--- /dev/null
+From fbda4b38fa3995aa0777fe9cbbdcb223c6292083 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 23 Mar 2016 00:11:20 +0100
+Subject: ACPI / PM: Runtime resume devices when waking from hibernate
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit fbda4b38fa3995aa0777fe9cbbdcb223c6292083 upstream.
+
+Commit 58a1fbbb2ee8 ("PM / PCI / ACPI: Kick devices that might have been
+reset by firmware") added a runtime resume for devices that were runtime
+suspended when the system entered suspend-to-RAM.
+
+Briefly, the motivation was to ensure that devices did not remain in a
+reset-power-on state after resume, potentially preventing deep SoC-wide
+low-power states from being entered on idle.
+
+Currently we're not doing the same when leaving suspend-to-disk and this
+asymmetry is a problem if drivers rely on the automatic resume triggered
+by pm_complete_with_resume_check(). Fix it.
+
+Fixes: 58a1fbbb2ee8 (PM / PCI / ACPI: Kick devices that might have been reset by firmware)
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sleep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -714,6 +714,7 @@ static int acpi_hibernation_enter(void)
+
+ static void acpi_hibernation_leave(void)
+ {
++ pm_set_resume_via_firmware();
+ /*
+ * If ACPI is not enabled by the BIOS and the boot kernel, we need to
+ * enable it here.
--- /dev/null
+From ae3fc8ea08e405682f1fa959f94b6e4126afbc1b Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Fri, 11 Mar 2016 11:43:39 +0100
+Subject: ARM: dts: at91: sama5d3 Xplained: don't disable hsmci regulator
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit ae3fc8ea08e405682f1fa959f94b6e4126afbc1b upstream.
+
+If enabling the hsmci regulator on card detection, the board can reboot
+on sd card insertion. Keeping the regulator always enabled fixes this
+issue.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Fixes: 1b53e3416dd0 ("ARM: at91/dt: sama5d3 xplained: add fixed regulator for vmmc0")
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+@@ -303,6 +303,7 @@
+ regulator-name = "mmc0-card-supply";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
++ regulator-always-on;
+ };
+
+ gpio_keys {
--- /dev/null
+From b02acd4e62602a6ab307da84388a16bf60106c48 Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Fri, 11 Mar 2016 11:35:10 +0100
+Subject: ARM: dts: at91: sama5d4 Xplained: don't disable hsmci regulator
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit b02acd4e62602a6ab307da84388a16bf60106c48 upstream.
+
+If enabling the hsmci regulator on card detection, the board can reboot
+on sd card insertion. Keeping the regulator always enabled fixes this
+issue.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Fixes: 8d545f32bd77 ("ARM: at91/dt: sama5d4 xplained: add regulators for v(q)mmc1 supplies")
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -268,5 +268,6 @@
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ vin-supply = <&vcc_3v3_reg>;
++ regulator-always-on;
+ };
+ };
--- /dev/null
+From 773b3966dd3cdaeb68e7f2edfe5656abac1dc411 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Mon, 15 Feb 2016 19:03:57 -0800
+Subject: clk: bcm2835: Fix setting of PLL divider clock rates
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 773b3966dd3cdaeb68e7f2edfe5656abac1dc411 upstream.
+
+Our dividers weren't being set successfully because CM_PASSWORD wasn't
+included in the register write. It looks easier to just compute the
+divider to write ourselves than to update clk-divider for the ability
+to OR in some arbitrary bits on write.
+
+Fixes about half of the video modes on my HDMI monitor (everything
+except 720x400).
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Michael Turquette <mturquette@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/bcm/clk-bcm2835.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate(
+ struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw);
+ struct bcm2835_cprman *cprman = divider->cprman;
+ const struct bcm2835_pll_divider_data *data = divider->data;
+- u32 cm;
+- int ret;
++ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS;
+
+- ret = clk_divider_ops.set_rate(hw, rate, parent_rate);
+- if (ret)
+- return ret;
++ div = DIV_ROUND_UP_ULL(parent_rate, rate);
+
++ div = min(div, max_div);
++ if (div == max_div)
++ div = 0;
++
++ cprman_write(cprman, data->a2w_reg, div);
+ cm = cprman_read(cprman, data->cm_reg);
+ cprman_write(cprman, data->cm_reg, cm | data->load_mask);
+ cprman_write(cprman, data->cm_reg, cm & ~data->load_mask);
--- /dev/null
+From e8b63288b37dbb8457b510c9d96f6006da4653f6 Mon Sep 17 00:00:00 2001
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Tue, 26 Jan 2016 16:34:00 +0300
+Subject: clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+commit e8b63288b37dbb8457b510c9d96f6006da4653f6 upstream.
+
+hclk_cpubus needs to keep running because it is needed for devices like
+the rom, i2s0 or spdif to be accessible via cpu. Without that all
+accesses to devices (readl/writel) return wrong data. So add it
+to the list of critical clocks.
+
+Fixes: 78eaf6095cc763c ("clk: rockchip: disable unused clocks")
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3188.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -748,6 +748,7 @@ static const char *const rk3188_critical
+ "hclk_peri",
+ "pclk_cpu",
+ "pclk_peri",
++ "hclk_cpubus"
+ };
+
+ static void __init rk3188_common_clk_init(struct device_node *np)
--- /dev/null
+From c6d5fe2ca8286f35a79f7345c9378c39d48a1527 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Tue, 19 Jan 2016 10:09:22 +0100
+Subject: clk: rockchip: rk3368: fix cpuclk core dividers
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit c6d5fe2ca8286f35a79f7345c9378c39d48a1527 upstream.
+
+Similar to commit 9880d4277f6a ("clk: rockchip: fix rk3288 cpuclk core
+dividers") it seems the cpuclk dividers are one to high on the rk3368
+as well.
+
+And again similar to the previous fix, we opt to make the divider list
+contain the values to be written to use the same paradigm for them on all
+supported socs.
+
+Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller")
+Reported-by: Zhang Qing <zhangqing@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: zhangqing <zhangqing@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3368.c | 40 +++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3368.c
++++ b/drivers/clk/rockchip/clk-rk3368.c
+@@ -218,29 +218,29 @@ static const struct rockchip_cpuclk_reg_
+ }
+
+ static struct rockchip_cpuclk_rate_table rk3368_cpuclkb_rates[] __initdata = {
+- RK3368_CPUCLKB_RATE(1512000000, 2, 6, 6),
+- RK3368_CPUCLKB_RATE(1488000000, 2, 5, 5),
+- RK3368_CPUCLKB_RATE(1416000000, 2, 5, 5),
+- RK3368_CPUCLKB_RATE(1200000000, 2, 4, 4),
+- RK3368_CPUCLKB_RATE(1008000000, 2, 4, 4),
+- RK3368_CPUCLKB_RATE( 816000000, 2, 3, 3),
+- RK3368_CPUCLKB_RATE( 696000000, 2, 3, 3),
+- RK3368_CPUCLKB_RATE( 600000000, 2, 2, 2),
+- RK3368_CPUCLKB_RATE( 408000000, 2, 2, 2),
+- RK3368_CPUCLKB_RATE( 312000000, 2, 2, 2),
++ RK3368_CPUCLKB_RATE(1512000000, 1, 5, 5),
++ RK3368_CPUCLKB_RATE(1488000000, 1, 4, 4),
++ RK3368_CPUCLKB_RATE(1416000000, 1, 4, 4),
++ RK3368_CPUCLKB_RATE(1200000000, 1, 3, 3),
++ RK3368_CPUCLKB_RATE(1008000000, 1, 3, 3),
++ RK3368_CPUCLKB_RATE( 816000000, 1, 2, 2),
++ RK3368_CPUCLKB_RATE( 696000000, 1, 2, 2),
++ RK3368_CPUCLKB_RATE( 600000000, 1, 1, 1),
++ RK3368_CPUCLKB_RATE( 408000000, 1, 1, 1),
++ RK3368_CPUCLKB_RATE( 312000000, 1, 1, 1),
+ };
+
+ static struct rockchip_cpuclk_rate_table rk3368_cpuclkl_rates[] __initdata = {
+- RK3368_CPUCLKL_RATE(1512000000, 2, 7, 7),
+- RK3368_CPUCLKL_RATE(1488000000, 2, 6, 6),
+- RK3368_CPUCLKL_RATE(1416000000, 2, 6, 6),
+- RK3368_CPUCLKL_RATE(1200000000, 2, 5, 5),
+- RK3368_CPUCLKL_RATE(1008000000, 2, 5, 5),
+- RK3368_CPUCLKL_RATE( 816000000, 2, 4, 4),
+- RK3368_CPUCLKL_RATE( 696000000, 2, 3, 3),
+- RK3368_CPUCLKL_RATE( 600000000, 2, 3, 3),
+- RK3368_CPUCLKL_RATE( 408000000, 2, 2, 2),
+- RK3368_CPUCLKL_RATE( 312000000, 2, 2, 2),
++ RK3368_CPUCLKL_RATE(1512000000, 1, 6, 6),
++ RK3368_CPUCLKL_RATE(1488000000, 1, 5, 5),
++ RK3368_CPUCLKL_RATE(1416000000, 1, 5, 5),
++ RK3368_CPUCLKL_RATE(1200000000, 1, 4, 4),
++ RK3368_CPUCLKL_RATE(1008000000, 1, 4, 4),
++ RK3368_CPUCLKL_RATE( 816000000, 1, 3, 3),
++ RK3368_CPUCLKL_RATE( 696000000, 1, 2, 2),
++ RK3368_CPUCLKL_RATE( 600000000, 1, 2, 2),
++ RK3368_CPUCLKL_RATE( 408000000, 1, 1, 1),
++ RK3368_CPUCLKL_RATE( 312000000, 1, 1, 1),
+ };
+
+ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
--- /dev/null
+From 535ebd428aeb07c3327947281306f2943f2c9faa Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Tue, 19 Jan 2016 10:01:08 +0100
+Subject: clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit 535ebd428aeb07c3327947281306f2943f2c9faa upstream.
+
+Both clusters have their mux bit in bit 7 of their respective register.
+For whatever reason the big cluster currently lists bit 15 which is
+definitly wrong.
+
+Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller")
+Reported-by: Zhang Qing <zhangqing@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: zhangqing <zhangqing@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3368.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/rockchip/clk-rk3368.c
++++ b/drivers/clk/rockchip/clk-rk3368.c
+@@ -165,7 +165,7 @@ static const struct rockchip_cpuclk_reg_
+ .core_reg = RK3368_CLKSEL_CON(0),
+ .div_core_shift = 0,
+ .div_core_mask = 0x1f,
+- .mux_core_shift = 15,
++ .mux_core_shift = 7,
+ };
+
+ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = {
--- /dev/null
+From fd0c0740fac17a014704ef89d8c8b1768711ca59 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Wed, 20 Jan 2016 21:47:57 +0100
+Subject: clk: rockchip: rk3368: fix hdmi_cec gate-register
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit fd0c0740fac17a014704ef89d8c8b1768711ca59 upstream.
+
+Fix a typo making the sclk_hdmi_cec access a wrong register to handle
+its gate.
+
+Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller")
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: zhangqing <zhangqing@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3368.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/rockchip/clk-rk3368.c
++++ b/drivers/clk/rockchip/clk-rk3368.c
+@@ -442,7 +442,7 @@ static struct rockchip_clk_branch rk3368
+ GATE(SCLK_HDMI_HDCP, "sclk_hdmi_hdcp", "xin24m", 0,
+ RK3368_CLKGATE_CON(4), 13, GFLAGS),
+ GATE(SCLK_HDMI_CEC, "sclk_hdmi_cec", "xin32k", 0,
+- RK3368_CLKGATE_CON(5), 12, GFLAGS),
++ RK3368_CLKGATE_CON(4), 12, GFLAGS),
+
+ COMPOSITE_NODIV(0, "vip_src", mux_pll_src_cpll_gpll_p, 0,
+ RK3368_CLKSEL_CON(21), 15, 1, MFLAGS,
--- /dev/null
+From 0f28d98463498c61c61a38aacbf9f69e92e85e9d Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Wed, 20 Jan 2016 19:22:38 +0100
+Subject: clk: rockchip: rk3368: fix parents of video encoder/decoder
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit 0f28d98463498c61c61a38aacbf9f69e92e85e9d upstream.
+
+The vdpu and vepu clocks can also be parented to the npll and current
+parent list also is wrong as it would use the npll as "usbphy" source,
+so adapt the parent to the correct one.
+
+Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller")
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: zhangqing <zhangqing@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3368.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3368.c
++++ b/drivers/clk/rockchip/clk-rk3368.c
+@@ -384,10 +384,10 @@ static struct rockchip_clk_branch rk3368
+ * Clock-Architecture Diagram 3
+ */
+
+- COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_usb_p, 0,
++ COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_npll_usb_p, 0,
+ RK3368_CLKSEL_CON(15), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3368_CLKGATE_CON(4), 6, GFLAGS),
+- COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb_p, 0,
++ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_npll_usb_p, 0,
+ RK3368_CLKSEL_CON(15), 14, 2, MFLAGS, 8, 5, DFLAGS,
+ RK3368_CLKGATE_CON(4), 7, GFLAGS),
+
--- /dev/null
+From aea92980601f7ddfcb3c54caa53a43726314fe46 Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Wed, 24 Feb 2016 19:23:59 +0200
+Subject: iser-target: Add new state ISER_CONN_BOUND to isert_conn
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit aea92980601f7ddfcb3c54caa53a43726314fe46 upstream.
+
+We need an indication that isert_conn->iscsi_conn binding has
+happened so we'll know not to invoke a connection reinstatement
+on an unbound connection which will lead to a bogus isert_conn->conn
+dereferece.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 7 +++++--
+ drivers/infiniband/ulp/isert/ib_isert.h | 1 +
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -825,7 +825,7 @@ isert_put_conn(struct isert_conn *isert_
+ * @isert_conn: isert connection struct
+ *
+ * Notes:
+- * In case the connection state is FULL_FEATURE, move state
++ * In case the connection state is BOUND, move state
+ * to TEMINATING and start teardown sequence (rdma_disconnect).
+ * In case the connection state is UP, complete flush as well.
+ *
+@@ -841,6 +841,7 @@ isert_conn_terminate(struct isert_conn *
+ case ISER_CONN_TERMINATING:
+ break;
+ case ISER_CONN_UP:
++ case ISER_CONN_BOUND:
+ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
+ isert_info("Terminating conn %p state %d\n",
+ isert_conn, isert_conn->state);
+@@ -2075,7 +2076,8 @@ isert_cq_comp_err(struct isert_conn *ise
+ isert_completion_put(desc, isert_cmd, ib_dev, true);
+ } else {
+ isert_conn->post_recv_buf_count--;
+- if (!isert_conn->post_recv_buf_count)
++ if (!isert_conn->post_recv_buf_count &&
++ isert_conn->state >= ISER_CONN_BOUND)
+ iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
+ }
+ }
+@@ -3215,6 +3217,7 @@ accept_wait:
+
+ conn->context = isert_conn;
+ isert_conn->conn = conn;
++ isert_conn->state = ISER_CONN_BOUND;
+
+ isert_set_conn_info(np, conn, isert_conn);
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -84,6 +84,7 @@ enum iser_ib_op_code {
+ enum iser_conn_state {
+ ISER_CONN_INIT,
+ ISER_CONN_UP,
++ ISER_CONN_BOUND,
+ ISER_CONN_FULL_FEATURE,
+ ISER_CONN_TERMINATING,
+ ISER_CONN_DOWN,
--- /dev/null
+From b89a7c25462b164db280abc3b05d4d9d888d40e9 Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Wed, 24 Feb 2016 19:23:58 +0200
+Subject: iser-target: Fix identification of login rx descriptor type
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit b89a7c25462b164db280abc3b05d4d9d888d40e9 upstream.
+
+Once connection request is accepted, one rx descriptor
+is posted to receive login request. This descriptor has rx type,
+but is outside the main pool of rx descriptors, and thus
+was mistreated as tx type.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2048,7 +2048,8 @@ is_isert_tx_desc(struct isert_conn *iser
+ void *start = isert_conn->rx_descs;
+ int len = ISERT_QP_MAX_RECV_DTOS * sizeof(*isert_conn->rx_descs);
+
+- if (wr_id >= start && wr_id < start + len)
++ if ((wr_id >= start && wr_id < start + len) ||
++ (wr_id == isert_conn->login_req_buf))
+ return false;
+
+ return true;
--- /dev/null
+From 6d1fba0c2cc7efe42fd761ecbba833ed0ea7b07e Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Wed, 24 Feb 2016 19:24:01 +0200
+Subject: iser-target: Rework connection termination
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit 6d1fba0c2cc7efe42fd761ecbba833ed0ea7b07e upstream.
+
+When we receive an event that triggers connection termination,
+we have a a couple of things we may want to do:
+1. In case we are already terminating, bailout early
+2. In case we are connected but not bound, disconnect and schedule
+ a connection cleanup silently (don't reinstate)
+3. In case we are connected and bound, disconnect and reinstate the connection
+
+This rework fixes a bug that was detected against a mis-behaved
+initiator which rejected our rdma_cm accept, in this stage the
+isert_conn is no bound and reinstate caused a bogus dereference.
+
+What's great about this is that we don't need the
+post_recv_buf_count anymore, so get rid of it.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 107 +++++++++++++++-----------------
+ drivers/infiniband/ulp/isert/ib_isert.h | 1
+ 2 files changed, 52 insertions(+), 56 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -65,6 +65,7 @@ isert_rdma_accept(struct isert_conn *ise
+ struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
+
+ static void isert_release_work(struct work_struct *work);
++static void isert_wait4flush(struct isert_conn *isert_conn);
+
+ static inline bool
+ isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
+@@ -820,6 +821,25 @@ isert_put_conn(struct isert_conn *isert_
+ kref_put(&isert_conn->kref, isert_release_kref);
+ }
+
++static void
++isert_handle_unbound_conn(struct isert_conn *isert_conn)
++{
++ struct isert_np *isert_np = isert_conn->cm_id->context;
++
++ mutex_lock(&isert_np->mutex);
++ if (!list_empty(&isert_conn->node)) {
++ /*
++ * This means iscsi doesn't know this connection
++ * so schedule a cleanup ourselves
++ */
++ list_del_init(&isert_conn->node);
++ isert_put_conn(isert_conn);
++ complete(&isert_conn->wait);
++ queue_work(isert_release_wq, &isert_conn->release_work);
++ }
++ mutex_unlock(&isert_np->mutex);
++}
++
+ /**
+ * isert_conn_terminate() - Initiate connection termination
+ * @isert_conn: isert connection struct
+@@ -837,24 +857,19 @@ isert_conn_terminate(struct isert_conn *
+ {
+ int err;
+
+- switch (isert_conn->state) {
+- case ISER_CONN_TERMINATING:
+- break;
+- case ISER_CONN_UP:
+- case ISER_CONN_BOUND:
+- case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
+- isert_info("Terminating conn %p state %d\n",
+- isert_conn, isert_conn->state);
+- isert_conn->state = ISER_CONN_TERMINATING;
+- err = rdma_disconnect(isert_conn->cm_id);
+- if (err)
+- isert_warn("Failed rdma_disconnect isert_conn %p\n",
+- isert_conn);
+- break;
+- default:
+- isert_warn("conn %p teminating in state %d\n",
+- isert_conn, isert_conn->state);
+- }
++ if (isert_conn->state >= ISER_CONN_TERMINATING)
++ return;
++
++ isert_info("Terminating conn %p state %d\n",
++ isert_conn, isert_conn->state);
++ isert_conn->state = ISER_CONN_TERMINATING;
++ err = rdma_disconnect(isert_conn->cm_id);
++ if (err)
++ isert_warn("Failed rdma_disconnect isert_conn %p\n",
++ isert_conn);
++
++ isert_info("conn %p completing wait\n", isert_conn);
++ complete(&isert_conn->wait);
+ }
+
+ static int
+@@ -888,30 +903,27 @@ static int
+ isert_disconnected_handler(struct rdma_cm_id *cma_id,
+ enum rdma_cm_event_type event)
+ {
+- struct isert_np *isert_np = cma_id->context;
+ struct isert_conn *isert_conn = cma_id->qp->qp_context;
+- bool terminating = false;
+
+ mutex_lock(&isert_conn->mutex);
+- terminating = (isert_conn->state == ISER_CONN_TERMINATING);
+- isert_conn_terminate(isert_conn);
+- mutex_unlock(&isert_conn->mutex);
+-
+- isert_info("conn %p completing wait\n", isert_conn);
+- complete(&isert_conn->wait);
+-
+- if (terminating)
+- goto out;
+-
+- mutex_lock(&isert_np->mutex);
+- if (!list_empty(&isert_conn->node)) {
+- list_del_init(&isert_conn->node);
+- isert_put_conn(isert_conn);
+- queue_work(isert_release_wq, &isert_conn->release_work);
++ switch (isert_conn->state) {
++ case ISER_CONN_TERMINATING:
++ break;
++ case ISER_CONN_UP:
++ isert_conn_terminate(isert_conn);
++ isert_wait4flush(isert_conn);
++ isert_handle_unbound_conn(isert_conn);
++ break;
++ case ISER_CONN_BOUND:
++ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
++ iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
++ break;
++ default:
++ isert_warn("conn %p teminating in state %d\n",
++ isert_conn, isert_conn->state);
+ }
+- mutex_unlock(&isert_np->mutex);
++ mutex_unlock(&isert_conn->mutex);
+
+-out:
+ return 0;
+ }
+
+@@ -985,13 +997,10 @@ isert_post_recvm(struct isert_conn *iser
+ rx_wr--;
+ rx_wr->next = NULL; /* mark end of work requests list */
+
+- isert_conn->post_recv_buf_count += count;
+ ret = ib_post_recv(isert_conn->qp, isert_conn->rx_wr,
+ &rx_wr_failed);
+- if (ret) {
++ if (ret)
+ isert_err("ib_post_recv() failed with ret: %d\n", ret);
+- isert_conn->post_recv_buf_count -= count;
+- }
+
+ return ret;
+ }
+@@ -1007,12 +1016,9 @@ isert_post_recv(struct isert_conn *isert
+ rx_wr.num_sge = 1;
+ rx_wr.next = NULL;
+
+- isert_conn->post_recv_buf_count++;
+ ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_failed);
+- if (ret) {
++ if (ret)
+ isert_err("ib_post_recv() failed with ret: %d\n", ret);
+- isert_conn->post_recv_buf_count--;
+- }
+
+ return ret;
+ }
+@@ -1132,12 +1138,9 @@ isert_rdma_post_recvl(struct isert_conn
+ rx_wr.sg_list = &sge;
+ rx_wr.num_sge = 1;
+
+- isert_conn->post_recv_buf_count++;
+ ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_fail);
+- if (ret) {
++ if (ret)
+ isert_err("ib_post_recv() failed: %d\n", ret);
+- isert_conn->post_recv_buf_count--;
+- }
+
+ return ret;
+ }
+@@ -1633,7 +1636,6 @@ isert_rcv_completion(struct iser_rx_desc
+ ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
+ DMA_FROM_DEVICE);
+
+- isert_conn->post_recv_buf_count--;
+ }
+
+ static int
+@@ -2073,11 +2075,6 @@ isert_cq_comp_err(struct isert_conn *ise
+ isert_unmap_tx_desc(desc, ib_dev);
+ else
+ isert_completion_put(desc, isert_cmd, ib_dev, true);
+- } else {
+- isert_conn->post_recv_buf_count--;
+- if (!isert_conn->post_recv_buf_count &&
+- isert_conn->state >= ISER_CONN_BOUND)
+- iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
+ }
+ }
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -180,7 +180,6 @@ struct isert_device;
+
+ struct isert_conn {
+ enum iser_conn_state state;
+- int post_recv_buf_count;
+ u32 responder_resources;
+ u32 initiator_depth;
+ bool pi_support;
--- /dev/null
+From f81bf458208ef6d12b2fc08091204e3859dcdba4 Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Wed, 24 Feb 2016 19:24:00 +0200
+Subject: iser-target: Separate flows for np listeners and connections cma events
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit f81bf458208ef6d12b2fc08091204e3859dcdba4 upstream.
+
+No need to restrict this check to specific events.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -889,14 +889,9 @@ isert_disconnected_handler(struct rdma_c
+ enum rdma_cm_event_type event)
+ {
+ struct isert_np *isert_np = cma_id->context;
+- struct isert_conn *isert_conn;
++ struct isert_conn *isert_conn = cma_id->qp->qp_context;
+ bool terminating = false;
+
+- if (isert_np->cm_id == cma_id)
+- return isert_np_cma_handler(cma_id->context, event);
+-
+- isert_conn = cma_id->qp->qp_context;
+-
+ mutex_lock(&isert_conn->mutex);
+ terminating = (isert_conn->state == ISER_CONN_TERMINATING);
+ isert_conn_terminate(isert_conn);
+@@ -935,12 +930,16 @@ isert_connect_error(struct rdma_cm_id *c
+ static int
+ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ {
++ struct isert_np *isert_np = cma_id->context;
+ int ret = 0;
+
+ isert_info("%s (%d): status %d id %p np %p\n",
+ rdma_event_msg(event->event), event->event,
+ event->status, cma_id, cma_id->context);
+
++ if (isert_np->cm_id == cma_id)
++ return isert_np_cma_handler(cma_id->context, event->event);
++
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST:
+ ret = isert_connect_request(cma_id, event);
--- /dev/null
+From 2f6fc056e899bd0144a08da5cacaecbe8997cd74 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Wed, 2 Mar 2016 16:36:21 -0800
+Subject: nfsd: fix deadlock secinfo+readdir compound
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 2f6fc056e899bd0144a08da5cacaecbe8997cd74 upstream.
+
+nfsd_lookup_dentry exits with the parent filehandle locked. fh_put also
+unlocks if necessary (nfsd filehandle locking is probably too lenient),
+so it gets unlocked eventually, but if the following op in the compound
+needs to lock it again, we can deadlock.
+
+A fuzzer ran into this; normal clients don't send a secinfo followed by
+a readdir in the same compound.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4proc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -878,6 +878,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, st
+ &exp, &dentry);
+ if (err)
+ return err;
++ fh_unlock(&cstate->current_fh);
+ if (d_really_is_negative(dentry)) {
+ exp_put(exp);
+ err = nfserr_noent;
--- /dev/null
+From 4aed9c46afb80164401143aa0fdcfe3798baa9d5 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 29 Feb 2016 20:21:21 -0500
+Subject: nfsd4: fix bad bounds checking
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 4aed9c46afb80164401143aa0fdcfe3798baa9d5 upstream.
+
+A number of spots in the xdr decoding follow a pattern like
+
+ n = be32_to_cpup(p++);
+ READ_BUF(n + 4);
+
+where n is a u32. The only bounds checking is done in READ_BUF itself,
+but since it's checking (n + 4), it won't catch cases where n is very
+large, (u32)(-4) or higher. I'm not sure exactly what the consequences
+are, but we've seen crashes soon after.
+
+Instead, just break these up into two READ_BUF()s.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoun
+
+ READ_BUF(4);
+ rename->rn_snamelen = be32_to_cpup(p++);
+- READ_BUF(rename->rn_snamelen + 4);
++ READ_BUF(rename->rn_snamelen);
+ SAVEMEM(rename->rn_sname, rename->rn_snamelen);
++ READ_BUF(4);
+ rename->rn_tnamelen = be32_to_cpup(p++);
+ READ_BUF(rename->rn_tnamelen);
+ SAVEMEM(rename->rn_tname, rename->rn_tnamelen);
+@@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_co
+ READ_BUF(8);
+ setclientid->se_callback_prog = be32_to_cpup(p++);
+ setclientid->se_callback_netid_len = be32_to_cpup(p++);
+-
+- READ_BUF(setclientid->se_callback_netid_len + 4);
++ READ_BUF(setclientid->se_callback_netid_len);
+ SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len);
++ READ_BUF(4);
+ setclientid->se_callback_addr_len = be32_to_cpup(p++);
+
+- READ_BUF(setclientid->se_callback_addr_len + 4);
++ READ_BUF(setclientid->se_callback_addr_len);
+ SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len);
++ READ_BUF(4);
+ setclientid->se_callback_ident = be32_to_cpup(p++);
+
+ DECODE_TAIL;
+@@ -1835,8 +1837,9 @@ nfsd4_decode_compound(struct nfsd4_compo
+
+ READ_BUF(4);
+ argp->taglen = be32_to_cpup(p++);
+- READ_BUF(argp->taglen + 8);
++ READ_BUF(argp->taglen);
+ SAVEMEM(argp->tag, argp->taglen);
++ READ_BUF(8);
+ argp->minorversion = be32_to_cpup(p++);
+ argp->opcnt = be32_to_cpup(p++);
+ max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2);
mmc-tegra-properly-disable-card-clock.patch
mmc-sdhci-fix-override-of-timeout-clk-wrt-max_busy_timeout.patch
mmc-atmel-mci-check-pdata-for-null-before-dereferencing-it-at-dma-config.patch
+clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch
+clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch
+clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch
+clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch
+clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch
+clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch
+target-fix-target_release_cmd_kref-shutdown-comp-leak.patch
+iser-target-fix-identification-of-login-rx-descriptor-type.patch
+iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch
+iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch
+iser-target-rework-connection-termination.patch
+nfsd4-fix-bad-bounds-checking.patch
+nfsd-fix-deadlock-secinfo-readdir-compound.patch
+arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch
+arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch
+acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch
--- /dev/null
+From 5e47f1985d7107331c3f64fb3ec83d66fd73577e Mon Sep 17 00:00:00 2001
+From: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Date: Mon, 14 Mar 2016 22:47:37 -0700
+Subject: target: Fix target_release_cmd_kref shutdown comp leak
+
+From: Himanshu Madhani <himanshu.madhani@qlogic.com>
+
+commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream.
+
+This patch fixes an active I/O shutdown bug for fabric
+drivers using target_wait_for_sess_cmds(), where se_cmd
+descriptor shutdown would result in hung tasks waiting
+indefinitely for se_cmd->cmd_wait_comp to complete().
+
+To address this bug, drop the incorrect list_del_init()
+usage in target_wait_for_sess_cmds() and always complete()
+during se_cmd target_release_cmd_kref() put, in order to
+let caller invoke the final fabric release callback
+into se_cmd->se_tfo->release_cmd() code.
+
+Reported-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Tested-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2596,8 +2596,6 @@ void target_wait_for_sess_cmds(struct se
+
+ list_for_each_entry_safe(se_cmd, tmp_cmd,
+ &se_sess->sess_wait_list, se_cmd_list) {
+- list_del_init(&se_cmd->se_cmd_list);
+-
+ pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
+ " %d\n", se_cmd, se_cmd->t_state,
+ se_cmd->se_tfo->get_cmd_state(se_cmd));
projects / thirdparty / kernel / stable-queue.git / commitdiff
