399445 upstream.
+
+Commit 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code")
+already removed the callback pointer, but there was one remaining
+user:
+
+drivers/cpufreq/s3c24xx-cpufreq.c: In function 's3c_cpufreq_resume_clocks':
+drivers/cpufreq/s3c24xx-cpufreq.c:149:14: error: 'struct s3c_cpufreq_info' has no member named 'resume_clocks'
+ cpu_cur.info->resume_clocks();
+ ^
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code")
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/s3c24xx-cpufreq.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/cpufreq/s3c24xx-cpufreq.c
++++ b/drivers/cpufreq/s3c24xx-cpufreq.c
+@@ -144,11 +144,6 @@ static void s3c_cpufreq_setfvco(struct s
+ (cfg->info->set_fvco)(cfg);
+ }
+
+-static inline void s3c_cpufreq_resume_clocks(void)
+-{
+- cpu_cur.info->resume_clocks();
+-}
+-
+ static inline void s3c_cpufreq_updateclk(struct clk *clk,
+ unsigned int freq)
+ {
+@@ -417,9 +412,6 @@ static int s3c_cpufreq_resume(struct cpu
+
+ last_target = ~0; /* invalidate last_target setting */
+
+- /* first, find out what speed we resumed at. */
+- s3c_cpufreq_resume_clocks();
+-
+ /* whilst we will be called later on, we try and re-set the
+ * cpu frequencies as soon as possible so that we do not end
+ * up resuming devices and then immediately having to re-set
--- /dev/null
+From 6ffae8c06fab058d6c3f8ecb7f921327721034e7 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Sat, 31 Jan 2015 06:02:44 +0530
+Subject: cpufreq: Set cpufreq_cpu_data to NULL before putting kobject
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 6ffae8c06fab058d6c3f8ecb7f921327721034e7 upstream.
+
+In __cpufreq_remove_dev_finish(), per-cpu 'cpufreq_cpu_data' needs
+to be cleared before calling kobject_put(&policy->kobj) and under
+cpufreq_driver_lock. Otherwise, if someone else calls cpufreq_cpu_get()
+in parallel with it, they can obtain a non-NULL policy from that after
+kobject_put(&policy->kobj) was executed.
+
+Consider this case:
+
+Thread A Thread B
+cpufreq_cpu_get()
+ acquire cpufreq_driver_lock
+ read-per-cpu cpufreq_cpu_data
+ kobject_put(&policy->kobj);
+ kobject_get(&policy->kobj);
+ ...
+ per_cpu(&cpufreq_cpu_data, cpu) = NULL
+
+And this will result in a warning like this one:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 4 at include/linux/kref.h:47
+ kobject_get+0x41/0x50()
+ Modules linked in: acpi_cpufreq(+) nfsd auth_rpcgss nfs_acl
+ lockd grace sunrpc xfs libcrc32c sd_mod ixgbe igb mdio ahci hwmon
+ ...
+ Call Trace:
+ [<ffffffff81661b14>] dump_stack+0x46/0x58
+ [<ffffffff81072b61>] warn_slowpath_common+0x81/0xa0
+ [<ffffffff81072c7a>] warn_slowpath_null+0x1a/0x20
+ [<ffffffff812e16d1>] kobject_get+0x41/0x50
+ [<ffffffff815262a5>] cpufreq_cpu_get+0x75/0xc0
+ [<ffffffff81527c3e>] cpufreq_update_policy+0x2e/0x1f0
+ [<ffffffff810b8cb2>] ? up+0x32/0x50
+ [<ffffffff81381aa9>] ? acpi_ns_get_node+0xcb/0xf2
+ [<ffffffff81381efd>] ? acpi_evaluate_object+0x22c/0x252
+ [<ffffffff813824f6>] ? acpi_get_handle+0x95/0xc0
+ [<ffffffff81360967>] ? acpi_has_method+0x25/0x40
+ [<ffffffff81391e08>] acpi_processor_ppc_has_changed+0x77/0x82
+ [<ffffffff81089566>] ? move_linked_works+0x66/0x90
+ [<ffffffff8138e8ed>] acpi_processor_notify+0x58/0xe7
+ [<ffffffff8137410c>] acpi_ev_notify_dispatch+0x44/0x5c
+ [<ffffffff8135f293>] acpi_os_execute_deferred+0x15/0x22
+ [<ffffffff8108c910>] process_one_work+0x160/0x410
+ [<ffffffff8108d05b>] worker_thread+0x11b/0x520
+ [<ffffffff8108cf40>] ? rescuer_thread+0x380/0x380
+ [<ffffffff81092421>] kthread+0xe1/0x100
+ [<ffffffff81092340>] ? kthread_create_on_node+0x1b0/0x1b0
+ [<ffffffff81669ebc>] ret_from_fork+0x7c/0xb0
+ [<ffffffff81092340>] ? kthread_create_on_node+0x1b0/0x1b0
+ ---[ end trace 89e66eb9795efdf7 ]---
+
+The actual code flow is as follows:
+
+ Thread A: Workqueue: kacpi_notify
+
+ acpi_processor_notify()
+ acpi_processor_ppc_has_changed()
+ cpufreq_update_policy()
+ cpufreq_cpu_get()
+ kobject_get()
+
+ Thread B: xenbus_thread()
+
+ xenbus_thread()
+ msg->u.watch.handle->callback()
+ handle_vcpu_hotplug_event()
+ vcpu_hotplug()
+ cpu_down()
+ __cpu_notify(CPU_POST_DEAD..)
+ cpufreq_cpu_callback()
+ __cpufreq_remove_dev_finish()
+ cpufreq_policy_put_kobj()
+ kobject_put()
+
+cpufreq_cpu_get() gets the policy from per-cpu variable cpufreq_cpu_data
+under cpufreq_driver_lock, and once it gets a valid policy it expects it
+to not be freed until cpufreq_cpu_put() is called.
+
+But the race happens when another thread puts the kobject first and updates
+cpufreq_cpu_data before or later. And so the first thread gets a valid policy
+structure and before it does kobject_get() on it, the second one has already
+done kobject_put().
+
+Fix this by setting cpufreq_cpu_data to NULL before putting the kobject and that
+too under locks.
+
+Reported-by: Ethan Zhao <ethan.zhao@oracle.com>
+Reported-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1416,9 +1416,10 @@ static int __cpufreq_remove_dev_finish(s
+ unsigned long flags;
+ struct cpufreq_policy *policy;
+
+- read_lock_irqsave(&cpufreq_driver_lock, flags);
++ write_lock_irqsave(&cpufreq_driver_lock, flags);
+ policy = per_cpu(cpufreq_cpu_data, cpu);
+- read_unlock_irqrestore(&cpufreq_driver_lock, flags);
++ per_cpu(cpufreq_cpu_data, cpu) = NULL;
++ write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+
+ if (!policy) {
+ pr_debug("%s: No cpu_data found\n", __func__);
+@@ -1473,7 +1474,6 @@ static int __cpufreq_remove_dev_finish(s
+ }
+ }
+
+- per_cpu(cpufreq_cpu_data, cpu) = NULL;
+ return 0;
+ }
+
--- /dev/null
+From d4d4eda23794c701442e55129dd4f8f2fefd5e4d Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 9 Feb 2015 13:38:17 -0500
+Subject: cpufreq: speedstep-smi: enable interrupts when waiting
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d4d4eda23794c701442e55129dd4f8f2fefd5e4d upstream.
+
+On Dell Latitude C600 laptop with Pentium 3 850MHz processor, the
+speedstep-smi driver sometimes loads and sometimes doesn't load with
+"change to state X failed" message.
+
+The hardware sometimes refuses to change frequency and in this case, we
+need to retry later. I found out that we need to enable interrupts while
+waiting. When we enable interrupts, the hardware blockage that prevents
+frequency transition resolves and the transition is possible. With
+disabled interrupts, the blockage doesn't resolve (no matter how long do
+we wait). The exact reasons for this hardware behavior are unknown.
+
+This patch enables interrupts in the function speedstep_set_state that can
+be called with disabled interrupts. However, this function is called with
+disabled interrupts only from speedstep_get_freqs, so it shouldn't cause
+any problem.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/speedstep-lib.c | 3 +++
+ drivers/cpufreq/speedstep-smi.c | 12 ++++++++++++
+ 2 files changed, 15 insertions(+)
+
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum sp
+
+ pr_debug("previous speed is %u\n", prev_speed);
+
++ preempt_disable();
+ local_irq_save(flags);
+
+ /* switch to low state */
+@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum sp
+
+ out:
+ local_irq_restore(flags);
++ preempt_enable();
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(speedstep_get_freqs);
+--- a/drivers/cpufreq/speedstep-smi.c
++++ b/drivers/cpufreq/speedstep-smi.c
+@@ -156,6 +156,7 @@ static void speedstep_set_state(unsigned
+ return;
+
+ /* Disable IRQs */
++ preempt_disable();
+ local_irq_save(flags);
+
+ command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
+@@ -166,9 +167,19 @@ static void speedstep_set_state(unsigned
+
+ do {
+ if (retry) {
++ /*
++ * We need to enable interrupts, otherwise the blockage
++ * won't resolve.
++ *
++ * We disable preemption so that other processes don't
++ * run. If other processes were running, they could
++ * submit more DMA requests, making the blockage worse.
++ */
+ pr_debug("retry %u, previous result %u, waiting...\n",
+ retry, result);
++ local_irq_enable();
+ mdelay(retry * 50);
++ local_irq_disable();
+ }
+ retry++;
+ __asm__ __volatile__(
+@@ -185,6 +196,7 @@ static void speedstep_set_state(unsigned
+
+ /* enable IRQs */
+ local_irq_restore(flags);
++ preempt_enable();
+
+ if (new_state == state)
+ pr_debug("change to %u MHz succeeded after %u tries "
--- /dev/null
+From fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:41 -0300
+Subject: [media] em28xx-audio: fix missing newlines, again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-audio. Fix these.
+
+Fixes: 6d746f91f230 ("[media] em28xx-audio: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -1005,7 +1005,7 @@ static int em28xx_audio_suspend(struct e
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Suspending audio extension");
++ em28xx_info("Suspending audio extension\n");
+ em28xx_deinit_isoc_audio(dev);
+ atomic_set(&dev->adev.stream_started, 0);
+ return 0;
+@@ -1019,7 +1019,7 @@ static int em28xx_audio_resume(struct em
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Resuming audio extension");
++ em28xx_info("Resuming audio extension\n");
+ /* Nothing to do other than schedule_work() ?? */
+ schedule_work(&dev->adev.wq_trigger);
+ return 0;
--- /dev/null
+From 7818b0aab87b680fb10f68eccebeeb6cd8283c73 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:36 -0300
+Subject: [media] em28xx-audio: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 7818b0aab87b680fb10f68eccebeeb6cd8283c73 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-audio. Fix these.
+
+Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -820,7 +820,7 @@ static int em28xx_audio_urb_init(struct
+ if (urb_size > ep_size * npackets)
+ npackets = DIV_ROUND_UP(urb_size, ep_size);
+
+- em28xx_info("Number of URBs: %d, with %d packets and %d size",
++ em28xx_info("Number of URBs: %d, with %d packets and %d size\n",
+ num_urb, npackets, urb_size);
+
+ /* Estimate the bytes per period */
--- /dev/null
+From 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:31 -0300
+Subject: [media] em28xx-core: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-core. Fix these.
+
+Fixes: 9c669b731470 ("[media] em28xx: add suspend/resume to em28xx_ops")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -1125,7 +1125,7 @@ int em28xx_suspend_extension(struct em28
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Suspending extensions");
++ em28xx_info("Suspending extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->suspend)
+@@ -1139,7 +1139,7 @@ int em28xx_resume_extension(struct em28x
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Resuming extensions");
++ em28xx_info("Resuming extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->resume)
--- /dev/null
+From a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:46 -0300
+Subject: [media] em28xx-dvb: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-dvb. Fix these.
+
+Fixes: ca2b46dacbf5 ("[media] em28xx-dvb: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-dvb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1775,17 +1775,17 @@ static int em28xx_dvb_suspend(struct em2
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Suspending DVB extension");
++ em28xx_info("Suspending DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_suspend(dvb->fe[0]);
+- em28xx_info("fe0 suspend %d", ret);
++ em28xx_info("fe0 suspend %d\n", ret);
+ }
+ if (dvb->fe[1]) {
+ dvb_frontend_suspend(dvb->fe[1]);
+- em28xx_info("fe1 suspend %d", ret);
++ em28xx_info("fe1 suspend %d\n", ret);
+ }
+ }
+
+@@ -1802,18 +1802,18 @@ static int em28xx_dvb_resume(struct em28
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Resuming DVB extension");
++ em28xx_info("Resuming DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_resume(dvb->fe[0]);
+- em28xx_info("fe0 resume %d", ret);
++ em28xx_info("fe0 resume %d\n", ret);
+ }
+
+ if (dvb->fe[1]) {
+ ret = dvb_frontend_resume(dvb->fe[1]);
+- em28xx_info("fe1 resume %d", ret);
++ em28xx_info("fe1 resume %d\n", ret);
+ }
+ }
+
--- /dev/null
+From 0418ca6073478f54f1da2e4013fa50d36838de75 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:20 -0300
+Subject: [media] em28xx: ensure "closing" messages terminate with a newline
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 0418ca6073478f54f1da2e4013fa50d36838de75 upstream.
+
+The lockdep splat addressed in a previous commit revealed that at
+least one message in em28xx-input.c was missing a new line:
+
+em28178 #0: Closing input extensionINFO: trying to register non-static key.
+
+Further inspection shows several other messages also miss a new line.
+These will be fixed in a subsequent patch.
+
+Fixes: aa929ad783c0 ("[media] em28xx: print a message at disconnect")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-dvb.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-input.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-video.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -981,7 +981,7 @@ static int em28xx_audio_fini(struct em28
+ return 0;
+ }
+
+- em28xx_info("Closing audio extension");
++ em28xx_info("Closing audio extension\n");
+
+ if (dev->adev.sndcard) {
+ snd_card_disconnect(dev->adev.sndcard);
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1724,7 +1724,7 @@ static int em28xx_dvb_fini(struct em28xx
+ if (!dev->dvb)
+ return 0;
+
+- em28xx_info("Closing DVB extension");
++ em28xx_info("Closing DVB extension\n");
+
+ dvb = dev->dvb;
+ client = dvb->i2c_client_tuner;
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -832,7 +832,7 @@ static int em28xx_ir_fini(struct em28xx
+ return 0;
+ }
+
+- em28xx_info("Closing input extension");
++ em28xx_info("Closing input extension\n");
+
+ em28xx_shutdown_buttons(dev);
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1958,7 +1958,7 @@ static int em28xx_v4l2_fini(struct em28x
+ if (v4l2 == NULL)
+ return 0;
+
+- em28xx_info("Closing video extension");
++ em28xx_info("Closing video extension\n");
+
+ mutex_lock(&dev->lock);
+
--- /dev/null
+From bbfebeea7640973613c484f0281bdd15d68fd873 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:15 -0300
+Subject: [media] em28xx: fix em28xx-input removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit bbfebeea7640973613c484f0281bdd15d68fd873 upstream.
+
+Removing the em28xx-rc module results in the following lockdep splat,
+which is caused by trying to call cancel_delayed_work_sync() on an
+uninitialised delayed work. Fix this by ensuring we always initialise
+the work.
+
+INFO: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+CPU: 0 PID: 2183 Comm: rmmod Not tainted 3.18.0+ #1464
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Backtrace:
+[<c0012228>] (dump_backtrace) from [<c00123c0>] (show_stack+0x18/0x1c)
+ r6:c1419d2c r5:00000000 r4:00000000 r3:00000000
+[<c00123a8>] (show_stack) from [<c06e2550>] (dump_stack+0x7c/0x98)
+[<c06e24d4>] (dump_stack) from [<c0061c94>] (__lock_acquire+0x16d4/0x1bb0)
+ r4:edf19f74 r3:df049380
+[<c00605c0>] (__lock_acquire) from [<c00626d4>] (lock_acquire+0xb0/0x124)
+ r10:00000000 r9:c003ba90 r8:00000000 r7:00000000 r6:00000000 r5:edf19f74
+ r4:00000000
+[<c0062624>] (lock_acquire) from [<c003bad4>] (flush_work+0x44/0x264)
+ r10:00000000 r9:eaa86000 r8:edf190b0 r7:edf19f74 r6:00000001 r5:edf19f64
+ r4:00000000
+[<c003ba90>] (flush_work) from [<c003d8f0>] (__cancel_work_timer+0x8c/0x124)
+ r7:00000000 r6:00000001 r5:00000000 r4:edf19f64
+[<c003d864>] (__cancel_work_timer) from [<c003d99c>] (cancel_delayed_work_sync+0x14/0x18)
+ r7:00000000 r6:eccc3600 r5:00000000 r4:edf19000
+[<c003d988>] (cancel_delayed_work_sync) from [<bf0b5c10>] (em28xx_ir_fini+0x48/0xd8 [em28xx_rc])
+[<bf0b5bc8>] (em28xx_ir_fini [em28xx_rc]) from [<bf08a0a8>] (em28xx_unregister_extension+0x40/0x94 [em28xx])
+ r8:c000edc4 r7:00000081 r6:bf092bf4 r5:bf0b6a2c r4:edf19000 r3:bf0b5bc8
+[<bf08a068>] (em28xx_unregister_extension [em28xx]) from [<bf0b64dc>] (em28xx_rc_unregister+0x14/0x1c [em28xx_rc])
+ r6:00000800 r5:00000000 r4:bf0b6a50 r3:bf0b64c8
+[<bf0b64c8>] (em28xx_rc_unregister [em28xx_rc]) from [<c0096710>] (SyS_delete_module+0x11c/0x180)
+[<c00965f4>] (SyS_delete_module) from [<c000ec00>] (ret_fast_syscall+0x0/0x48)
+ r6:00000001 r5:beb0f813 r4:b8b17d00
+
+Fixes: f52226099382 ("[media] em28xx: extend the support for device buttons")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-input.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -654,8 +654,6 @@ next_button:
+ if (dev->num_button_polling_addresses) {
+ memset(dev->button_polling_last_values, 0,
+ EM28XX_NUM_BUTTON_ADDRESSES_MAX);
+- INIT_DELAYED_WORK(&dev->buttons_query_work,
+- em28xx_query_buttons);
+ schedule_delayed_work(&dev->buttons_query_work,
+ msecs_to_jiffies(dev->button_polling_interval));
+ }
+@@ -689,6 +687,7 @@ static int em28xx_ir_init(struct em28xx
+ }
+
+ kref_get(&dev->ref);
++ INIT_DELAYED_WORK(&dev->buttons_query_work, em28xx_query_buttons);
+
+ if (dev->board.buttons)
+ em28xx_init_buttons(dev);
--- /dev/null
+From ebfd59cf549899a166d595bf1eab7eec3299ebe7 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:26 -0300
+Subject: [media] em28xx-input: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit ebfd59cf549899a166d595bf1eab7eec3299ebe7 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-input. Fix these.
+
+Fixes: 5025076aadfe ("[media] em28xx-input: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-input.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -861,7 +861,7 @@ static int em28xx_ir_suspend(struct em28
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Suspending input extension");
++ em28xx_info("Suspending input extension\n");
+ if (ir)
+ cancel_delayed_work_sync(&ir->work);
+ cancel_delayed_work_sync(&dev->buttons_query_work);
+@@ -878,7 +878,7 @@ static int em28xx_ir_resume(struct em28x
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Resuming input extension");
++ em28xx_info("Resuming input extension\n");
+ /* if suspend calls ir_raw_event_unregister(), the should call
+ ir_raw_event_register() */
+ if (ir)
--- /dev/null
+From 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:51 -0300
+Subject: [media] em28xx-video: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-video. Fix these.
+
+Fixes: a61f68119af3 ("[media] em28xx-video: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -2007,7 +2007,7 @@ static int em28xx_v4l2_suspend(struct em
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Suspending video extension");
++ em28xx_info("Suspending video extension\n");
+ em28xx_stop_urbs(dev);
+ return 0;
+ }
+@@ -2020,7 +2020,7 @@ static int em28xx_v4l2_resume(struct em2
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Resuming video extension");
++ em28xx_info("Resuming video extension\n");
+ /* what do we do here */
+ return 0;
+ }
--- /dev/null
+From 15e1ce33182d1d5dbd8efe8d382b9352dc857527 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 2 Jan 2015 10:56:28 -0300
+Subject: [media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 15e1ce33182d1d5dbd8efe8d382b9352dc857527 upstream.
+
+A quirk of some older firmwares that report endpoint pipe type as PIPE_BULK
+but the endpoint otheriwse functions as interrupt.
+
+Check if usb_endpoint_type is USB_ENDPOINT_XFER_BULK and set as usb_rcvbulkpipe.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -354,6 +354,7 @@ static int lme2510_int_read(struct dvb_u
+ {
+ struct dvb_usb_device *d = adap_to_d(adap);
+ struct lme2510_state *lme_int = adap_to_priv(adap);
++ struct usb_host_endpoint *ep;
+
+ lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
+
+@@ -375,6 +376,12 @@ static int lme2510_int_read(struct dvb_u
+ adap,
+ 8);
+
++ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
++ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++
++ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++
+ lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
--- /dev/null
+From cfcd7b825892cb498c6bcb13257f2141f7eacb76 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 2 Jan 2015 10:56:27 -0300
+Subject: [media] lmedm04: Increase Interupt due time to 200 msec
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit cfcd7b825892cb498c6bcb13257f2141f7eacb76 upstream.
+
+Ocassionally the device fails to report back an interrupt urb status which
+results in false no lock trigger on the RS2000 demodulator.
+
+Increase time from 60 msecs to 200 msecs.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -344,9 +344,10 @@ static void lme2510_int_response(struct
+
+ usb_submit_urb(lme_urb, GFP_ATOMIC);
+
+- /* interrupt urb is due every 48 msecs while streaming
+- * add 12msecs for system lag */
+- st->int_urb_due = jiffies + msecs_to_jiffies(60);
++ /* Interrupt urb is due every 48 msecs while streaming the buffer
++ * stores up to 4 periods if missed. Allow 200 msec for next interrupt.
++ */
++ st->int_urb_due = jiffies + msecs_to_jiffies(200);
+ }
+
+ static int lme2510_int_read(struct dvb_usb_adapter *adap)
--- /dev/null
+From c8dd61eff2780c481fcf919c1572e16e397c714e Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:06:18 +0530
+Subject: megaraid_sas: complete outstanding IOCTLs before killing adapter
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit c8dd61eff2780c481fcf919c1572e16e397c714e upstream.
+
+Driver calls megasas_complete_cmd() to call wake_up() for each MFI frame
+that was issued through the ioctl() interface prior to the kill adapter.
+This ensures userspace ioctl() system calls issued just before a kill
+adapter don't get stuck in wait state and IOCTLs are returned to
+the application.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Chaitra Basappa <chaitra.basappa@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 65 +++++++++++++++++++++++-----
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 -
+ 2 files changed, 54 insertions(+), 15 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1689,22 +1689,66 @@ static int megasas_slave_alloc(struct sc
+ return 0;
+ }
+
++/*
++* megasas_complete_outstanding_ioctls - Complete outstanding ioctls after a
++* kill adapter
++* @instance: Adapter soft state
++*
++*/
++void megasas_complete_outstanding_ioctls(struct megasas_instance *instance)
++{
++ int i;
++ struct megasas_cmd *cmd_mfi;
++ struct megasas_cmd_fusion *cmd_fusion;
++ struct fusion_context *fusion = instance->ctrl_context;
++
++ /* Find all outstanding ioctls */
++ if (fusion) {
++ for (i = 0; i < instance->max_fw_cmds; i++) {
++ cmd_fusion = fusion->cmd_list[i];
++ if (cmd_fusion->sync_cmd_idx != (u32)ULONG_MAX) {
++ cmd_mfi = instance->cmd_list[cmd_fusion->sync_cmd_idx];
++ if (cmd_mfi->sync_cmd &&
++ cmd_mfi->frame->hdr.cmd != MFI_CMD_ABORT)
++ megasas_complete_cmd(instance,
++ cmd_mfi, DID_OK);
++ }
++ }
++ } else {
++ for (i = 0; i < instance->max_fw_cmds; i++) {
++ cmd_mfi = instance->cmd_list[i];
++ if (cmd_mfi->sync_cmd && cmd_mfi->frame->hdr.cmd !=
++ MFI_CMD_ABORT)
++ megasas_complete_cmd(instance, cmd_mfi, DID_OK);
++ }
++ }
++}
++
++
+ void megaraid_sas_kill_hba(struct megasas_instance *instance)
+ {
++ /* Set critical error to block I/O & ioctls in case caller didn't */
++ instance->adprecovery = MEGASAS_HW_CRITICAL_ERROR;
++ /* Wait 1 second to ensure IO or ioctls in build have posted */
++ msleep(1000);
+ if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+- (instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
+- (instance->pdev->device == PCI_DEVICE_ID_LSI_FUSION) ||
+- (instance->pdev->device == PCI_DEVICE_ID_LSI_PLASMA) ||
+- (instance->pdev->device == PCI_DEVICE_ID_LSI_INVADER) ||
+- (instance->pdev->device == PCI_DEVICE_ID_LSI_FURY)) {
+- writel(MFI_STOP_ADP, &instance->reg_set->doorbell);
++ (instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
++ (instance->pdev->device == PCI_DEVICE_ID_LSI_FUSION) ||
++ (instance->pdev->device == PCI_DEVICE_ID_LSI_PLASMA) ||
++ (instance->pdev->device == PCI_DEVICE_ID_LSI_INVADER) ||
++ (instance->pdev->device == PCI_DEVICE_ID_LSI_FURY)) {
++ writel(MFI_STOP_ADP,
++ &instance->reg_set->doorbell);
+ /* Flush */
+ readl(&instance->reg_set->doorbell);
+ if (instance->mpio && instance->requestorId)
+ memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS);
+ } else {
+- writel(MFI_STOP_ADP, &instance->reg_set->inbound_doorbell);
++ writel(MFI_STOP_ADP,
++ &instance->reg_set->inbound_doorbell);
+ }
++ /* Complete outstanding ioctls when adapter is killed */
++ megasas_complete_outstanding_ioctls(instance);
+ }
+
+ /**
+@@ -3028,10 +3072,9 @@ megasas_issue_pending_cmds_again(struct
+ "was tried multiple times during reset."
+ "Shutting down the HBA\n",
+ cmd, cmd->scmd, cmd->sync_cmd);
++ instance->instancet->disable_intr(instance);
++ atomic_set(&instance->fw_reset_no_pci_access, 1);
+ megaraid_sas_kill_hba(instance);
+-
+- instance->adprecovery =
+- MEGASAS_HW_CRITICAL_ERROR;
+ return;
+ }
+ }
+@@ -3165,8 +3208,8 @@ process_fw_state_change_wq(struct work_s
+ if (megasas_transition_to_ready(instance, 1)) {
+ printk(KERN_NOTICE "megaraid_sas:adapter not ready\n");
+
++ atomic_set(&instance->fw_reset_no_pci_access, 1);
+ megaraid_sas_kill_hba(instance);
+- instance->adprecovery = MEGASAS_HW_CRITICAL_ERROR;
+ return ;
+ }
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2622,7 +2622,6 @@ int megasas_reset_fusion(struct Scsi_Hos
+ instance->host->host_no);
+ megaraid_sas_kill_hba(instance);
+ instance->skip_heartbeat_timer_del = 1;
+- instance->adprecovery = MEGASAS_HW_CRITICAL_ERROR;
+ retval = FAILED;
+ goto out;
+ }
+@@ -2818,8 +2817,6 @@ int megasas_reset_fusion(struct Scsi_Hos
+ dev_info(&instance->pdev->dev,
+ "Failed from %s %d\n",
+ __func__, __LINE__);
+- instance->adprecovery =
+- MEGASAS_HW_CRITICAL_ERROR;
+ megaraid_sas_kill_hba(instance);
+ retval = FAILED;
+ }
+@@ -2868,7 +2865,6 @@ int megasas_reset_fusion(struct Scsi_Hos
+ "adapter scsi%d.\n", instance->host->host_no);
+ megaraid_sas_kill_hba(instance);
+ instance->skip_heartbeat_timer_del = 1;
+- instance->adprecovery = MEGASAS_HW_CRITICAL_ERROR;
+ retval = FAILED;
+ } else {
+ /* For VF: Restart HB timer if we didn't OCR */
--- /dev/null
+From c2ced1719a1b903350955a511e1666e6d05a7f5b Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:06:13 +0530
+Subject: megaraid_sas: disable interrupt_mask before enabling hardware interrupts
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit c2ced1719a1b903350955a511e1666e6d05a7f5b upstream.
+
+Update driver "mask_interrupts" before enable/disable hardware interrupt
+in order to avoid missing interrupts because of "mask_interrupts" still
+set to 1 and hardware interrupts are enabled.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Chaitra Basappa <chaitra.basappa@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -103,6 +103,8 @@ megasas_enable_intr_fusion(struct megasa
+ {
+ struct megasas_register_set __iomem *regs;
+ regs = instance->reg_set;
++
++ instance->mask_interrupts = 0;
+ /* For Thunderbolt/Invader also clear intr on enable */
+ writel(~0, ®s->outbound_intr_status);
+ readl(®s->outbound_intr_status);
+@@ -111,7 +113,6 @@ megasas_enable_intr_fusion(struct megasa
+
+ /* Dummy readl to force pci flush */
+ readl(®s->outbound_intr_mask);
+- instance->mask_interrupts = 0;
+ }
+
+ /**
--- /dev/null
+From 200aed582d6170a2687cd69095469b663f69f16f Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:05:58 +0530
+Subject: megaraid_sas: endianness related bug fixes and code optimization
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit 200aed582d6170a2687cd69095469b663f69f16f upstream.
+
+This patch addresses below issues:
+
+1) Few endianness bug fixes.
+2) Break the iteration after (MAX_LOGICAL_DRIVES_EXT - 1)),
+ instead of MAX_LOGICAL_DRIVES_EXT.
+3) Optimization in MFI INIT frame before firing.
+4) MFI IO frame should be 256bytes aligned. Code is optimized to reduce
+ the size of frame for fusion adapters and make the MFI frame size
+ calculation a bit transparent and readable.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Chaitra Basappa <chaitra.basappa@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 24 +++++++++++-------------
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 14 ++++++++------
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 7 +++----
+ drivers/scsi/megaraid/megaraid_sas_fusion.h | 9 ++-------
+ 4 files changed, 24 insertions(+), 30 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3547,7 +3547,6 @@ static int megasas_create_frame_pool(str
+ int i;
+ u32 max_cmd;
+ u32 sge_sz;
+- u32 sgl_sz;
+ u32 total_sz;
+ u32 frame_count;
+ struct megasas_cmd *cmd;
+@@ -3566,24 +3565,23 @@ static int megasas_create_frame_pool(str
+ }
+
+ /*
+- * Calculated the number of 64byte frames required for SGL
++ * For MFI controllers.
++ * max_num_sge = 60
++ * max_sge_sz = 16 byte (sizeof megasas_sge_skinny)
++ * Total 960 byte (15 MFI frame of 64 byte)
++ *
++ * Fusion adapter require only 3 extra frame.
++ * max_num_sge = 16 (defined as MAX_IOCTL_SGE)
++ * max_sge_sz = 12 byte (sizeof megasas_sge64)
++ * Total 192 byte (3 MFI frame of 64 byte)
+ */
+- sgl_sz = sge_sz * instance->max_num_sge;
+- frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE;
+- frame_count = 15;
+-
+- /*
+- * We need one extra frame for the MFI command
+- */
+- frame_count++;
+-
++ frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1);
+ total_sz = MEGAMFI_FRAME_SIZE * frame_count;
+ /*
+ * Use DMA pool facility provided by PCI layer
+ */
+ instance->frame_dma_pool = pci_pool_create("megasas frame pool",
+- instance->pdev, total_sz, 64,
+- 0);
++ instance->pdev, total_sz, 256, 0);
+
+ if (!instance->frame_dma_pool) {
+ printk(KERN_DEBUG "megasas: failed to setup frame pool\n");
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -172,6 +172,7 @@ void MR_PopulateDrvRaidMap(struct megasa
+ struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL;
+ struct MR_FW_RAID_MAP *pFwRaidMap = NULL;
+ int i;
++ u16 ld_count;
+
+
+ struct MR_DRV_RAID_MAP_ALL *drv_map =
+@@ -191,9 +192,10 @@ void MR_PopulateDrvRaidMap(struct megasa
+ fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
+ fusion->ld_map[(instance->map_id & 1)];
+ pFwRaidMap = &fw_map_old->raidMap;
++ ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount);
+
+ #if VD_EXT_DEBUG
+- for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) {
++ for (i = 0; i < ld_count; i++) {
+ dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
+ "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
+ instance->unique_id, i,
+@@ -205,12 +207,12 @@ void MR_PopulateDrvRaidMap(struct megasa
+
+ memset(drv_map, 0, fusion->drv_map_sz);
+ pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
+- pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount;
++ pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
+ pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
+- for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) {
++ for (i = 0; i < ld_count; i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+ dev_dbg(&instance->pdev->dev,
+@@ -252,7 +254,7 @@ u8 MR_ValidateMapInfo(struct megasas_ins
+ struct LD_LOAD_BALANCE_INFO *lbInfo;
+ PLD_SPAN_INFO ldSpanInfo;
+ struct MR_LD_RAID *raid;
+- int ldCount, num_lds;
++ u16 ldCount, num_lds;
+ u16 ld;
+ u32 expected_size;
+
+@@ -356,7 +358,7 @@ static int getSpanInfo(struct MR_DRV_RAI
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ dev_dbg(&instance->pdev->dev, "LD %x: span_depth=%x\n",
+@@ -1157,7 +1159,7 @@ void mr_update_span_set(struct MR_DRV_RA
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ for (element = 0; element < MAX_QUAD_DEPTH; element++) {
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -698,12 +698,11 @@ megasas_ioc_init_fusion(struct megasas_i
+ cpu_to_le32(lower_32_bits(ioc_init_handle));
+ init_frame->data_xfer_len = cpu_to_le32(sizeof(struct MPI2_IOC_INIT_REQUEST));
+
+- req_desc.Words = 0;
++ req_desc.u.low = cpu_to_le32(lower_32_bits(cmd->frame_phys_addr));
++ req_desc.u.high = cpu_to_le32(upper_32_bits(cmd->frame_phys_addr));
+ req_desc.MFAIo.RequestFlags =
+ (MEGASAS_REQ_DESCRIPT_FLAGS_MFA <<
+- MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+- cpu_to_le32s((u32 *)&req_desc.MFAIo);
+- req_desc.Words |= cpu_to_le64(cmd->frame_phys_addr);
++ MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+
+ /*
+ * disable the intr before firing the init frame
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+@@ -306,14 +306,9 @@ struct MPI2_RAID_SCSI_IO_REQUEST {
+ * MPT RAID MFA IO Descriptor.
+ */
+ struct MEGASAS_RAID_MFA_IO_REQUEST_DESCRIPTOR {
+-#if defined(__BIG_ENDIAN_BITFIELD)
+- u32 MessageAddress1:24; /* bits 31:8*/
+ u32 RequestFlags:8;
+-#else
+- u32 RequestFlags:8;
+- u32 MessageAddress1:24; /* bits 31:8*/
+-#endif
+- u32 MessageAddress2; /* bits 61:32 */
++ u32 MessageAddress1:24;
++ u32 MessageAddress2;
+ };
+
+ /* Default Request Descriptor */
--- /dev/null
+From ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:06:08 +0530
+Subject: megaraid_sas: fix the problem of non-existing VD exposed to host
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 upstream.
+
+This patch will address the issue of SCSI device created at OS level for
+non existing VD. ldTgtIdtoLd[] array has size 256 for Extended VD firmware
+and 128 for legacy firmware. Accessing indices beyond array size (OS will
+send TUR, INQUIRY.. commands upto device index 255), may return valid LD
+value and that particular SCSI command will be SUCCESS and creating SCSI
+device for non existing target(VD).
+
+For legacy firmware (64 VD firmware), invalidates LD (by setting LD value
+to 0xff) in LdTgtIdtoLd[] array for device index beyond 127, so that
+invalid LD(0xff) value should be returned beyond device index beyond 127.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 3 +++
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 14 ++++++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -212,6 +212,9 @@ void MR_PopulateDrvRaidMap(struct megasa
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
++ for (i = (MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS);
++ i < MAX_LOGICAL_DRIVES_EXT; i++)
++ pDrvRaidMap->ldTgtIdToLd[i] = 0xff;
+ for (i = 0; i < ld_count; i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1716,9 +1716,19 @@ megasas_build_dcdb_fusion(struct megasas
+ if (scmd->device->channel < MEGASAS_MAX_PD_CHANNELS)
+ goto NonFastPath;
+
++ /*
++ * For older firmware, Driver should not access ldTgtIdToLd
++ * beyond index 127 and for Extended VD firmware, ldTgtIdToLd
++ * should not go beyond 255.
++ */
++
++ if ((!fusion->fast_path_io) ||
++ (device_id >= instance->fw_supported_vd_count))
++ goto NonFastPath;
++
+ ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
+- if ((ld >= instance->fw_supported_vd_count) ||
+- (!fusion->fast_path_io))
++
++ if (ld >= instance->fw_supported_vd_count)
+ goto NonFastPath;
+
+ raid = MR_LdRaidGet(ld, local_map_ptr);
--- /dev/null
+From 478913fdbdfd4a781d91c993eb86838620fe7421 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Mon, 5 Jan 2015 09:51:48 +0100
+Subject: power: bq24190: Fix ignored supplicants
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 478913fdbdfd4a781d91c993eb86838620fe7421 upstream.
+
+The driver mismatched 'num_supplicants' with 'num_supplies' of
+power_supply structure.
+
+It provided list of supplicants (power_supply.supplied_to) but did
+not set the number of supplicants. Instead it set the num_supplies which
+is used when iterating over number of supplies (power_supply.supplied_from).
+
+As a result the list of supplicants was ignored by core because its size
+was 0.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: d7bf353fd0aa ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/bq24190_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/bq24190_charger.c
++++ b/drivers/power/bq24190_charger.c
+@@ -929,7 +929,7 @@ static void bq24190_charger_init(struct
+ charger->properties = bq24190_charger_properties;
+ charger->num_properties = ARRAY_SIZE(bq24190_charger_properties);
+ charger->supplied_to = bq24190_charger_supplied_to;
+- charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to);
++ charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to);
+ charger->get_property = bq24190_charger_get_property;
+ charger->set_property = bq24190_charger_set_property;
+ charger->property_is_writeable = bq24190_charger_property_is_writeable;
--- /dev/null
+From faeed51bb65ce0241052d8dc24ac331ade12e976 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Thu, 15 Jan 2015 05:00:37 +0300
+Subject: power: gpio-charger: balance enable/disable_irq_wake calls
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit faeed51bb65ce0241052d8dc24ac331ade12e976 upstream.
+
+enable_irq_wakeup returns 0 in case it correctly enabled the IRQ to
+generate the wakeup event (and thus resume should call disable_irq_wake).
+Currently gpio-charger driver has this logic inverted. Correct that thus
+correcting enable/disable_irq_wake() calls balance.
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/gpio-charger.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/gpio-charger.c
++++ b/drivers/power/gpio-charger.c
+@@ -229,7 +229,7 @@ static int gpio_charger_suspend(struct d
+
+ if (device_may_wakeup(dev))
+ gpio_charger->wakeup_enabled =
+- enable_irq_wake(gpio_charger->irq);
++ !enable_irq_wake(gpio_charger->irq);
+
+ return 0;
+ }
+@@ -239,7 +239,7 @@ static int gpio_charger_resume(struct de
+ struct platform_device *pdev = to_platform_device(dev);
+ struct gpio_charger *gpio_charger = platform_get_drvdata(pdev);
+
+- if (gpio_charger->wakeup_enabled)
++ if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled)
+ disable_irq_wake(gpio_charger->irq);
+ power_supply_changed(&gpio_charger->charger);
+
--- /dev/null
+From 24727b45b484e8937dcde53fa8d1aa70ac30ec0c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Tue, 27 Jan 2015 16:51:54 +0100
+Subject: power_supply: 88pm860x: Fix leaked power supply on probe fail
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 24727b45b484e8937dcde53fa8d1aa70ac30ec0c upstream.
+
+Driver forgot to unregister power supply if request_threaded_irq()
+failed in probe(). In such case the memory associated with power supply
+leaked.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/88pm860x_charger.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/power/88pm860x_charger.c
++++ b/drivers/power/88pm860x_charger.c
+@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct p
+ return 0;
+
+ out_irq:
++ power_supply_unregister(&info->usb);
+ while (--i >= 0)
+ free_irq(info->irq[i], info);
+ out:
--- /dev/null
+From 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 8 Dec 2014 13:17:07 -0300
+Subject: [media] rc-main: Re-apply filter for no-op protocol change
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 upstream.
+
+Since commit da6e162d6a46 ("[media] rc-core: simplify sysfs code"), when
+the IR protocol is set using the sysfs interface to the same set of
+protocols that are already set, store_protocols() does not refresh the
+scancode filter with the new protocol, even if it has already called the
+change_protocol() callback successfully. This results in the filter
+being disabled in the hardware and not re-enabled until the filter is
+set again using sysfs.
+
+Fix in store_protocols() by still re-applying the filter whenever the
+change_protocol() driver callback succeeded.
+
+The problem can be reproduced with the img-ir driver by setting a
+filter, and then setting the protocol to the same protocol that is
+already set:
+$ echo nec > protocols
+$ echo 0xffff > filter_mask
+$ echo nec > protocols
+
+After this, messages which don't match the filter were still being
+received.
+
+Fixes: da6e162d6a46 ("[media] rc-core: simplify sysfs code")
+
+Reported-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/rc-main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1021,16 +1021,16 @@ static ssize_t store_protocols(struct de
+ goto out;
+ }
+
+- if (new_protocols == old_protocols) {
+- rc = len;
+- goto out;
++ if (new_protocols != old_protocols) {
++ *current_protocols = new_protocols;
++ IR_dprintk(1, "Protocols changed to 0x%llx\n",
++ (long long)new_protocols);
+ }
+
+- *current_protocols = new_protocols;
+- IR_dprintk(1, "Protocols changed to 0x%llx\n", (long long)new_protocols);
+-
+ /*
+- * If the protocol is changed the filter needs updating.
++ * If a protocol change was attempted the filter may need updating, even
++ * if the actual protocol mask hasn't changed (since the driver may have
++ * cleared the filter).
+ * Try setting the same filter with the new protocol (if any).
+ * Fall back to clearing the filter.
+ */
--- /dev/null
+From aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 20 Jan 2015 11:01:20 -0600
+Subject: rtlwifi: Remove logging statement that is no longer needed
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 upstream.
+
+In commit e9538cf4f907 ("rtlwifi: Fix error when accessing unmapped memory
+in skb"), a printk was included to indicate that the condition had been
+reached. There is now enough evidence from other users that the fix is
+working. That logging statement can now be removed.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/pci.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -816,11 +816,8 @@ static void _rtl_pci_rx_interrupt(struct
+
+ /* get a new skb - if fail, old one will be reused */
+ new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+- if (unlikely(!new_skb)) {
+- pr_err("Allocation of new skb failed in %s\n",
+- __func__);
++ if (unlikely(!new_skb))
+ goto no_new;
+- }
+ if (rtlpriv->use_new_trx_flow) {
+ buffer_desc =
+ &rtlpci->rx_ring[rxring_idx].buffer_desc
--- /dev/null
+From b661a5da57766f4f565d64238b753d6efc0f5499 Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:22 -0600
+Subject: rtlwifi: rtl8192ee: Fix adhoc fail
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit b661a5da57766f4f565d64238b753d6efc0f5499 upstream.
+
+When the buffer descriptor index exceeds 2, then a TX HANG condition
+will result.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/fw.c | 6 +-----
+ drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 26 --------------------------
+ 2 files changed, 1 insertion(+), 31 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
+ struct sk_buff *skb = NULL;
+
+ u32 totalpacketlen;
+- bool rtstatus;
+ u8 u1rsvdpageloc[5] = { 0 };
+ bool b_dlok = false;
+
+@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
+ memcpy((u8 *)skb_put(skb, totalpacketlen),
+ &reserved_page_packet, totalpacketlen);
+
+- rtstatus = rtl_cmd_send_packet(hw, skb);
+-
+- if (rtstatus)
+- b_dlok = true;
++ b_dlok = true;
+
+ if (b_dlok) {
+ RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func
+ _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
+ }
+
+-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+- struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+- unsigned long flags;
+-
+- spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+- while (skb_queue_len(&ring->queue)) {
+- struct rtl_tx_buffer_desc *entry =
+- &ring->buffer_desc[ring->idx];
+- struct sk_buff *skb = __skb_dequeue(&ring->queue);
+-
+- pci_unmap_single(rtlpci->pdev,
+- rtlpriv->cfg->ops->get_desc(
+- (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+- skb->len, PCI_DMA_TODEVICE);
+- kfree_skb(skb);
+- ring->idx = (ring->idx + 1) % ring->entries;
+- }
+- spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+-}
+-
+ static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
+ {
+ _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
+@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page(
+ rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
+ bcnvalid_reg | BIT(0));
+
+- /* Return Beacon TCB */
+- _rtl92ee_return_beacon_queue_skb(hw);
+-
+ /* download rsvd page */
+ rtl92ee_set_fw_rsvdpagepkt(hw, false);
+
--- /dev/null
+From 21b39ddb5bb2294fe64fbd29045591fe0707825f Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:26 -0600
+Subject: rtlwifi: rtl8192ee: Fix DMA stalls
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 21b39ddb5bb2294fe64fbd29045591fe0707825f upstream.
+
+There are instances where the DMA engine stalls. The new code detects
+such stalls and restarts DMA without needing a power reset.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 140 +++++++++++++++++++++++++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/reg.h | 2
+ 2 files changed, 142 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -1137,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(s
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
+ }
+
++static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
++{
++ u8 tmp;
++
++ /* write reg 0x350 Bit[26]=1. Enable debug port. */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if (!(tmp & BIT(2))) {
++ rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
++ tmp | BIT(2));
++ mdelay(100); /* Suggested by DD Justin_tsai. */
++ }
++
++ /* read reg 0x350 Bit[25] if 1 : RX hang
++ * read reg 0x350 Bit[24] if 1 : TX hang
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if ((tmp & BIT(0)) || (tmp & BIT(1))) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "CheckPcieDMAHang8192EE(): true!!\n");
++ return true;
++ }
++ return false;
++}
++
++static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
++ bool mac_power_on)
++{
++ u8 tmp;
++ bool release_mac_rx_pause;
++ u8 backup_pcie_dma_pause;
++
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "ResetPcieInterfaceDMA8192EE()\n");
++
++ /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
++ * released by SD1 Alan.
++ */
++
++ /* 1. disable register write lock
++ * write 0x1C bit[1:0] = 2'h0
++ * write 0xCC bit[2] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
++ tmp &= ~(BIT(1) | BIT(0));
++ rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp |= BIT(2);
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++
++ /* 2. Check and pause TRX DMA
++ * write 0x284 bit[18] = 1'b1
++ * write 0x301 = 0xFF
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ if (tmp & BIT(2)) {
++ /* Already pause before the function for another reason. */
++ release_mac_rx_pause = false;
++ } else {
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
++ release_mac_rx_pause = true;
++ }
++
++ backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
++ if (backup_pcie_dma_pause != 0xFF)
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
++
++ if (mac_power_on) {
++ /* 3. reset TRX function
++ * write 0x100 = 0x00
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0);
++ }
++
++ /* 4. Reset PCIe DMA
++ * write 0x003 bit[0] = 0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp &= ~(BIT(0));
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ /* 5. Enable PCIe DMA
++ * write 0x003 bit[0] = 1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp |= BIT(0);
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ if (mac_power_on) {
++ /* 6. enable TRX function
++ * write 0x100 = 0xFF
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0xFF);
++
++ /* We should init LLT & RQPN and
++ * prepare Tx/Rx descrptor address later
++ * because MAC function is reset.
++ */
++ }
++
++ /* 7. Restore PCIe autoload down bit
++ * write 0xF8 bit[17] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
++ tmp |= BIT(1);
++ rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
++
++ /* In MAC power on state, BB and RF maybe in ON state,
++ * if we release TRx DMA here
++ * it will cause packets to be started to Tx/Rx,
++ * so we release Tx/Rx DMA later.
++ */
++ if (!mac_power_on) {
++ /* 8. release TRX DMA
++ * write 0x284 bit[18] = 1'b0
++ * write 0x301 = 0x00
++ */
++ if (release_mac_rx_pause) {
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
++ (tmp & (~BIT(2))));
++ }
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
++ backup_pcie_dma_pause);
++ }
++
++ /* 9. lock system register
++ * write 0xCC bit[2] = 1'b0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp &= ~(BIT(2));
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++}
++
+ int rtl92ee_hw_init(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -1162,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw
+ rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
+ }
+
++ if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
++ _rtl8192ee_reset_pcie_interface_dma(rtlpriv,
++ rtlhal->mac_func_enable);
++ rtlhal->mac_func_enable = false;
++ }
++
+ rtstatus = _rtl92ee_init_mac(hw);
+
+ rtl_write_byte(rtlpriv, 0x577, 0x03);
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+@@ -77,9 +77,11 @@
+ #define REG_HIMRE 0x00B8
+ #define REG_HISRE 0x00BC
+
++#define REG_PMC_DBG_CTRL2 0x00CC
+ #define REG_EFUSE_ACCESS 0x00CF
+ #define REG_HPON_FSM 0x00EC
+ #define REG_SYS_CFG1 0x00F0
++#define REG_MAC_PHY_CTRL_NORMAL 0x00F8
+ #define REG_SYS_CFG2 0x00FC
+
+ #define REG_CR 0x0100
--- /dev/null
+From 92ff754240b892cbc16dee5aa080322f3db88b68 Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:24 -0600
+Subject: rtlwifi: rtl8192ee: Fix parsing of received packet
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 92ff754240b892cbc16dee5aa080322f3db88b68 upstream.
+
+The firmware supplies two kinds of packets via the RX mechanism. Besides the
+normal data received over the air, these packets may contain bluetooth status
+and other information. The present code fails to detect which kind of
+information was received.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 4 ++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.h | 2 ++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -512,6 +512,10 @@ bool rtl92ee_rx_query_desc(struct ieee80
+ struct ieee80211_hdr *hdr;
+ u32 phystatus = GET_RX_DESC_PHYST(pdesc);
+
++ if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
++ status->packet_report_type = NORMAL_RX;
++ else
++ status->packet_report_type = C2H_PACKET;
+ status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
+ status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
+ RX_DRV_INFO_SIZE_UNIT;
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+@@ -542,6 +542,8 @@
+ LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
+ #define GET_RX_DESC_RX_IS_QOS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
++#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc) \
++ LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
+
+ #define GET_RX_DESC_RXMCS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
--- /dev/null
+From 6d4beca3775222884e1ee9d48ef586c438c3dfa1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 3 Feb 2015 11:15:18 -0600
+Subject: rtlwifi: rtl8192ee: Fix problems with calculating free space in FIFO
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 6d4beca3775222884e1ee9d48ef586c438c3dfa1 upstream.
+
+This driver utilizes a FIFO buffer for RX descriptors. There are four places
+in the code where it calculates the number of free slots. Several of those
+locations do the calculation incorrectly. To fix these and to prevent future
+mistakes, a common inline routine is created.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/pci.h | 7 +++++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 9 +--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.h
++++ b/drivers/net/wireless/rtlwifi/pci.h
+@@ -325,4 +325,11 @@ static inline void pci_write32_async(str
+ writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
+ }
+
++static inline u16 calc_fifo_space(u16 rp, u16 wp)
++{
++ if (rp <= wp)
++ return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
++ return rp - wp - 1;
++}
++
+ #endif
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -658,14 +658,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(st
+ if (!start_rx)
+ return 0;
+
+- if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
+- (read_point <= (RX_DESC_NUM_92E / 2))) {
+- remind_cnt = RX_DESC_NUM_92E - write_point;
+- } else {
+- remind_cnt = (read_point >= write_point) ?
+- (read_point - write_point) :
+- (RX_DESC_NUM_92E - write_point + read_point);
+- }
++ remind_cnt = calc_fifo_space(read_point, write_point);
+
+ if (remind_cnt == 0)
+ return 0;
--- /dev/null
+From 6e5f4436162848289f071be38ee6b87dc8ea653d Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:23 -0600
+Subject: rtlwifi: rtl8192ee: Fix TX hang due to failure to update TX write point
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 6e5f4436162848289f071be38ee6b87dc8ea653d upstream.
+
+Initially, the routine to update the write point in the FIFO buffer was
+coded to save CPU time by not doing the calculation every interrupt. This
+was an error and results in TX hangs.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -1207,8 +1207,7 @@ bool rtl92ee_is_tx_desc_closed(struct ie
+ static u8 stop_report_cnt;
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+
+- /*checking Read/Write Point each interrupt wastes CPU */
+- if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
++ {
+ u16 point_diff = 0;
+ u16 cur_tx_rp, cur_tx_wp;
+ u32 tmpu32 = 0;
asoc-rt5677-fix-spi-dependency.patch
asoc-mioa701_wm9713-fix-speaker-event.patch
asoc-davinci-fix-dm365_evm-codec-selection.patch
+rtlwifi-rtl8192ee-fix-adhoc-fail.patch
+rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch
+rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch
+rtlwifi-rtl8192ee-fix-dma-stalls.patch
+rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch
+rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch
+cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch
+cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch
+cpufreq-s3c-remove-incorrect-__init-annotations.patch
+cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch
+xen-manage-fix-usb-interaction-issues-when-resuming.patch
+xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch
+acpi-lpss-always-disable-i2c-host-controllers.patch
+acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch
+lmedm04-increase-interupt-due-time-to-200-msec.patch
+lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch
+si2168-define-symbol-rate-limits.patch
+alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch
+alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch
+alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch
+alsa-usb-fix-support-for-denon-da-300usb-dac-id-154e-1003.patch
+alsa-hdspm-constrain-periods-to-2-on-older-cards.patch
+power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch
+power-bq24190-fix-ignored-supplicants.patch
+power-gpio-charger-balance-enable-disable_irq_wake-calls.patch
+megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch
+megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch
+megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch
+megaraid_sas-complete-outstanding-ioctls-before-killing-adapter.patch
+rc-main-re-apply-filter-for-no-op-protocol-change.patch
+timberdale-do-not-select-timb_dma.patch
+em28xx-fix-em28xx-input-removal.patch
+em28xx-ensure-closing-messages-terminate-with-a-newline.patch
+em28xx-input-fix-missing-newlines.patch
+em28xx-audio-fix-missing-newlines.patch
+em28xx-core-fix-missing-newlines.patch
+em28xx-video-fix-missing-newlines.patch
+em28xx-dvb-fix-missing-newlines.patch
+em28xx-audio-fix-missing-newlines-again.patch
--- /dev/null
+From f1ecc5d119530fce01094307e029ed7f2c9067d8 Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Tue, 25 Nov 2014 16:26:49 -0300
+Subject: [media] si2168: define symbol rate limits
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit f1ecc5d119530fce01094307e029ed7f2c9067d8 upstream.
+
+w_scan complains about missing symbol rate limits:
+This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org
+
+Chip supports 1 to 7.2 MSymbol/s on DVB-C.
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/si2168.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/dvb-frontends/si2168.c
++++ b/drivers/media/dvb-frontends/si2168.c
+@@ -635,6 +635,8 @@ static const struct dvb_frontend_ops si2
+ .delsys = {SYS_DVBT, SYS_DVBT2, SYS_DVBC_ANNEX_A},
+ .info = {
+ .name = "Silicon Labs Si2168",
++ .symbol_rate_min = 1000000,
++ .symbol_rate_max = 7200000,
+ .caps = FE_CAN_FEC_1_2 |
+ FE_CAN_FEC_2_3 |
+ FE_CAN_FEC_3_4 |
--- /dev/null
+From 244829226f47ffb4d6009a2ccd2771cd149d8114 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 28 Jan 2015 18:17:41 -0300
+Subject: [media] timberdale: do not select TIMB_DMA
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 244829226f47ffb4d6009a2ccd2771cd149d8114 upstream.
+
+The timberdale media driver requires the use of the respective
+dma engine driver, but that may not be enabled, causing a
+Kconfig warning:
+
+warning: (VIDEO_TIMBERDALE) selects TIMB_DMA which has unmet direct dependencies (DMADEVICES && MFD_TIMBERDALE)
+
+This fixes the dependency by removing the inappropriate 'select'
+statement and replacing it with a direct dependency on the
+drivers that provide the services this needs.
+
+Fixes: 7155043c2d027 ("[media] enable COMPILE_TEST for media drivers")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/Kconfig | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -56,10 +56,8 @@ config VIDEO_VIU
+
+ config VIDEO_TIMBERDALE
+ tristate "Support for timberdale Video In/LogiWIN"
+- depends on VIDEO_V4L2 && I2C && DMADEVICES
+- depends on MFD_TIMBERDALE || COMPILE_TEST
+- select DMA_ENGINE
+- select TIMB_DMA
++ depends on VIDEO_V4L2 && I2C
++ depends on (MFD_TIMBERDALE && TIMB_DMA) || COMPILE_TEST
+ select VIDEO_ADV7180
+ select VIDEOBUF_DMA_CONTIG
+ ---help---
--- /dev/null
+From 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Mon, 19 Jan 2015 13:19:38 +0000
+Subject: xen/manage: Fix USB interaction issues when resuming
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+commit 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 upstream.
+
+Commit 61a734d305e1 ("xen/manage: Always freeze/thaw processes when
+suspend/resuming") ensured that userspace processes were always frozen
+before suspending to reduce interaction issues when resuming devices.
+However, freeze_processes() does not freeze kernel threads. Freeze
+kernel threads as well to prevent deadlocks with the khubd thread when
+resuming devices.
+
+This is what native suspend and resume does.
+
+Example deadlock:
+[ 7279.648010] [<ffffffff81446bde>] ? xen_poll_irq_timeout+0x3e/0x50
+[ 7279.648010] [<ffffffff81448d60>] xen_poll_irq+0x10/0x20
+[ 7279.648010] [<ffffffff81011723>] xen_lock_spinning+0xb3/0x120
+[ 7279.648010] [<ffffffff810115d1>] __raw_callee_save_xen_lock_spinning+0x11/0x20
+[ 7279.648010] [<ffffffff815620b6>] ? usb_control_msg+0xe6/0x120
+[ 7279.648010] [<ffffffff81747e50>] ? _raw_spin_lock_irq+0x50/0x60
+[ 7279.648010] [<ffffffff8174522c>] wait_for_completion+0xac/0x160
+[ 7279.648010] [<ffffffff8109c520>] ? try_to_wake_up+0x2c0/0x2c0
+[ 7279.648010] [<ffffffff814b60f2>] dpm_wait+0x32/0x40
+[ 7279.648010] [<ffffffff814b6eb0>] device_resume+0x90/0x210
+[ 7279.648010] [<ffffffff814b7d71>] dpm_resume+0x121/0x250
+[ 7279.648010] [<ffffffff8144c570>] ? xenbus_dev_request_and_reply+0xc0/0xc0
+[ 7279.648010] [<ffffffff814b80d5>] dpm_resume_end+0x15/0x30
+[ 7279.648010] [<ffffffff81449fba>] do_suspend+0x10a/0x200
+[ 7279.648010] [<ffffffff8144a2f0>] ? xen_pre_suspend+0x20/0x20
+[ 7279.648010] [<ffffffff8144a1d0>] shutdown_handler+0x120/0x150
+[ 7279.648010] [<ffffffff8144c60f>] xenwatch_thread+0x9f/0x160
+[ 7279.648010] [<ffffffff810ac510>] ? finish_wait+0x80/0x80
+[ 7279.648010] [<ffffffff8108d189>] kthread+0xc9/0xe0
+[ 7279.648010] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+[ 7279.648010] [<ffffffff8175087c>] ret_from_fork+0x7c/0xb0
+[ 7279.648010] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+
+[ 7441.216287] INFO: task khubd:89 blocked for more than 120 seconds.
+[ 7441.219457] Tainted: G X 3.13.11-ckt12.kz #1
+[ 7441.222176] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 7441.225827] khubd D ffff88003f433440 0 89 2 0x00000000
+[ 7441.229258] ffff88003ceb9b98 0000000000000046 ffff88003ce83000 0000000000013440
+[ 7441.232959] ffff88003ceb9fd8 0000000000013440 ffff88003cd13000 ffff88003ce83000
+[ 7441.236658] 0000000000000286 ffff88003d3e0000 ffff88003ceb9bd0 00000001001aa01e
+[ 7441.240415] Call Trace:
+[ 7441.241614] [<ffffffff817442f9>] schedule+0x29/0x70
+[ 7441.243930] [<ffffffff81743406>] schedule_timeout+0x166/0x2c0
+[ 7441.246681] [<ffffffff81075b80>] ? call_timer_fn+0x110/0x110
+[ 7441.249339] [<ffffffff8174357e>] schedule_timeout_uninterruptible+0x1e/0x20
+[ 7441.252644] [<ffffffff81077710>] msleep+0x20/0x30
+[ 7441.254812] [<ffffffff81555f00>] hub_port_reset+0xf0/0x580
+[ 7441.257400] [<ffffffff81558465>] hub_port_init+0x75/0xb40
+[ 7441.259981] [<ffffffff814bb3c9>] ? update_autosuspend+0x39/0x60
+[ 7441.262817] [<ffffffff814bb4f0>] ? pm_runtime_set_autosuspend_delay+0x50/0xa0
+[ 7441.266212] [<ffffffff8155a64a>] hub_thread+0x71a/0x1750
+[ 7441.268728] [<ffffffff810ac510>] ? finish_wait+0x80/0x80
+[ 7441.271272] [<ffffffff81559f30>] ? usb_port_resume+0x670/0x670
+[ 7441.274067] [<ffffffff8108d189>] kthread+0xc9/0xe0
+[ 7441.276305] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+[ 7441.279131] [<ffffffff8175087c>] ret_from_fork+0x7c/0xb0
+[ 7441.281659] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/manage.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -105,10 +105,16 @@ static void do_suspend(void)
+
+ err = freeze_processes();
+ if (err) {
+- pr_err("%s: freeze failed %d\n", __func__, err);
++ pr_err("%s: freeze processes failed %d\n", __func__, err);
+ goto out;
+ }
+
++ err = freeze_kernel_threads();
++ if (err) {
++ pr_err("%s: freeze kernel threads failed %d\n", __func__, err);
++ goto out_thaw;
++ }
++
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+ pr_err("%s: dpm_suspend_start %d\n", __func__, err);
--- /dev/null
+From facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 17 Feb 2015 08:02:47 +0100
+Subject: xen-scsiback: mark pvscsi frontend request consumed only after last read
+
+From: Juergen Gross <jgross@suse.com>
+
+commit facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 upstream.
+
+A request in the ring buffer mustn't be read after it has been marked
+as consumed. Otherwise it might already have been reused by the
+frontend without violating the ring protocol.
+
+To avoid inconsistencies in the backend only work on a private copy
+of the request. This will ensure a malicious guest not being able to
+bypass consistency checks of the backend by modifying an active
+request.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/xen-scsiback.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -708,12 +708,11 @@ static int prepare_pending_reqs(struct v
+ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ {
+ struct vscsiif_back_ring *ring = &info->ring;
+- struct vscsiif_request *ring_req;
++ struct vscsiif_request ring_req;
+ struct vscsibk_pend *pending_req;
+ RING_IDX rc, rp;
+ int err, more_to_do;
+ uint32_t result;
+- uint8_t act;
+
+ rc = ring->req_cons;
+ rp = ring->sring->req_prod;
+@@ -734,11 +733,10 @@ static int scsiback_do_cmd_fn(struct vsc
+ if (!pending_req)
+ return 1;
+
+- ring_req = RING_GET_REQUEST(ring, rc);
++ ring_req = *RING_GET_REQUEST(ring, rc);
+ ring->req_cons = ++rc;
+
+- act = ring_req->act;
+- err = prepare_pending_reqs(info, ring_req, pending_req);
++ err = prepare_pending_reqs(info, &ring_req, pending_req);
+ if (err) {
+ switch (err) {
+ case -ENODEV:
+@@ -754,9 +752,9 @@ static int scsiback_do_cmd_fn(struct vsc
+ return 1;
+ }
+
+- switch (act) {
++ switch (ring_req.act) {
+ case VSCSIIF_ACT_SCSI_CDB:
+- if (scsiback_gnttab_data_map(ring_req, pending_req)) {
++ if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
+ scsiback_fast_flush_area(pending_req);
+ scsiback_do_resp_with_sense(NULL,
+ DRIVER_ERROR << 24, 0, pending_req);
+@@ -767,7 +765,7 @@ static int scsiback_do_cmd_fn(struct vsc
+ break;
+ case VSCSIIF_ACT_SCSI_ABORT:
+ scsiback_device_action(pending_req, TMR_ABORT_TASK,
+- ring_req->ref_rqid);
++ ring_req.ref_rqid);
+ break;
+ case VSCSIIF_ACT_SCSI_RESET:
+ scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
projects / thirdparty / kernel / stable-queue.git / commitdiff
