--- /dev/null
+From 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 18 Feb 2015 13:50:16 +0200
+Subject: ACPI / LPSS: Always disable I2C host controllers
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 3293c7b8ec213a640f5ea2e5efeaa2b7559b1e19 upstream.
+
+On Baytrail and Braswell the BIOS might leave the I2C host controllers
+enabled, probably because it uses them for its own purposes. This is fine
+in normal cases because the I2C driver will disable the hardware when it
+is probed anyway.
+
+However, in case of suspend to disk it is different story. If the driver
+happens to be compiled as a module the boot kernel never loads the driver
+thus leaving host controllers enabled upon loading the hibernation image.
+
+The I2C host controller interrupt mask register has default value of 0x8ff,
+in other words it has most of the interrupts unmasked. When combined with
+the fact that the host controller is enabled, the driver immediately starts
+getting interrupts even before its resume hook is called (once IO-APIC is
+resumed). Since the driver is not prepared for this it will crash the
+kernel due to NULL pointer derefence because dev->msgs is NULL.
+
+Unfortunately we were not able to get full backtrace to from the console
+which could be reproduced here.
+
+In order to fix this even when the driver is compiled as module, we disable
+the I2C host controllers in byt_i2c_setup() before devices are created.
+
+Reported-by: Yu Chen <yu.c.chen@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -105,6 +105,8 @@ static void lpss_uart_setup(struct lpss_
+ }
+ }
+
++#define LPSS_I2C_ENABLE 0x6c
++
+ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ {
+ unsigned int offset;
+@@ -117,6 +119,8 @@ static void byt_i2c_setup(struct lpss_pr
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+ pdata->fixed_clk_rate = 133000000;
++
++ writel(0, pdata->mmio_base + LPSS_I2C_ENABLE);
+ }
+
+ static struct lpss_device_desc lpt_dev_desc = {
--- /dev/null
+From 3095794ae972bc6fc76af6cb3b864d6686b96094 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 18 Feb 2015 13:50:17 +0200
+Subject: ACPI / LPSS: Deassert resets for SPI host controllers on Braswell
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 3095794ae972bc6fc76af6cb3b864d6686b96094 upstream.
+
+On some Braswell systems BIOS leaves resets for SPI host controllers
+active. This prevents the SPI driver from transferring messages on wire.
+
+Fix this in similar way that we do for I2C already by deasserting resets
+for the SPI host controllers.
+
+Reported-by: Yang A Fang <yang.a.fang@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -105,9 +105,7 @@ static void lpss_uart_setup(struct lpss_
+ }
+ }
+
+-#define LPSS_I2C_ENABLE 0x6c
+-
+-static void byt_i2c_setup(struct lpss_private_data *pdata)
++static void lpss_deassert_reset(struct lpss_private_data *pdata)
+ {
+ unsigned int offset;
+ u32 val;
+@@ -116,6 +114,13 @@ static void byt_i2c_setup(struct lpss_pr
+ val = readl(pdata->mmio_base + offset);
+ val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC;
+ writel(val, pdata->mmio_base + offset);
++}
++
++#define LPSS_I2C_ENABLE 0x6c
++
++static void byt_i2c_setup(struct lpss_private_data *pdata)
++{
++ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+ pdata->fixed_clk_rate = 133000000;
+@@ -170,6 +175,12 @@ static struct lpss_device_desc byt_i2c_d
+ .setup = byt_i2c_setup,
+ };
+
++static struct lpss_device_desc bsw_spi_dev_desc = {
++ .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
++ .prv_offset = 0x400,
++ .setup = lpss_deassert_reset,
++};
++
+ #else
+
+ #define LPSS_ADDR(desc) (0UL)
+@@ -202,7 +213,7 @@ static const struct acpi_device_id acpi_
+ /* Braswell LPSS devices */
+ { "80862288", LPSS_ADDR(byt_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(byt_uart_dev_desc) },
+- { "8086228E", LPSS_ADDR(byt_spi_dev_desc) },
++ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
+ { "808622C1", LPSS_ADDR(byt_i2c_dev_desc) },
+
+ { "INT3430", LPSS_ADDR(lpt_dev_desc) },
--- /dev/null
+From eb71f8a5e33fa1066fb92f0111ab366a341e1f6c Mon Sep 17 00:00:00 2001
+From: honclo <honclo@imap.linux.ibm.com>
+Date: Thu, 12 Feb 2015 21:02:24 -0500
+Subject: Added Little Endian support to vtpm module
+
+From: honclo <honclo@imap.linux.ibm.com>
+
+commit eb71f8a5e33fa1066fb92f0111ab366a341e1f6c upstream.
+
+The tpm_ibmvtpm module is affected by an unaligned access problem.
+ibmvtpm_crq_get_version failed with rc=-4 during boot when vTPM is
+enabled in Power partition, which supports both little endian and
+big endian modes.
+
+We added little endian support to fix this problem:
+1) added cpu_to_be64 calls to ensure BE data is sent from an LE OS.
+2) added be16_to_cpu and be32_to_cpu calls to make sure data received
+ is in LE format on a LE OS.
+
+Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
+Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
+[phuewe: manually applied the patch :( ]
+Reviewed-by: Ashley Lai <ashley@ahsleylai.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_ibmvtpm.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -148,7 +148,8 @@ static int tpm_ibmvtpm_send(struct tpm_c
+ crq.len = (u16)count;
+ crq.data = ibmvtpm->rtce_dma_handle;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
++ cpu_to_be64(word[1]));
+ if (rc != H_SUCCESS) {
+ dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+ rc = 0;
+@@ -186,7 +187,8 @@ static int ibmvtpm_crq_get_rtce_size(str
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
+@@ -212,7 +214,8 @@ static int ibmvtpm_crq_get_version(struc
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_GET_VERSION;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "ibmvtpm_crq_get_version failed rc=%d\n", rc);
+@@ -335,7 +338,8 @@ static int tpm_ibmvtpm_suspend(struct de
+ crq.valid = (u8)IBMVTPM_VALID_CMD;
+ crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
+
+- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
++ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
++ cpu_to_be64(buf[1]));
+ if (rc != H_SUCCESS)
+ dev_err(ibmvtpm->dev,
+ "tpm_ibmvtpm_suspend failed rc=%d\n", rc);
+@@ -480,11 +484,11 @@ static void ibmvtpm_crq_process(struct i
+ case IBMVTPM_VALID_CMD:
+ switch (crq->msg) {
+ case VTPM_GET_RTCE_BUFFER_SIZE_RES:
+- if (crq->len <= 0) {
++ if (be16_to_cpu(crq->len) <= 0) {
+ dev_err(ibmvtpm->dev, "Invalid rtce size\n");
+ return;
+ }
+- ibmvtpm->rtce_size = crq->len;
++ ibmvtpm->rtce_size = be16_to_cpu(crq->len);
+ ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
+ GFP_KERNEL);
+ if (!ibmvtpm->rtce_buf) {
+@@ -505,11 +509,11 @@ static void ibmvtpm_crq_process(struct i
+
+ return;
+ case VTPM_GET_VERSION_RES:
+- ibmvtpm->vtpm_version = crq->data;
++ ibmvtpm->vtpm_version = be32_to_cpu(crq->data);
+ return;
+ case VTPM_TPM_COMMAND_RES:
+ /* len of the data in rtce buffer */
+- ibmvtpm->res_len = crq->len;
++ ibmvtpm->res_len = be16_to_cpu(crq->len);
+ wake_up_interruptible(&ibmvtpm->wq);
+ return;
+ default:
--- /dev/null
+From 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 13 Feb 2015 11:14:41 +0800
+Subject: ALSA: hda - enable mute led quirk for one more hp machine.
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 7976eb49cbd138d8014fa02682d8f969ad1e9ff2 upstream.
+
+Otherwise, the mute led can't work at all.
+
+Tested-by: Taihsiang Ho <taihsiang.ho@canonical.com>
+BugLink: https://bugs.launchpad.net/bugs/1410704
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4805,6 +4805,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+ /* ALC282 */
++ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
--- /dev/null
+From 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 5 Feb 2015 12:23:33 +0100
+Subject: ALSA: hda - Set up GPIO for Toshiba Satellite S50D
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4227de2a7e5f0ff6a58e919a9c4f2bb06e882f48 upstream.
+
+Toshiba Satellite S50D laptop with an IDT codec uses the GPIO4 (0x10)
+as the master EAPD.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=915858
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -99,6 +99,7 @@ enum {
+ STAC_HP_ENVY_BASS,
+ STAC_HP_BNB13_EQ,
+ STAC_HP_ENVY_TS_BASS,
++ STAC_92HD83XXX_GPIO10_EAPD,
+ STAC_92HD83XXX_MODELS
+ };
+
+@@ -2141,6 +2142,19 @@ static void stac92hd83xxx_fixup_headset_
+ spec->headset_jack = 1;
+ }
+
++static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++ spec->eapd_mask = spec->gpio_mask = spec->gpio_dir =
++ spec->gpio_data = 0x10;
++ spec->eapd_switch = 0;
++}
++
+ static const struct hda_verb hp_bnb13_eq_verbs[] = {
+ /* 44.1KHz base */
+ { 0x22, 0x7A6, 0x3E },
+@@ -2656,6 +2670,10 @@ static const struct hda_fixup stac92hd83
+ {}
+ },
+ },
++ [STAC_92HD83XXX_GPIO10_EAPD] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = stac92hd83xxx_fixup_gpio10_eapd,
++ },
+ };
+
+ static const struct hda_model_fixup stac92hd83xxx_models[] = {
+@@ -2861,6 +2879,8 @@ static const struct snd_pci_quirk stac92
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ "HP Mini", STAC_92HD83XXX_HP_LED),
+ SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++ "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ {} /* terminator */
+ };
+
--- /dev/null
+From f0153c3d948c1764f6c920a0675d86fc1d75813e Mon Sep 17 00:00:00 2001
+From: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+Date: Tue, 10 Feb 2015 11:33:50 +0100
+Subject: ALSA: hdspm - Constrain periods to 2 on older cards
+
+From: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+
+commit f0153c3d948c1764f6c920a0675d86fc1d75813e upstream.
+
+RME RayDAT and AIO use a fixed buffer size of 16384 samples. With period
+sizes of 32-4096, this translates to 4-512 periods.
+
+The older RME cards have a variable buffer size but require exactly two
+periods.
+
+This patch enforces nperiods=2 on those cards.
+
+Signed-off-by: Adrian Knoth <adi@drcomp.erfurt.thur.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/rme9652/hdspm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -6114,6 +6114,9 @@ static int snd_hdspm_playback_open(struc
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+@@ -6188,6 +6191,9 @@ static int snd_hdspm_capture_open(struct
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
--- /dev/null
+From e4940626defdf6c92da1052ad3f12741c1a28c90 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 9 Feb 2015 16:51:40 +0300
+Subject: ALSA: off by one bug in snd_riptide_joystick_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e4940626defdf6c92da1052ad3f12741c1a28c90 upstream.
+
+The problem here is that we check:
+
+ if (dev >= SNDRV_CARDS)
+
+Then we increment "dev".
+
+ if (!joystick_port[dev++])
+
+Then we use it as an offset into a array with SNDRV_CARDS elements.
+
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+
+This has 3 effects:
+1) If you use the module option to specify the joystick port then it has
+ to be shifted one space over.
+2) The wrong error message will be printed on failure if you have over
+ 32 cards.
+3) Static checkers will correctly complain that are off by one.
+
+Fixes: db1005ec6ff8 ('ALSA: riptide - Fix joystick resource handling')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/riptide/riptide.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/riptide/riptide.c
++++ b/sound/pci/riptide/riptide.c
+@@ -2030,32 +2030,43 @@ snd_riptide_joystick_probe(struct pci_de
+ {
+ static int dev;
+ struct gameport *gameport;
++ int ret;
+
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
++
+ if (!enable[dev]) {
+- dev++;
+- return -ENOENT;
++ ret = -ENOENT;
++ goto inc_dev;
+ }
+
+- if (!joystick_port[dev++])
+- return 0;
++ if (!joystick_port[dev]) {
++ ret = 0;
++ goto inc_dev;
++ }
+
+ gameport = gameport_allocate_port();
+- if (!gameport)
+- return -ENOMEM;
++ if (!gameport) {
++ ret = -ENOMEM;
++ goto inc_dev;
++ }
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+ snd_printk(KERN_WARNING
+ "Riptide: cannot grab gameport 0x%x\n",
+ joystick_port[dev]);
+ gameport_free_port(gameport);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto inc_dev;
+ }
+
+ gameport->io = joystick_port[dev];
+ gameport_register_port(gameport);
+ pci_set_drvdata(pci, gameport);
+- return 0;
++
++ ret = 0;
++inc_dev:
++ dev++;
++ return ret;
+ }
+
+ static void snd_riptide_joystick_remove(struct pci_dev *pci)
--- /dev/null
+From 06f34e1c28f3608b0ce5b310e41102d3fe7b65a1 Mon Sep 17 00:00:00 2001
+From: Alexey Brodkin <abrodkin@synopsys.com>
+Date: Thu, 12 Feb 2015 21:10:11 +0300
+Subject: ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE
+
+From: Alexey Brodkin <abrodkin@synopsys.com>
+
+commit 06f34e1c28f3608b0ce5b310e41102d3fe7b65a1 upstream.
+
+We used to calculate page address differently in 2 cases:
+
+1. In virt_to_page(x) we do
+ --->8---
+ mem_map + (x - CONFIG_LINUX_LINK_BASE) >> PAGE_SHIFT
+ --->8---
+
+2. In in pte_page(x) we do
+ --->8---
+ mem_map + (pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT
+ --->8---
+
+That leads to problems in case PAGE_OFFSET != CONFIG_LINUX_LINK_BASE -
+different pages will be selected depending on where and how we calculate
+page address.
+
+In particular in the STAR 9000853582 when gdb attempted to read memory
+of another process it got improper page in get_user_pages() because this
+is exactly one of the places where we search for a page by pte_page().
+
+The fix is trivial - we need to calculate page address similarly in both
+cases.
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/pgtable.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -259,7 +259,8 @@ static inline void pmd_set(pmd_t *pmdp,
+ #define pmd_clear(xp) do { pmd_val(*(xp)) = 0; } while (0)
+
+ #define pte_page(x) (mem_map + \
+- (unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT)))
++ (unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \
++ PAGE_SHIFT)))
+
+ #define mk_pte(page, pgprot) \
+ ({ \
--- /dev/null
+From e461894dc2ce7778ccde1c3483c9b15a85a7fc5f Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Thu, 15 Jan 2015 03:06:22 +0100
+Subject: ARM: 8284/1: sa1100: clear RCSR_SMR on resume
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit e461894dc2ce7778ccde1c3483c9b15a85a7fc5f upstream.
+
+StrongARM core uses RCSR SMR bit to tell to bootloader that it was reset
+by entering the sleep mode. After we have resumed, there is little point
+in having that bit enabled. Moreover, if this bit is set before reboot,
+the bootloader can become confused. Thus clear the SMR bit on resume
+just before clearing the scratchpad (resume address) register.
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-sa1100/pm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-sa1100/pm.c
++++ b/arch/arm/mach-sa1100/pm.c
+@@ -81,6 +81,7 @@ static int sa11x0_pm_enter(suspend_state
+ /*
+ * Ensure not to come back here if it wasn't intended
+ */
++ RCSR = RCSR_SMR;
+ PSPR = 0;
+
+ /*
--- /dev/null
+From 1c7e36bfc3e2fb2df5e2d1989a4b6fb9055a0f9b Mon Sep 17 00:00:00 2001
+From: Lokesh Vutla <lokeshvutla@ti.com>
+Date: Thu, 8 Jan 2015 17:22:04 +0530
+Subject: ARM: DRA7: hwmod: Fix boot crash with DEBUG_LL enabled on UART3
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+commit 1c7e36bfc3e2fb2df5e2d1989a4b6fb9055a0f9b upstream.
+
+With commit '7dedd34: ARM: OMAP2+: hwmod: Fix a crash in _setup_reset()
+with DEBUG_LL' we moved from parsing cmdline to identify uart used
+for earlycon to using the requsite hwmod CONFIG_DEBUG_OMAPxUARTy FLAGS.
+
+On DRA7 UART3 hwmod doesn't have this flag enabled, and atleast on
+BeagleBoard-X15, where we use UART3 for console, boot fails with
+DEBUG_LL enabled. Enable DEBUG_OMAP4UART3_FLAGS for UART3 hwmod.
+
+For using DEBUG_LL, enable CONFIG_DEBUG_OMAP4UART3 in menuconfig.
+
+Fixes: 90020c7b2c5e ("ARM: OMAP: DRA7: hwmod: Create initial DRA7XX SoC data")
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Acked-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+@@ -2017,7 +2017,7 @@ static struct omap_hwmod dra7xx_uart3_hw
+ .class = &dra7xx_uart_hwmod_class,
+ .clkdm_name = "l4per_clkdm",
+ .main_clk = "uart3_gfclk_mux",
+- .flags = HWMOD_SWSUP_SIDLE_ACT,
++ .flags = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP4UART3_FLAGS,
+ .prcm = {
+ .omap4 = {
+ .clkctrl_offs = DRA7XX_CM_L4PER_UART3_CLKCTRL_OFFSET,
--- /dev/null
+From 67fd14b3eca63b14429350e9eadc5fab709a8821 Mon Sep 17 00:00:00 2001
+From: Robert Nelson <robertcnelson@gmail.com>
+Date: Tue, 24 Feb 2015 10:10:43 -0600
+Subject: ARM: dts: am335x-bone*: usb0 is hardwired for peripheral
+
+From: Robert Nelson <robertcnelson@gmail.com>
+
+commit 67fd14b3eca63b14429350e9eadc5fab709a8821 upstream.
+
+Fixes: http://bugs.elinux.org/issues/127
+
+the bb.org community was seeing random reboots before this change.
+
+Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Acked-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/am335x-bone-common.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
+@@ -195,6 +195,7 @@
+
+ &usb0 {
+ status = "okay";
++ dr_mode = "peripheral";
+ };
+
+ &usb1 {
--- /dev/null
+From 9df11828d9b5665ddef81e45f83dd5376a8cd620 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Tue, 10 Feb 2015 17:33:07 -0800
+Subject: ARM: dts: BCM63xx: fix L2 cache properties
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 9df11828d9b5665ddef81e45f83dd5376a8cd620 upstream.
+
+The L2 cache properties were completely off with respect to what the
+hardware is configured for. Fix the cache-size, cache-line-size and
+cache-sets to reflect the L2 cache controller we have: 512KB, 16 ways
+and 32 bytes per cache-line.
+
+Fixes: 46d4bca0445a0 ("ARM: BCM63XX: add BCM63138 minimal Device Tree")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/bcm63138.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm63138.dtsi
++++ b/arch/arm/boot/dts/bcm63138.dtsi
+@@ -66,8 +66,9 @@
+ reg = <0x1d000 0x1000>;
+ cache-unified;
+ cache-level = <2>;
+- cache-sets = <16>;
+- cache-size = <0x80000>;
++ cache-size = <524288>;
++ cache-sets = <1024>;
++ cache-line-size = <32>;
+ interrupts = <GIC_PPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
--- /dev/null
+From de47699d005996b41cea590c6098078ac12058be Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Dec 2014 18:19:19 +0300
+Subject: ARM: dts: tegra20: fix GR3D, DSI unit and reg base addresses
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit de47699d005996b41cea590c6098078ac12058be upstream.
+
+Commit 58ecb23f64ee ("ARM: tegra: add missing unit addresses to DT") added
+unit address and changed reg base for GR3D and DSI host1x modules, but these
+addresses belongs to GR2D and TVO modules respectively. Fix it by changing
+modules unit and reg base addresses to proper ones.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Fixes: 58ecb23f64ee (ARM: tegra: add missing unit addresses to DT)
+Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/tegra20.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/tegra20.dtsi
++++ b/arch/arm/boot/dts/tegra20.dtsi
+@@ -68,9 +68,9 @@
+ reset-names = "2d";
+ };
+
+- gr3d@54140000 {
++ gr3d@54180000 {
+ compatible = "nvidia,tegra20-gr3d";
+- reg = <0x54140000 0x00040000>;
++ reg = <0x54180000 0x00040000>;
+ clocks = <&tegra_car TEGRA20_CLK_GR3D>;
+ resets = <&tegra_car 24>;
+ reset-names = "3d";
+@@ -130,9 +130,9 @@
+ status = "disabled";
+ };
+
+- dsi@542c0000 {
++ dsi@54300000 {
+ compatible = "nvidia,tegra20-dsi";
+- reg = <0x542c0000 0x00040000>;
++ reg = <0x54300000 0x00040000>;
+ clocks = <&tegra_car TEGRA20_CLK_DSI>;
+ resets = <&tegra_car 48>;
+ reset-names = "dsi";
--- /dev/null
+From 165235180ff61f0012ea68a299e46daec43dcaa7 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 2 Feb 2015 15:27:16 +0100
+Subject: ARM: mvebu: build armada375-smp code conditionally
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 165235180ff61f0012ea68a299e46daec43dcaa7 upstream.
+
+mvebu_armada375_smp_wa_init is only used on armada 375 but is defined
+for all mvebu machines. As it calls a function that is only provided
+sometimes, this can result in a link error:
+
+arch/arm/mach-mvebu/built-in.o: In function `mvebu_armada375_smp_wa_init':
+:(.text+0x228): undefined reference to `mvebu_setup_boot_addr_wa'
+
+To solve this, we can just change the existing #ifdef around the
+function to also check for Armada375 SMP platforms.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 305969fb6292 ("ARM: mvebu: use the common function for Armada 375 SMP workaround")
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Gregory Clement <gregory.clement@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/system-controller.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-mvebu/system-controller.c
++++ b/arch/arm/mach-mvebu/system-controller.c
+@@ -126,7 +126,7 @@ int mvebu_system_controller_get_soc_id(u
+ return -ENODEV;
+ }
+
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) && defined(CONFIG_MACH_MVEBU_V7)
+ void mvebu_armada375_smp_wa_init(void)
+ {
+ u32 dev, rev;
--- /dev/null
+From 271e80176aae4e5b481f4bb92df9768c6075bbca Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Thu, 4 Dec 2014 14:10:00 +0300
+Subject: ARM: pxa: add regulator_has_full_constraints to corgi board file
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit 271e80176aae4e5b481f4bb92df9768c6075bbca upstream.
+
+Add regulator_has_full_constraints() call to corgi board file to let
+regulator core know that we do not have any additional regulators left.
+This lets it substitute unprovided regulators with dummy ones.
+
+This fixes the following warnings that can be seen on corgi if
+regulators are enabled:
+
+ads7846 spi1.0: unable to get regulator: -517
+spi spi1.0: Driver ads7846 requests probe deferral
+wm8731 0-001b: Failed to get supply 'AVDD': -517
+wm8731 0-001b: Failed to request supplies: -517
+wm8731 0-001b: ASoC: failed to probe component -517
+corgi-audio corgi-audio: ASoC: failed to instantiate card -517
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-pxa/corgi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/mach-pxa/corgi.c
++++ b/arch/arm/mach-pxa/corgi.c
+@@ -26,6 +26,7 @@
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
+ #include <linux/io.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/corgi_lcd.h>
+@@ -752,6 +753,8 @@ static void __init corgi_init(void)
+ sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;
+
+ platform_add_devices(devices, ARRAY_SIZE(devices));
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_corgi(struct tag *tags, char **cmdline)
--- /dev/null
+From 9bc78f32c2e430aebf6def965b316aa95e37a20c Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Thu, 4 Dec 2014 14:10:01 +0300
+Subject: ARM: pxa: add regulator_has_full_constraints to poodle board file
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit 9bc78f32c2e430aebf6def965b316aa95e37a20c upstream.
+
+Add regulator_has_full_constraints() call to poodle board file to let
+regulator core know that we do not have any additional regulators left.
+This lets it substitute unprovided regulators with dummy ones.
+
+This fixes the following warnings that can be seen on poodle if
+regulators are enabled:
+
+ads7846 spi1.0: unable to get regulator: -517
+spi spi1.0: Driver ads7846 requests probe deferral
+wm8731 0-001b: Failed to get supply 'AVDD': -517
+wm8731 0-001b: Failed to request supplies: -517
+wm8731 0-001b: ASoC: failed to probe component -517
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-pxa/poodle.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/mach-pxa/poodle.c
++++ b/arch/arm/mach-pxa/poodle.c
+@@ -25,6 +25,7 @@
+ #include <linux/gpio.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/pxa2xx_spi.h>
+@@ -455,6 +456,7 @@ static void __init poodle_init(void)
+ pxa_set_i2c_info(NULL);
+ i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
+ poodle_init_spi();
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_poodle(struct tag *tags, char **cmdline)
--- /dev/null
+From 95fcedb027a27f32bf2434f9271635c380e57fb5 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 5 Feb 2015 13:42:43 +0100
+Subject: ARM: vexpress: use ARM_CPU_SUSPEND if needed
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 95fcedb027a27f32bf2434f9271635c380e57fb5 upstream.
+
+The vexpress tc2 power management code calls mcpm_loopback, which
+is only available if ARM_CPU_SUSPEND is enabled, otherwise we
+get a link error:
+
+arch/arm/mach-vexpress/built-in.o: In function `tc2_pm_init':
+arch/arm/mach-vexpress/tc2_pm.c:389: undefined reference to `mcpm_loopback'
+
+This explicitly selects ARM_CPU_SUSPEND like other platforms that
+need it.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 3592d7e002438 ("ARM: 8082/1: TC2: test the MCPM loopback during boot")
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Cc: Kevin Hilman <khilman@linaro.org>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-vexpress/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-vexpress/Kconfig
++++ b/arch/arm/mach-vexpress/Kconfig
+@@ -75,6 +75,7 @@ config ARCH_VEXPRESS_TC2_PM
+ depends on MCPM
+ select ARM_CCI
+ select ARCH_VEXPRESS_SPC
++ select ARM_CPU_SUSPEND
+ help
+ Support for CPU and cluster power management on Versatile Express
+ with a TC2 (A15x2 A7x3) big.LITTLE core tile.
--- /dev/null
+From f9a7ba326938f03b9305af8d31c360fce10cd4df Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 28 Jan 2015 22:30:01 +0100
+Subject: ASoC: davinci: fix DM365_EVM codec selection
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit f9a7ba326938f03b9305af8d31c360fce10cd4df upstream.
+
+An earlier bug fix of mine made the SND_DM365_VOICE_CODEC symbol
+tristate to avoid creating an undefined reference from the
+davinci-vcif.c driver to the davinci_soc_platform_register
+function that may be in a module.
+
+However, this may now lead to a different error on randconfig
+kernels:
+
+"warning: SND_DM365_VOICE_CODEC creates inconsistent choice state"
+
+This happens because we now have a choice statement with
+one bool and one tristate option, and the latter might not
+support being set to 'y' because of dependencies.
+
+This new change turns the other option into 'tristate' as well,
+which avoids the problem.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 19926c6de0c3 ("ASoC: davinci: vcif must be a module if SND_DAVINCI_SOC is")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/davinci/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/davinci/Kconfig
++++ b/sound/soc/davinci/Kconfig
+@@ -58,13 +58,12 @@ choice
+ depends on MACH_DAVINCI_DM365_EVM
+
+ config SND_DM365_AIC3X_CODEC
+- bool "Audio Codec - AIC3101"
++ tristate "Audio Codec - AIC3101"
+ help
+ Say Y if you want to add support for AIC3101 audio codec
+
+ config SND_DM365_VOICE_CODEC
+ tristate "Voice Codec - CQ93VC"
+- depends on SND_DAVINCI_SOC
+ select MFD_DAVINCI_VOICECODEC
+ select SND_DAVINCI_SOC_VCIF
+ select SND_SOC_CQ0093VC
--- /dev/null
+From 7331ea474e9e7a348541c207bdb6aa518c6403f4 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Thu, 15 Jan 2015 12:52:01 +0100
+Subject: ASoC: mioa701_wm9713: Fix speaker event
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 7331ea474e9e7a348541c207bdb6aa518c6403f4 upstream.
+
+Commit f6b2a04590bb ("ASoC: pxa: mioa701_wm9713: Convert to table based DAPM
+setup") converted the driver to register the board level DAPM elements with
+the card's DAPM context rather than the CODEC's DAPM context. The change
+overlooked that the speaker widget event callback accesses the widget's
+codec field which is only valid if the widget has been registered in a CODEC
+DAPM context. This patch modifies the callback to take an alternative route
+to get the CODEC.
+
+Fixes: f6b2a04590bb ("ASoC: pxa: mioa701_wm9713: Convert to table based DAPM
+setup")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/pxa/mioa701_wm9713.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/pxa/mioa701_wm9713.c
++++ b/sound/soc/pxa/mioa701_wm9713.c
+@@ -81,7 +81,7 @@ static int rear_amp_power(struct snd_soc
+ static int rear_amp_event(struct snd_soc_dapm_widget *widget,
+ struct snd_kcontrol *kctl, int event)
+ {
+- struct snd_soc_codec *codec = widget->codec;
++ struct snd_soc_codec *codec = widget->dapm->card->rtd[0].codec;
+
+ return rear_amp_power(codec, SND_SOC_DAPM_EVENT_ON(event));
+ }
--- /dev/null
+From 92b133f251b5f914f3ed28bc83e5b7a40d4e22ed Mon Sep 17 00:00:00 2001
+From: Bard Liao <bardliao@realtek.com>
+Date: Mon, 9 Feb 2015 14:41:50 +0800
+Subject: ASoC: rt5670: Set use_single_rw flag for regmap
+
+From: Bard Liao <bardliao@realtek.com>
+
+commit 92b133f251b5f914f3ed28bc83e5b7a40d4e22ed upstream.
+
+RT5670 doesn't support auto incrementing writes so driver should
+set the use_single_rw flag for regmap.
+
+Signed-off-by: Bard Liao <bardliao@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5670.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -2439,6 +2439,7 @@ static struct snd_soc_codec_driver soc_c
+ static const struct regmap_config rt5670_regmap = {
+ .reg_bits = 8,
+ .val_bits = 16,
++ .use_single_rw = true,
+ .max_register = RT5670_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5670_ranges) *
+ RT5670_PR_SPACING),
+ .volatile_reg = rt5670_volatile_register,
--- /dev/null
+From 91117a20245b59f70b563523edbf998a62fc6383 Mon Sep 17 00:00:00 2001
+From: Matthew Wilcox <matthew.r.wilcox@intel.com>
+Date: Wed, 7 Jan 2015 18:04:18 +0200
+Subject: axonram: Fix bug in direct_access
+
+From: Matthew Wilcox <matthew.r.wilcox@intel.com>
+
+commit 91117a20245b59f70b563523edbf998a62fc6383 upstream.
+
+The 'pfn' returned by axonram was completely bogus, and has been since
+2008.
+
+Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/sysdev/axonram.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/sysdev/axonram.c
++++ b/arch/powerpc/sysdev/axonram.c
+@@ -156,7 +156,7 @@ axon_ram_direct_access(struct block_devi
+ }
+
+ *kaddr = (void *)(bank->ph_addr + offset);
+- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
++ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;
+
+ return 0;
+ }
--- /dev/null
+From 564e559f2baf6a868768d0cac286980b3cfd6e30 Mon Sep 17 00:00:00 2001
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Wed, 11 Feb 2015 11:32:30 -0500
+Subject: blk-mq: fix double-free in error path
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+commit 564e559f2baf6a868768d0cac286980b3cfd6e30 upstream.
+
+If the allocation of bt->bs fails, then bt->map can be freed twice, once
+in blk_mq_init_bitmap_tags() -> bt_alloc(), and once in
+blk_mq_init_bitmap_tags() -> bt_free(). Fix by setting the pointer to
+NULL after the first free.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq-tag.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -500,6 +500,7 @@ static int bt_alloc(struct blk_mq_bitmap
+ bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL);
+ if (!bt->bs) {
+ kfree(bt->map);
++ bt->map = NULL;
+ return -ENOMEM;
+ }
+
--- /dev/null
+From 033efa920a7f22a8caf7a38d851a2f451781bbf7 Mon Sep 17 00:00:00 2001
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+Date: Sun, 18 Jan 2015 00:16:51 +0300
+Subject: Bluetooth: ath3k: Add support of AR3012 bluetooth 13d3:3423 device
+
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+
+commit 033efa920a7f22a8caf7a38d851a2f451781bbf7 upstream.
+
+Add support of 13d3:3423 device.
+
+BugLink: https://bugs.launchpad.net/bugs/1411193
+
+T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3423 Rev= 0.01
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/ath3k.c | 2 ++
+ drivers/bluetooth/btusb.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -106,6 +106,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x13d3, 0x3402) },
+ { USB_DEVICE(0x13d3, 0x3408) },
++ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -158,6 +159,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -183,6 +183,7 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
--- /dev/null
+From c561a5753dd631920c4459a067d22679b3d110d6 Mon Sep 17 00:00:00 2001
+From: Adam Lee <adam.lee@canonical.com>
+Date: Wed, 28 Jan 2015 15:30:27 -0500
+Subject: Bluetooth: ath3k: workaround the compatibility issue with xHCI controller
+
+From: Adam Lee <adam.lee@canonical.com>
+
+commit c561a5753dd631920c4459a067d22679b3d110d6 upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/1400215
+
+ath3k devices fail to load firmwares on xHCI buses, but work well on
+EHCI, this might be a compatibility issue between xHCI and ath3k chips.
+As my testing result, those chips will work on xHCI buses again with
+this patch.
+
+This workaround is from Qualcomm, they also did some workarounds in
+Windows driver.
+
+Signed-off-by: Adam Lee <adam.lee@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/ath3k.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -170,6 +170,8 @@ static const struct usb_device_id ath3k_
+ #define USB_REQ_DFU_DNLOAD 1
+ #define BULK_SIZE 4096
+ #define FW_HDR_SIZE 20
++#define TIMEGAP_USEC_MIN 50
++#define TIMEGAP_USEC_MAX 100
+
+ static int ath3k_load_firmware(struct usb_device *udev,
+ const struct firmware *firmware)
+@@ -201,6 +203,9 @@ static int ath3k_load_firmware(struct us
+ pipe = usb_sndbulkpipe(udev, 0x02);
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ memcpy(send_buf, firmware->data + sent, size);
+
+@@ -298,6 +303,9 @@ static int ath3k_load_fwfile(struct usb_
+ pipe = usb_sndbulkpipe(udev, 0x02);
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ memcpy(send_buf, firmware->data + sent, size);
+
--- /dev/null
+From 9a5abdaaf9d2e80e157c7a756f9d9fd933dee48e Mon Sep 17 00:00:00 2001
+From: Rick Dunn <rick@rickdunn.com>
+Date: Sat, 17 Jan 2015 05:29:12 +0100
+Subject: Bluetooth: btusb: Add Broadcom patchram support for ASUSTek devices
+
+From: Rick Dunn <rick@rickdunn.com>
+
+commit 9a5abdaaf9d2e80e157c7a756f9d9fd933dee48e upstream.
+
+T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0b05 ProdID=17cf Rev= 1.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+S: SerialNumber=54271E3298CD
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Firmware is extracted from the latest Broadcom BCM4352 Windows driver
+by extracting the zip and searching the .hex file names for '17cf'.
+
+The hex file must then be converted to hcd format using the hex2hcd
+utility and then moved to /lib/firmware/brcm/.
+
+Signed-off-by: Rick Dunn <rick@rickdunn.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -115,7 +115,8 @@ static const struct usb_device_id btusb_
+ .driver_info = BTUSB_BCM_PATCHRAM },
+
+ /* ASUSTek Computer - Broadcom based */
+- { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
+
+ /* Belkin F8065bf - Broadcom based */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
--- /dev/null
+From d049f4e513e861167361b06c7ca85f9e872c8cde Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Mon, 26 Jan 2015 20:35:32 -0800
+Subject: Bluetooth: btusb: Add support for Dynex/Insignia USB dongles
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit d049f4e513e861167361b06c7ca85f9e872c8cde upstream.
+
+The Dynex/Insignia USB dongles are Broadcom BCM20702B0 based and require
+firmware update before operation.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=19ff ProdID=0239 Rev= 1.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Since this is an unsual USB vendor ID (0x19ff), these dongles are added
+via USB_DEVICE macro and not USB_VENDOR_AND_INTERFACE_INFO as done for
+mainstream Broadcom based dongles.
+
+The latest known working firmware is BCM20702B0_002.001.014.0527.0557.hex
+which needs to be converted using hex2hcd utility and then installed
+as /lib/firmware/brcm/BCM20702A0-19ff-0239.hcd to make this device fully
+operational.
+
+Bluetooth: hci0: BCM: patching hci_ver=06 hci_rev=2000 lmp_ver=06 lmp_subver=410e
+Bluetooth: hci0: BCM: firmware hci_ver=06 hci_rev=222d lmp_ver=06 lmp_subver=410e
+
+With this firmware the device reports support for connectionless slave
+broadcast (master and slave) feature used by 3D Glasses and TVs.
+
+ < HCI Command: Read Local Extended Features (0x04|0x0004) plen 1
+ Page: 2
+ > HCI Event: Command Complete (0x0e) plen 14
+ Read Local Extended Features (0x04|0x0004) ncmd 1
+ Status: Success (0x00)
+ Page: 2/2
+ Features: 0x0f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ Connectionless Slave Broadcast - Master
+ Connectionless Slave Broadcast - Slave
+ Synchronization Train
+ Synchronization Scan
+
+However there are some flaws with this feature. The Set Event Mask Page 2
+command is actually not supported and with that all connectionless slave
+broadcast events are always enabled.
+
+ < HCI Command: Set Event Mask Page 2 (0x03|0x0063) plen 8
+ Mask: 0x00000000000f0000
+ Synchronization Train Received
+ Connectionless Slave Broadcast Receive
+ Connectionless Slave Broadcast Timeout
+ Truncated Page Complete
+ > HCI Event: Command Complete (0x0e) plen 4
+ Set Event Mask Page 2 (0x03|0x0063) ncmd 1
+ Status: Unknown HCI Command (0x01)
+
+In addition the Synchronization Train Received event is actually broken
+on this controller. It mixes up the order of parameters. According to the
+Bluetooth Core specification the fields are like this:
+
+ struct hci_ev_sync_train_received {
+ __u8 status;
+ bdaddr_t bdaddr;
+ __le32 offset;
+ __u8 map[10];
+ __u8 lt_addr;
+ __le32 instant;
+ __le16 interval;
+ __u8 service_data;
+ } __packed;
+
+This controller however sends the service_data as 5th parameter instead
+of having it as last parameter.
+
+ struct hci_ev_sync_train_received {
+ __u8 status;
+ bdaddr_t bdaddr;
+ __le32 offset;
+ __u8 map[10];
+ __u8 service_data;
+ __u8 lt_addr;
+ __le32 instant;
+ __le16 interval;
+ } __packed;
+
+So anybody trying to use this hardware for utilizing connectionless slave
+broadcast receivers (aka 3D Glasses), be warned about this shortcoming.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -107,6 +107,9 @@ static const struct usb_device_id btusb_
+ { USB_DEVICE(0x0b05, 0x17cb) },
+ { USB_DEVICE(0x413c, 0x8197) },
+
++ /* Broadcom BCM20702B0 (Dynex/Insignia) */
++ { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Foxconn - Hon Hai */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
+
--- /dev/null
+From 8f0c304c693c5a9759ed6ae50d07d4590dad5ae7 Mon Sep 17 00:00:00 2001
+From: Matej Dubovy <matej.dubovy@gmail.com>
+Date: Mon, 2 Feb 2015 18:50:14 +0100
+Subject: Bluetooth: btusb: Add support for Lite-On (04ca) Broadcom based, BCM43142
+
+From: Matej Dubovy <matej.dubovy@gmail.com>
+
+commit 8f0c304c693c5a9759ed6ae50d07d4590dad5ae7 upstream.
+
+Please add support for sub BT chip on the combo card
+Broadcom 43142A0 (in Lenovo E145), 04ca:2007
+
+/sys/kernel/debug/usb/devices
+
+T: Bus=05 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=04ca ProdID=2007 Rev= 1.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM43142A0
+S: SerialNumber=28E347EC73BD
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Firmware for 04ca:2007 can be extracted from the latest Lenovo E145
+Bluetooth driver for Windows (driver is however described as BCM20702
+but contains also firwmare for BCM43142).
+Search for BCM43142A0_001.001.011.0122.0153.hex within hex files, then
+it must be converted using hex2hcd utility. Rename file to
+BCM43142A0-04ca-2007.hcd, then move to /lib/firmware/brcm/.
+
+Signed-off-by: Matej Dubovy <matej.dubovy@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -113,6 +113,10 @@ static const struct usb_device_id btusb_
+ /* Foxconn - Hon Hai */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
+
++ /* Lite-On Technology - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Broadcom devices with vendor specific id */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
+ .driver_info = BTUSB_BCM_PATCHRAM },
--- /dev/null
+From e12af489b91d47a806f4e96e4edc20df612482e7 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Wed, 14 Jan 2015 20:51:37 +0200
+Subject: Bluetooth: Fix valid Identity Address check
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit e12af489b91d47a806f4e96e4edc20df612482e7 upstream.
+
+According to the Bluetooth core specification valid identity addresses
+are either Public Device Addresses or Static Random Addresses. IRKs
+received with any other type of address should be discarded since we
+cannot assume to know the permanent identity of the peer device.
+
+This patch fixes a missing check for the Identity Address when receiving
+the Identity Address Information SMP PDU.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/smp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -1392,8 +1392,12 @@ static int smp_cmd_ident_addr_info(struc
+ * implementations are not known of and in order to not over
+ * complicate our implementation, simply pretend that we never
+ * received an IRK for such a device.
++ *
++ * The Identity Address must also be a Static Random or Public
++ * Address, which hci_is_identity_address() checks for.
+ */
+- if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
++ if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
++ !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
+ BT_ERR("Ignoring IRK with no identity address");
+ goto distribute;
+ }
--- /dev/null
+From c6ce194325cef342313e3d27620411ce90a89c50 Mon Sep 17 00:00:00 2001
+From: Jeff Moyer <jmoyer@redhat.com>
+Date: Mon, 12 Jan 2015 15:21:01 -0500
+Subject: cfq-iosched: fix incorrect filing of rt async cfqq
+
+From: Jeff Moyer <jmoyer@redhat.com>
+
+commit c6ce194325cef342313e3d27620411ce90a89c50 upstream.
+
+Hi,
+
+If you can manage to submit an async write as the first async I/O from
+the context of a process with realtime scheduling priority, then a
+cfq_queue is allocated, but filed into the wrong async_cfqq bucket. It
+ends up in the best effort array, but actually has realtime I/O
+scheduling priority set in cfqq->ioprio.
+
+The reason is that cfq_get_queue assumes the default scheduling class and
+priority when there is no information present (i.e. when the async cfqq
+is created):
+
+static struct cfq_queue *
+cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
+ struct bio *bio, gfp_t gfp_mask)
+{
+ const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+ const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
+
+cic->ioprio starts out as 0, which is "invalid". So, class of 0
+(IOPRIO_CLASS_NONE) is passed to cfq_async_queue_prio like so:
+
+ async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);
+
+static struct cfq_queue **
+cfq_async_queue_prio(struct cfq_data *cfqd, int ioprio_class, int ioprio)
+{
+ switch (ioprio_class) {
+ case IOPRIO_CLASS_RT:
+ return &cfqd->async_cfqq[0][ioprio];
+ case IOPRIO_CLASS_NONE:
+ ioprio = IOPRIO_NORM;
+ /* fall through */
+ case IOPRIO_CLASS_BE:
+ return &cfqd->async_cfqq[1][ioprio];
+ case IOPRIO_CLASS_IDLE:
+ return &cfqd->async_idle_cfqq;
+ default:
+ BUG();
+ }
+}
+
+Here, instead of returning a class mapped from the process' scheduling
+priority, we get back the bucket associated with IOPRIO_CLASS_BE.
+
+Now, there is no queue allocated there yet, so we create it:
+
+ cfqq = cfq_find_alloc_queue(cfqd, is_sync, cic, bio, gfp_mask);
+
+That function ends up doing this:
+
+ cfq_init_cfqq(cfqd, cfqq, current->pid, is_sync);
+ cfq_init_prio_data(cfqq, cic);
+
+cfq_init_cfqq marks the priority as having changed. Then, cfq_init_prio
+data does this:
+
+ ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+ switch (ioprio_class) {
+ default:
+ printk(KERN_ERR "cfq: bad prio %x\n", ioprio_class);
+ case IOPRIO_CLASS_NONE:
+ /*
+ * no prio set, inherit CPU scheduling settings
+ */
+ cfqq->ioprio = task_nice_ioprio(tsk);
+ cfqq->ioprio_class = task_nice_ioclass(tsk);
+ break;
+
+So we basically have two code paths that treat IOPRIO_CLASS_NONE
+differently, which results in an RT async cfqq filed into a best effort
+bucket.
+
+Attached is a patch which fixes the problem. I'm not sure how to make
+it cleaner. Suggestions would be welcome.
+
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Tested-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/cfq-iosched.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3661,12 +3661,17 @@ static struct cfq_queue *
+ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
+ struct bio *bio, gfp_t gfp_mask)
+ {
+- const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+- const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
++ int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
++ int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
+ struct cfq_queue **async_cfqq = NULL;
+ struct cfq_queue *cfqq = NULL;
+
+ if (!is_sync) {
++ if (!ioprio_valid(cic->ioprio)) {
++ struct task_struct *tsk = current;
++ ioprio = task_nice_ioprio(tsk);
++ ioprio_class = task_nice_ioclass(tsk);
++ }
+ async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);
+ cfqq = *async_cfqq;
+ }
--- /dev/null
+From 69abaffec7d47a083739b79e3066cb3730eba72e Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Mon, 9 Feb 2015 16:42:49 +0300
+Subject: cfq-iosched: handle failure of cfq group allocation
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+commit 69abaffec7d47a083739b79e3066cb3730eba72e upstream.
+
+Cfq_lookup_create_cfqg() allocates struct blkcg_gq using GFP_ATOMIC.
+In cfq_find_alloc_queue() possible allocation failure is not handled.
+As a result kernel oopses on NULL pointer dereference when
+cfq_link_cfqq_cfqg() calls cfqg_get() for NULL pointer.
+
+Bug was introduced in v3.5 in commit cd1604fab4f9 ("blkcg: factor
+out blkio_group creation"). Prior to that commit cfq group lookup
+had returned pointer to root group as fallback.
+
+This patch handles this error using existing fallback oom_cfqq.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Acked-by: Tejun Heo <tj@kernel.org>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Fixes: cd1604fab4f9 ("blkcg: factor out blkio_group creation")
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/cfq-iosched.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3590,6 +3590,11 @@ retry:
+
+ blkcg = bio_blkcg(bio);
+ cfqg = cfq_lookup_create_cfqg(cfqd, blkcg);
++ if (!cfqg) {
++ cfqq = &cfqd->oom_cfqq;
++ goto out;
++ }
++
+ cfqq = cic_to_cfqq(cic, is_sync);
+
+ /*
+@@ -3626,7 +3631,7 @@ retry:
+ } else
+ cfqq = &cfqd->oom_cfqq;
+ }
+-
++out:
+ if (new_cfqq)
+ kmem_cache_free(cfq_pool, new_cfqq);
+
--- /dev/null
+From bb95cd34ba4c9467114acc78eeddd53ab1c10085 Mon Sep 17 00:00:00 2001
+From: Kiran Padwal <kiran.padwal@smartplayin.com>
+Date: Fri, 19 Sep 2014 12:44:39 +0530
+Subject: char: tpm: Add missing error check for devm_kzalloc
+
+From: Kiran Padwal <kiran.padwal@smartplayin.com>
+
+commit bb95cd34ba4c9467114acc78eeddd53ab1c10085 upstream.
+
+Currently these driver are missing a check on the return value of devm_kzalloc,
+which would cause a NULL pointer dereference in a OOM situation.
+
+This patch adds a missing check for tpm_i2c_atmel.c and tpm_i2c_nuvoton.c
+
+Signed-off-by: Kiran Padwal <kiran.padwal@smartplayin.com>
+Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_i2c_atmel.c | 4 ++++
+ drivers/char/tpm/tpm_i2c_nuvoton.c | 5 +++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -168,6 +168,10 @@ static int i2c_atmel_probe(struct i2c_cl
+
+ chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+ GFP_KERNEL);
++ if (!chip->vendor.priv) {
++ rc = -ENOMEM;
++ goto out_err;
++ }
+
+ /* Default timeouts */
+ chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -538,6 +538,11 @@ static int i2c_nuvoton_probe(struct i2c_
+
+ chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+ GFP_KERNEL);
++ if (!chip->vendor.priv) {
++ rc = -ENOMEM;
++ goto out_err;
++ }
++
+ init_waitqueue_head(&chip->vendor.read_queue);
+ init_waitqueue_head(&chip->vendor.int_queue);
+
--- /dev/null
+From 04f81f0154e4bf002be6f4d85668ce1257efa4d9 Mon Sep 17 00:00:00 2001
+From: Paul Moore <pmoore@redhat.com>
+Date: Wed, 11 Feb 2015 14:46:37 -0500
+Subject: cipso: don't use IPCB() to locate the CIPSO IP option
+
+From: Paul Moore <pmoore@redhat.com>
+
+commit 04f81f0154e4bf002be6f4d85668ce1257efa4d9 upstream.
+
+Using the IPCB() macro to get the IPv4 options is convenient, but
+unfortunately NetLabel often needs to examine the CIPSO option outside
+of the scope of the IP layer in the stack. While historically IPCB()
+worked above the IP layer, due to the inclusion of the inet_skb_param
+struct at the head of the {tcp,udp}_skb_cb structs, recent commit
+971f10ec ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
+reordered the tcp_skb_cb struct and invalidated this IPCB() trick.
+
+This patch fixes the problem by creating a new function,
+cipso_v4_optptr(), which locates the CIPSO option inside the IP header
+without calling IPCB(). Unfortunately, this isn't as fast as a simple
+lookup so some additional tweaks were made to limit the use of this
+new function.
+
+Reported-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Paul Moore <pmoore@redhat.com>
+Tested-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/cipso_ipv4.h | 25 +++++++++++++--------
+ net/ipv4/cipso_ipv4.c | 51 +++++++++++++++++++++++++------------------
+ net/netlabel/netlabel_kapi.c | 15 ++++++++----
+ 3 files changed, 56 insertions(+), 35 deletions(-)
+
+--- a/include/net/cipso_ipv4.h
++++ b/include/net/cipso_ipv4.h
+@@ -121,13 +121,6 @@ extern int cipso_v4_rbm_strictvalid;
+ #endif
+
+ /*
+- * Helper Functions
+- */
+-
+-#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
+-#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso)
+-
+-/*
+ * DOI List Functions
+ */
+
+@@ -190,7 +183,7 @@ static inline int cipso_v4_doi_domhsh_re
+
+ #ifdef CONFIG_NETLABEL
+ void cipso_v4_cache_invalidate(void);
+-int cipso_v4_cache_add(const struct sk_buff *skb,
++int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr);
+ #else
+ static inline void cipso_v4_cache_invalidate(void)
+@@ -198,7 +191,7 @@ static inline void cipso_v4_cache_invali
+ return;
+ }
+
+-static inline int cipso_v4_cache_add(const struct sk_buff *skb,
++static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr)
+ {
+ return 0;
+@@ -211,6 +204,8 @@ static inline int cipso_v4_cache_add(con
+
+ #ifdef CONFIG_NETLABEL
+ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
++int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr);
+ int cipso_v4_sock_setattr(struct sock *sk,
+ const struct cipso_v4_doi *doi_def,
+ const struct netlbl_lsm_secattr *secattr);
+@@ -226,6 +221,7 @@ int cipso_v4_skbuff_setattr(struct sk_bu
+ int cipso_v4_skbuff_delattr(struct sk_buff *skb);
+ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+ struct netlbl_lsm_secattr *secattr);
++unsigned char *cipso_v4_optptr(const struct sk_buff *skb);
+ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
+ #else
+ static inline void cipso_v4_error(struct sk_buff *skb,
+@@ -235,6 +231,12 @@ static inline void cipso_v4_error(struct
+ return;
+ }
+
++static inline int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr)
++{
++ return -ENOSYS;
++}
++
+ static inline int cipso_v4_sock_setattr(struct sock *sk,
+ const struct cipso_v4_doi *doi_def,
+ const struct netlbl_lsm_secattr *secattr)
+@@ -282,6 +284,11 @@ static inline int cipso_v4_skbuff_getatt
+ return -ENOSYS;
+ }
+
++static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
++{
++ return NULL;
++}
++
+ static inline int cipso_v4_validate(const struct sk_buff *skb,
+ unsigned char **option)
+ {
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -376,20 +376,18 @@ static int cipso_v4_cache_check(const un
+ * negative values on failure.
+ *
+ */
+-int cipso_v4_cache_add(const struct sk_buff *skb,
++int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr)
+ {
+ int ret_val = -EPERM;
+ u32 bkt;
+ struct cipso_v4_map_cache_entry *entry = NULL;
+ struct cipso_v4_map_cache_entry *old_entry = NULL;
+- unsigned char *cipso_ptr;
+ u32 cipso_ptr_len;
+
+ if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
+ return 0;
+
+- cipso_ptr = CIPSO_V4_OPTPTR(skb);
+ cipso_ptr_len = cipso_ptr[1];
+
+ entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+@@ -1577,6 +1575,33 @@ static int cipso_v4_parsetag_loc(const s
+ }
+
+ /**
++ * cipso_v4_optptr - Find the CIPSO option in the packet
++ * @skb: the packet
++ *
++ * Description:
++ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
++ * to the start of the CIPSO option on success, NULL if one if not found.
++ *
++ */
++unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
++{
++ const struct iphdr *iph = ip_hdr(skb);
++ unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
++ int optlen;
++ int taglen;
++
++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
++ if (optptr[0] == IPOPT_CIPSO)
++ return optptr;
++ taglen = optptr[1];
++ optlen -= taglen;
++ optptr += taglen;
++ }
++
++ return NULL;
++}
++
++/**
+ * cipso_v4_validate - Validate a CIPSO option
+ * @option: the start of the option, on error it is set to point to the error
+ *
+@@ -2117,8 +2142,8 @@ void cipso_v4_req_delattr(struct request
+ * on success and negative values on failure.
+ *
+ */
+-static int cipso_v4_getattr(const unsigned char *cipso,
+- struct netlbl_lsm_secattr *secattr)
++int cipso_v4_getattr(const unsigned char *cipso,
++ struct netlbl_lsm_secattr *secattr)
+ {
+ int ret_val = -ENOMSG;
+ u32 doi;
+@@ -2303,22 +2328,6 @@ int cipso_v4_skbuff_delattr(struct sk_bu
+ return 0;
+ }
+
+-/**
+- * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
+- * @skb: the packet
+- * @secattr: the security attributes
+- *
+- * Description:
+- * Parse the given packet's CIPSO option and return the security attributes.
+- * Returns zero on success and negative values on failure.
+- *
+- */
+-int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+- struct netlbl_lsm_secattr *secattr)
+-{
+- return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
+-}
+-
+ /*
+ * Setup Functions
+ */
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -1065,10 +1065,12 @@ int netlbl_skbuff_getattr(const struct s
+ u16 family,
+ struct netlbl_lsm_secattr *secattr)
+ {
++ unsigned char *ptr;
++
+ switch (family) {
+ case AF_INET:
+- if (CIPSO_V4_OPTEXIST(skb) &&
+- cipso_v4_skbuff_getattr(skb, secattr) == 0)
++ ptr = cipso_v4_optptr(skb);
++ if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
+ return 0;
+ break;
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -1094,7 +1096,7 @@ int netlbl_skbuff_getattr(const struct s
+ */
+ void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway)
+ {
+- if (CIPSO_V4_OPTEXIST(skb))
++ if (cipso_v4_optptr(skb))
+ cipso_v4_error(skb, error, gateway);
+ }
+
+@@ -1126,11 +1128,14 @@ void netlbl_cache_invalidate(void)
+ int netlbl_cache_add(const struct sk_buff *skb,
+ const struct netlbl_lsm_secattr *secattr)
+ {
++ unsigned char *ptr;
++
+ if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
+ return -ENOMSG;
+
+- if (CIPSO_V4_OPTEXIST(skb))
+- return cipso_v4_cache_add(skb, secattr);
++ ptr = cipso_v4_optptr(skb);
++ if (ptr)
++ return cipso_v4_cache_add(ptr, secattr);
+
+ return -ENOMSG;
+ }
--- /dev/null
+From 61882b63171736571e1139ab5aa929e3bb336016 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 18 Feb 2015 21:55:03 +0100
+Subject: cpufreq: s3c: remove incorrect __init annotations
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 61882b63171736571e1139ab5aa929e3bb336016 upstream.
+
+The two functions s3c2416_cpufreq_driver_init and s3c_cpufreq_register
+are marked init but are called from a context that might be run after
+the __init sections are discarded, as the compiler points out:
+
+WARNING: vmlinux.o(.data+0x1ad9dc): Section mismatch in reference from the variable s3c2416_cpufreq_driver to the function .init.text:s3c2416_cpufreq_driver_init()
+WARNING: drivers/built-in.o(.text+0x35b5dc): Section mismatch in reference from the function s3c2410a_cpufreq_add() to the function .init.text:s3c_cpufreq_register()
+
+This removes the __init markings.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/s3c2416-cpufreq.c | 4 ++--
+ drivers/cpufreq/s3c24xx-cpufreq.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/s3c2416-cpufreq.c
++++ b/drivers/cpufreq/s3c2416-cpufreq.c
+@@ -263,7 +263,7 @@ out:
+ }
+
+ #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE
+-static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
++static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
+ {
+ int count, v, i, found;
+ struct cpufreq_frequency_table *pos;
+@@ -333,7 +333,7 @@ static struct notifier_block s3c2416_cpu
+ .notifier_call = s3c2416_cpufreq_reboot_notifier_evt,
+ };
+
+-static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
++static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
+ {
+ struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
+ struct cpufreq_frequency_table *pos;
+--- a/drivers/cpufreq/s3c24xx-cpufreq.c
++++ b/drivers/cpufreq/s3c24xx-cpufreq.c
+@@ -454,7 +454,7 @@ static struct cpufreq_driver s3c24xx_dri
+ };
+
+
+-int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info)
++int s3c_cpufreq_register(struct s3c_cpufreq_info *info)
+ {
+ if (!info || !info->name) {
+ printk(KERN_ERR "%s: failed to pass valid information\n",
--- /dev/null
+From 67fadaa2768716209ee19a8b8bf05bc3ac399445 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 18 Feb 2015 21:55:53 +0100
+Subject: cpufreq: s3c: remove last use of resume_clocks callback
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 67fadaa2768716209ee19a8b8bf05bc3ac399445 upstream.
+
+Commit 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code")
+already removed the callback pointer, but there was one remaining
+user:
+
+drivers/cpufreq/s3c24xx-cpufreq.c: In function 's3c_cpufreq_resume_clocks':
+drivers/cpufreq/s3c24xx-cpufreq.c:149:14: error: 'struct s3c_cpufreq_info' has no member named 'resume_clocks'
+ cpu_cur.info->resume_clocks();
+ ^
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 32726d2d550 ("ARM: SAMSUNG: Remove legacy clock code")
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/s3c24xx-cpufreq.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/cpufreq/s3c24xx-cpufreq.c
++++ b/drivers/cpufreq/s3c24xx-cpufreq.c
+@@ -144,11 +144,6 @@ static void s3c_cpufreq_setfvco(struct s
+ (cfg->info->set_fvco)(cfg);
+ }
+
+-static inline void s3c_cpufreq_resume_clocks(void)
+-{
+- cpu_cur.info->resume_clocks();
+-}
+-
+ static inline void s3c_cpufreq_updateclk(struct clk *clk,
+ unsigned int freq)
+ {
+@@ -417,9 +412,6 @@ static int s3c_cpufreq_resume(struct cpu
+
+ last_target = ~0; /* invalidate last_target setting */
+
+- /* first, find out what speed we resumed at. */
+- s3c_cpufreq_resume_clocks();
+-
+ /* whilst we will be called later on, we try and re-set the
+ * cpu frequencies as soon as possible so that we do not end
+ * up resuming devices and then immediately having to re-set
--- /dev/null
+From 6ffae8c06fab058d6c3f8ecb7f921327721034e7 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Sat, 31 Jan 2015 06:02:44 +0530
+Subject: cpufreq: Set cpufreq_cpu_data to NULL before putting kobject
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 6ffae8c06fab058d6c3f8ecb7f921327721034e7 upstream.
+
+In __cpufreq_remove_dev_finish(), per-cpu 'cpufreq_cpu_data' needs
+to be cleared before calling kobject_put(&policy->kobj) and under
+cpufreq_driver_lock. Otherwise, if someone else calls cpufreq_cpu_get()
+in parallel with it, they can obtain a non-NULL policy from that after
+kobject_put(&policy->kobj) was executed.
+
+Consider this case:
+
+Thread A Thread B
+cpufreq_cpu_get()
+ acquire cpufreq_driver_lock
+ read-per-cpu cpufreq_cpu_data
+ kobject_put(&policy->kobj);
+ kobject_get(&policy->kobj);
+ ...
+ per_cpu(&cpufreq_cpu_data, cpu) = NULL
+
+And this will result in a warning like this one:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 4 at include/linux/kref.h:47
+ kobject_get+0x41/0x50()
+ Modules linked in: acpi_cpufreq(+) nfsd auth_rpcgss nfs_acl
+ lockd grace sunrpc xfs libcrc32c sd_mod ixgbe igb mdio ahci hwmon
+ ...
+ Call Trace:
+ [<ffffffff81661b14>] dump_stack+0x46/0x58
+ [<ffffffff81072b61>] warn_slowpath_common+0x81/0xa0
+ [<ffffffff81072c7a>] warn_slowpath_null+0x1a/0x20
+ [<ffffffff812e16d1>] kobject_get+0x41/0x50
+ [<ffffffff815262a5>] cpufreq_cpu_get+0x75/0xc0
+ [<ffffffff81527c3e>] cpufreq_update_policy+0x2e/0x1f0
+ [<ffffffff810b8cb2>] ? up+0x32/0x50
+ [<ffffffff81381aa9>] ? acpi_ns_get_node+0xcb/0xf2
+ [<ffffffff81381efd>] ? acpi_evaluate_object+0x22c/0x252
+ [<ffffffff813824f6>] ? acpi_get_handle+0x95/0xc0
+ [<ffffffff81360967>] ? acpi_has_method+0x25/0x40
+ [<ffffffff81391e08>] acpi_processor_ppc_has_changed+0x77/0x82
+ [<ffffffff81089566>] ? move_linked_works+0x66/0x90
+ [<ffffffff8138e8ed>] acpi_processor_notify+0x58/0xe7
+ [<ffffffff8137410c>] acpi_ev_notify_dispatch+0x44/0x5c
+ [<ffffffff8135f293>] acpi_os_execute_deferred+0x15/0x22
+ [<ffffffff8108c910>] process_one_work+0x160/0x410
+ [<ffffffff8108d05b>] worker_thread+0x11b/0x520
+ [<ffffffff8108cf40>] ? rescuer_thread+0x380/0x380
+ [<ffffffff81092421>] kthread+0xe1/0x100
+ [<ffffffff81092340>] ? kthread_create_on_node+0x1b0/0x1b0
+ [<ffffffff81669ebc>] ret_from_fork+0x7c/0xb0
+ [<ffffffff81092340>] ? kthread_create_on_node+0x1b0/0x1b0
+ ---[ end trace 89e66eb9795efdf7 ]---
+
+The actual code flow is as follows:
+
+ Thread A: Workqueue: kacpi_notify
+
+ acpi_processor_notify()
+ acpi_processor_ppc_has_changed()
+ cpufreq_update_policy()
+ cpufreq_cpu_get()
+ kobject_get()
+
+ Thread B: xenbus_thread()
+
+ xenbus_thread()
+ msg->u.watch.handle->callback()
+ handle_vcpu_hotplug_event()
+ vcpu_hotplug()
+ cpu_down()
+ __cpu_notify(CPU_POST_DEAD..)
+ cpufreq_cpu_callback()
+ __cpufreq_remove_dev_finish()
+ cpufreq_policy_put_kobj()
+ kobject_put()
+
+cpufreq_cpu_get() gets the policy from per-cpu variable cpufreq_cpu_data
+under cpufreq_driver_lock, and once it gets a valid policy it expects it
+to not be freed until cpufreq_cpu_put() is called.
+
+But the race happens when another thread puts the kobject first and updates
+cpufreq_cpu_data before or later. And so the first thread gets a valid policy
+structure and before it does kobject_get() on it, the second one has already
+done kobject_put().
+
+Fix this by setting cpufreq_cpu_data to NULL before putting the kobject and that
+too under locks.
+
+Reported-by: Ethan Zhao <ethan.zhao@oracle.com>
+Reported-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1409,9 +1409,10 @@ static int __cpufreq_remove_dev_finish(s
+ unsigned long flags;
+ struct cpufreq_policy *policy;
+
+- read_lock_irqsave(&cpufreq_driver_lock, flags);
++ write_lock_irqsave(&cpufreq_driver_lock, flags);
+ policy = per_cpu(cpufreq_cpu_data, cpu);
+- read_unlock_irqrestore(&cpufreq_driver_lock, flags);
++ per_cpu(cpufreq_cpu_data, cpu) = NULL;
++ write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+
+ if (!policy) {
+ pr_debug("%s: No cpu_data found\n", __func__);
+@@ -1466,7 +1467,6 @@ static int __cpufreq_remove_dev_finish(s
+ }
+ }
+
+- per_cpu(cpufreq_cpu_data, cpu) = NULL;
+ return 0;
+ }
+
--- /dev/null
+From d4d4eda23794c701442e55129dd4f8f2fefd5e4d Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 9 Feb 2015 13:38:17 -0500
+Subject: cpufreq: speedstep-smi: enable interrupts when waiting
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d4d4eda23794c701442e55129dd4f8f2fefd5e4d upstream.
+
+On Dell Latitude C600 laptop with Pentium 3 850MHz processor, the
+speedstep-smi driver sometimes loads and sometimes doesn't load with
+"change to state X failed" message.
+
+The hardware sometimes refuses to change frequency and in this case, we
+need to retry later. I found out that we need to enable interrupts while
+waiting. When we enable interrupts, the hardware blockage that prevents
+frequency transition resolves and the transition is possible. With
+disabled interrupts, the blockage doesn't resolve (no matter how long do
+we wait). The exact reasons for this hardware behavior are unknown.
+
+This patch enables interrupts in the function speedstep_set_state that can
+be called with disabled interrupts. However, this function is called with
+disabled interrupts only from speedstep_get_freqs, so it shouldn't cause
+any problem.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/speedstep-lib.c | 3 +++
+ drivers/cpufreq/speedstep-smi.c | 12 ++++++++++++
+ 2 files changed, 15 insertions(+)
+
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum sp
+
+ pr_debug("previous speed is %u\n", prev_speed);
+
++ preempt_disable();
+ local_irq_save(flags);
+
+ /* switch to low state */
+@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum sp
+
+ out:
+ local_irq_restore(flags);
++ preempt_enable();
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(speedstep_get_freqs);
+--- a/drivers/cpufreq/speedstep-smi.c
++++ b/drivers/cpufreq/speedstep-smi.c
+@@ -156,6 +156,7 @@ static void speedstep_set_state(unsigned
+ return;
+
+ /* Disable IRQs */
++ preempt_disable();
+ local_irq_save(flags);
+
+ command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
+@@ -166,9 +167,19 @@ static void speedstep_set_state(unsigned
+
+ do {
+ if (retry) {
++ /*
++ * We need to enable interrupts, otherwise the blockage
++ * won't resolve.
++ *
++ * We disable preemption so that other processes don't
++ * run. If other processes were running, they could
++ * submit more DMA requests, making the blockage worse.
++ */
+ pr_debug("retry %u, previous result %u, waiting...\n",
+ retry, result);
++ local_irq_enable();
+ mdelay(retry * 50);
++ local_irq_disable();
+ }
+ retry++;
+ __asm__ __volatile__(
+@@ -185,6 +196,7 @@ static void speedstep_set_state(unsigned
+
+ /* enable IRQs */
+ local_irq_restore(flags);
++ preempt_enable();
+
+ if (new_state == state)
+ pr_debug("change to %u MHz succeeded after %u tries "
--- /dev/null
+From fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:41 -0300
+Subject: [media] em28xx-audio: fix missing newlines, again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit fbaa48d1853002c2e7bcf12c1fdc0f6fb16d1525 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-audio. Fix these.
+
+Fixes: 6d746f91f230 ("[media] em28xx-audio: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -1006,7 +1006,7 @@ static int em28xx_audio_suspend(struct e
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Suspending audio extension");
++ em28xx_info("Suspending audio extension\n");
+ em28xx_deinit_isoc_audio(dev);
+ atomic_set(&dev->adev.stream_started, 0);
+ return 0;
+@@ -1020,7 +1020,7 @@ static int em28xx_audio_resume(struct em
+ if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
+ return 0;
+
+- em28xx_info("Resuming audio extension");
++ em28xx_info("Resuming audio extension\n");
+ /* Nothing to do other than schedule_work() ?? */
+ schedule_work(&dev->adev.wq_trigger);
+ return 0;
--- /dev/null
+From 7818b0aab87b680fb10f68eccebeeb6cd8283c73 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:36 -0300
+Subject: [media] em28xx-audio: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 7818b0aab87b680fb10f68eccebeeb6cd8283c73 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-audio. Fix these.
+
+Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -821,7 +821,7 @@ static int em28xx_audio_urb_init(struct
+ if (urb_size > ep_size * npackets)
+ npackets = DIV_ROUND_UP(urb_size, ep_size);
+
+- em28xx_info("Number of URBs: %d, with %d packets and %d size",
++ em28xx_info("Number of URBs: %d, with %d packets and %d size\n",
+ num_urb, npackets, urb_size);
+
+ /* Estimate the bytes per period */
--- /dev/null
+From 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:31 -0300
+Subject: [media] em28xx-core: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 522adc7c1f70d302155bb07f7fdf5a7fe4ff9094 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-core. Fix these.
+
+Fixes: 9c669b731470 ("[media] em28xx: add suspend/resume to em28xx_ops")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -1122,7 +1122,7 @@ int em28xx_suspend_extension(struct em28
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Suspending extensions");
++ em28xx_info("Suspending extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->suspend)
+@@ -1136,7 +1136,7 @@ int em28xx_resume_extension(struct em28x
+ {
+ const struct em28xx_ops *ops = NULL;
+
+- em28xx_info("Resuming extensions");
++ em28xx_info("Resuming extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+ if (ops->resume)
--- /dev/null
+From a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:46 -0300
+Subject: [media] em28xx-dvb: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit a084c57fc1ccd24ef8e6ca41e75afa745d5dbb98 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-dvb. Fix these.
+
+Fixes: ca2b46dacbf5 ("[media] em28xx-dvb: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-dvb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1718,17 +1718,17 @@ static int em28xx_dvb_suspend(struct em2
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Suspending DVB extension");
++ em28xx_info("Suspending DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_suspend(dvb->fe[0]);
+- em28xx_info("fe0 suspend %d", ret);
++ em28xx_info("fe0 suspend %d\n", ret);
+ }
+ if (dvb->fe[1]) {
+ dvb_frontend_suspend(dvb->fe[1]);
+- em28xx_info("fe1 suspend %d", ret);
++ em28xx_info("fe1 suspend %d\n", ret);
+ }
+ }
+
+@@ -1745,18 +1745,18 @@ static int em28xx_dvb_resume(struct em28
+ if (!dev->board.has_dvb)
+ return 0;
+
+- em28xx_info("Resuming DVB extension");
++ em28xx_info("Resuming DVB extension\n");
+ if (dev->dvb) {
+ struct em28xx_dvb *dvb = dev->dvb;
+
+ if (dvb->fe[0]) {
+ ret = dvb_frontend_resume(dvb->fe[0]);
+- em28xx_info("fe0 resume %d", ret);
++ em28xx_info("fe0 resume %d\n", ret);
+ }
+
+ if (dvb->fe[1]) {
+ ret = dvb_frontend_resume(dvb->fe[1]);
+- em28xx_info("fe1 resume %d", ret);
++ em28xx_info("fe1 resume %d\n", ret);
+ }
+ }
+
--- /dev/null
+From 0418ca6073478f54f1da2e4013fa50d36838de75 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:20 -0300
+Subject: [media] em28xx: ensure "closing" messages terminate with a newline
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 0418ca6073478f54f1da2e4013fa50d36838de75 upstream.
+
+The lockdep splat addressed in a previous commit revealed that at
+least one message in em28xx-input.c was missing a new line:
+
+em28178 #0: Closing input extensionINFO: trying to register non-static key.
+
+Further inspection shows several other messages also miss a new line.
+These will be fixed in a subsequent patch.
+
+Fixes: aa929ad783c0 ("[media] em28xx: print a message at disconnect")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-audio.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-dvb.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-input.c | 2 +-
+ drivers/media/usb/em28xx/em28xx-video.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-audio.c
++++ b/drivers/media/usb/em28xx/em28xx-audio.c
+@@ -982,7 +982,7 @@ static int em28xx_audio_fini(struct em28
+ return 0;
+ }
+
+- em28xx_info("Closing audio extension");
++ em28xx_info("Closing audio extension\n");
+
+ if (dev->adev.sndcard) {
+ snd_card_disconnect(dev->adev.sndcard);
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1667,7 +1667,7 @@ static int em28xx_dvb_fini(struct em28xx
+ if (!dev->dvb)
+ return 0;
+
+- em28xx_info("Closing DVB extension");
++ em28xx_info("Closing DVB extension\n");
+
+ dvb = dev->dvb;
+ client = dvb->i2c_client_tuner;
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -833,7 +833,7 @@ static int em28xx_ir_fini(struct em28xx
+ return 0;
+ }
+
+- em28xx_info("Closing input extension");
++ em28xx_info("Closing input extension\n");
+
+ em28xx_shutdown_buttons(dev);
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1956,7 +1956,7 @@ static int em28xx_v4l2_fini(struct em28x
+ if (v4l2 == NULL)
+ return 0;
+
+- em28xx_info("Closing video extension");
++ em28xx_info("Closing video extension\n");
+
+ mutex_lock(&dev->lock);
+
--- /dev/null
+From ebfd59cf549899a166d595bf1eab7eec3299ebe7 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:26 -0300
+Subject: [media] em28xx-input: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit ebfd59cf549899a166d595bf1eab7eec3299ebe7 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-input. Fix these.
+
+Fixes: 5025076aadfe ("[media] em28xx-input: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-input.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -863,7 +863,7 @@ static int em28xx_ir_suspend(struct em28
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Suspending input extension");
++ em28xx_info("Suspending input extension\n");
+ if (ir)
+ cancel_delayed_work_sync(&ir->work);
+ cancel_delayed_work_sync(&dev->buttons_query_work);
+@@ -880,7 +880,7 @@ static int em28xx_ir_resume(struct em28x
+ if (dev->is_audio_only)
+ return 0;
+
+- em28xx_info("Resuming input extension");
++ em28xx_info("Resuming input extension\n");
+ /* if suspend calls ir_raw_event_unregister(), the should call
+ ir_raw_event_register() */
+ if (ir)
--- /dev/null
+From 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 20 Dec 2014 09:45:51 -0300
+Subject: [media] em28xx-video: fix missing newlines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 32e63f0368ed16e5ac417dc0bc2a5f8acbfb1511 upstream.
+
+Inspection shows that newlines are missing from several kernel messages
+in em28xx-video. Fix these.
+
+Fixes: a61f68119af3 ("[media] em28xx-video: implement em28xx_ops: suspend/resume hooks")
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -2005,7 +2005,7 @@ static int em28xx_v4l2_suspend(struct em
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Suspending video extension");
++ em28xx_info("Suspending video extension\n");
+ em28xx_stop_urbs(dev);
+ return 0;
+ }
+@@ -2018,7 +2018,7 @@ static int em28xx_v4l2_resume(struct em2
+ if (!dev->has_video)
+ return 0;
+
+- em28xx_info("Resuming video extension");
++ em28xx_info("Resuming video extension\n");
+ /* what do we do here */
+ return 0;
+ }
--- /dev/null
+From 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 10 Feb 2015 14:08:32 -0800
+Subject: fsnotify: fix handling of renames in audit
+
+From: Jan Kara <jack@suse.cz>
+
+commit 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab upstream.
+
+Commit e9fd702a58c4 ("audit: convert audit watches to use fsnotify
+instead of inotify") broke handling of renames in audit. Audit code
+wants to update inode number of an inode corresponding to watched name
+in a directory. When something gets renamed into a directory to a
+watched name, inotify previously passed moved inode to audit code
+however new fsnotify code passes directory inode where the change
+happened. That confuses audit and it starts watching parent directory
+instead of a file in a directory.
+
+This can be observed for example by doing:
+
+ cd /tmp
+ touch foo bar
+ auditctl -w /tmp/foo
+ touch foo
+ mv bar foo
+ touch foo
+
+In audit log we see events like:
+
+ type=CONFIG_CHANGE msg=audit(1423563584.155:90): auid=1000 ses=2 op="updated rules" path="/tmp/foo" key=(null) list=4 res=1
+ ...
+ type=PATH msg=audit(1423563584.155:91): item=2 name="bar" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
+ type=PATH msg=audit(1423563584.155:91): item=3 name="foo" inode=1046842 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
+ type=PATH msg=audit(1423563584.155:91): item=4 name="foo" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
+ ...
+
+and that's it - we see event for the first touch after creating the
+audit rule, we see events for rename but we don't see any event for the
+last touch. However we start seeing events for unrelated stuff
+happening in /tmp.
+
+Fix the problem by passing moved inode as data in the FS_MOVED_FROM and
+FS_MOVED_TO events instead of the directory where the change happens.
+This doesn't introduce any new problems because noone besides
+audit_watch.c cares about the passed value:
+
+ fs/notify/fanotify/fanotify.c cares only about FSNOTIFY_EVENT_PATH events.
+ fs/notify/dnotify/dnotify.c doesn't care about passed 'data' value at all.
+ fs/notify/inotify/inotify_fsnotify.c uses 'data' only for FSNOTIFY_EVENT_PATH.
+ kernel/audit_tree.c doesn't care about passed 'data' at all.
+ kernel/audit_watch.c expects moved inode as 'data'.
+
+Fixes: e9fd702a58c49db ("audit: convert audit watches to use fsnotify instead of inotify")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Paul Moore <paul@paul-moore.com>
+Cc: Eric Paris <eparis@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/fsnotify.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct
+ new_dir_mask |= FS_ISDIR;
+ }
+
+- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
+- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
++ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
++ fs_cookie);
++ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
++ fs_cookie);
+
+ if (target)
+ fsnotify_link_count(target);
--- /dev/null
+From 6d00f37e49d95e640a3937a4a1ae07dbe92a10cb Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Fri, 20 Feb 2015 11:45:11 -0600
+Subject: HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 6d00f37e49d95e640a3937a4a1ae07dbe92a10cb upstream.
+
+d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ)
+changed hid_get_input() to read ihid->bufsize bytes, which can be
+more than wMaxInputLength. This is the case with the Dell XPS 13
+9343, and it is causing events to be missed. In some cases the
+missed events are releases, which can cause the cursor to jump or
+freeze, among other problems. Limit the number of bytes read to
+min(wMaxInputLength, ihid->bufsize) to prevent such problems.
+
+Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ"
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/i2c-hid/i2c-hid.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_cl
+ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ {
+ int ret, ret_size;
+- int size = ihid->bufsize;
++ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
++
++ if (size > ihid->bufsize)
++ size = ihid->bufsize;
+
+ ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ if (ret != size) {
--- /dev/null
+From 3fd7b60f2c7418239d586e359e0c6d8503e10646 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 22 Jan 2015 00:56:53 -0800
+Subject: iscsi-target: Drop problematic active_ts_list usage
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 3fd7b60f2c7418239d586e359e0c6d8503e10646 upstream.
+
+This patch drops legacy active_ts_list usage within iscsi_target_tq.c
+code. It was originally used to track the active thread sets during
+iscsi-target shutdown, and is no longer used by modern upstream code.
+
+Two people have reported list corruption using traditional iscsi-target
+and iser-target with the following backtrace, that appears to be related
+to iscsi_thread_set->ts_list being used across both active_ts_list and
+inactive_ts_list.
+
+[ 60.782534] ------------[ cut here ]------------
+[ 60.782543] WARNING: CPU: 0 PID: 9430 at lib/list_debug.c:53 __list_del_entry+0x63/0xd0()
+[ 60.782545] list_del corruption, ffff88045b00d180->next is LIST_POISON1 (dead000000100100)
+[ 60.782546] Modules linked in: ib_srpt tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc scsi_tgt ib_isert rdma_cm iw_cm ib_addr iscsi_target_mod target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge stp llc autofs4 sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ib_ipoib ib_cm ib_uverbs ib_umad mlx4_en mlx4_ib ib_sa ib_mad ib_core mlx4_core dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support microcode serio_raw pcspkr sb_edac edac_core sg i2c_i801 lpc_ich mfd_core mtip32xx igb i2c_algo_bit i2c_core ptp pps_core ioatdma dca wmi ext3(F) jbd(F) mbcache(F) sd_mod(F) crc_t10dif(F) crct10dif_common(F) ahci(F) libahci(F) isci(F) libsas(F) scsi_transport_sas(F) [last unloaded: speedstep_lib]
+[ 60.782597] CPU: 0 PID: 9430 Comm: iscsi_ttx Tainted: GF 3.12.19+ #2
+[ 60.782598] Hardware name: Supermicro X9DRX+-F/X9DRX+-F, BIOS 3.00 07/09/2013
+[ 60.782599] 0000000000000035 ffff88044de31d08 ffffffff81553ae7 0000000000000035
+[ 60.782602] ffff88044de31d58 ffff88044de31d48 ffffffff8104d1cc 0000000000000002
+[ 60.782605] ffff88045b00d180 ffff88045b00d0c0 ffff88045b00d0c0 ffff88044de31e58
+[ 60.782607] Call Trace:
+[ 60.782611] [<ffffffff81553ae7>] dump_stack+0x49/0x62
+[ 60.782615] [<ffffffff8104d1cc>] warn_slowpath_common+0x8c/0xc0
+[ 60.782618] [<ffffffff8104d2b6>] warn_slowpath_fmt+0x46/0x50
+[ 60.782620] [<ffffffff81280933>] __list_del_entry+0x63/0xd0
+[ 60.782622] [<ffffffff812809b1>] list_del+0x11/0x40
+[ 60.782630] [<ffffffffa06e7cf9>] iscsi_del_ts_from_active_list+0x29/0x50 [iscsi_target_mod]
+[ 60.782635] [<ffffffffa06e87b1>] iscsi_tx_thread_pre_handler+0xa1/0x180 [iscsi_target_mod]
+[ 60.782642] [<ffffffffa06fb9ae>] iscsi_target_tx_thread+0x4e/0x220 [iscsi_target_mod]
+[ 60.782647] [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod]
+[ 60.782652] [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod]
+[ 60.782655] [<ffffffff8106f99e>] kthread+0xce/0xe0
+[ 60.782657] [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70
+[ 60.782660] [<ffffffff8156026c>] ret_from_fork+0x7c/0xb0
+[ 60.782662] [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70
+[ 60.782663] ---[ end trace 9662f4a661d33965 ]---
+
+Since this code is no longer used, go ahead and drop the problematic usage
+all-together.
+
+Reported-by: Gavin Guo <gavin.guo@canonical.com>
+Reported-by: Moussa Ba <moussaba@micron.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_tq.c | 28 +++++-----------------------
+ 1 file changed, 5 insertions(+), 23 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_tq.c
++++ b/drivers/target/iscsi/iscsi_target_tq.c
+@@ -24,36 +24,22 @@
+ #include "iscsi_target_tq.h"
+ #include "iscsi_target.h"
+
+-static LIST_HEAD(active_ts_list);
+ static LIST_HEAD(inactive_ts_list);
+-static DEFINE_SPINLOCK(active_ts_lock);
+ static DEFINE_SPINLOCK(inactive_ts_lock);
+ static DEFINE_SPINLOCK(ts_bitmap_lock);
+
+-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_add_tail(&ts->ts_list, &active_ts_list);
+- iscsit_global->active_ts++;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
+ {
++ if (!list_empty(&ts->ts_list)) {
++ WARN_ON(1);
++ return;
++ }
+ spin_lock(&inactive_ts_lock);
+ list_add_tail(&ts->ts_list, &inactive_ts_list);
+ iscsit_global->inactive_ts++;
+ spin_unlock(&inactive_ts_lock);
+ }
+
+-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_del(&ts->ts_list);
+- iscsit_global->active_ts--;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ {
+ struct iscsi_thread_set *ts;
+@@ -66,7 +52,7 @@ static struct iscsi_thread_set *iscsi_ge
+
+ ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list);
+
+- list_del(&ts->ts_list);
++ list_del_init(&ts->ts_list);
+ iscsit_global->inactive_ts--;
+ spin_unlock(&inactive_ts_lock);
+
+@@ -204,8 +190,6 @@ static void iscsi_deallocate_extra_threa
+
+ void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
+ {
+- iscsi_add_ts_to_active_list(ts);
+-
+ spin_lock_bh(&ts->ts_state_lock);
+ conn->thread_set = ts;
+ ts->conn = conn;
+@@ -397,7 +381,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_h
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
+@@ -452,7 +435,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_h
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
--- /dev/null
+From 5523d11cc46393a1e61b7ef4a0b2d4e7ed9521e4 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Thu, 29 Jan 2015 12:48:20 +0200
+Subject: iwlwifi: mvm: always use mac color zero
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit 5523d11cc46393a1e61b7ef4a0b2d4e7ed9521e4 upstream.
+
+We don't really need to use different mac colors when adding mac
+contexts, because they're not used anywhere. In fact, the firmware
+doesn't accept 255 as a valid color, so we get into a SYSASSERT 0x3401
+when we reach that.
+
+Remove the color increment to use always zero and avoid reaching 255.
+
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -668,9 +668,6 @@ static void iwl_mvm_cleanup_iterator(voi
+ mvmvif->uploaded = false;
+ mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
+
+- /* does this make sense at all? */
+- mvmvif->color++;
+-
+ spin_lock_bh(&mvm->time_event_lock);
+ iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
+ spin_unlock_bh(&mvm->time_event_lock);
--- /dev/null
+From fd66fc1cafd72ddf27dbec3a5e29e99839d1bc84 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Tue, 27 Jan 2015 15:06:57 +0200
+Subject: iwlwifi: mvm: fix failure path when power_update fails in add_interface
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit fd66fc1cafd72ddf27dbec3a5e29e99839d1bc84 upstream.
+
+When iwl_mvm_power_update_mac() is called, we have already added the
+mac context, so if this call fails we should remove the mac.
+
+Fixes: commit e5e7aa8e2561 ('iwlwifi: mvm: refactor power code')
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -1014,7 +1014,7 @@ static int iwl_mvm_mac_add_interface(str
+
+ ret = iwl_mvm_power_update_mac(mvm);
+ if (ret)
+- goto out_release;
++ goto out_remove_mac;
+
+ /* beacon filtering */
+ ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
--- /dev/null
+From 2cee4762c528a9bd2cdff793197bf591a2196c11 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Fri, 16 Jan 2015 11:09:30 +0200
+Subject: iwlwifi: mvm: validate tid and sta_id in ba_notif
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit 2cee4762c528a9bd2cdff793197bf591a2196c11 upstream.
+
+These are coming from the FW and are used to access arrays.
+Bad values can cause an out of bounds access so discard
+such ba_notifs and warn.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/tx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -902,6 +902,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *
+ sta_id = ba_notif->sta_id;
+ tid = ba_notif->tid;
+
++ if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
++ tid >= IWL_MAX_TID_COUNT,
++ "sta_id %d tid %d", sta_id, tid))
++ return 0;
++
+ rcu_read_lock();
+
+ sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
--- /dev/null
+From cd8f438405032ac8ff88bd8f2eca5e0c0063b14b Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 29 Jan 2015 21:34:00 +0200
+Subject: iwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit cd8f438405032ac8ff88bd8f2eca5e0c0063b14b upstream.
+
+The base address of the scheduler in the device's memory
+(SRAM) comes from two different sources. The periphery
+register and the alive notification from the firmware.
+We have a check in iwl_pcie_tx_start that ensures that
+they are the same.
+When we resume from WoWLAN, the firmware may have crashed
+for whatever reason. In that case, the whole device may be
+reset which means that the periphery register will hold a
+meaningless value. When we come to compare
+trans_pcie->scd_base_addr (which really holds the value we
+had when we loaded the WoWLAN firmware upon suspend) and
+the current value of the register, we don't see a match
+unsurprisingly.
+Trick the check to avoid a loud yet harmless WARN.
+Note that when the WoWLAN has crashed, we will see that
+in iwl_trans_pcie_d3_resume which will let the op_mode
+know. Once the op_mode is informed that the WowLAN firmware
+has crashed, it can't do much besides resetting the whole
+device.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/tx.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -722,7 +722,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_
+ iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
+ trans_pcie->kw.dma >> 4);
+
+- iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
++ /*
++ * Send 0 as the scd_base_addr since the device may have be reset
++ * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
++ * contain garbage.
++ */
++ iwl_pcie_tx_start(trans, 0);
+ }
+
+ /*
--- /dev/null
+From 146755923262037fc4c54abc28c04b1103f3cc51 Mon Sep 17 00:00:00 2001
+From: Jay Lan <jlan@sgi.com>
+Date: Mon, 29 Sep 2014 15:36:57 -0700
+Subject: kdb: fix incorrect counts in KDB summary command output
+
+From: Jay Lan <jlan@sgi.com>
+
+commit 146755923262037fc4c54abc28c04b1103f3cc51 upstream.
+
+The output of KDB 'summary' command should report MemTotal, MemFree
+and Buffers output in kB. Current codes report in unit of pages.
+
+A define of K(x) as
+is defined in the code, but not used.
+
+This patch would apply the define to convert the values to kB.
+Please include me on Cc on replies. I do not subscribe to linux-kernel.
+
+Signed-off-by: Jay Lan <jlan@sgi.com>
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/debug/kdb/kdb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2535,7 +2535,7 @@ static int kdb_summary(int argc, const c
+ #define K(x) ((x) << (PAGE_SHIFT - 10))
+ kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n"
+ "Buffers: %8lu kB\n",
+- val.totalram, val.freeram, val.bufferram);
++ K(val.totalram), K(val.freeram), K(val.bufferram));
+ return 0;
+ }
+
--- /dev/null
+From c4c6f2cad9e1d4cc076bc183c3689cc9e7019c75 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 4 Feb 2015 10:52:03 +0000
+Subject: KVM: MIPS: Disable HTW while in guest
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit c4c6f2cad9e1d4cc076bc183c3689cc9e7019c75 upstream.
+
+Ensure any hardware page table walker (HTW) is disabled while in KVM
+guest mode, as KVM doesn't yet set up hardware page table walking for
+guest mappings so the wrong mappings would get loaded, resulting in the
+guest hanging or crashing once it reaches userland.
+
+The HTW is disabled and re-enabled around the call to
+__kvm_mips_vcpu_run() which does the initial switch into guest mode and
+the final switch out of guest context. Additionally it is enabled for
+the duration of guest exits (i.e. kvm_mips_handle_exit()), getting
+disabled again before returning back to guest or host.
+
+In all cases the HTW is only disabled in normal kernel mode while
+interrupts are disabled, so that the HTW doesn't get left disabled if
+the process is preempted.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Markos Chandras <markos.chandras@imgtec.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: kvm@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kvm/mips.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -18,6 +18,7 @@
+ #include <asm/page.h>
+ #include <asm/cacheflush.h>
+ #include <asm/mmu_context.h>
++#include <asm/pgtable.h>
+
+ #include <linux/kvm_host.h>
+
+@@ -385,8 +386,14 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+
+ kvm_guest_enter();
+
++ /* Disable hardware page table walking while in guest */
++ htw_stop();
++
+ r = __kvm_mips_vcpu_run(run, vcpu);
+
++ /* Re-enable HTW before enabling interrupts */
++ htw_start();
++
+ kvm_guest_exit();
+ local_irq_enable();
+
+@@ -1002,6 +1009,9 @@ int kvm_mips_handle_exit(struct kvm_run
+ enum emulation_result er = EMULATE_DONE;
+ int ret = RESUME_GUEST;
+
++ /* re-enable HTW before enabling interrupts */
++ htw_start();
++
+ /* Set a default exit reason */
+ run->exit_reason = KVM_EXIT_UNKNOWN;
+ run->ready_for_interrupt_injection = 1;
+@@ -1136,6 +1146,9 @@ skip_emul:
+ }
+ }
+
++ /* Disable HTW before returning to guest or host */
++ htw_stop();
++
+ return ret;
+ }
+
--- /dev/null
+From f798217dfd038af981a18bbe4bc57027a08bb182 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 4 Feb 2015 17:06:37 +0000
+Subject: KVM: MIPS: Don't leak FPU/DSP to guest
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit f798217dfd038af981a18bbe4bc57027a08bb182 upstream.
+
+The FPU and DSP are enabled via the CP0 Status CU1 and MX bits by
+kvm_mips_set_c0_status() on a guest exit, presumably in case there is
+active state that needs saving if pre-emption occurs. However neither of
+these bits are cleared again when returning to the guest.
+
+This effectively gives the guest access to the FPU/DSP hardware after
+the first guest exit even though it is not aware of its presence,
+allowing FP instructions in guest user code to intermittently actually
+execute instead of trapping into the guest OS for emulation. It will
+then read & manipulate the hardware FP registers which technically
+belong to the user process (e.g. QEMU), or are stale from another user
+process. It can also crash the guest OS by causing an FP exception, for
+which a guest exception handler won't have been registered.
+
+First lets save and disable the FPU (and MSA) state with lose_fpu(1)
+before entering the guest. This simplifies the problem, especially for
+when guest FPU/MSA support is added in the future, and prevents FR=1 FPU
+state being live when the FR bit gets cleared for the guest, which
+according to the architecture causes the contents of the FPU and vector
+registers to become UNPREDICTABLE.
+
+We can then safely remove the enabling of the FPU in
+kvm_mips_set_c0_status(), since there should never be any active FPU or
+MSA state to save at pre-emption, which should plug the FPU leak.
+
+DSP state is always live rather than being lazily restored, so for that
+it is simpler to just clear the MX bit again when re-entering the guest.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Sanjay Lal <sanjayl@kymasys.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: kvm@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kvm/locore.S | 2 +-
+ arch/mips/kvm/mips.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/kvm/locore.S
++++ b/arch/mips/kvm/locore.S
+@@ -434,7 +434,7 @@ __kvm_mips_return_to_guest:
+ /* Setup status register for running guest in UM */
+ .set at
+ or v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
+- and v1, v1, ~ST0_CU0
++ and v1, v1, ~(ST0_CU0 | ST0_MX)
+ .set noat
+ mtc0 v1, CP0_STATUS
+ ehb
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -15,6 +15,7 @@
+ #include <linux/vmalloc.h>
+ #include <linux/fs.h>
+ #include <linux/bootmem.h>
++#include <asm/fpu.h>
+ #include <asm/page.h>
+ #include <asm/cacheflush.h>
+ #include <asm/mmu_context.h>
+@@ -379,6 +380,8 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ vcpu->mmio_needed = 0;
+ }
+
++ lose_fpu(1);
++
+ local_irq_disable();
+ /* Check if we have any exceptions/interrupts pending */
+ kvm_mips_deliver_interrupts(vcpu,
+@@ -987,9 +990,6 @@ static void kvm_mips_set_c0_status(void)
+ {
+ uint32_t status = read_c0_status();
+
+- if (cpu_has_fpu)
+- status |= (ST0_CU1);
+-
+ if (cpu_has_dsp)
+ status |= (ST0_MX);
+
--- /dev/null
+From 15e1ce33182d1d5dbd8efe8d382b9352dc857527 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 2 Jan 2015 10:56:28 -0300
+Subject: [media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 15e1ce33182d1d5dbd8efe8d382b9352dc857527 upstream.
+
+A quirk of some older firmwares that report endpoint pipe type as PIPE_BULK
+but the endpoint otheriwse functions as interrupt.
+
+Check if usb_endpoint_type is USB_ENDPOINT_XFER_BULK and set as usb_rcvbulkpipe.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -354,6 +354,7 @@ static int lme2510_int_read(struct dvb_u
+ {
+ struct dvb_usb_device *d = adap_to_d(adap);
+ struct lme2510_state *lme_int = adap_to_priv(adap);
++ struct usb_host_endpoint *ep;
+
+ lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
+
+@@ -375,6 +376,12 @@ static int lme2510_int_read(struct dvb_u
+ adap,
+ 8);
+
++ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
++ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++
++ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++
+ lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
--- /dev/null
+From cfcd7b825892cb498c6bcb13257f2141f7eacb76 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 2 Jan 2015 10:56:27 -0300
+Subject: [media] lmedm04: Increase Interupt due time to 200 msec
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit cfcd7b825892cb498c6bcb13257f2141f7eacb76 upstream.
+
+Ocassionally the device fails to report back an interrupt urb status which
+results in false no lock trigger on the RS2000 demodulator.
+
+Increase time from 60 msecs to 200 msecs.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -344,9 +344,10 @@ static void lme2510_int_response(struct
+
+ usb_submit_urb(lme_urb, GFP_ATOMIC);
+
+- /* interrupt urb is due every 48 msecs while streaming
+- * add 12msecs for system lag */
+- st->int_urb_due = jiffies + msecs_to_jiffies(60);
++ /* Interrupt urb is due every 48 msecs while streaming the buffer
++ * stores up to 4 periods if missed. Allow 200 msec for next interrupt.
++ */
++ st->int_urb_due = jiffies + msecs_to_jiffies(200);
+ }
+
+ static int lme2510_int_read(struct dvb_usb_adapter *adap)
--- /dev/null
+From c2ced1719a1b903350955a511e1666e6d05a7f5b Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:06:13 +0530
+Subject: megaraid_sas: disable interrupt_mask before enabling hardware interrupts
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit c2ced1719a1b903350955a511e1666e6d05a7f5b upstream.
+
+Update driver "mask_interrupts" before enable/disable hardware interrupt
+in order to avoid missing interrupts because of "mask_interrupts" still
+set to 1 and hardware interrupts are enabled.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Chaitra Basappa <chaitra.basappa@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -101,6 +101,8 @@ megasas_enable_intr_fusion(struct megasa
+ {
+ struct megasas_register_set __iomem *regs;
+ regs = instance->reg_set;
++
++ instance->mask_interrupts = 0;
+ /* For Thunderbolt/Invader also clear intr on enable */
+ writel(~0, ®s->outbound_intr_status);
+ readl(®s->outbound_intr_status);
+@@ -109,7 +111,6 @@ megasas_enable_intr_fusion(struct megasa
+
+ /* Dummy readl to force pci flush */
+ readl(®s->outbound_intr_mask);
+- instance->mask_interrupts = 0;
+ }
+
+ /**
--- /dev/null
+From 200aed582d6170a2687cd69095469b663f69f16f Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:05:58 +0530
+Subject: megaraid_sas: endianness related bug fixes and code optimization
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit 200aed582d6170a2687cd69095469b663f69f16f upstream.
+
+This patch addresses below issues:
+
+1) Few endianness bug fixes.
+2) Break the iteration after (MAX_LOGICAL_DRIVES_EXT - 1)),
+ instead of MAX_LOGICAL_DRIVES_EXT.
+3) Optimization in MFI INIT frame before firing.
+4) MFI IO frame should be 256bytes aligned. Code is optimized to reduce
+ the size of frame for fusion adapters and make the MFI frame size
+ calculation a bit transparent and readable.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Chaitra Basappa <chaitra.basappa@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 24 +++++++++++-------------
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 14 ++++++++------
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 7 +++----
+ drivers/scsi/megaraid/megaraid_sas_fusion.h | 9 ++-------
+ 4 files changed, 24 insertions(+), 30 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3556,7 +3556,6 @@ static int megasas_create_frame_pool(str
+ int i;
+ u32 max_cmd;
+ u32 sge_sz;
+- u32 sgl_sz;
+ u32 total_sz;
+ u32 frame_count;
+ struct megasas_cmd *cmd;
+@@ -3575,24 +3574,23 @@ static int megasas_create_frame_pool(str
+ }
+
+ /*
+- * Calculated the number of 64byte frames required for SGL
++ * For MFI controllers.
++ * max_num_sge = 60
++ * max_sge_sz = 16 byte (sizeof megasas_sge_skinny)
++ * Total 960 byte (15 MFI frame of 64 byte)
++ *
++ * Fusion adapter require only 3 extra frame.
++ * max_num_sge = 16 (defined as MAX_IOCTL_SGE)
++ * max_sge_sz = 12 byte (sizeof megasas_sge64)
++ * Total 192 byte (3 MFI frame of 64 byte)
+ */
+- sgl_sz = sge_sz * instance->max_num_sge;
+- frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE;
+- frame_count = 15;
+-
+- /*
+- * We need one extra frame for the MFI command
+- */
+- frame_count++;
+-
++ frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1);
+ total_sz = MEGAMFI_FRAME_SIZE * frame_count;
+ /*
+ * Use DMA pool facility provided by PCI layer
+ */
+ instance->frame_dma_pool = pci_pool_create("megasas frame pool",
+- instance->pdev, total_sz, 64,
+- 0);
++ instance->pdev, total_sz, 256, 0);
+
+ if (!instance->frame_dma_pool) {
+ printk(KERN_DEBUG "megasas: failed to setup frame pool\n");
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -170,6 +170,7 @@ void MR_PopulateDrvRaidMap(struct megasa
+ struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL;
+ struct MR_FW_RAID_MAP *pFwRaidMap = NULL;
+ int i;
++ u16 ld_count;
+
+
+ struct MR_DRV_RAID_MAP_ALL *drv_map =
+@@ -189,9 +190,10 @@ void MR_PopulateDrvRaidMap(struct megasa
+ fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
+ fusion->ld_map[(instance->map_id & 1)];
+ pFwRaidMap = &fw_map_old->raidMap;
++ ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount);
+
+ #if VD_EXT_DEBUG
+- for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) {
++ for (i = 0; i < ld_count; i++) {
+ dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
+ "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
+ instance->unique_id, i,
+@@ -203,12 +205,12 @@ void MR_PopulateDrvRaidMap(struct megasa
+
+ memset(drv_map, 0, fusion->drv_map_sz);
+ pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
+- pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount;
++ pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
+ pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
+- for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) {
++ for (i = 0; i < ld_count; i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+ dev_dbg(&instance->pdev->dev,
+@@ -250,7 +252,7 @@ u8 MR_ValidateMapInfo(struct megasas_ins
+ struct LD_LOAD_BALANCE_INFO *lbInfo;
+ PLD_SPAN_INFO ldSpanInfo;
+ struct MR_LD_RAID *raid;
+- int ldCount, num_lds;
++ u16 ldCount, num_lds;
+ u16 ld;
+ u32 expected_size;
+
+@@ -354,7 +356,7 @@ static int getSpanInfo(struct MR_DRV_RAI
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ dev_dbg(&instance->pdev->dev, "LD %x: span_depth=%x\n",
+@@ -1155,7 +1157,7 @@ void mr_update_span_set(struct MR_DRV_RA
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT)
++ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
+ continue;
+ raid = MR_LdRaidGet(ld, map);
+ for (element = 0; element < MAX_QUAD_DEPTH; element++) {
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -696,12 +696,11 @@ megasas_ioc_init_fusion(struct megasas_i
+ cpu_to_le32(lower_32_bits(ioc_init_handle));
+ init_frame->data_xfer_len = cpu_to_le32(sizeof(struct MPI2_IOC_INIT_REQUEST));
+
+- req_desc.Words = 0;
++ req_desc.u.low = cpu_to_le32(lower_32_bits(cmd->frame_phys_addr));
++ req_desc.u.high = cpu_to_le32(upper_32_bits(cmd->frame_phys_addr));
+ req_desc.MFAIo.RequestFlags =
+ (MEGASAS_REQ_DESCRIPT_FLAGS_MFA <<
+- MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+- cpu_to_le32s((u32 *)&req_desc.MFAIo);
+- req_desc.Words |= cpu_to_le64(cmd->frame_phys_addr);
++ MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+
+ /*
+ * disable the intr before firing the init frame
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+@@ -304,14 +304,9 @@ struct MPI2_RAID_SCSI_IO_REQUEST {
+ * MPT RAID MFA IO Descriptor.
+ */
+ struct MEGASAS_RAID_MFA_IO_REQUEST_DESCRIPTOR {
+-#if defined(__BIG_ENDIAN_BITFIELD)
+- u32 MessageAddress1:24; /* bits 31:8*/
+ u32 RequestFlags:8;
+-#else
+- u32 RequestFlags:8;
+- u32 MessageAddress1:24; /* bits 31:8*/
+-#endif
+- u32 MessageAddress2; /* bits 61:32 */
++ u32 MessageAddress1:24;
++ u32 MessageAddress2;
+ };
+
+ /* Default Request Descriptor */
--- /dev/null
+From ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 5 Jan 2015 20:06:08 +0530
+Subject: megaraid_sas: fix the problem of non-existing VD exposed to host
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit ab2f0608e16d64a23a2dcc8d83b966a0e0a281f3 upstream.
+
+This patch will address the issue of SCSI device created at OS level for
+non existing VD. ldTgtIdtoLd[] array has size 256 for Extended VD firmware
+and 128 for legacy firmware. Accessing indices beyond array size (OS will
+send TUR, INQUIRY.. commands upto device index 255), may return valid LD
+value and that particular SCSI command will be SUCCESS and creating SCSI
+device for non existing target(VD).
+
+For legacy firmware (64 VD firmware), invalidates LD (by setting LD value
+to 0xff) in LdTgtIdtoLd[] array for device index beyond 127, so that
+invalid LD(0xff) value should be returned beyond device index beyond 127.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 3 +++
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 14 ++++++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -210,6 +210,9 @@ void MR_PopulateDrvRaidMap(struct megasa
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
++ for (i = (MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS);
++ i < MAX_LOGICAL_DRIVES_EXT; i++)
++ pDrvRaidMap->ldTgtIdToLd[i] = 0xff;
+ for (i = 0; i < ld_count; i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1752,9 +1752,19 @@ megasas_build_dcdb_fusion(struct megasas
+ if (scmd->device->channel < MEGASAS_MAX_PD_CHANNELS)
+ goto NonFastPath;
+
++ /*
++ * For older firmware, Driver should not access ldTgtIdToLd
++ * beyond index 127 and for Extended VD firmware, ldTgtIdToLd
++ * should not go beyond 255.
++ */
++
++ if ((!fusion->fast_path_io) ||
++ (device_id >= instance->fw_supported_vd_count))
++ goto NonFastPath;
++
+ ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
+- if ((ld >= instance->fw_supported_vd_count) ||
+- (!fusion->fast_path_io))
++
++ if (ld >= instance->fw_supported_vd_count)
+ goto NonFastPath;
+
+ raid = MR_LdRaidGet(ld, local_map_ptr);
--- /dev/null
+From 1ab1e79b9fd4b01331490bbe2e630a0fc0b25449 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sun, 25 Jan 2015 23:45:27 +0200
+Subject: mei: mask interrupt set bit on clean reset bit
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 1ab1e79b9fd4b01331490bbe2e630a0fc0b25449 upstream.
+
+We should mask interrupt set bit when writing back
+hcsr value in reset bit clean-up.
+
+This is refinement for
+mei: clean reset bit before reset
+commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -242,7 +242,7 @@ static int mei_me_hw_reset(struct mei_de
+ if ((hcsr & H_RST) == H_RST) {
+ dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
+ hcsr &= ~H_RST;
+- mei_me_reg_write(hw, H_CSR, hcsr);
++ mei_hcsr_set(hw, hcsr);
+ hcsr = mei_hcsr_read(hw);
+ }
+
--- /dev/null
+From 663b7ee9517eec6deea9a48c7a1392a9a34f7809 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sun, 25 Jan 2015 23:45:28 +0200
+Subject: mei: me: release hw from reset only during the reset flow
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 663b7ee9517eec6deea9a48c7a1392a9a34f7809 upstream.
+
+We might enter the interrupt handler with hw_ready already set,
+but prior we actually started the reset flow.
+To soleve this we move the reset release from the interrupt handler
+to the HW start wait function which is part of the reset sequence.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -335,6 +335,7 @@ static int mei_me_hw_ready_wait(struct m
+ return -ETIME;
+ }
+
++ mei_me_hw_reset_release(dev);
+ dev->recvd_hw_ready = false;
+ return 0;
+ }
+@@ -729,9 +730,7 @@ irqreturn_t mei_me_irq_thread_handler(in
+ /* check if we need to start the dev */
+ if (!mei_host_is_ready(dev)) {
+ if (mei_hw_is_ready(dev)) {
+- mei_me_hw_reset_release(dev);
+ dev_dbg(dev->dev, "we need to start the dev.\n");
+-
+ dev->recvd_hw_ready = true;
+ wake_up(&dev->wait_hw_ready);
+ } else {
--- /dev/null
+From 69e4e63ec816a7e22cc3aa14bc7ef4ac734d370c Mon Sep 17 00:00:00 2001
+From: Manuel Lauss <manuel.lauss@gmail.com>
+Date: Wed, 18 Feb 2015 11:01:56 +0100
+Subject: MIPS: Alchemy: Fix cpu clock calculation
+
+From: Manuel Lauss <manuel.lauss@gmail.com>
+
+commit 69e4e63ec816a7e22cc3aa14bc7ef4ac734d370c upstream.
+
+The current code uses bits 0-6 of the sys_cpupll register to calculate
+core clock speed. However this is only valid on Au1300, on all earlier
+models the hardware only uses bits 0-5 to generate core clock.
+
+This fixes clock calculation on the MTX1 (Au1500), where bit 6 of cpupll
+is set as well, which ultimately lead the code to calculate a bogus cpu
+core clock and also uart base clock down the line.
+
+Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
+Reported-by: John Crispin <blogic@openwrt.org>
+Tested-by: Bruno Randolf <br1@einfach.org>
+Cc: Linux-MIPS <linux-mips@linux-mips.org>
+Patchwork: https://patchwork.linux-mips.org/patch/9279/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/alchemy/common/clock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -128,6 +128,8 @@ static unsigned long alchemy_clk_cpu_rec
+ t = 396000000;
+ else {
+ t = alchemy_rdsys(AU1000_SYS_CPUPLL) & 0x7f;
++ if (alchemy_get_cputype() < ALCHEMY_CPU_AU1300)
++ t &= 0x3f;
+ t *= parent_rate;
+ }
+
--- /dev/null
+From 98a833c1fa4de0695830f77b2d13fd86693da298 Mon Sep 17 00:00:00 2001
+From: Markos Chandras <markos.chandras@imgtec.com>
+Date: Wed, 5 Nov 2014 14:17:52 +0000
+Subject: MIPS: asm: asmmacro: Replace "add" instructions with "addu"
+
+From: Markos Chandras <markos.chandras@imgtec.com>
+
+commit 98a833c1fa4de0695830f77b2d13fd86693da298 upstream.
+
+The "add" instruction is actually a macro in binutils and depending on
+the size of the immediate it can expand to an "addi" instruction.
+However, the "addi" instruction traps on overflows which is not
+something we want on address calculation.
+
+Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00121.html
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/asmmacro.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -304,7 +304,7 @@
+ .set push
+ .set noat
+ SET_HARDFLOAT
+- add $1, \base, \off
++ addu $1, \base, \off
+ .word LDD_MSA_INSN | (\wd << 6)
+ .set pop
+ .endm
+@@ -313,7 +313,7 @@
+ .set push
+ .set noat
+ SET_HARDFLOAT
+- add $1, \base, \off
++ addu $1, \base, \off
+ .word STD_MSA_INSN | (\wd << 6)
+ .set pop
+ .endm
--- /dev/null
+From 461d1597ffad7a826f8aaa63ab0727c37b632e34 Mon Sep 17 00:00:00 2001
+From: Markos Chandras <markos.chandras@imgtec.com>
+Date: Mon, 26 Jan 2015 09:40:34 +0000
+Subject: MIPS: asm: pgtable: Add c0 hazards on HTW start/stop sequences
+
+From: Markos Chandras <markos.chandras@imgtec.com>
+
+commit 461d1597ffad7a826f8aaa63ab0727c37b632e34 upstream.
+
+When we use htw_{start,stop}() outside of htw_reset(), we need
+to ensure that c0 changes have been propagated properly before
+we attempt to continue with subsequence memory operations.
+
+Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9114/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/pgtable.h | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -99,16 +99,20 @@ extern void paging_init(void);
+
+ #define htw_stop() \
+ do { \
+- if (cpu_has_htw) \
++ if (cpu_has_htw) { \
+ write_c0_pwctl(read_c0_pwctl() & \
+ ~(1 << MIPS_PWCTL_PWEN_SHIFT)); \
++ back_to_back_c0_hazard(); \
++ } \
+ } while(0)
+
+ #define htw_start() \
+ do { \
+- if (cpu_has_htw) \
++ if (cpu_has_htw) { \
+ write_c0_pwctl(read_c0_pwctl() | \
+ (1 << MIPS_PWCTL_PWEN_SHIFT)); \
++ back_to_back_c0_hazard(); \
++ } \
+ } while(0)
+
+
+@@ -116,9 +120,7 @@ do { \
+ do { \
+ if (cpu_has_htw) { \
+ htw_stop(); \
+- back_to_back_c0_hazard(); \
+ htw_start(); \
+- back_to_back_c0_hazard(); \
+ } \
+ } while(0)
+
--- /dev/null
+From fde3538a8a711aedf1173ecb2d45aed868f51c97 Mon Sep 17 00:00:00 2001
+From: Markos Chandras <markos.chandras@imgtec.com>
+Date: Mon, 26 Jan 2015 09:40:36 +0000
+Subject: MIPS: asm: pgtable: Prevent HTW race when updating PTEs
+
+From: Markos Chandras <markos.chandras@imgtec.com>
+
+commit fde3538a8a711aedf1173ecb2d45aed868f51c97 upstream.
+
+Whenever we modify a page table entry, we need to ensure that the HTW
+will not fetch a stable entry. And for that to happen we need to ensure
+that HTW is stopped before we modify the said entry otherwise the HTW
+may already be in the process of reading that entry and fetching the
+old information. As a result of which, we replace the htw_reset() calls
+with htw_{stop,start} in more appropriate places. This also removes the
+remaining users of htw_reset() and as a result we drop that macro
+
+Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9116/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/pgtable.h | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -116,14 +116,6 @@ do { \
+ } while(0)
+
+
+-#define htw_reset() \
+-do { \
+- if (cpu_has_htw) { \
+- htw_stop(); \
+- htw_start(); \
+- } \
+-} while(0)
+-
+ extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
+ pte_t pteval);
+
+@@ -155,12 +147,13 @@ static inline void pte_clear(struct mm_s
+ {
+ pte_t null = __pte(0);
+
++ htw_stop();
+ /* Preserve global status for the pair */
+ if (ptep_buddy(ptep)->pte_low & _PAGE_GLOBAL)
+ null.pte_low = null.pte_high = _PAGE_GLOBAL;
+
+ set_pte_at(mm, addr, ptep, null);
+- htw_reset();
++ htw_start();
+ }
+ #else
+
+@@ -190,6 +183,7 @@ static inline void set_pte(pte_t *ptep,
+
+ static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
++ htw_stop();
+ #if !defined(CONFIG_CPU_R3000) && !defined(CONFIG_CPU_TX39XX)
+ /* Preserve global status for the pair */
+ if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL)
+@@ -197,7 +191,7 @@ static inline void pte_clear(struct mm_s
+ else
+ #endif
+ set_pte_at(mm, addr, ptep, __pte(0));
+- htw_reset();
++ htw_start();
+ }
+ #endif
+
--- /dev/null
+From 3ce465e04bfd8de9956d515d6e9587faac3375dc Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Tue, 10 Feb 2015 10:02:59 +0000
+Subject: MIPS: Export FP functions used by lose_fpu(1) for KVM
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 3ce465e04bfd8de9956d515d6e9587faac3375dc upstream.
+
+Export the _save_fp asm function used by the lose_fpu(1) macro to GPL
+modules so that KVM can make use of it when it is built as a module.
+
+This fixes the following build error when CONFIG_KVM=m due to commit
+f798217dfd03 ("KVM: MIPS: Don't leak FPU/DSP to guest"):
+
+ERROR: "_save_fp" [arch/mips/kvm/kvm.ko] undefined!
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Fixes: f798217dfd03 (KVM: MIPS: Don't leak FPU/DSP to guest)
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: kvm@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9260/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/mips_ksyms.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/mips/kernel/mips_ksyms.c
++++ b/arch/mips/kernel/mips_ksyms.c
+@@ -14,6 +14,7 @@
+ #include <linux/mm.h>
+ #include <asm/uaccess.h>
+ #include <asm/ftrace.h>
++#include <asm/fpu.h>
+
+ extern void *__bzero(void *__s, size_t __count);
+ extern long __strncpy_from_kernel_nocheck_asm(char *__to,
+@@ -34,6 +35,11 @@ extern long __strnlen_user_nocheck_asm(c
+ extern long __strnlen_user_asm(const char *s);
+
+ /*
++ * Core architecture code
++ */
++EXPORT_SYMBOL_GPL(_save_fp);
++
++/*
+ * String functions
+ */
+ EXPORT_SYMBOL(memset);
--- /dev/null
+From ca5d25642e212f73492d332d95dc90ef46a0e8dc Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Tue, 10 Feb 2015 10:03:00 +0000
+Subject: MIPS: Export MSA functions used by lose_fpu(1) for KVM
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit ca5d25642e212f73492d332d95dc90ef46a0e8dc upstream.
+
+Export the _save_msa asm function used by the lose_fpu(1) macro to GPL
+modules so that KVM can make use of it when it is built as a module.
+
+This fixes the following build error when CONFIG_KVM=m and
+CONFIG_CPU_HAS_MSA=y due to commit f798217dfd03 ("KVM: MIPS: Don't leak
+FPU/DSP to guest"):
+
+ERROR: "_save_msa" [arch/mips/kvm/kvm.ko] undefined!
+
+Fixes: f798217dfd03 (KVM: MIPS: Don't leak FPU/DSP to guest)
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: kvm@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9261/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/mips_ksyms.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/mips_ksyms.c
++++ b/arch/mips/kernel/mips_ksyms.c
+@@ -15,6 +15,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/ftrace.h>
+ #include <asm/fpu.h>
++#include <asm/msa.h>
+
+ extern void *__bzero(void *__s, size_t __count);
+ extern long __strncpy_from_kernel_nocheck_asm(char *__to,
+@@ -38,6 +39,9 @@ extern long __strnlen_user_asm(const cha
+ * Core architecture code
+ */
+ EXPORT_SYMBOL_GPL(_save_fp);
++#ifdef CONFIG_CPU_HAS_MSA
++EXPORT_SYMBOL_GPL(_save_msa);
++#endif
+
+ /*
+ * String functions
--- /dev/null
+From acac4108df6029c03195513ead7073bbb0cb9718 Mon Sep 17 00:00:00 2001
+From: Markos Chandras <markos.chandras@imgtec.com>
+Date: Mon, 24 Nov 2014 14:40:11 +0000
+Subject: MIPS: kernel: cps-vec: Replace "addi" with "addiu"
+
+From: Markos Chandras <markos.chandras@imgtec.com>
+
+commit acac4108df6029c03195513ead7073bbb0cb9718 upstream.
+
+The "addi" instruction will trap on overflows which is not something
+we need in this code, so we replace that with "addiu".
+
+Link: http://www.linux-mips.org/archives/linux-mips/2015-01/msg00430.html
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/cps-vec.S | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/mips/kernel/cps-vec.S
++++ b/arch/mips/kernel/cps-vec.S
+@@ -99,11 +99,11 @@ not_nmi:
+ xori t2, t1, 0x7
+ beqz t2, 1f
+ li t3, 32
+- addi t1, t1, 1
++ addiu t1, t1, 1
+ sllv t1, t3, t1
+ 1: /* At this point t1 == I-cache sets per way */
+ _EXT t2, v0, MIPS_CONF1_IA_SHF, MIPS_CONF1_IA_SZ
+- addi t2, t2, 1
++ addiu t2, t2, 1
+ mul t1, t1, t0
+ mul t1, t1, t2
+
+@@ -126,11 +126,11 @@ icache_done:
+ xori t2, t1, 0x7
+ beqz t2, 1f
+ li t3, 32
+- addi t1, t1, 1
++ addiu t1, t1, 1
+ sllv t1, t3, t1
+ 1: /* At this point t1 == D-cache sets per way */
+ _EXT t2, v0, MIPS_CONF1_DA_SHF, MIPS_CONF1_DA_SZ
+- addi t2, t2, 1
++ addiu t2, t2, 1
+ mul t1, t1, t0
+ mul t1, t1, t2
+
+@@ -250,7 +250,7 @@ LEAF(mips_cps_core_init)
+ mfc0 t0, CP0_MVPCONF0
+ srl t0, t0, MVPCONF0_PVPE_SHIFT
+ andi t0, t0, (MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT)
+- addi t7, t0, 1
++ addiu t7, t0, 1
+
+ /* If there's only 1, we're done */
+ beqz t0, 2f
+@@ -280,7 +280,7 @@ LEAF(mips_cps_core_init)
+ mttc0 t0, CP0_TCHALT
+
+ /* Next VPE */
+- addi t5, t5, 1
++ addiu t5, t5, 1
+ slt t0, t5, t7
+ bnez t0, 1b
+ nop
+@@ -317,7 +317,7 @@ LEAF(mips_cps_boot_vpes)
+ mfc0 t1, CP0_MVPCONF0
+ srl t1, t1, MVPCONF0_PVPE_SHIFT
+ andi t1, t1, MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT
+- addi t1, t1, 1
++ addiu t1, t1, 1
+
+ /* Calculate a mask for the VPE ID from EBase.CPUNum */
+ clz t1, t1
+@@ -424,7 +424,7 @@ LEAF(mips_cps_boot_vpes)
+
+ /* Next VPE */
+ 2: srl t6, t6, 1
+- addi t5, t5, 1
++ addiu t5, t5, 1
+ bnez t6, 1b
+ nop
+
--- /dev/null
+From cbef8478bee55775ac312a574aad48af7bb9cf9f Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Wed, 11 Feb 2015 15:25:19 -0800
+Subject: mm/hugetlb: pmd_huge() returns true for non-present hugepage
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit cbef8478bee55775ac312a574aad48af7bb9cf9f upstream.
+
+Migrating hugepages and hwpoisoned hugepages are considered as non-present
+hugepages, and they are referenced via migration entries and hwpoison
+entries in their page table slots.
+
+This behavior causes race condition because pmd_huge() doesn't tell
+non-huge pages from migrating/hwpoisoned hugepages. follow_page_mask() is
+one example where the kernel would call follow_page_pte() for such
+hugepage while this function is supposed to handle only normal pages.
+
+To avoid this, this patch makes pmd_huge() return true when pmd_none() is
+true *and* pmd_present() is false. We don't have to worry about mixing up
+non-present pmd entry with normal pmd (pointing to leaf level pte entry)
+because pmd_present() is true in normal pmd.
+
+The same race condition could happen in (x86-specific) gup_pmd_range(),
+where this patch simply adds pmd_present() check instead of pmd_huge().
+This is because gup_pmd_range() is fast path. If we have non-present
+hugepage in this function, we will go into gup_huge_pmd(), then return 0
+at flag mask check, and finally fall back to the slow path.
+
+Fixes: 290408d4a2 ("hugetlb: hugepage migration core")
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Luiz Capitulino <lcapitulino@redhat.com>
+Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Steve Capper <steve.capper@linaro.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/mm/gup.c | 2 +-
+ arch/x86/mm/hugetlbpage.c | 8 +++++++-
+ mm/hugetlb.c | 2 ++
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/gup.c
++++ b/arch/x86/mm/gup.c
+@@ -172,7 +172,7 @@ static int gup_pmd_range(pud_t pud, unsi
+ */
+ if (pmd_none(pmd) || pmd_trans_splitting(pmd))
+ return 0;
+- if (unlikely(pmd_large(pmd))) {
++ if (unlikely(pmd_large(pmd) || !pmd_present(pmd))) {
+ /*
+ * NUMA hinting faults need to be handled in the GUP
+ * slowpath for accounting purposes and so that they
+--- a/arch/x86/mm/hugetlbpage.c
++++ b/arch/x86/mm/hugetlbpage.c
+@@ -66,9 +66,15 @@ follow_huge_addr(struct mm_struct *mm, u
+ return ERR_PTR(-EINVAL);
+ }
+
++/*
++ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal
++ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry.
++ * Otherwise, returns 0.
++ */
+ int pmd_huge(pmd_t pmd)
+ {
+- return !!(pmd_val(pmd) & _PAGE_PSE);
++ return !pmd_none(pmd) &&
++ (pmd_val(pmd) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT;
+ }
+
+ int pud_huge(pud_t pud)
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3659,6 +3659,8 @@ follow_huge_pmd(struct mm_struct *mm, un
+ {
+ struct page *page;
+
++ if (!pmd_present(*pmd))
++ return NULL;
+ page = pte_page(*(pte_t *)pmd);
+ if (page)
+ page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
--- /dev/null
+From a39128bcd6f1e56c6514abf489b40b67d226093b Mon Sep 17 00:00:00 2001
+From: Marcin Wojtas <mw@semihalf.com>
+Date: Thu, 29 Jan 2015 12:36:25 +0100
+Subject: mmc: sdhci-pxav3: Fix Armada 38x controller's caps according to erratum ERR-7878951
+
+From: Marcin Wojtas <mw@semihalf.com>
+
+commit a39128bcd6f1e56c6514abf489b40b67d226093b upstream.
+
+According to erratum 'ERR-7878951' Armada 38x SDHCI controller has
+different capabilities than the ones shown in its registers:
+
+- it doesn't support the voltage switching: it can work either with
+ 3.3V or 1.8V supply
+- it doesn't support the SDR104 mode
+- SDR50 mode doesn't need tuning
+
+The SDHCI_QUIRK_MISSING_CAPS quirk is used for updating the
+capabilities accordingly.
+
+[gregory.clement@free-electrons.com: port from 3.10]
+
+Fixes: 5491ce3f79ee ("mmc: sdhci-pxav3: add support for the Armada 38x SDHCI controller")
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pxav3.c | 28 +++++++++++++++++++++++-----
+ 1 file changed, 23 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -112,8 +112,11 @@ static int mv_conf_mbus_windows(struct p
+ return 0;
+ }
+
+-static int armada_38x_quirks(struct sdhci_host *host)
++static int armada_38x_quirks(struct platform_device *pdev,
++ struct sdhci_host *host)
+ {
++ struct device_node *np = pdev->dev.of_node;
++
+ host->quirks |= SDHCI_QUIRK_MISSING_CAPS;
+ /*
+ * According to erratum 'FE-2946959' both SDR50 and DDR50
+@@ -123,6 +126,21 @@ static int armada_38x_quirks(struct sdhc
+ */
+ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
++
++ /*
++ * According to erratum 'ERR-7878951' Armada 38x SDHCI
++ * controller has different capabilities than the ones shown
++ * in its registers
++ */
++ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
++ if (of_property_read_bool(np, "no-1-8-v")) {
++ host->caps &= ~SDHCI_CAN_VDD_180;
++ host->mmc->caps &= ~MMC_CAP_1_8V_DDR;
++ } else {
++ host->caps &= ~SDHCI_CAN_VDD_330;
++ }
++ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_USE_SDR50_TUNING);
++
+ return 0;
+ }
+
+@@ -309,8 +327,11 @@ static int sdhci_pxav3_probe(struct plat
+ if (IS_ERR(host))
+ return PTR_ERR(host);
+
++ /* enable 1/8V DDR capable */
++ host->mmc->caps |= MMC_CAP_1_8V_DDR;
++
+ if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
+- ret = armada_38x_quirks(host);
++ ret = armada_38x_quirks(pdev, host);
+ if (ret < 0)
+ goto err_clk_get;
+ ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
+@@ -331,9 +352,6 @@ static int sdhci_pxav3_probe(struct plat
+ pltfm_host->clk = clk;
+ clk_prepare_enable(clk);
+
+- /* enable 1/8V DDR capable */
+- host->mmc->caps |= MMC_CAP_1_8V_DDR;
+-
+ match = of_match_device(of_match_ptr(sdhci_pxav3_of_match), &pdev->dev);
+ if (match) {
+ ret = mmc_of_parse(host->mmc);
--- /dev/null
+From d4b803c559843e3774736e5108cf6331cf75f64c Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Thu, 29 Jan 2015 12:36:24 +0100
+Subject: mmc: sdhci-pxav3: Fix SDR50 and DDR50 capabilities for the Armada 38x flavor
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit d4b803c559843e3774736e5108cf6331cf75f64c upstream.
+
+According to erratum 'FE-2946959' both SDR50 and DDR50 modes require
+specific clock adjustments in SDIO3 Configuration register. However,
+this register was not part of the device tree binding. Even if the
+binding can (and will) be extended we still need handling the case
+where this register was not available. In this case we use the
+SDHCI_QUIRK_MISSING_CAPS quirk remove them from the capabilities.
+
+This commit is based on the work done by Marcin Wojtas<mw@semihalf.com>
+
+Fixes: 5491ce3f79ee ("mmc: sdhci-pxav3: add support for the Armada 38x SDHCI controller")
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pxav3.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -112,6 +112,20 @@ static int mv_conf_mbus_windows(struct p
+ return 0;
+ }
+
++static int armada_38x_quirks(struct sdhci_host *host)
++{
++ host->quirks |= SDHCI_QUIRK_MISSING_CAPS;
++ /*
++ * According to erratum 'FE-2946959' both SDR50 and DDR50
++ * modes require specific clock adjustments in SDIO3
++ * Configuration register, if the adjustment is not done,
++ * remove them from the capabilities.
++ */
++ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
++ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
++ return 0;
++}
++
+ static void pxav3_reset(struct sdhci_host *host, u8 mask)
+ {
+ struct platform_device *pdev = to_platform_device(mmc_dev(host->mmc));
+@@ -296,6 +310,9 @@ static int sdhci_pxav3_probe(struct plat
+ return PTR_ERR(host);
+
+ if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
++ ret = armada_38x_quirks(host);
++ if (ret < 0)
++ goto err_clk_get;
+ ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
+ if (ret < 0)
+ goto err_mbus_win;
--- /dev/null
+From 14460dbaf7a5a0488963fdb8232ad5c8a8cca7b7 Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Wed, 28 Jan 2015 19:54:12 +0800
+Subject: mmc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles
+
+From: Jisheng Zhang <jszhang@marvell.com>
+
+commit 14460dbaf7a5a0488963fdb8232ad5c8a8cca7b7 upstream.
+
+Current code checks "clk_delay_cycles > 0" to know whether the optional
+"mrvl,clk_delay_cycles" is set or not. But of_property_read_u32() doesn't
+touch clk_delay_cycles if the property is not set. And type of
+clk_delay_cycles is u32, so we may always set pdata->clk_delay_cycles as a
+random value.
+
+This patch fix this problem by check the return value of of_property_read_u32()
+to know whether the optional clk-delay-cycles is set or not.
+
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pxav3.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -261,8 +261,8 @@ static struct sdhci_pxa_platdata *pxav3_
+ if (!pdata)
+ return NULL;
+
+- of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles);
+- if (clk_delay_cycles > 0)
++ if (!of_property_read_u32(np, "mrvl,clk-delay-cycles",
++ &clk_delay_cycles))
+ pdata->clk_delay_cycles = clk_delay_cycles;
+
+ return pdata;
--- /dev/null
+From 62cf983ad84275f8580c807e5e596216c46773cf Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Sun, 4 Jan 2015 23:15:47 +0800
+Subject: mmc: sdhci-pxav3: fix unbalanced clock issues during probe
+
+From: Jisheng Zhang <jszhang@marvell.com>
+
+commit 62cf983ad84275f8580c807e5e596216c46773cf upstream.
+
+Commit 0dcaa2499b7d ("sdhci-pxav3: Fix runtime PM initialization") tries
+to fix one hang issue caused by calling sdhci_add_host() on a suspended
+device. The fix enables the clock twice, once by clk_prepare_enable() and
+another by pm_runtime_get_sync(), meaning that the clock will never be
+gated at runtime PM suspend. I observed the power consumption regression on
+Marvell BG2Q SoCs.
+
+In fact, the fix is not correct. There still be a very small window
+during which a runtime suspend might somehow occur after pm_runtime_enable()
+but before pm_runtime_get_sync().
+
+This patch fixes all of the two problems by just incrementing the usage
+counter before pm_runtime_enable(). It also adjust the order of disabling
+runtime pm and storing the usage count in the error path to handle clock
+gating properly.
+
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pxav3.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -355,10 +355,11 @@ static int sdhci_pxav3_probe(struct plat
+ }
+ }
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(&pdev->dev);
++ pm_runtime_get_noresume(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, PXAV3_RPM_DELAY_MS);
+ pm_runtime_use_autosuspend(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
+ pm_suspend_ignore_children(&pdev->dev, 1);
+
+ ret = sdhci_add_host(host);
+@@ -381,8 +382,8 @@ static int sdhci_pxav3_probe(struct plat
+ return 0;
+
+ err_add_host:
+- pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
+ err_of_parse:
+ err_cd_req:
+ clk_disable_unprepare(clk);
--- /dev/null
+From 6ffa30d3f734d4f6b478081dfc09592021028f90 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@primarydata.com>
+Date: Wed, 14 Jan 2015 13:08:57 -0500
+Subject: nfs: don't call blocking operations while !TASK_RUNNING
+
+From: Jeff Layton <jlayton@primarydata.com>
+
+commit 6ffa30d3f734d4f6b478081dfc09592021028f90 upstream.
+
+Bruce reported seeing this warning pop when mounting using v4.1:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 1121 at kernel/sched/core.c:7300 __might_sleep+0xbd/0xd0()
+ do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff810ff58f>] prepare_to_wait+0x2f/0x90
+ Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer ppdev joydev snd virtio_console virtio_balloon pcspkr serio_raw parport_pc parport pvpanic floppy soundcore i2c_piix4 virtio_blk virtio_net qxl drm_kms_helper ttm drm virtio_pci virtio_ring ata_generic virtio pata_acpi
+ CPU: 1 PID: 1121 Comm: nfsv4.1-svc Not tainted 3.19.0-rc4+ #25
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
+ 0000000000000000 000000004e5e3f73 ffff8800b998fb48 ffffffff8186ac78
+ 0000000000000000 ffff8800b998fba0 ffff8800b998fb88 ffffffff810ac9da
+ ffff8800b998fb68 ffffffff81c923e7 00000000000004d9 0000000000000000
+ Call Trace:
+ [<ffffffff8186ac78>] dump_stack+0x4c/0x65
+ [<ffffffff810ac9da>] warn_slowpath_common+0x8a/0xc0
+ [<ffffffff810aca65>] warn_slowpath_fmt+0x55/0x70
+ [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90
+ [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90
+ [<ffffffff810dd2ad>] __might_sleep+0xbd/0xd0
+ [<ffffffff8124c973>] kmem_cache_alloc_trace+0x243/0x430
+ [<ffffffff810d941e>] ? groups_alloc+0x3e/0x130
+ [<ffffffff810d941e>] groups_alloc+0x3e/0x130
+ [<ffffffffa0301b1e>] svcauth_unix_accept+0x16e/0x290 [sunrpc]
+ [<ffffffffa0300571>] svc_authenticate+0xe1/0xf0 [sunrpc]
+ [<ffffffffa02fc564>] svc_process_common+0x244/0x6a0 [sunrpc]
+ [<ffffffffa02fd044>] bc_svc_process+0x1c4/0x260 [sunrpc]
+ [<ffffffffa03d5478>] nfs41_callback_svc+0x128/0x1f0 [nfsv4]
+ [<ffffffff810ff970>] ? wait_woken+0xc0/0xc0
+ [<ffffffffa03d5350>] ? nfs4_callback_svc+0x60/0x60 [nfsv4]
+ [<ffffffff810d45bf>] kthread+0x11f/0x140
+ [<ffffffff810ea815>] ? local_clock+0x15/0x30
+ [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250
+ [<ffffffff81874bfc>] ret_from_fork+0x7c/0xb0
+ [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250
+ ---[ end trace 675220a11e30f4f2 ]---
+
+nfs41_callback_svc does most of its work while in TASK_INTERRUPTIBLE,
+which is just wrong. Fix that by finishing the wait immediately if we've
+found that the list has something on it.
+
+Also, we don't expect this kthread to accept signals, so we should be
+using a TASK_UNINTERRUPTIBLE sleep instead. That however, opens us up
+hung task warnings from the watchdog, so have the schedule_timeout
+wake up every 60s if there's no callback activity.
+
+Reported-by: "J. Bruce Fields" <bfields@fieldses.org>
+Signed-off-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/callback.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -128,22 +128,24 @@ nfs41_callback_svc(void *vrqstp)
+ if (try_to_freeze())
+ continue;
+
+- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
++ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE);
+ spin_lock_bh(&serv->sv_cb_lock);
+ if (!list_empty(&serv->sv_cb_list)) {
+ req = list_first_entry(&serv->sv_cb_list,
+ struct rpc_rqst, rq_bc_list);
+ list_del(&req->rq_bc_list);
+ spin_unlock_bh(&serv->sv_cb_lock);
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ dprintk("Invoking bc_svc_process()\n");
+ error = bc_svc_process(serv, req, rqstp);
+ dprintk("bc_svc_process() returned w/ error code= %d\n",
+ error);
+ } else {
+ spin_unlock_bh(&serv->sv_cb_lock);
+- schedule();
++ /* schedule_timeout to game the hung task watchdog */
++ schedule_timeout(60 * HZ);
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ }
+- finish_wait(&serv->sv_cb_waitq, &wq);
+ }
+ return 0;
+ }
--- /dev/null
+From f4086a3d789dbe18949862276d83b8f49fce6d2f Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 13 Feb 2015 21:03:16 -0500
+Subject: NFS: struct nfs_commit_info.lock must always point to inode->i_lock
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit f4086a3d789dbe18949862276d83b8f49fce6d2f upstream.
+
+Commit 411a99adffb4f (nfs: clear_request_commit while holding i_lock)
+assumes that the nfs_commit_info always points to the inode->i_lock.
+For historical reasons, that is not the case for O_DIRECT writes.
+
+Cc: Weston Andros Adamson <dros@primarydata.com>
+Fixes: 411a99adffb4f ("nfs: clear_request_commit while holding i_lock")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/direct.c | 2 +-
+ include/linux/nfs_xdr.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -242,7 +242,7 @@ static void nfs_direct_release_pages(str
+ void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo,
+ struct nfs_direct_req *dreq)
+ {
+- cinfo->lock = &dreq->lock;
++ cinfo->lock = &dreq->inode->i_lock;
+ cinfo->mds = &dreq->mds_cinfo;
+ cinfo->ds = &dreq->ds_cinfo;
+ cinfo->dreq = dreq;
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1328,7 +1328,7 @@ struct nfs_commit_completion_ops {
+ };
+
+ struct nfs_commit_info {
+- spinlock_t *lock;
++ spinlock_t *lock; /* inode->i_lock */
+ struct nfs_mds_commit_info *mds;
+ struct pnfs_ds_commit_info *ds;
+ struct nfs_direct_req *dreq; /* O_DIRECT request */
--- /dev/null
+From cb5d04bc39e914124e811ea55f3034d2379a5f6c Mon Sep 17 00:00:00 2001
+From: Peng Tao <tao.peng@primarydata.com>
+Date: Sat, 24 Jan 2015 22:14:52 +0800
+Subject: nfs41: .init_read and .init_write can be called with valid pg_lseg
+
+From: Peng Tao <tao.peng@primarydata.com>
+
+commit cb5d04bc39e914124e811ea55f3034d2379a5f6c upstream.
+
+With pgio refactoring in v3.15, .init_read and .init_write can be
+called with valid pgio->pg_lseg. file layout was fixed at that time
+by commit c6194271f (pnfs: filelayout: support non page aligned
+layouts). But the generic helper still needs to be fixed.
+
+Signed-off-by: Peng Tao <tao.peng@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/pnfs.c | 41 ++++++++++++++++++++---------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1445,19 +1445,19 @@ pnfs_generic_pg_init_read(struct nfs_pag
+ {
+ u64 rd_size = req->wb_bytes;
+
+- WARN_ON_ONCE(pgio->pg_lseg != NULL);
+-
+- if (pgio->pg_dreq == NULL)
+- rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
+- else
+- rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
+-
+- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+- req->wb_context,
+- req_offset(req),
+- rd_size,
+- IOMODE_READ,
+- GFP_KERNEL);
++ if (pgio->pg_lseg == NULL) {
++ if (pgio->pg_dreq == NULL)
++ rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
++ else
++ rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++
++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
++ req->wb_context,
++ req_offset(req),
++ rd_size,
++ IOMODE_READ,
++ GFP_KERNEL);
++ }
+ /* If no lseg, fall back to read through mds */
+ if (pgio->pg_lseg == NULL)
+ nfs_pageio_reset_read_mds(pgio);
+@@ -1469,14 +1469,13 @@ void
+ pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio,
+ struct nfs_page *req, u64 wb_size)
+ {
+- WARN_ON_ONCE(pgio->pg_lseg != NULL);
+-
+- pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+- req->wb_context,
+- req_offset(req),
+- wb_size,
+- IOMODE_RW,
+- GFP_NOFS);
++ if (pgio->pg_lseg == NULL)
++ pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
++ req->wb_context,
++ req_offset(req),
++ wb_size,
++ IOMODE_RW,
++ GFP_NOFS);
+ /* If no lseg, fall back to write through mds */
+ if (pgio->pg_lseg == NULL)
+ nfs_pageio_reset_write_mds(pgio);
--- /dev/null
+From ea7c38fef0b774a5dc16fb0ca5935f0ae8568176 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Thu, 5 Feb 2015 15:13:24 -0500
+Subject: NFSv4: Ensure we reference the inode for return-on-close in delegreturn
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit ea7c38fef0b774a5dc16fb0ca5935f0ae8568176 upstream.
+
+If we have to do a return-on-close in the delegreturn code, then
+we must ensure that the inode and super block remain referenced.
+
+Cc: Peng Tao <tao.peng@primarydata.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Reviewed-by: Peng Tao <tao.peng@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/internal.h | 22 +++++++++++++++++++++-
+ fs/nfs/nfs4proc.c | 14 +++++++++-----
+ fs/nfs/super.c | 9 ++++++---
+ 3 files changed, 36 insertions(+), 9 deletions(-)
+
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -377,7 +377,7 @@ extern struct rpc_stat nfs_rpcstat;
+
+ extern int __init register_nfs_fs(void);
+ extern void __exit unregister_nfs_fs(void);
+-extern void nfs_sb_active(struct super_block *sb);
++extern bool nfs_sb_active(struct super_block *sb);
+ extern void nfs_sb_deactive(struct super_block *sb);
+
+ /* namespace.c */
+@@ -495,6 +495,26 @@ extern int nfs41_walk_client_list(struct
+ struct nfs_client **result,
+ struct rpc_cred *cred);
+
++static inline struct inode *nfs_igrab_and_active(struct inode *inode)
++{
++ inode = igrab(inode);
++ if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
++ iput(inode);
++ inode = NULL;
++ }
++ return inode;
++}
++
++static inline void nfs_iput_and_deactive(struct inode *inode)
++{
++ if (inode != NULL) {
++ struct super_block *sb = inode->i_sb;
++
++ iput(inode);
++ nfs_sb_deactive(sb);
++ }
++}
++
+ /*
+ * Determine the device name as a string
+ */
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5130,9 +5130,13 @@ static void nfs4_delegreturn_done(struct
+ static void nfs4_delegreturn_release(void *calldata)
+ {
+ struct nfs4_delegreturndata *data = calldata;
++ struct inode *inode = data->inode;
+
+- if (data->roc)
+- pnfs_roc_release(data->inode);
++ if (inode) {
++ if (data->roc)
++ pnfs_roc_release(inode);
++ nfs_iput_and_deactive(inode);
++ }
+ kfree(calldata);
+ }
+
+@@ -5189,9 +5193,9 @@ static int _nfs4_proc_delegreturn(struct
+ nfs_fattr_init(data->res.fattr);
+ data->timestamp = jiffies;
+ data->rpc_status = 0;
+- data->inode = inode;
+- data->roc = list_empty(&NFS_I(inode)->open_files) ?
+- pnfs_roc(inode) : false;
++ data->inode = nfs_igrab_and_active(inode);
++ if (data->inode)
++ data->roc = nfs4_roc(inode);
+
+ task_setup_data.callback_data = data;
+ msg.rpc_argp = &data->args;
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -405,12 +405,15 @@ void __exit unregister_nfs_fs(void)
+ unregister_filesystem(&nfs_fs_type);
+ }
+
+-void nfs_sb_active(struct super_block *sb)
++bool nfs_sb_active(struct super_block *sb)
+ {
+ struct nfs_server *server = NFS_SB(sb);
+
+- if (atomic_inc_return(&server->active) == 1)
+- atomic_inc(&sb->s_active);
++ if (!atomic_inc_not_zero(&sb->s_active))
++ return false;
++ if (atomic_inc_return(&server->active) != 1)
++ atomic_dec(&sb->s_active);
++ return true;
+ }
+ EXPORT_SYMBOL_GPL(nfs_sb_active);
+
--- /dev/null
+From d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Wed, 11 Feb 2015 17:27:55 -0500
+Subject: NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.
+
+If the call to decode_rc_list() fails due to a memory allocation error,
+then we need to truncate the array size to ensure that we only call
+kfree() on those pointer that were allocated.
+
+Reported-by: David Ramos <daramos@stanford.edu>
+Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/callback_xdr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(st
+
+ for (i = 0; i < args->csa_nrclists; i++) {
+ status = decode_rc_list(xdr, &args->csa_rclists[i]);
+- if (status)
++ if (status) {
++ args->csa_nrclists = i;
+ goto out_free;
++ }
+ }
+ }
+ status = 0;
--- /dev/null
+From 29183a70b0b828500816bd794b3fe192fce89f73 Mon Sep 17 00:00:00 2001
+From: John Stultz <john.stultz@linaro.org>
+Date: Mon, 9 Feb 2015 23:30:36 -0800
+Subject: ntp: Fixup adjtimex freq validation on 32-bit systems
+
+From: John Stultz <john.stultz@linaro.org>
+
+commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream.
+
+Additional validation of adjtimex freq values to avoid
+potential multiplication overflows were added in commit
+5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)
+
+Unfortunately the patch used LONG_MAX/MIN instead of
+LLONG_MAX/MIN, which was fine on 64-bit systems, but being
+much smaller on 32-bit systems caused false positives
+resulting in most direct frequency adjustments to fail w/
+EINVAL.
+
+ntpd only does direct frequency adjustments at startup, so
+the issue was not as easily observed there, but other time
+sync applications like ptpd and chrony were more effected by
+the bug.
+
+See bugs:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=92481
+ https://bugzilla.redhat.com/show_bug.cgi?id=1188074
+
+This patch changes the checks to use LLONG_MAX for
+clarity, and additionally the checks are disabled
+on 32-bit systems since LLONG_MAX/PPM_SCALE is always
+larger then the 32-bit long freq value, so multiplication
+overflows aren't possible there.
+
+Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
+Reported-by: George Joseph <george.joseph@fairview5.com>
+Tested-by: George Joseph <george.joseph@fairview5.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Sasha Levin <sasha.levin@oracle.com>
+Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org
+[ Prettified the changelog and the comments a bit. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -633,10 +633,14 @@ int ntp_validate_timex(struct timex *txc
+ if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ return -EPERM;
+
+- if (txc->modes & ADJ_FREQUENCY) {
+- if (LONG_MIN / PPM_SCALE > txc->freq)
++ /*
++ * Check for potential multiplication overflows that can
++ * only happen on 64-bit systems:
++ */
++ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
++ if (LLONG_MIN / PPM_SCALE > txc->freq)
+ return -EINVAL;
+- if (LONG_MAX / PPM_SCALE < txc->freq)
++ if (LLONG_MAX / PPM_SCALE < txc->freq)
+ return -EINVAL;
+ }
+
--- /dev/null
+From 16b036af31e1456cb69243a5a0c9ef801ecd1f17 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Mon, 19 Jan 2015 17:53:20 +0900
+Subject: PCI: Fix infinite loop with ROM image of size 0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+
+commit 16b036af31e1456cb69243a5a0c9ef801ecd1f17 upstream.
+
+If the image size would ever read as 0, pci_get_rom_size() could keep
+processing the same image over and over again. Exit the loop if we ever
+read a length of zero.
+
+This fixes a soft lockup on boot when the radeon driver calls
+pci_get_rom_size() on an AMD Radeon R7 250X PCIe discrete graphics card.
+
+[bhelgaas: changelog, reference]
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386973
+Reported-by: Federico <federicotg@gmail.com>
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/rom.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -71,6 +71,7 @@ size_t pci_get_rom_size(struct pci_dev *
+ {
+ void __iomem *image;
+ int last_image;
++ unsigned length;
+
+ image = rom;
+ do {
+@@ -93,9 +94,9 @@ size_t pci_get_rom_size(struct pci_dev *
+ if (readb(pds + 3) != 'R')
+ break;
+ last_image = readb(pds + 21) & 0x80;
+- /* this length is reliable */
+- image += readw(pds + 16) * 512;
+- } while (!last_image);
++ length = readw(pds + 16);
++ image += length * 512;
++ } while (length && !last_image);
+
+ /* never return a size larger than the PCI resource window */
+ /* there are known ROMs that get the size wrong */
--- /dev/null
+From 145b3fe579db66fbe999a2bc3fd5b63dffe9636d Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Tue, 2 Dec 2014 17:35:04 +0100
+Subject: PCI: Generate uppercase hex for modalias var in uevent
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+commit 145b3fe579db66fbe999a2bc3fd5b63dffe9636d upstream.
+
+Some implementations of modprobe fail to load the driver for a PCI device
+automatically because the "interface" part of the modalias from the kernel
+is lowercase, and the modalias from file2alias is uppercase.
+
+The "interface" is the low-order byte of the Class Code, defined in PCI
+r3.0, Appendix D. Most interface types defined in the spec do not use
+alpha characters, so they won't be affected. For example, 00h, 01h, 10h,
+20h, etc. are unaffected.
+
+Print the "interface" byte of the Class Code in uppercase hex, as we
+already do for the Vendor ID, Device ID, Class, etc.
+
+Commit 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface
+class") fixed only half of the problem. Some udev implementations rely on
+the uevent file and not the modalias file.
+
+Fixes: d1ded203adf1 ("PCI: add MODALIAS to hotplug event for pci devices")
+Fixes: 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface class")
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pci-driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1389,7 +1389,7 @@ static int pci_uevent(struct device *dev
+ if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
+ return -ENOMEM;
+
+- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
++ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
+ pdev->vendor, pdev->device,
+ pdev->subsystem_vendor, pdev->subsystem_device,
+ (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
--- /dev/null
+From 478913fdbdfd4a781d91c993eb86838620fe7421 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Mon, 5 Jan 2015 09:51:48 +0100
+Subject: power: bq24190: Fix ignored supplicants
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 478913fdbdfd4a781d91c993eb86838620fe7421 upstream.
+
+The driver mismatched 'num_supplicants' with 'num_supplies' of
+power_supply structure.
+
+It provided list of supplicants (power_supply.supplied_to) but did
+not set the number of supplicants. Instead it set the num_supplies which
+is used when iterating over number of supplies (power_supply.supplied_from).
+
+As a result the list of supplicants was ignored by core because its size
+was 0.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: d7bf353fd0aa ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/bq24190_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/bq24190_charger.c
++++ b/drivers/power/bq24190_charger.c
+@@ -929,7 +929,7 @@ static void bq24190_charger_init(struct
+ charger->properties = bq24190_charger_properties;
+ charger->num_properties = ARRAY_SIZE(bq24190_charger_properties);
+ charger->supplied_to = bq24190_charger_supplied_to;
+- charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to);
++ charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to);
+ charger->get_property = bq24190_charger_get_property;
+ charger->set_property = bq24190_charger_set_property;
+ charger->property_is_writeable = bq24190_charger_property_is_writeable;
--- /dev/null
+From faeed51bb65ce0241052d8dc24ac331ade12e976 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Thu, 15 Jan 2015 05:00:37 +0300
+Subject: power: gpio-charger: balance enable/disable_irq_wake calls
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit faeed51bb65ce0241052d8dc24ac331ade12e976 upstream.
+
+enable_irq_wakeup returns 0 in case it correctly enabled the IRQ to
+generate the wakeup event (and thus resume should call disable_irq_wake).
+Currently gpio-charger driver has this logic inverted. Correct that thus
+correcting enable/disable_irq_wake() calls balance.
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/gpio-charger.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/gpio-charger.c
++++ b/drivers/power/gpio-charger.c
+@@ -168,7 +168,7 @@ static int gpio_charger_suspend(struct d
+
+ if (device_may_wakeup(dev))
+ gpio_charger->wakeup_enabled =
+- enable_irq_wake(gpio_charger->irq);
++ !enable_irq_wake(gpio_charger->irq);
+
+ return 0;
+ }
+@@ -178,7 +178,7 @@ static int gpio_charger_resume(struct de
+ struct platform_device *pdev = to_platform_device(dev);
+ struct gpio_charger *gpio_charger = platform_get_drvdata(pdev);
+
+- if (gpio_charger->wakeup_enabled)
++ if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled)
+ disable_irq_wake(gpio_charger->irq);
+ power_supply_changed(&gpio_charger->charger);
+
--- /dev/null
+From 24727b45b484e8937dcde53fa8d1aa70ac30ec0c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Tue, 27 Jan 2015 16:51:54 +0100
+Subject: power_supply: 88pm860x: Fix leaked power supply on probe fail
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 24727b45b484e8937dcde53fa8d1aa70ac30ec0c upstream.
+
+Driver forgot to unregister power supply if request_threaded_irq()
+failed in probe(). In such case the memory associated with power supply
+leaked.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/88pm860x_charger.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/power/88pm860x_charger.c
++++ b/drivers/power/88pm860x_charger.c
+@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct p
+ return 0;
+
+ out_irq:
++ power_supply_unregister(&info->usb);
+ while (--i >= 0)
+ free_irq(info->irq[i], info);
+ out:
--- /dev/null
+From 05fbf357d94152171bc50f8a369390f1f16efd89 Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Wed, 11 Feb 2015 15:27:31 -0800
+Subject: proc/pagemap: walk page tables under pte lock
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+commit 05fbf357d94152171bc50f8a369390f1f16efd89 upstream.
+
+Lockless access to pte in pagemap_pte_range() might race with page
+migration and trigger BUG_ON(!PageLocked()) in migration_entry_to_page():
+
+CPU A (pagemap) CPU B (migration)
+ lock_page()
+ try_to_unmap(page, TTU_MIGRATION...)
+ make_migration_entry()
+ set_pte_at()
+<read *pte>
+pte_to_pagemap_entry()
+ remove_migration_ptes()
+ unlock_page()
+ if(is_migration_entry())
+ migration_entry_to_page()
+ BUG_ON(!PageLocked(page))
+
+Also lockless read might be non-atomic if pte is larger than wordsize.
+Other pte walkers (smaps, numa_maps, clear_refs) already lock ptes.
+
+Fixes: 052fb0d635df ("proc: report file/anon bit in /proc/pid/pagemap")
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Andrey Ryabinin <a.ryabinin@samsung.com>
+Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
+Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/task_mmu.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1034,7 +1034,7 @@ static int pagemap_pte_range(pmd_t *pmd,
+ struct vm_area_struct *vma;
+ struct pagemapread *pm = walk->private;
+ spinlock_t *ptl;
+- pte_t *pte;
++ pte_t *pte, *orig_pte;
+ int err = 0;
+
+ /* find the first VMA at or above 'addr' */
+@@ -1095,15 +1095,19 @@ static int pagemap_pte_range(pmd_t *pmd,
+ BUG_ON(is_vm_hugetlb_page(vma));
+
+ /* Addresses in the VMA. */
+- for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) {
++ orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++ for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) {
+ pagemap_entry_t pme;
+- pte = pte_offset_map(pmd, addr);
++
+ pte_to_pagemap_entry(&pme, pm, vma, addr, *pte);
+- pte_unmap(pte);
+ err = add_to_pagemap(addr, &pme, pm);
+ if (err)
+- return err;
++ break;
+ }
++ pte_unmap_unlock(orig_pte, ptl);
++
++ if (err)
++ return err;
+
+ if (addr == end)
+ break;
--- /dev/null
+From 19acc77a36970958a4a0e4daeb2c8cb2aab0ffd4 Mon Sep 17 00:00:00 2001
+From: George Spelvin <linux@horizon.com>
+Date: Sat, 7 Feb 2015 00:32:06 -0500
+Subject: random: Fix fast_mix() function
+
+From: George Spelvin <linux@horizon.com>
+
+commit 19acc77a36970958a4a0e4daeb2c8cb2aab0ffd4 upstream.
+
+There was a bad typo in commit 43759d4f429c ("random: use an improved
+fast_mix() function") and I didn't notice because it "looked right", so
+I saw what I expected to see when I reviewed it.
+
+Only months later did I look and notice it's not the Threefish-inspired
+mix function that I had designed and optimized.
+
+Mea Culpa. Each input bit still has a chance to affect each output bit,
+and the fast pool is spilled *long* before it fills, so it's not a total
+disaster, but it's definitely not the intended great improvement.
+
+I'm still working on finding better rotation constants. These are good
+enough, but since it's unrolled twice, it's possible to get better
+mixing for free by using eight different constants rather than repeating
+the same four.
+
+Signed-off-by: George Spelvin <linux@horizon.com>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -569,19 +569,19 @@ static void fast_mix(struct fast_pool *f
+ __u32 c = f->pool[2], d = f->pool[3];
+
+ a += b; c += d;
+- b = rol32(a, 6); d = rol32(c, 27);
++ b = rol32(b, 6); d = rol32(d, 27);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 16); d = rol32(c, 14);
++ b = rol32(b, 16); d = rol32(d, 14);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 6); d = rol32(c, 27);
++ b = rol32(b, 6); d = rol32(d, 27);
+ d ^= a; b ^= c;
+
+ a += b; c += d;
+- b = rol32(a, 16); d = rol32(c, 14);
++ b = rol32(b, 16); d = rol32(d, 14);
+ d ^= a; b ^= c;
+
+ f->pool[0] = a; f->pool[1] = b;
--- /dev/null
+From 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 8 Dec 2014 13:17:07 -0300
+Subject: [media] rc-main: Re-apply filter for no-op protocol change
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 983c5bd26b86ba1c0d79b770e596bb8b77e42f32 upstream.
+
+Since commit da6e162d6a46 ("[media] rc-core: simplify sysfs code"), when
+the IR protocol is set using the sysfs interface to the same set of
+protocols that are already set, store_protocols() does not refresh the
+scancode filter with the new protocol, even if it has already called the
+change_protocol() callback successfully. This results in the filter
+being disabled in the hardware and not re-enabled until the filter is
+set again using sysfs.
+
+Fix in store_protocols() by still re-applying the filter whenever the
+change_protocol() driver callback succeeded.
+
+The problem can be reproduced with the img-ir driver by setting a
+filter, and then setting the protocol to the same protocol that is
+already set:
+$ echo nec > protocols
+$ echo 0xffff > filter_mask
+$ echo nec > protocols
+
+After this, messages which don't match the filter were still being
+received.
+
+Fixes: da6e162d6a46 ("[media] rc-core: simplify sysfs code")
+
+Reported-by: Sifan Naeem <sifan.naeem@imgtec.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/rc-main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1021,16 +1021,16 @@ static ssize_t store_protocols(struct de
+ goto out;
+ }
+
+- if (new_protocols == old_protocols) {
+- rc = len;
+- goto out;
++ if (new_protocols != old_protocols) {
++ *current_protocols = new_protocols;
++ IR_dprintk(1, "Protocols changed to 0x%llx\n",
++ (long long)new_protocols);
+ }
+
+- *current_protocols = new_protocols;
+- IR_dprintk(1, "Protocols changed to 0x%llx\n", (long long)new_protocols);
+-
+ /*
+- * If the protocol is changed the filter needs updating.
++ * If a protocol change was attempted the filter may need updating, even
++ * if the actual protocol mask hasn't changed (since the driver may have
++ * cleared the filter).
+ * Try setting the same filter with the new protocol (if any).
+ * Fall back to clearing the filter.
+ */
--- /dev/null
+From 1e0d6714aceb770b04161fbedd7765d0e1fc27bd Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 10 Feb 2015 22:14:53 -0500
+Subject: ring-buffer: Do not wake up a splice waiter when page is not full
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 1e0d6714aceb770b04161fbedd7765d0e1fc27bd upstream.
+
+When an application connects to the ring buffer via splice, it can only
+read full pages. Splice does not work with partial pages. If there is
+not enough data to fill a page, the splice command will either block
+or return -EAGAIN (if set to nonblock).
+
+Code was added where if the page is not full, to just sleep again.
+The problem is, it will get woken up again on the next event. That
+is, when something is written into the ring buffer, if there is a waiter
+it will wake it up. The waiter would then check the buffer, see that
+it still does not have enough data to fill a page and go back to sleep.
+To make matters worse, when the waiter goes back to sleep, it could
+cause another event, which would wake it back up again to see it
+doesn't have enough data and sleep again. This produces a tremendous
+overhead and fills the ring buffer with noise.
+
+For example, recording sched_switch on an idle system for 10 seconds
+produces 25,350,475 events!!!
+
+Create another wait queue for those waiters wanting full pages.
+When an event is written, it only wakes up waiters if there's a full
+page of data. It does not wake up the waiter if the page is not yet
+full.
+
+After this change, recording sched_switch on an idle system for 10
+seconds produces only 800 events. Getting rid of 25,349,675 useless
+events (99.9969% of events!!), is something to take seriously.
+
+Cc: Rabin Vincent <rabin@rab.in>
+Fixes: e30f53aad220 "tracing: Do not busy wait in buffer splice"
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 40 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 35 insertions(+), 5 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -450,7 +450,10 @@ int ring_buffer_print_page_header(struct
+ struct rb_irq_work {
+ struct irq_work work;
+ wait_queue_head_t waiters;
++ wait_queue_head_t full_waiters;
+ bool waiters_pending;
++ bool full_waiters_pending;
++ bool wakeup_full;
+ };
+
+ /*
+@@ -532,6 +535,10 @@ static void rb_wake_up_waiters(struct ir
+ struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);
+
+ wake_up_all(&rbwork->waiters);
++ if (rbwork->wakeup_full) {
++ rbwork->wakeup_full = false;
++ wake_up_all(&rbwork->full_waiters);
++ }
+ }
+
+ /**
+@@ -556,9 +563,11 @@ int ring_buffer_wait(struct ring_buffer
+ * data in any cpu buffer, or a specific buffer, put the
+ * caller on the appropriate wait queue.
+ */
+- if (cpu == RING_BUFFER_ALL_CPUS)
++ if (cpu == RING_BUFFER_ALL_CPUS) {
+ work = &buffer->irq_work;
+- else {
++ /* Full only makes sense on per cpu reads */
++ full = false;
++ } else {
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return -ENODEV;
+ cpu_buffer = buffer->buffers[cpu];
+@@ -567,7 +576,10 @@ int ring_buffer_wait(struct ring_buffer
+
+
+ while (true) {
+- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
++ if (full)
++ prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE);
++ else
++ prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
+
+ /*
+ * The events can happen in critical sections where
+@@ -589,7 +601,10 @@ int ring_buffer_wait(struct ring_buffer
+ * that is necessary is that the wake up happens after
+ * a task has been queued. It's OK for spurious wake ups.
+ */
+- work->waiters_pending = true;
++ if (full)
++ work->full_waiters_pending = true;
++ else
++ work->waiters_pending = true;
+
+ if (signal_pending(current)) {
+ ret = -EINTR;
+@@ -618,7 +633,10 @@ int ring_buffer_wait(struct ring_buffer
+ schedule();
+ }
+
+- finish_wait(&work->waiters, &wait);
++ if (full)
++ finish_wait(&work->full_waiters, &wait);
++ else
++ finish_wait(&work->waiters, &wait);
+
+ return ret;
+ }
+@@ -1233,6 +1251,7 @@ rb_allocate_cpu_buffer(struct ring_buffe
+ init_completion(&cpu_buffer->update_done);
+ init_irq_work(&cpu_buffer->irq_work.work, rb_wake_up_waiters);
+ init_waitqueue_head(&cpu_buffer->irq_work.waiters);
++ init_waitqueue_head(&cpu_buffer->irq_work.full_waiters);
+
+ bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
+ GFP_KERNEL, cpu_to_node(cpu));
+@@ -2804,6 +2823,8 @@ static void rb_commit(struct ring_buffer
+ static __always_inline void
+ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ {
++ bool pagebusy;
++
+ if (buffer->irq_work.waiters_pending) {
+ buffer->irq_work.waiters_pending = false;
+ /* irq_work_queue() supplies it's own memory barriers */
+@@ -2815,6 +2836,15 @@ rb_wakeups(struct ring_buffer *buffer, s
+ /* irq_work_queue() supplies it's own memory barriers */
+ irq_work_queue(&cpu_buffer->irq_work.work);
+ }
++
++ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
++
++ if (!pagebusy && cpu_buffer->irq_work.full_waiters_pending) {
++ cpu_buffer->irq_work.wakeup_full = true;
++ cpu_buffer->irq_work.full_waiters_pending = false;
++ /* irq_work_queue() supplies it's own memory barriers */
++ irq_work_queue(&cpu_buffer->irq_work.work);
++ }
+ }
+
+ /**
--- /dev/null
+From aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 20 Jan 2015 11:01:20 -0600
+Subject: rtlwifi: Remove logging statement that is no longer needed
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit aeb2d2a4c0ae1739a6e1782bd8c1c96aee8db4e1 upstream.
+
+In commit e9538cf4f907 ("rtlwifi: Fix error when accessing unmapped memory
+in skb"), a printk was included to indicate that the condition had been
+reached. There is now enough evidence from other users that the fix is
+working. That logging statement can now be removed.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/pci.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -816,11 +816,8 @@ static void _rtl_pci_rx_interrupt(struct
+
+ /* get a new skb - if fail, old one will be reused */
+ new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+- if (unlikely(!new_skb)) {
+- pr_err("Allocation of new skb failed in %s\n",
+- __func__);
++ if (unlikely(!new_skb))
+ goto no_new;
+- }
+ if (rtlpriv->use_new_trx_flow) {
+ buffer_desc =
+ &rtlpci->rx_ring[rxring_idx].buffer_desc
--- /dev/null
+From b661a5da57766f4f565d64238b753d6efc0f5499 Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:22 -0600
+Subject: rtlwifi: rtl8192ee: Fix adhoc fail
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit b661a5da57766f4f565d64238b753d6efc0f5499 upstream.
+
+When the buffer descriptor index exceeds 2, then a TX HANG condition
+will result.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/fw.c | 6 +-----
+ drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 26 --------------------------
+ 2 files changed, 1 insertion(+), 31 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
+ struct sk_buff *skb = NULL;
+
+ u32 totalpacketlen;
+- bool rtstatus;
+ u8 u1rsvdpageloc[5] = { 0 };
+ bool b_dlok = false;
+
+@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
+ memcpy((u8 *)skb_put(skb, totalpacketlen),
+ &reserved_page_packet, totalpacketlen);
+
+- rtstatus = rtl_cmd_send_packet(hw, skb);
+-
+- if (rtstatus)
+- b_dlok = true;
++ b_dlok = true;
+
+ if (b_dlok) {
+ RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func
+ _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
+ }
+
+-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+- struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+- unsigned long flags;
+-
+- spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
+- while (skb_queue_len(&ring->queue)) {
+- struct rtl_tx_buffer_desc *entry =
+- &ring->buffer_desc[ring->idx];
+- struct sk_buff *skb = __skb_dequeue(&ring->queue);
+-
+- pci_unmap_single(rtlpci->pdev,
+- rtlpriv->cfg->ops->get_desc(
+- (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+- skb->len, PCI_DMA_TODEVICE);
+- kfree_skb(skb);
+- ring->idx = (ring->idx + 1) % ring->entries;
+- }
+- spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+-}
+-
+ static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
+ {
+ _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
+@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page(
+ rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
+ bcnvalid_reg | BIT(0));
+
+- /* Return Beacon TCB */
+- _rtl92ee_return_beacon_queue_skb(hw);
+-
+ /* download rsvd page */
+ rtl92ee_set_fw_rsvdpagepkt(hw, false);
+
--- /dev/null
+From 21b39ddb5bb2294fe64fbd29045591fe0707825f Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:26 -0600
+Subject: rtlwifi: rtl8192ee: Fix DMA stalls
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 21b39ddb5bb2294fe64fbd29045591fe0707825f upstream.
+
+There are instances where the DMA engine stalls. The new code detects
+such stalls and restarts DMA without needing a power reset.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 140 +++++++++++++++++++++++++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/reg.h | 2
+ 2 files changed, 142 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -1137,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(s
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
+ }
+
++static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
++{
++ u8 tmp;
++
++ /* write reg 0x350 Bit[26]=1. Enable debug port. */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if (!(tmp & BIT(2))) {
++ rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
++ tmp | BIT(2));
++ mdelay(100); /* Suggested by DD Justin_tsai. */
++ }
++
++ /* read reg 0x350 Bit[25] if 1 : RX hang
++ * read reg 0x350 Bit[24] if 1 : TX hang
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
++ if ((tmp & BIT(0)) || (tmp & BIT(1))) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "CheckPcieDMAHang8192EE(): true!!\n");
++ return true;
++ }
++ return false;
++}
++
++static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
++ bool mac_power_on)
++{
++ u8 tmp;
++ bool release_mac_rx_pause;
++ u8 backup_pcie_dma_pause;
++
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
++ "ResetPcieInterfaceDMA8192EE()\n");
++
++ /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
++ * released by SD1 Alan.
++ */
++
++ /* 1. disable register write lock
++ * write 0x1C bit[1:0] = 2'h0
++ * write 0xCC bit[2] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
++ tmp &= ~(BIT(1) | BIT(0));
++ rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp |= BIT(2);
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++
++ /* 2. Check and pause TRX DMA
++ * write 0x284 bit[18] = 1'b1
++ * write 0x301 = 0xFF
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ if (tmp & BIT(2)) {
++ /* Already pause before the function for another reason. */
++ release_mac_rx_pause = false;
++ } else {
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
++ release_mac_rx_pause = true;
++ }
++
++ backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
++ if (backup_pcie_dma_pause != 0xFF)
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
++
++ if (mac_power_on) {
++ /* 3. reset TRX function
++ * write 0x100 = 0x00
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0);
++ }
++
++ /* 4. Reset PCIe DMA
++ * write 0x003 bit[0] = 0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp &= ~(BIT(0));
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ /* 5. Enable PCIe DMA
++ * write 0x003 bit[0] = 1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
++ tmp |= BIT(0);
++ rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
++
++ if (mac_power_on) {
++ /* 6. enable TRX function
++ * write 0x100 = 0xFF
++ */
++ rtl_write_byte(rtlpriv, REG_CR, 0xFF);
++
++ /* We should init LLT & RQPN and
++ * prepare Tx/Rx descrptor address later
++ * because MAC function is reset.
++ */
++ }
++
++ /* 7. Restore PCIe autoload down bit
++ * write 0xF8 bit[17] = 1'b1
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
++ tmp |= BIT(1);
++ rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
++
++ /* In MAC power on state, BB and RF maybe in ON state,
++ * if we release TRx DMA here
++ * it will cause packets to be started to Tx/Rx,
++ * so we release Tx/Rx DMA later.
++ */
++ if (!mac_power_on) {
++ /* 8. release TRX DMA
++ * write 0x284 bit[18] = 1'b0
++ * write 0x301 = 0x00
++ */
++ if (release_mac_rx_pause) {
++ tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
++ rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
++ (tmp & (~BIT(2))));
++ }
++ rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
++ backup_pcie_dma_pause);
++ }
++
++ /* 9. lock system register
++ * write 0xCC bit[2] = 1'b0
++ */
++ tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
++ tmp &= ~(BIT(2));
++ rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
++}
++
+ int rtl92ee_hw_init(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -1162,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw
+ rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
+ }
+
++ if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
++ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
++ _rtl8192ee_reset_pcie_interface_dma(rtlpriv,
++ rtlhal->mac_func_enable);
++ rtlhal->mac_func_enable = false;
++ }
++
+ rtstatus = _rtl92ee_init_mac(hw);
+
+ rtl_write_byte(rtlpriv, 0x577, 0x03);
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+@@ -77,9 +77,11 @@
+ #define REG_HIMRE 0x00B8
+ #define REG_HISRE 0x00BC
+
++#define REG_PMC_DBG_CTRL2 0x00CC
+ #define REG_EFUSE_ACCESS 0x00CF
+ #define REG_HPON_FSM 0x00EC
+ #define REG_SYS_CFG1 0x00F0
++#define REG_MAC_PHY_CTRL_NORMAL 0x00F8
+ #define REG_SYS_CFG2 0x00FC
+
+ #define REG_CR 0x0100
--- /dev/null
+From 92ff754240b892cbc16dee5aa080322f3db88b68 Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:24 -0600
+Subject: rtlwifi: rtl8192ee: Fix parsing of received packet
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 92ff754240b892cbc16dee5aa080322f3db88b68 upstream.
+
+The firmware supplies two kinds of packets via the RX mechanism. Besides the
+normal data received over the air, these packets may contain bluetooth status
+and other information. The present code fails to detect which kind of
+information was received.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 4 ++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.h | 2 ++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -512,6 +512,10 @@ bool rtl92ee_rx_query_desc(struct ieee80
+ struct ieee80211_hdr *hdr;
+ u32 phystatus = GET_RX_DESC_PHYST(pdesc);
+
++ if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
++ status->packet_report_type = NORMAL_RX;
++ else
++ status->packet_report_type = C2H_PACKET;
+ status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
+ status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
+ RX_DRV_INFO_SIZE_UNIT;
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+@@ -542,6 +542,8 @@
+ LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
+ #define GET_RX_DESC_RX_IS_QOS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
++#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc) \
++ LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
+
+ #define GET_RX_DESC_RXMCS(__pdesc) \
+ LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
--- /dev/null
+From 6d4beca3775222884e1ee9d48ef586c438c3dfa1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 3 Feb 2015 11:15:18 -0600
+Subject: rtlwifi: rtl8192ee: Fix problems with calculating free space in FIFO
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 6d4beca3775222884e1ee9d48ef586c438c3dfa1 upstream.
+
+This driver utilizes a FIFO buffer for RX descriptors. There are four places
+in the code where it calculates the number of free slots. Several of those
+locations do the calculation incorrectly. To fix these and to prevent future
+mistakes, a common inline routine is created.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/pci.h | 7 +++++++
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 9 +--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/pci.h
++++ b/drivers/net/wireless/rtlwifi/pci.h
+@@ -325,4 +325,11 @@ static inline void pci_write32_async(str
+ writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
+ }
+
++static inline u16 calc_fifo_space(u16 rp, u16 wp)
++{
++ if (rp <= wp)
++ return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
++ return rp - wp - 1;
++}
++
+ #endif
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -658,14 +658,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(st
+ if (!start_rx)
+ return 0;
+
+- if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
+- (read_point <= (RX_DESC_NUM_92E / 2))) {
+- remind_cnt = RX_DESC_NUM_92E - write_point;
+- } else {
+- remind_cnt = (read_point >= write_point) ?
+- (read_point - write_point) :
+- (RX_DESC_NUM_92E - write_point + read_point);
+- }
++ remind_cnt = calc_fifo_space(read_point, write_point);
+
+ if (remind_cnt == 0)
+ return 0;
--- /dev/null
+From 6e5f4436162848289f071be38ee6b87dc8ea653d Mon Sep 17 00:00:00 2001
+From: Troy Tan <troy_tan@realsil.com.cn>
+Date: Tue, 20 Jan 2015 11:01:23 -0600
+Subject: rtlwifi: rtl8192ee: Fix TX hang due to failure to update TX write point
+
+From: Troy Tan <troy_tan@realsil.com.cn>
+
+commit 6e5f4436162848289f071be38ee6b87dc8ea653d upstream.
+
+Initially, the routine to update the write point in the FIFO buffer was
+coded to save CPU time by not doing the calculation every interrupt. This
+was an error and results in TX hangs.
+
+Signed-off-by: Troy Tan <troy_tan@realsil.com.cn>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ee/trx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -1207,8 +1207,7 @@ bool rtl92ee_is_tx_desc_closed(struct ie
+ static u8 stop_report_cnt;
+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+
+- /*checking Read/Write Point each interrupt wastes CPU */
+- if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
++ {
+ u16 point_diff = 0;
+ u16 cur_tx_rp, cur_tx_wp;
+ u32 tmpu32 = 0;
--- /dev/null
+From 5f1437f61a0b351d25b528c159360da3d5e8c77b Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Sat, 10 Jan 2015 01:08:59 +0100
+Subject: serial: fsl_lpuart: avoid new transfer while DMA is running
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 5f1437f61a0b351d25b528c159360da3d5e8c77b upstream.
+
+When the UART is in DMA receive mode (RDMAS set) and one character
+just arrived while another interrupt is handled (e.g. TX), the RDRF
+(receiver data register full flag) is set due to the water level of
+1. But since the DMA will take care of this character, there is no
+need to handle it by calling lpuart_prepare_rx. Handling it leads to
+adding the RX timeout timer twice:
+
+[ 74.336698] Kernel BUG at 80053070 [verbose debug info unavailable]
+[ 74.342999] Internal error: Oops - BUG: 0 [#1] ARM0:00.00 khungtaskd
+[ 74.347817] Modules linked in: 0 S 0.0 0.0 0:00.00 writeback
+[ 74.350926] CPU: 0 PID: 0 Comm: swapper Not tainted 3.19.0-rc3-00001-g39d78e2 #1788
+[ 74.358617] Hardware name: Freescale Vybrid VF610 (Device Tree)t
+[ 74.364563] task: 807a7678 ti: 8079c000 task.ti: 8079c000 kblockd
+[ 74.370002] PC is at add_timer+0x24/0x28.0 0.0 0:00.09 kworker/u2:1
+[ 74.373960] LR is at lpuart_int+0x15c/0x3d8
+[ 74.378171] pc : [<80053070>] lr : [<802e0d88>] psr: a0010193
+[ 74.378171] sp : 8079de10 ip : 8079de20 fp : 8079de1c
+[ 74.389694] r10: 807d44c0 r9 : 8688c300 r8 : 00000013
+[ 74.394943] r7 : 20010193 r6 : 00000000 r5 : 000000a0 r4 : 86997210
+[ 74.401498] r3 : ffffa7da r2 : 80817868 r1 : 86997210 r0 : 86997344
+[ 74.408052] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
+[ 74.415489] Control: 10c5387d Table: 8611c059 DAC: 00000015
+[ 74.421265] Process swapper (pid: 0, stack limit = 0x8079c230)
+...
+
+Solve this by only execute the receiver path (lpuart_prepare_rx) if
+the DMA receive mode (RDMAS) is not set. Also, make sure the flag is
+cleared on initialization, in case it has been left set.
+
+This can be best reproduced using UART as a serial console, then
+running top while dd'ing data into the terminal.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -755,18 +755,18 @@ out:
+ static irqreturn_t lpuart_int(int irq, void *dev_id)
+ {
+ struct lpuart_port *sport = dev_id;
+- unsigned char sts;
++ unsigned char sts, crdma;
+
+ sts = readb(sport->port.membase + UARTSR1);
++ crdma = readb(sport->port.membase + UARTCR5);
+
+- if (sts & UARTSR1_RDRF) {
++ if (sts & UARTSR1_RDRF && !(crdma & UARTCR5_RDMAS)) {
+ if (sport->lpuart_dma_use)
+ lpuart_prepare_rx(sport);
+ else
+ lpuart_rxint(irq, dev_id);
+ }
+- if (sts & UARTSR1_TDRE &&
+- !(readb(sport->port.membase + UARTCR5) & UARTCR5_TDMAS)) {
++ if (sts & UARTSR1_TDRE && !(crdma & UARTCR5_TDMAS)) {
+ if (sport->lpuart_dma_use)
+ lpuart_pio_tx(sport);
+ else
+@@ -1106,6 +1106,7 @@ static int lpuart_startup(struct uart_po
+ setup_timer(&sport->lpuart_timer, lpuart_timer_func,
+ (unsigned long)sport);
+ temp = readb(port->membase + UARTCR5);
++ temp &= ~UARTCR5_RDMAS;
+ writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5);
+ }
+
--- /dev/null
+From 4a8588a1cf867333187d9ff071e6fbdab587d194 Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Sat, 10 Jan 2015 01:08:58 +0100
+Subject: serial: fsl_lpuart: delete timer on shutdown
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 4a8588a1cf867333187d9ff071e6fbdab587d194 upstream.
+
+If the serial port gets closed while a RX transfer is in progress,
+the timer might fire after the serial port shutdown finished. This
+leads in a NULL pointer dereference:
+
+[ 7.508324] Unable to handle kernel NULL pointer dereference at virtual address 00000000
+[ 7.516590] pgd = 86348000
+[ 7.519445] [00000000] *pgd=86179831, *pte=00000000, *ppte=00000000
+[ 7.526145] Internal error: Oops: 17 [#1] ARM
+[ 7.530611] Modules linked in:
+[ 7.533876] CPU: 0 PID: 123 Comm: systemd Not tainted 3.19.0-rc3-00004-g5b11ea7 #1778
+[ 7.541827] Hardware name: Freescale Vybrid VF610 (Device Tree)
+[ 7.547862] task: 861c3400 ti: 86ac8000 task.ti: 86ac8000
+[ 7.553392] PC is at lpuart_timer_func+0x24/0xf8
+[ 7.558127] LR is at lpuart_timer_func+0x20/0xf8
+[ 7.562857] pc : [<802df99c>] lr : [<802df998>] psr: 600b0113
+[ 7.562857] sp : 86ac9b90 ip : 86ac9b90 fp : 86ac9bbc
+[ 7.574467] r10: 80817180 r9 : 80817b98 r8 : 80817998
+[ 7.579803] r7 : 807acee0 r6 : 86989000 r5 : 00000100 r4 : 86997210
+[ 7.586444] r3 : 86ac8000 r2 : 86ac9bc0 r1 : 86997210 r0 : 00000000
+[ 7.593085] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 7.600341] Control: 10c5387d Table: 86348059 DAC: 00000015
+[ 7.606203] Process systemd (pid: 123, stack limit = 0x86ac8230)
+
+Setup the timer on UART startup which allows to delete the timer
+unconditionally on shutdown. This also saves the initialization
+on each transfer.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -506,9 +506,6 @@ static inline void lpuart_prepare_rx(str
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+- init_timer(&sport->lpuart_timer);
+- sport->lpuart_timer.function = lpuart_timer_func;
+- sport->lpuart_timer.data = (unsigned long)sport;
+ sport->lpuart_timer.expires = jiffies + sport->dma_rx_timeout;
+ add_timer(&sport->lpuart_timer);
+
+@@ -1106,6 +1103,8 @@ static int lpuart_startup(struct uart_po
+ sport->lpuart_dma_use = false;
+ } else {
+ sport->lpuart_dma_use = true;
++ setup_timer(&sport->lpuart_timer, lpuart_timer_func,
++ (unsigned long)sport);
+ temp = readb(port->membase + UARTCR5);
+ writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5);
+ }
+@@ -1180,6 +1179,8 @@ static void lpuart_shutdown(struct uart_
+ devm_free_irq(port->dev, port->irq, sport);
+
+ if (sport->lpuart_dma_use) {
++ del_timer_sync(&sport->lpuart_timer);
++
+ lpuart_dma_tx_free(port);
+ lpuart_dma_rx_free(port);
+ }
--- /dev/null
+bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch
+bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch
+bluetooth-fix-valid-identity-address-check.patch
+bluetooth-btusb-add-broadcom-patchram-support-for-asustek-devices.patch
+bluetooth-btusb-add-support-for-dynex-insignia-usb-dongles.patch
+bluetooth-btusb-add-support-for-lite-on-04ca-broadcom-based-bcm43142.patch
+random-fix-fast_mix-function.patch
+xfs-ensure-buffer-types-are-set-correctly.patch
+xfs-inode-unlink-does-not-set-agi-buffer-type.patch
+xfs-set-buf-types-when-converting-extent-formats.patch
+xfs-set-superblock-buffer-type-correctly.patch
+fsnotify-fix-handling-of-renames-in-audit.patch
+iwlwifi-pcie-disable-the-scd_base_addr-when-we-resume-from-wowlan.patch
+iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch
+iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch
+iwlwifi-mvm-always-use-mac-color-zero.patch
+hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch
+pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch
+pci-fix-infinite-loop-with-rom-image-of-size-0.patch
+asoc-rt5670-set-use_single_rw-flag-for-regmap.patch
+asoc-mioa701_wm9713-fix-speaker-event.patch
+asoc-davinci-fix-dm365_evm-codec-selection.patch
+rtlwifi-rtl8192ee-fix-adhoc-fail.patch
+rtlwifi-rtl8192ee-fix-tx-hang-due-to-failure-to-update-tx-write-point.patch
+rtlwifi-rtl8192ee-fix-parsing-of-received-packet.patch
+rtlwifi-rtl8192ee-fix-dma-stalls.patch
+rtlwifi-rtl8192ee-fix-problems-with-calculating-free-space-in-fifo.patch
+rtlwifi-remove-logging-statement-that-is-no-longer-needed.patch
+cpufreq-set-cpufreq_cpu_data-to-null-before-putting-kobject.patch
+cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch
+cpufreq-s3c-remove-incorrect-__init-annotations.patch
+cpufreq-s3c-remove-last-use-of-resume_clocks-callback.patch
+xen-manage-fix-usb-interaction-issues-when-resuming.patch
+xen-scsiback-mark-pvscsi-frontend-request-consumed-only-after-last-read.patch
+acpi-lpss-always-disable-i2c-host-controllers.patch
+acpi-lpss-deassert-resets-for-spi-host-controllers-on-braswell.patch
+lmedm04-increase-interupt-due-time-to-200-msec.patch
+lmedm04-fix-usb_submit_urb-bogus-urb-xfer-pipe-1-type-3-in-interrupt-urb.patch
+si2168-define-symbol-rate-limits.patch
+alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch
+alsa-hda-set-up-gpio-for-toshiba-satellite-s50d.patch
+alsa-hda-enable-mute-led-quirk-for-one-more-hp-machine.patch
+alsa-hdspm-constrain-periods-to-2-on-older-cards.patch
+power_supply-88pm860x-fix-leaked-power-supply-on-probe-fail.patch
+power-bq24190-fix-ignored-supplicants.patch
+power-gpio-charger-balance-enable-disable_irq_wake-calls.patch
+megaraid_sas-endianness-related-bug-fixes-and-code-optimization.patch
+megaraid_sas-fix-the-problem-of-non-existing-vd-exposed-to-host.patch
+megaraid_sas-disable-interrupt_mask-before-enabling-hardware-interrupts.patch
+rc-main-re-apply-filter-for-no-op-protocol-change.patch
+timberdale-do-not-select-timb_dma.patch
+em28xx-ensure-closing-messages-terminate-with-a-newline.patch
+em28xx-input-fix-missing-newlines.patch
+em28xx-audio-fix-missing-newlines.patch
+em28xx-core-fix-missing-newlines.patch
+em28xx-video-fix-missing-newlines.patch
+em28xx-dvb-fix-missing-newlines.patch
+em28xx-audio-fix-missing-newlines-again.patch
+mmc-sdhci-pxav3-fix-unbalanced-clock-issues-during-probe.patch
+mmc-sdhci-pxav3-fix-setting-of-pdata-clk_delay_cycles.patch
+mmc-sdhci-pxav3-fix-sdr50-and-ddr50-capabilities-for-the-armada-38x-flavor.patch
+mmc-sdhci-pxav3-fix-armada-38x-controller-s-caps-according-to-erratum-err-7878951.patch
+proc-pagemap-walk-page-tables-under-pte-lock.patch
+nfs-don-t-call-blocking-operations-while-task_running.patch
+nfs-struct-nfs_commit_info.lock-must-always-point-to-inode-i_lock.patch
+kvm-mips-disable-htw-while-in-guest.patch
+kvm-mips-don-t-leak-fpu-dsp-to-guest.patch
+mips-alchemy-fix-cpu-clock-calculation.patch
+mips-kernel-cps-vec-replace-addi-with-addiu.patch
+mips-asm-asmmacro-replace-add-instructions-with-addu.patch
+mips-asm-pgtable-add-c0-hazards-on-htw-start-stop-sequences.patch
+mips-asm-pgtable-prevent-htw-race-when-updating-ptes.patch
+mips-export-fp-functions-used-by-lose_fpu-1-for-kvm.patch
+mips-export-msa-functions-used-by-lose_fpu-1-for-kvm.patch
+mm-hugetlb-pmd_huge-returns-true-for-non-present-hugepage.patch
+tracing-fix-unmapping-loop-in-tracing_mark_write.patch
+blk-mq-fix-double-free-in-error-path.patch
+arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch
+arm-dra7-hwmod-fix-boot-crash-with-debug_ll-enabled-on-uart3.patch
+arm-dts-tegra20-fix-gr3d-dsi-unit-and-reg-base-addresses.patch
+arm-dts-am335x-bone-usb0-is-hardwired-for-peripheral.patch
+arm-dts-bcm63xx-fix-l2-cache-properties.patch
+tpm_tis-verify-interrupt-during-init.patch
+tpm-add-new-tpms-to-the-tail-of-the-list-to-prevent-inadvertent-change-of-dev.patch
+char-tpm-add-missing-error-check-for-devm_kzalloc.patch
+tpm-fix-null-return-in-tpm_ibmvtpm_get_desired_dma.patch
+tpm-tpm_i2c_stm_st33-fix-potential-bug-in-tpm_stm_i2c_send.patch
+added-little-endian-support-to-vtpm-module.patch
+nfs41-.init_read-and-.init_write-can-be-called-with-valid-pg_lseg.patch
+sunrpc-null-utsname-dereference-on-nfs-umount-during-namespace-cleanup.patch
+nfsv4-ensure-we-reference-the-inode-for-return-on-close-in-delegreturn.patch
+nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch
+sg-fix-unkillable-i-o-wait-deadlock-with-scsi-mq.patch
+sg-fix-ewouldblock-errors-with-scsi-mq.patch
+iscsi-target-drop-problematic-active_ts_list-usage.patch
+cfq-iosched-handle-failure-of-cfq-group-allocation.patch
+cfq-iosched-fix-incorrect-filing-of-rt-async-cfqq.patch
+cipso-don-t-use-ipcb-to-locate-the-cipso-ip-option.patch
+ring-buffer-do-not-wake-up-a-splice-waiter-when-page-is-not-full.patch
+smack-fix-possible-use-after-frees-in-task_security-callers.patch
+axonram-fix-bug-in-direct_access.patch
+tty-prevent-untrappable-signals-from-malicious-program.patch
+tty-serial-at91-fix-error-handling-in-atmel_serial_probe.patch
+mei-mask-interrupt-set-bit-on-clean-reset-bit.patch
+mei-me-release-hw-from-reset-only-during-the-reset-flow.patch
+usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch
+usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch
+usb-musb-add-omap-control-dependency.patch
+usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch
+usb-don-t-cancel-queued-resets-when-unbinding-drivers.patch
+usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch
+vt-provide-notifications-on-selection-changes.patch
+arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch
+arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch
+arm-vexpress-use-arm_cpu_suspend-if-needed.patch
+arm-mvebu-build-armada375-smp-code-conditionally.patch
+kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch
+ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch
+serial-fsl_lpuart-delete-timer-on-shutdown.patch
+serial-fsl_lpuart-avoid-new-transfer-while-dma-is-running.patch
+arc-fix-page-address-calculation-if-page_offset-linux_link_base.patch
--- /dev/null
+From 7772855a996ec6e16944b120ab5ce21050279821 Mon Sep 17 00:00:00 2001
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Fri, 13 Feb 2015 12:10:58 -0500
+Subject: sg: fix EWOULDBLOCK errors with scsi-mq
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+commit 7772855a996ec6e16944b120ab5ce21050279821 upstream.
+
+With scsi-mq enabled, userspace programs can get unexpected EWOULDBLOCK
+(a.k.a. EAGAIN) errors when submitting commands to the SCSI generic
+driver. Fix by calling blk_get_request() with GFP_KERNEL instead of
+GFP_ATOMIC.
+
+Note: to avoid introducing a potential deadlock, this patch should be
+applied after the patch titled "sg: fix unkillable I/O wait deadlock
+with scsi-mq".
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Tested-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1721,7 +1721,22 @@ sg_start_req(Sg_request *srp, unsigned c
+ return -ENOMEM;
+ }
+
+- rq = blk_get_request(q, rw, GFP_ATOMIC);
++ /*
++ * NOTE
++ *
++ * With scsi-mq enabled, there are a fixed number of preallocated
++ * requests equal in number to shost->can_queue. If all of the
++ * preallocated requests are already in use, then using GFP_ATOMIC with
++ * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
++ * will cause blk_get_request() to sleep until an active command
++ * completes, freeing up a request. Neither option is ideal, but
++ * GFP_KERNEL is the better choice to prevent userspace from getting an
++ * unexpected EWOULDBLOCK.
++ *
++ * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
++ * does not sleep except under memory pressure.
++ */
++ rq = blk_get_request(q, rw, GFP_KERNEL);
+ if (IS_ERR(rq)) {
+ kfree(long_cmdp);
+ return PTR_ERR(rq);
--- /dev/null
+From 7568615c1054907ea8c7701ab86dad51aa099888 Mon Sep 17 00:00:00 2001
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Fri, 13 Feb 2015 12:09:44 -0500
+Subject: sg: fix unkillable I/O wait deadlock with scsi-mq
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+commit 7568615c1054907ea8c7701ab86dad51aa099888 upstream.
+
+When using the write()/read() interface for submitting commands, the
+SCSI generic driver does not call blk_put_request() on a completed SCSI
+command until userspace calls read() to get the command completion.
+Since scsi-mq uses a fixed number of preallocated requests, this makes
+it possible for userspace to exhaust the entire preallocated supply of
+requests. For places in the kernel that call blk_get_request() with
+GFP_KERNEL, this can cause the calling process to deadlock in a
+permanent unkillable I/O wait in blk_get_request() -> ... -> bt_get().
+For places in the kernel that call blk_get_request() with GFP_ATOMIC,
+this can cause blk_get_request() always to return -EWOULDBLOCK. Note
+that these problems happen only if scsi-mq is enabled. Prevent the
+problems by calling blk_put_request() as soon as the SCSI command
+completes instead of waiting for userspace to call read().
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Tested-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1376,6 +1376,17 @@ sg_rq_end_io(struct request *rq, int upt
+ }
+ /* Rely on write phase to clean out srp status values, so no "else" */
+
++ /*
++ * Free the request as soon as it is complete so that its resources
++ * can be reused without waiting for userspace to read() the
++ * result. But keep the associated bio (if any) around until
++ * blk_rq_unmap_user() can be called from user context.
++ */
++ srp->rq = NULL;
++ if (rq->cmd != rq->__cmd)
++ kfree(rq->cmd);
++ __blk_put_request(rq->q, rq);
++
+ write_lock_irqsave(&sfp->rq_list_lock, iflags);
+ if (unlikely(srp->orphan)) {
+ if (sfp->keep_orphan)
+@@ -1803,10 +1814,10 @@ sg_finish_rem_req(Sg_request *srp)
+ SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
+ "sg_finish_rem_req: res_used=%d\n",
+ (int) srp->res_used));
+- if (srp->rq) {
+- if (srp->bio)
+- ret = blk_rq_unmap_user(srp->bio);
++ if (srp->bio)
++ ret = blk_rq_unmap_user(srp->bio);
+
++ if (srp->rq) {
+ if (srp->rq->cmd != srp->rq->__cmd)
+ kfree(srp->rq->cmd);
+ blk_put_request(srp->rq);
--- /dev/null
+From f1ecc5d119530fce01094307e029ed7f2c9067d8 Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Tue, 25 Nov 2014 16:26:49 -0300
+Subject: [media] si2168: define symbol rate limits
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit f1ecc5d119530fce01094307e029ed7f2c9067d8 upstream.
+
+w_scan complains about missing symbol rate limits:
+This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org
+
+Chip supports 1 to 7.2 MSymbol/s on DVB-C.
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/si2168.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/dvb-frontends/si2168.c
++++ b/drivers/media/dvb-frontends/si2168.c
+@@ -605,6 +605,8 @@ static const struct dvb_frontend_ops si2
+ .delsys = {SYS_DVBT, SYS_DVBT2, SYS_DVBC_ANNEX_A},
+ .info = {
+ .name = "Silicon Labs Si2168",
++ .symbol_rate_min = 1000000,
++ .symbol_rate_max = 7200000,
+ .caps = FE_CAN_FEC_1_2 |
+ FE_CAN_FEC_2_3 |
+ FE_CAN_FEC_3_4 |
--- /dev/null
+From 6d1cff2a885850b78b40c34777b46cf5da5d1050 Mon Sep 17 00:00:00 2001
+From: Andrey Ryabinin <a.ryabinin@samsung.com>
+Date: Tue, 13 Jan 2015 18:52:40 +0300
+Subject: smack: fix possible use after frees in task_security() callers
+
+From: Andrey Ryabinin <a.ryabinin@samsung.com>
+
+commit 6d1cff2a885850b78b40c34777b46cf5da5d1050 upstream.
+
+We hit use after free on dereferncing pointer to task_smack struct in
+smk_of_task() called from smack_task_to_inode().
+
+task_security() macro uses task_cred_xxx() to get pointer to the task_smack.
+task_cred_xxx() could be used only for non-pointer members of task's
+credentials. It cannot be used for pointer members since what they point
+to may disapper after dropping RCU read lock.
+
+Mainly task_security() used this way:
+ smk_of_task(task_security(p))
+
+Intead of this introduce function smk_of_task_struct() which
+takes task_struct as argument and returns pointer to smk_known struct
+and do this under RCU read lock.
+Bogus task_security() macro is not used anymore, so remove it.
+
+KASan's report for this:
+
+ AddressSanitizer: use after free in smack_task_to_inode+0x50/0x70 at addr c4635600
+ =============================================================================
+ BUG kmalloc-64 (Tainted: PO): kasan error
+ -----------------------------------------------------------------------------
+
+ Disabling lock debugging due to kernel taint
+ INFO: Allocated in new_task_smack+0x44/0xd8 age=39 cpu=0 pid=1866
+ kmem_cache_alloc_trace+0x88/0x1bc
+ new_task_smack+0x44/0xd8
+ smack_cred_prepare+0x48/0x21c
+ security_prepare_creds+0x44/0x4c
+ prepare_creds+0xdc/0x110
+ smack_setprocattr+0x104/0x150
+ security_setprocattr+0x4c/0x54
+ proc_pid_attr_write+0x12c/0x194
+ vfs_write+0x1b0/0x370
+ SyS_write+0x5c/0x94
+ ret_fast_syscall+0x0/0x48
+ INFO: Freed in smack_cred_free+0xc4/0xd0 age=27 cpu=0 pid=1564
+ kfree+0x270/0x290
+ smack_cred_free+0xc4/0xd0
+ security_cred_free+0x34/0x3c
+ put_cred_rcu+0x58/0xcc
+ rcu_process_callbacks+0x738/0x998
+ __do_softirq+0x264/0x4cc
+ do_softirq+0x94/0xf4
+ irq_exit+0xbc/0x120
+ handle_IRQ+0x104/0x134
+ gic_handle_irq+0x70/0xac
+ __irq_svc+0x44/0x78
+ _raw_spin_unlock+0x18/0x48
+ sync_inodes_sb+0x17c/0x1d8
+ sync_filesystem+0xac/0xfc
+ vdfs_file_fsync+0x90/0xc0
+ vfs_fsync_range+0x74/0x7c
+ INFO: Slab 0xd3b23f50 objects=32 used=31 fp=0xc4635600 flags=0x4080
+ INFO: Object 0xc4635600 @offset=5632 fp=0x (null)
+
+ Bytes b4 c46355f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
+ Object c4635600: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ Object c4635610: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ Object c4635620: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ Object c4635630: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
+ Redzone c4635640: bb bb bb bb ....
+ Padding c46356e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
+ Padding c46356f8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
+ CPU: 5 PID: 834 Comm: launchpad_prelo Tainted: PBO 3.10.30 #1
+ Backtrace:
+ [<c00233a4>] (dump_backtrace+0x0/0x158) from [<c0023dec>] (show_stack+0x20/0x24)
+ r7:c4634010 r6:d3b23f50 r5:c4635600 r4:d1002140
+ [<c0023dcc>] (show_stack+0x0/0x24) from [<c06d6d7c>] (dump_stack+0x20/0x28)
+ [<c06d6d5c>] (dump_stack+0x0/0x28) from [<c01c1d50>] (print_trailer+0x124/0x144)
+ [<c01c1c2c>] (print_trailer+0x0/0x144) from [<c01c1e88>] (object_err+0x3c/0x44)
+ r7:c4635600 r6:d1002140 r5:d3b23f50 r4:c4635600
+ [<c01c1e4c>] (object_err+0x0/0x44) from [<c01cac18>] (kasan_report_error+0x2b8/0x538)
+ r6:d1002140 r5:d3b23f50 r4:c6429cf8 r3:c09e1aa7
+ [<c01ca960>] (kasan_report_error+0x0/0x538) from [<c01c9430>] (__asan_load4+0xd4/0xf8)
+ [<c01c935c>] (__asan_load4+0x0/0xf8) from [<c031e168>] (smack_task_to_inode+0x50/0x70)
+ r5:c4635600 r4:ca9da000
+ [<c031e118>] (smack_task_to_inode+0x0/0x70) from [<c031af64>] (security_task_to_inode+0x3c/0x44)
+ r5:cca25e80 r4:c0ba9780
+ [<c031af28>] (security_task_to_inode+0x0/0x44) from [<c023d614>] (pid_revalidate+0x124/0x178)
+ r6:00000000 r5:cca25e80 r4:cbabe3c0 r3:00008124
+ [<c023d4f0>] (pid_revalidate+0x0/0x178) from [<c01db98c>] (lookup_fast+0x35c/0x43y4)
+ r9:c6429efc r8:00000101 r7:c079d940 r6:c6429e90 r5:c6429ed8 r4:c83c4148
+ [<c01db630>] (lookup_fast+0x0/0x434) from [<c01deec8>] (do_last.isra.24+0x1c0/0x1108)
+ [<c01ded08>] (do_last.isra.24+0x0/0x1108) from [<c01dff04>] (path_openat.isra.25+0xf4/0x648)
+ [<c01dfe10>] (path_openat.isra.25+0x0/0x648) from [<c01e1458>] (do_filp_open+0x3c/0x88)
+ [<c01e141c>] (do_filp_open+0x0/0x88) from [<c01ccb28>] (do_sys_open+0xf0/0x198)
+ r7:00000001 r6:c0ea2180 r5:0000000b r4:00000000
+ [<c01cca38>] (do_sys_open+0x0/0x198) from [<c01ccc00>] (SyS_open+0x30/0x34)
+ [<c01ccbd0>] (SyS_open+0x0/0x34) from [<c001db80>] (ret_fast_syscall+0x0/0x48)
+ Read of size 4 by thread T834:
+ Memory state around the buggy address:
+ c4635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ c4635400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
+ c4635480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ c4635500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
+ c4635580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ >c4635600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ c4635680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ c4635700: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc
+ c4635780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ c4635800: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
+ c4635880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ==================================================================
+
+Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/smack/smack.h | 10 ++++++++++
+ security/smack/smack_lsm.c | 24 +++++++++++++-----------
+ 2 files changed, 23 insertions(+), 11 deletions(-)
+
+--- a/security/smack/smack.h
++++ b/security/smack/smack.h
+@@ -298,6 +298,16 @@ static inline struct smack_known *smk_of
+ return tsp->smk_task;
+ }
+
++static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
++{
++ struct smack_known *skp;
++
++ rcu_read_lock();
++ skp = smk_of_task(__task_cred(t)->security);
++ rcu_read_unlock();
++ return skp;
++}
++
+ /*
+ * Present a pointer to the forked smack label entry in an task blob.
+ */
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -43,8 +43,6 @@
+ #include <linux/binfmts.h>
+ #include "smack.h"
+
+-#define task_security(task) (task_cred_xxx((task), security))
+-
+ #define TRANS_TRUE "TRUE"
+ #define TRANS_TRUE_SIZE 4
+
+@@ -119,7 +117,7 @@ static int smk_bu_current(char *note, st
+ static int smk_bu_task(struct task_struct *otp, int mode, int rc)
+ {
+ struct task_smack *tsp = current_security();
+- struct task_smack *otsp = task_security(otp);
++ struct smack_known *smk_task = smk_of_task_struct(otp);
+ char acc[SMK_NUM_ACCESS_TYPE + 1];
+
+ if (rc <= 0)
+@@ -127,7 +125,7 @@ static int smk_bu_task(struct task_struc
+
+ smk_bu_mode(mode, acc);
+ pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
+- tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
++ tsp->smk_task->smk_known, smk_task->smk_known, acc,
+ current->comm, otp->comm);
+ return 0;
+ }
+@@ -344,7 +342,8 @@ static int smk_ptrace_rule_check(struct
+ saip = &ad;
+ }
+
+- tsp = task_security(tracer);
++ rcu_read_lock();
++ tsp = __task_cred(tracer)->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -364,11 +363,14 @@ static int smk_ptrace_rule_check(struct
+ tracee_known->smk_known,
+ 0, rc, saip);
+
++ rcu_read_unlock();
+ return rc;
+ }
+
+ /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
+ rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
++
++ rcu_read_unlock();
+ return rc;
+ }
+
+@@ -395,7 +397,7 @@ static int smack_ptrace_access_check(str
+ if (rc != 0)
+ return rc;
+
+- skp = smk_of_task(task_security(ctp));
++ skp = smk_of_task_struct(ctp);
+
+ rc = smk_ptrace_rule_check(current, skp, mode, __func__);
+ return rc;
+@@ -1825,7 +1827,7 @@ static int smk_curacc_on_task(struct tas
+ const char *caller)
+ {
+ struct smk_audit_info ad;
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+ int rc;
+
+ smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
+@@ -1878,7 +1880,7 @@ static int smack_task_getsid(struct task
+ */
+ static void smack_task_getsecid(struct task_struct *p, u32 *secid)
+ {
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+
+ *secid = skp->smk_secid;
+ }
+@@ -1985,7 +1987,7 @@ static int smack_task_kill(struct task_s
+ {
+ struct smk_audit_info ad;
+ struct smack_known *skp;
+- struct smack_known *tkp = smk_of_task(task_security(p));
++ struct smack_known *tkp = smk_of_task_struct(p);
+ int rc;
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+@@ -2039,7 +2041,7 @@ static int smack_task_wait(struct task_s
+ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
+ {
+ struct inode_smack *isp = inode->i_security;
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+
+ isp->smk_inode = skp;
+ }
+@@ -3199,7 +3201,7 @@ unlockandout:
+ */
+ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
+ {
+- struct smack_known *skp = smk_of_task(task_security(p));
++ struct smack_known *skp = smk_of_task_struct(p);
+ char *cp;
+ int slen;
+
--- /dev/null
+From 03a9a42a1a7e5b3e7919ddfacc1d1cc81882a955 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 30 Jan 2015 18:12:28 -0500
+Subject: SUNRPC: NULL utsname dereference on NFS umount during namespace cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 03a9a42a1a7e5b3e7919ddfacc1d1cc81882a955 upstream.
+
+Fix an Oopsable condition when nsm_mon_unmon is called as part of the
+namespace cleanup, which now apparently happens after the utsname
+has been freed.
+
+Link: http://lkml.kernel.org/r/20150125220604.090121ae@neptune.home
+Reported-by: Bruno Prémont <bonbons@linux-vserver.org>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/lockd/mon.c | 13 +++++++++----
+ include/linux/sunrpc/clnt.h | 3 ++-
+ net/sunrpc/clnt.c | 12 +++++++-----
+ net/sunrpc/rpcb_clnt.c | 8 ++++++--
+ 4 files changed, 24 insertions(+), 12 deletions(-)
+
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -65,7 +65,7 @@ static inline struct sockaddr *nsm_addr(
+ return (struct sockaddr *)&nsm->sm_addr;
+ }
+
+-static struct rpc_clnt *nsm_create(struct net *net)
++static struct rpc_clnt *nsm_create(struct net *net, const char *nodename)
+ {
+ struct sockaddr_in sin = {
+ .sin_family = AF_INET,
+@@ -77,6 +77,7 @@ static struct rpc_clnt *nsm_create(struc
+ .address = (struct sockaddr *)&sin,
+ .addrsize = sizeof(sin),
+ .servername = "rpc.statd",
++ .nodename = nodename,
+ .program = &nsm_program,
+ .version = NSM_VERSION,
+ .authflavor = RPC_AUTH_NULL,
+@@ -102,7 +103,7 @@ out:
+ return clnt;
+ }
+
+-static struct rpc_clnt *nsm_client_get(struct net *net)
++static struct rpc_clnt *nsm_client_get(struct net *net, const char *nodename)
+ {
+ struct rpc_clnt *clnt, *new;
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
+@@ -111,7 +112,7 @@ static struct rpc_clnt *nsm_client_get(s
+ if (clnt != NULL)
+ goto out;
+
+- clnt = new = nsm_create(net);
++ clnt = new = nsm_create(net, nodename);
+ if (IS_ERR(clnt))
+ goto out;
+
+@@ -190,19 +191,23 @@ int nsm_monitor(const struct nlm_host *h
+ struct nsm_res res;
+ int status;
+ struct rpc_clnt *clnt;
++ const char *nodename = NULL;
+
+ dprintk("lockd: nsm_monitor(%s)\n", nsm->sm_name);
+
+ if (nsm->sm_monitored)
+ return 0;
+
++ if (host->h_rpcclnt)
++ nodename = host->h_rpcclnt->cl_nodename;
++
+ /*
+ * Choose whether to record the caller_name or IP address of
+ * this peer in the local rpc.statd's database.
+ */
+ nsm->sm_mon_name = nsm_use_hostnames ? nsm->sm_name : nsm->sm_addrbuf;
+
+- clnt = nsm_client_get(host->net);
++ clnt = nsm_client_get(host->net, nodename);
+ if (IS_ERR(clnt)) {
+ status = PTR_ERR(clnt);
+ dprintk("lockd: failed to create NSM upcall transport, "
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -57,7 +57,7 @@ struct rpc_clnt {
+ const struct rpc_timeout *cl_timeout; /* Timeout strategy */
+
+ int cl_nodelen; /* nodename length */
+- char cl_nodename[UNX_MAXNODENAME];
++ char cl_nodename[UNX_MAXNODENAME+1];
+ struct rpc_pipe_dir_head cl_pipedir_objects;
+ struct rpc_clnt * cl_parent; /* Points to parent of clones */
+ struct rpc_rtt cl_rtt_default;
+@@ -109,6 +109,7 @@ struct rpc_create_args {
+ struct sockaddr *saddress;
+ const struct rpc_timeout *timeout;
+ const char *servername;
++ const char *nodename;
+ const struct rpc_program *program;
+ u32 prognumber; /* overrides program->number */
+ u32 version;
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -286,10 +286,8 @@ static struct rpc_xprt *rpc_clnt_set_tra
+
+ static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+ {
+- clnt->cl_nodelen = strlen(nodename);
+- if (clnt->cl_nodelen > UNX_MAXNODENAME)
+- clnt->cl_nodelen = UNX_MAXNODENAME;
+- memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
++ clnt->cl_nodelen = strlcpy(clnt->cl_nodename,
++ nodename, sizeof(clnt->cl_nodename));
+ }
+
+ static int rpc_client_register(struct rpc_clnt *clnt,
+@@ -360,6 +358,7 @@ static struct rpc_clnt * rpc_new_client(
+ const struct rpc_version *version;
+ struct rpc_clnt *clnt = NULL;
+ const struct rpc_timeout *timeout;
++ const char *nodename = args->nodename;
+ int err;
+
+ /* sanity check the name before trying to print it */
+@@ -415,8 +414,10 @@ static struct rpc_clnt * rpc_new_client(
+
+ atomic_set(&clnt->cl_count, 1);
+
++ if (nodename == NULL)
++ nodename = utsname()->nodename;
+ /* save the nodename */
+- rpc_clnt_set_nodename(clnt, utsname()->nodename);
++ rpc_clnt_set_nodename(clnt, nodename);
+
+ err = rpc_client_register(clnt, args->authflavor, args->client_name);
+ if (err)
+@@ -571,6 +572,7 @@ static struct rpc_clnt *__rpc_clone_clie
+ if (xprt == NULL)
+ goto out_err;
+ args->servername = xprt->servername;
++ args->nodename = clnt->cl_nodename;
+
+ new = rpc_new_client(args, xprt, clnt);
+ if (IS_ERR(new)) {
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -355,7 +355,8 @@ out:
+ return result;
+ }
+
+-static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
++static struct rpc_clnt *rpcb_create(struct net *net, const char *nodename,
++ const char *hostname,
+ struct sockaddr *srvaddr, size_t salen,
+ int proto, u32 version)
+ {
+@@ -365,6 +366,7 @@ static struct rpc_clnt *rpcb_create(stru
+ .address = srvaddr,
+ .addrsize = salen,
+ .servername = hostname,
++ .nodename = nodename,
+ .program = &rpcb_program,
+ .version = version,
+ .authflavor = RPC_AUTH_UNIX,
+@@ -740,7 +742,9 @@ void rpcb_getport_async(struct rpc_task
+ dprintk("RPC: %5u %s: trying rpcbind version %u\n",
+ task->tk_pid, __func__, bind_version);
+
+- rpcb_clnt = rpcb_create(xprt->xprt_net, xprt->servername, sap, salen,
++ rpcb_clnt = rpcb_create(xprt->xprt_net,
++ clnt->cl_nodename,
++ xprt->servername, sap, salen,
+ xprt->prot, bind_version);
+ if (IS_ERR(rpcb_clnt)) {
+ status = PTR_ERR(rpcb_clnt);
--- /dev/null
+From 244829226f47ffb4d6009a2ccd2771cd149d8114 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 28 Jan 2015 18:17:41 -0300
+Subject: [media] timberdale: do not select TIMB_DMA
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 244829226f47ffb4d6009a2ccd2771cd149d8114 upstream.
+
+The timberdale media driver requires the use of the respective
+dma engine driver, but that may not be enabled, causing a
+Kconfig warning:
+
+warning: (VIDEO_TIMBERDALE) selects TIMB_DMA which has unmet direct dependencies (DMADEVICES && MFD_TIMBERDALE)
+
+This fixes the dependency by removing the inappropriate 'select'
+statement and replacing it with a direct dependency on the
+drivers that provide the services this needs.
+
+Fixes: 7155043c2d027 ("[media] enable COMPILE_TEST for media drivers")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/Kconfig | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -56,10 +56,8 @@ config VIDEO_VIU
+
+ config VIDEO_TIMBERDALE
+ tristate "Support for timberdale Video In/LogiWIN"
+- depends on VIDEO_V4L2 && I2C && DMADEVICES
+- depends on MFD_TIMBERDALE || COMPILE_TEST
+- select DMA_ENGINE
+- select TIMB_DMA
++ depends on VIDEO_V4L2 && I2C
++ depends on (MFD_TIMBERDALE && TIMB_DMA) || COMPILE_TEST
+ select VIDEO_ADV7180
+ select VIDEOBUF_DMA_CONTIG
+ ---help---
--- /dev/null
+From 398a1e71dc827b994b7f2f56c7c2186fea7f8d75 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 29 Aug 2014 10:33:02 +0100
+Subject: TPM: Add new TPMs to the tail of the list to prevent inadvertent change of dev
+
+From: David Howells <dhowells@redhat.com>
+
+commit 398a1e71dc827b994b7f2f56c7c2186fea7f8d75 upstream.
+
+Add newly registered TPMs to the tail of the list, not the beginning, so that
+things that are specifying TPM_ANY_NUM don't find that the device they're
+using has inadvertently changed. Adding a second device would break IMA, for
+instance.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm-interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -1122,7 +1122,7 @@ struct tpm_chip *tpm_register_hardware(s
+
+ /* Make chip available */
+ spin_lock(&driver_lock);
+- list_add_rcu(&chip->list, &tpm_chip_list);
++ list_add_tail_rcu(&chip->list, &tpm_chip_list);
+ spin_unlock(&driver_lock);
+
+ return chip;
--- /dev/null
+From 84eb186bc37c0900b53077ca21cf6dd15823a232 Mon Sep 17 00:00:00 2001
+From: "Hon Ching (Vicky) Lo" <honclo@linux.vnet.ibm.com>
+Date: Sun, 30 Nov 2014 15:01:28 +0100
+Subject: tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma
+
+From: "Hon Ching (Vicky) Lo" <honclo@linux.vnet.ibm.com>
+
+commit 84eb186bc37c0900b53077ca21cf6dd15823a232 upstream.
+
+There was an oops in tpm_ibmvtpm_get_desired_dma, which caused
+kernel panic during boot when vTPM is enabled in Power partition
+configured in AMS mode.
+
+vio_bus_probe calls vio_cmo_bus_probe which calls
+tpm_ibmvtpm_get_desired_dma to get the size needed for DMA allocation.
+The problem is, vio_cmo_bus_probe is called before calling probe, which
+for vtpm is tpm_ibmvtpm_probe and it's this function that initializes
+and sets up vtpm's CRQ and gets required data values. Therefore,
+since this has not yet been done, NULL is returned in attempt to get
+the size for DMA allocation.
+
+We added a NULL check. In addition, a default buffer size will
+be set when NULL is returned.
+
+Signed-off-by: Hon Ching (Vicky) Lo <honclo@linux.vnet.ibm.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -307,6 +307,14 @@ static int tpm_ibmvtpm_remove(struct vio
+ static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev)
+ {
+ struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev);
++
++ /* ibmvtpm initializes at probe time, so the data we are
++ * asking for may not be set yet. Estimate that 4K required
++ * for TCE-mapped buffer in addition to CRQ.
++ */
++ if (!ibmvtpm)
++ return CRQ_RES_BUF_SIZE + PAGE_SIZE;
++
+ return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
+ }
+
--- /dev/null
+From 1ba3b0b6f218072afe8372d12f1b6bf26a26008e Mon Sep 17 00:00:00 2001
+From: Christophe Ricard <christophe.ricard@gmail.com>
+Date: Mon, 1 Dec 2014 19:32:46 +0100
+Subject: tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send
+
+From: Christophe Ricard <christophe.ricard@gmail.com>
+
+commit 1ba3b0b6f218072afe8372d12f1b6bf26a26008e upstream.
+
+When sending data in tpm_stm_i2c_send, each loop iteration send buf.
+Send buf + i instead as the goal of this for loop is to send a number
+of byte from buf that fit in burstcnt. Once those byte are sent, we are
+supposed to send the next ones.
+
+The driver was working because the burstcount value returns always the maximum size for a TPM
+command or response. (0x800 for a command and 0x400 for a response).
+
+Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_i2c_stm_st33.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -487,7 +487,7 @@ static int tpm_stm_i2c_send(struct tpm_c
+ if (burstcnt < 0)
+ return burstcnt;
+ size = min_t(int, len - i - 1, burstcnt);
+- ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
++ ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size);
+ if (ret < 0)
+ goto out_err;
+
--- /dev/null
+From 448e9c55c12d6bd4fa90a7e31d802e045666d7c8 Mon Sep 17 00:00:00 2001
+From: Scot Doyle <lkml14@scotdoyle.com>
+Date: Wed, 24 Sep 2014 22:41:10 +0000
+Subject: tpm_tis: verify interrupt during init
+
+From: Scot Doyle <lkml14@scotdoyle.com>
+
+commit 448e9c55c12d6bd4fa90a7e31d802e045666d7c8 upstream.
+
+Some machines, such as the Acer C720 and Toshiba CB35, have TPMs that do
+not send IRQs while also having an ACPI TPM entry indicating that they
+will be sent. These machines freeze on resume while the tpm_tis module
+waits for an IRQ, eventually timing out.
+
+When in interrupt mode, the tpm_tis module should receive an IRQ during
+module init. Fall back to polling mode if none is received when expected.
+
+Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
+Tested-by: Michael Mullin <masmullin@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+[phuewe: minor checkpatch fixed]
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_tis.c | 76 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 62 insertions(+), 14 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -75,6 +75,10 @@ enum tis_defaults {
+ #define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
+ #define TPM_RID(l) (0x0F04 | ((l) << 12))
+
++struct priv_data {
++ bool irq_tested;
++};
++
+ static LIST_HEAD(tis_chips);
+ static DEFINE_MUTEX(tis_lock);
+
+@@ -338,12 +342,27 @@ out_err:
+ return rc;
+ }
+
++static void disable_interrupts(struct tpm_chip *chip)
++{
++ u32 intmask;
++
++ intmask =
++ ioread32(chip->vendor.iobase +
++ TPM_INT_ENABLE(chip->vendor.locality));
++ intmask &= ~TPM_GLOBAL_INT_ENABLE;
++ iowrite32(intmask,
++ chip->vendor.iobase +
++ TPM_INT_ENABLE(chip->vendor.locality));
++ free_irq(chip->vendor.irq, chip);
++ chip->vendor.irq = 0;
++}
++
+ /*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+-static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len)
+ {
+ int rc;
+ u32 ordinal;
+@@ -373,6 +392,30 @@ out_err:
+ return rc;
+ }
+
++static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
++{
++ int rc, irq;
++ struct priv_data *priv = chip->vendor.priv;
++
++ if (!chip->vendor.irq || priv->irq_tested)
++ return tpm_tis_send_main(chip, buf, len);
++
++ /* Verify receipt of the expected IRQ */
++ irq = chip->vendor.irq;
++ chip->vendor.irq = 0;
++ rc = tpm_tis_send_main(chip, buf, len);
++ chip->vendor.irq = irq;
++ if (!priv->irq_tested)
++ msleep(1);
++ if (!priv->irq_tested) {
++ disable_interrupts(chip);
++ dev_err(chip->dev,
++ FW_BUG "TPM interrupt not working, polling instead\n");
++ }
++ priv->irq_tested = true;
++ return rc;
++}
++
+ struct tis_vendor_timeout_override {
+ u32 did_vid;
+ unsigned long timeout_us[4];
+@@ -505,6 +548,7 @@ static irqreturn_t tis_int_handler(int d
+ if (interrupt == 0)
+ return IRQ_NONE;
+
++ ((struct priv_data *)chip->vendor.priv)->irq_tested = true;
+ if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+ wake_up_interruptible(&chip->vendor.read_queue);
+ if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+@@ -534,9 +578,14 @@ static int tpm_tis_init(struct device *d
+ u32 vendor, intfcaps, intmask;
+ int rc, i, irq_s, irq_e, probe;
+ struct tpm_chip *chip;
++ struct priv_data *priv;
+
++ priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL);
++ if (priv == NULL)
++ return -ENOMEM;
+ if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
+ return -ENODEV;
++ chip->vendor.priv = priv;
+
+ chip->vendor.iobase = ioremap(start, len);
+ if (!chip->vendor.iobase) {
+@@ -605,19 +654,6 @@ static int tpm_tis_init(struct device *d
+ if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+ dev_dbg(dev, "\tData Avail Int Support\n");
+
+- /* get the timeouts before testing for irqs */
+- if (tpm_get_timeouts(chip)) {
+- dev_err(dev, "Could not get TPM timeouts and durations\n");
+- rc = -ENODEV;
+- goto out_err;
+- }
+-
+- if (tpm_do_selftest(chip)) {
+- dev_err(dev, "TPM self test failed\n");
+- rc = -ENODEV;
+- goto out_err;
+- }
+-
+ /* INTERRUPT Setup */
+ init_waitqueue_head(&chip->vendor.read_queue);
+ init_waitqueue_head(&chip->vendor.int_queue);
+@@ -719,6 +755,18 @@ static int tpm_tis_init(struct device *d
+ }
+ }
+
++ if (tpm_get_timeouts(chip)) {
++ dev_err(dev, "Could not get TPM timeouts and durations\n");
++ rc = -ENODEV;
++ goto out_err;
++ }
++
++ if (tpm_do_selftest(chip)) {
++ dev_err(dev, "TPM self test failed\n");
++ rc = -ENODEV;
++ goto out_err;
++ }
++
+ INIT_LIST_HEAD(&chip->vendor.list);
+ mutex_lock(&tis_lock);
+ list_add(&chip->vendor.list, &tis_chips);
--- /dev/null
+From 7215853e985a4bef1a6c14e00e89dfec84f1e457 Mon Sep 17 00:00:00 2001
+From: Vikram Mulukutla <markivx@codeaurora.org>
+Date: Wed, 17 Dec 2014 18:50:56 -0800
+Subject: tracing: Fix unmapping loop in tracing_mark_write
+
+From: Vikram Mulukutla <markivx@codeaurora.org>
+
+commit 7215853e985a4bef1a6c14e00e89dfec84f1e457 upstream.
+
+Commit 6edb2a8a385f0cdef51dae37ff23e74d76d8a6ce introduced
+an array map_pages that contains the addresses returned by
+kmap_atomic. However, when unmapping those pages, map_pages[0]
+is unmapped before map_pages[1], breaking the nesting requirement
+as specified in the documentation for kmap_atomic/kunmap_atomic.
+
+This was caught by the highmem debug code present in kunmap_atomic.
+Fix the loop to do the unmapping properly.
+
+Link: http://lkml.kernel.org/r/1418871056-6614-1-git-send-email-markivx@codeaurora.org
+
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Reported-by: Lime Yang <limey@codeaurora.org>
+Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4916,7 +4916,7 @@ tracing_mark_write(struct file *filp, co
+ *fpos += written;
+
+ out_unlock:
+- for (i = 0; i < nr_pages; i++){
++ for (i = nr_pages - 1; i >= 0; i--) {
+ kunmap_atomic(map_page[i]);
+ put_page(pages[i]);
+ }
--- /dev/null
+From 37480a05685ed5b8e1b9bf5e5c53b5810258b149 Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Mon, 19 Jan 2015 13:05:03 -0500
+Subject: tty: Prevent untrappable signals from malicious program
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream.
+
+Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE")
+allows a process which has opened a pty master to send _any_ signal
+to the process group of the pty slave. Although potentially
+exploitable by a malicious program running a setuid program on
+a pty slave, it's unknown if this exploit currently exists.
+
+Limit to signals actually used.
+
+Cc: Theodore Ts'o <tytso@mit.edu>
+Cc: Howard Chu <hyc@symas.com>
+Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/pty.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -210,6 +210,9 @@ static int pty_signal(struct tty_struct
+ unsigned long flags;
+ struct pid *pgrp;
+
++ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
++ return -EINVAL;
++
+ if (tty->link) {
+ spin_lock_irqsave(&tty->link->ctrl_lock, flags);
+ pgrp = get_pid(tty->link->pgrp);
--- /dev/null
+From 6fbb9bdf0f3fbe23aeff806489791aa876adaffb Mon Sep 17 00:00:00 2001
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Date: Tue, 9 Dec 2014 14:31:34 +0100
+Subject: tty/serial: at91: fix error handling in atmel_serial_probe()
+
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+
+commit 6fbb9bdf0f3fbe23aeff806489791aa876adaffb upstream.
+
+-EDEFER error wasn't handle properly by atmel_serial_probe().
+As an example, when atmel_serial_probe() is called for the first time, we pass
+the test_and_set_bit() test to check whether the port has already been
+initalized. Then we call atmel_init_port(), which may return -EDEFER, possibly
+returned before by clk_get(). Consequently atmel_serial_probe() used to return
+this error code WITHOUT clearing the port bit in the "atmel_ports_in_use" mask.
+When atmel_serial_probe() was called for the second time, it used to fail on
+the test_and_set_bit() function then returning -EBUSY.
+
+When atmel_serial_probe() fails, this patch make it clear the port bit in the
+"atmel_ports_in_use" mask, if needed, before returning the error code.
+
+Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2577,7 +2577,7 @@ static int atmel_serial_probe(struct pla
+
+ ret = atmel_init_port(port, pdev);
+ if (ret)
+- goto err;
++ goto err_clear_bit;
+
+ if (!atmel_use_pdc_rx(&port->uart)) {
+ ret = -ENOMEM;
+@@ -2626,6 +2626,8 @@ err_alloc_ring:
+ clk_put(port->clk);
+ port->clk = NULL;
+ }
++err_clear_bit:
++ clear_bit(port->uart.line, atmel_ports_in_use);
+ err:
+ return ret;
+ }
--- /dev/null
+From 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 29 Jan 2015 15:05:04 -0500
+Subject: USB: add flag for HCDs that can't receive wakeup requests (isp1760-hcd)
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 upstream.
+
+Currently the USB stack assumes that all host controller drivers are
+capable of receiving wakeup requests from downstream devices.
+However, this isn't true for the isp1760-hcd driver, which means that
+it isn't safe to do a runtime suspend of any device attached to a
+root-hub port if the device requires wakeup.
+
+This patch adds a "cant_recv_wakeups" flag to the usb_hcd structure
+and sets the flag in isp1760-hcd. The core is modified to prevent a
+direct child of the root hub from being put into runtime suspend with
+wakeup enabled if the flag is set.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/driver.c | 12 ++++++++++++
+ drivers/usb/host/isp1760-hcd.c | 3 +++
+ include/linux/usb/hcd.h | 2 ++
+ 3 files changed, 17 insertions(+)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1784,6 +1784,18 @@ static int autosuspend_check(struct usb_
+ dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n");
+ return -EOPNOTSUPP;
+ }
++
++ /*
++ * If the device is a direct child of the root hub and the HCD
++ * doesn't handle wakeup requests, don't allow autosuspend when
++ * wakeup is needed.
++ */
++ if (w && udev->parent == udev->bus->root_hub &&
++ bus_to_hcd(udev->bus)->cant_recv_wakeups) {
++ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n");
++ return -EOPNOTSUPP;
++ }
++
+ udev->do_remote_wakeup = w;
+ return 0;
+ }
+--- a/drivers/usb/host/isp1760-hcd.c
++++ b/drivers/usb/host/isp1760-hcd.c
+@@ -2247,6 +2247,9 @@ struct usb_hcd *isp1760_register(phys_ad
+ hcd->rsrc_start = res_start;
+ hcd->rsrc_len = res_len;
+
++ /* This driver doesn't support wakeup requests */
++ hcd->cant_recv_wakeups = 1;
++
+ ret = usb_add_hcd(hcd, irq, irqflags);
+ if (ret)
+ goto err_unmap;
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -146,6 +146,8 @@ struct usb_hcd {
+ unsigned amd_resume_bug:1; /* AMD remote wakeup quirk */
+ unsigned can_do_streams:1; /* HC supports streams */
+ unsigned tpl_support:1; /* OTG & EH TPL support */
++ unsigned cant_recv_wakeups:1;
++ /* wakeup requests from downstream aren't received */
+
+ unsigned int irq; /* irq allocated */
+ void __iomem *regs; /* device memory/io */
--- /dev/null
+From 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Fri, 5 Dec 2014 15:13:54 +0100
+Subject: usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 upstream.
+
+the following error pops up during "testusb -a -t 10"
+| musb-hdrc musb-hdrc.1.auto: dma_pool_free buffer-128, f134e000/be842000 (bad dma)
+hcd_buffer_create() creates a few buffers, the smallest has 32 bytes of
+size. ARCH_KMALLOC_MINALIGN is set to 64 bytes. This combo results in
+hcd_buffer_alloc() returning memory which is 32 bytes aligned and it
+might by identified by buffer_offset() as another buffer. This means the
+buffer which is on a 32 byte boundary will not get freed, instead it
+tries to free another buffer with the error message.
+
+This patch fixes the issue by creating the smallest DMA buffer with the
+size of ARCH_KMALLOC_MINALIGN (or 32 in case ARCH_KMALLOC_MINALIGN is
+smaller). This might be 32, 64 or even 128 bytes. The next three pools
+will have the size 128, 512 and 2048.
+In case the smallest pool is 128 bytes then we have only three pools
+instead of four (and zero the first entry in the array).
+The last pool size is always 2048 bytes which is the assumed PAGE_SIZE /
+2 of 4096. I doubt it makes sense to continue using PAGE_SIZE / 2 where
+we would end up with 8KiB buffer in case we have 16KiB pages.
+Instead I think it makes sense to have a common size(s) and extend them
+if there is need to.
+There is a BUILD_BUG_ON() now in case someone has a minalign of more than
+128 bytes.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/buffer.c | 26 +++++++++++++++++---------
+ drivers/usb/core/usb.c | 1 +
+ include/linux/usb/hcd.h | 1 +
+ 3 files changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/core/buffer.c
++++ b/drivers/usb/core/buffer.c
+@@ -22,17 +22,25 @@
+ */
+
+ /* FIXME tune these based on pool statistics ... */
+-static const size_t pool_max[HCD_BUFFER_POOLS] = {
+- /* platforms without dma-friendly caches might need to
+- * prevent cacheline sharing...
+- */
+- 32,
+- 128,
+- 512,
+- PAGE_SIZE / 2
+- /* bigger --> allocate pages */
++static size_t pool_max[HCD_BUFFER_POOLS] = {
++ 32, 128, 512, 2048,
+ };
+
++void __init usb_init_pool_max(void)
++{
++ /*
++ * The pool_max values must never be smaller than
++ * ARCH_KMALLOC_MINALIGN.
++ */
++ if (ARCH_KMALLOC_MINALIGN <= 32)
++ ; /* Original value is okay */
++ else if (ARCH_KMALLOC_MINALIGN <= 64)
++ pool_max[0] = 64;
++ else if (ARCH_KMALLOC_MINALIGN <= 128)
++ pool_max[0] = 0; /* Don't use this pool */
++ else
++ BUILD_BUG(); /* We don't allow this */
++}
+
+ /* SETUP primitives */
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -1051,6 +1051,7 @@ static int __init usb_init(void)
+ pr_info("%s: USB support disabled\n", usbcore_name);
+ return 0;
+ }
++ usb_init_pool_max();
+
+ retval = usb_debugfs_init();
+ if (retval)
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -450,6 +450,7 @@ extern const struct dev_pm_ops usb_hcd_p
+ #endif /* CONFIG_PCI */
+
+ /* pci-ish (pdev null is ok) buffer alloc/mapping support */
++void usb_init_pool_max(void);
+ int hcd_buffer_create(struct usb_hcd *hcd);
+ void hcd_buffer_destroy(struct usb_hcd *hcd);
+
--- /dev/null
+From a6f0331236fa75afba14bbcf6668d42cebb55c43 Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Wed, 21 Jan 2015 15:24:27 -0500
+Subject: USB: cp210x: add ID for RUGGEDCOM USB Serial Console
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+commit a6f0331236fa75afba14bbcf6668d42cebb55c43 upstream.
+
+Added the USB serial console device ID for Siemens Ruggedcom devices
+which have a USB port for their serial console.
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -56,6 +56,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
--- /dev/null
+From 524134d422316a59d5464ccbc12036bbe90c5563 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 21 Jan 2015 14:02:43 -0500
+Subject: USB: don't cancel queued resets when unbinding drivers
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 524134d422316a59d5464ccbc12036bbe90c5563 upstream.
+
+The USB stack provides a mechanism for drivers to request an
+asynchronous device reset (usb_queue_reset_device()). The mechanism
+uses a work item (reset_ws) embedded in the usb_interface structure
+used by the driver, and the reset is carried out by a work queue
+routine.
+
+The asynchronous reset can race with driver unbinding. When this
+happens, we try to cancel the queued reset before unbinding the
+driver, on the theory that the driver won't care about any resets once
+it is unbound.
+
+However, thanks to the fact that lockdep now tracks work queue
+accesses, this can provoke a lockdep warning in situations where the
+device reset causes another interface's driver to be unbound; see
+
+ http://marc.info/?l=linux-usb&m=141893165203776&w=2
+
+for an example. The reason is that the work routine for reset_ws in
+one interface calls cancel_queued_work() for the reset_ws in another
+interface. Lockdep thinks this might lead to a work routine trying to
+cancel itself. The simplest solution is not to cancel queued resets
+when unbinding drivers.
+
+This means we now need to acquire a reference to the usb_interface
+when queuing a reset_ws work item and to drop the reference when the
+work routine finishes. We also need to make sure that the
+usb_interface structure doesn't outlive its parent usb_device; this
+means acquiring and dropping a reference when the interface is created
+and destroyed.
+
+In addition, cancelling a queued reset can fail (if the device is in
+the middle of an earlier reset), and this can cause usb_reset_device()
+to try to rebind an interface that has been deallocated (see
+http://marc.info/?l=linux-usb&m=142175717016628&w=2 for details).
+Acquiring the extra references prevents this failure.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Russell King - ARM Linux <linux@arm.linux.org.uk>
+Reported-by: Olivier Sobrie <olivier@sobrie.be>
+Tested-by: Olivier Sobrie <olivier@sobrie.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/driver.c | 17 -----------------
+ drivers/usb/core/hub.c | 25 +++++++++----------------
+ drivers/usb/core/message.c | 23 +++--------------------
+ include/linux/usb.h | 5 -----
+ 4 files changed, 12 insertions(+), 58 deletions(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -275,21 +275,6 @@ static int usb_unbind_device(struct devi
+ return 0;
+ }
+
+-/*
+- * Cancel any pending scheduled resets
+- *
+- * [see usb_queue_reset_device()]
+- *
+- * Called after unconfiguring / when releasing interfaces. See
+- * comments in __usb_queue_reset_device() regarding
+- * udev->reset_running.
+- */
+-static void usb_cancel_queued_reset(struct usb_interface *iface)
+-{
+- if (iface->reset_running == 0)
+- cancel_work_sync(&iface->reset_ws);
+-}
+-
+ /* called from driver core with dev locked */
+ static int usb_probe_interface(struct device *dev)
+ {
+@@ -380,7 +365,6 @@ static int usb_probe_interface(struct de
+ usb_set_intfdata(intf, NULL);
+ intf->needs_remote_wakeup = 0;
+ intf->condition = USB_INTERFACE_UNBOUND;
+- usb_cancel_queued_reset(intf);
+
+ /* If the LPM disable succeeded, balance the ref counts. */
+ if (!lpm_disable_error)
+@@ -425,7 +409,6 @@ static int usb_unbind_interface(struct d
+ usb_disable_interface(udev, intf, false);
+
+ driver->disconnect(intf);
+- usb_cancel_queued_reset(intf);
+
+ /* Free streams */
+ for (i = 0, j = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5591,26 +5591,19 @@ EXPORT_SYMBOL_GPL(usb_reset_device);
+ * possible; depending on how the driver attached to each interface
+ * handles ->pre_reset(), the second reset might happen or not.
+ *
+- * - If a driver is unbound and it had a pending reset, the reset will
+- * be cancelled.
++ * - If the reset is delayed so long that the interface is unbound from
++ * its driver, the reset will be skipped.
+ *
+- * - This function can be called during .probe() or .disconnect()
+- * times. On return from .disconnect(), any pending resets will be
+- * cancelled.
+- *
+- * There is no no need to lock/unlock the @reset_ws as schedule_work()
+- * does its own.
+- *
+- * NOTE: We don't do any reference count tracking because it is not
+- * needed. The lifecycle of the work_struct is tied to the
+- * usb_interface. Before destroying the interface we cancel the
+- * work_struct, so the fact that work_struct is queued and or
+- * running means the interface (and thus, the device) exist and
+- * are referenced.
++ * - This function can be called during .probe(). It can also be called
++ * during .disconnect(), but doing so is pointless because the reset
++ * will not occur. If you really want to reset the device during
++ * .disconnect(), call usb_reset_device() directly -- but watch out
++ * for nested unbinding issues!
+ */
+ void usb_queue_reset_device(struct usb_interface *iface)
+ {
+- schedule_work(&iface->reset_ws);
++ if (schedule_work(&iface->reset_ws))
++ usb_get_intf(iface);
+ }
+ EXPORT_SYMBOL_GPL(usb_queue_reset_device);
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1551,6 +1551,7 @@ static void usb_release_interface(struct
+ altsetting_to_usb_interface_cache(intf->altsetting);
+
+ kref_put(&intfc->ref, usb_release_interface_cache);
++ usb_put_dev(interface_to_usbdev(intf));
+ kfree(intf);
+ }
+
+@@ -1626,24 +1627,6 @@ static struct usb_interface_assoc_descri
+
+ /*
+ * Internal function to queue a device reset
+- *
+- * This is initialized into the workstruct in 'struct
+- * usb_device->reset_ws' that is launched by
+- * message.c:usb_set_configuration() when initializing each 'struct
+- * usb_interface'.
+- *
+- * It is safe to get the USB device without reference counts because
+- * the life cycle of @iface is bound to the life cycle of @udev. Then,
+- * this function will be ran only if @iface is alive (and before
+- * freeing it any scheduled instances of it will have been cancelled).
+- *
+- * We need to set a flag (usb_dev->reset_running) because when we call
+- * the reset, the interfaces might be unbound. The current interface
+- * cannot try to remove the queued work as it would cause a deadlock
+- * (you cannot remove your work from within your executing
+- * workqueue). This flag lets it know, so that
+- * usb_cancel_queued_reset() doesn't try to do it.
+- *
+ * See usb_queue_reset_device() for more details
+ */
+ static void __usb_queue_reset_device(struct work_struct *ws)
+@@ -1655,11 +1638,10 @@ static void __usb_queue_reset_device(str
+
+ rc = usb_lock_device_for_reset(udev, iface);
+ if (rc >= 0) {
+- iface->reset_running = 1;
+ usb_reset_device(udev);
+- iface->reset_running = 0;
+ usb_unlock_device(udev);
+ }
++ usb_put_intf(iface); /* Undo _get_ in usb_queue_reset_device() */
+ }
+
+
+@@ -1854,6 +1836,7 @@ free_interfaces:
+ dev_set_name(&intf->dev, "%d-%s:%d.%d",
+ dev->bus->busnum, dev->devpath,
+ configuration, alt->desc.bInterfaceNumber);
++ usb_get_dev(dev);
+ }
+ kfree(new_interfaces);
+
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -127,10 +127,6 @@ enum usb_interface_condition {
+ * to the sysfs representation for that device.
+ * @pm_usage_cnt: PM usage counter for this interface
+ * @reset_ws: Used for scheduling resets from atomic context.
+- * @reset_running: set to 1 if the interface is currently running a
+- * queued reset so that usb_cancel_queued_reset() doesn't try to
+- * remove from the workqueue when running inside the worker
+- * thread. See __usb_queue_reset_device().
+ * @resetting_device: USB core reset the device, so use alt setting 0 as
+ * current; needs bandwidth alloc after reset.
+ *
+@@ -181,7 +177,6 @@ struct usb_interface {
+ unsigned needs_remote_wakeup:1; /* driver requires remote wakeup */
+ unsigned needs_altsetting0:1; /* switch to altsetting 0 is pending */
+ unsigned needs_binding:1; /* needs delayed unbind/rebind */
+- unsigned reset_running:1;
+ unsigned resetting_device:1; /* true: bandwidth alloc after reset */
+
+ struct device dev; /* interface specific device info */
--- /dev/null
+From c99197902da284b4b723451c1471c45b18537cde Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 30 Jan 2015 12:58:26 -0500
+Subject: USB: fix use-after-free bug in usb_hcd_unlink_urb()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit c99197902da284b4b723451c1471c45b18537cde upstream.
+
+The usb_hcd_unlink_urb() routine in hcd.c contains two possible
+use-after-free errors. The dev_dbg() statement at the end of the
+routine dereferences urb and urb->dev even though both structures may
+have been deallocated.
+
+This patch fixes the problem by storing urb->dev in a local variable
+(avoiding the dereference of urb) and moving the dev_dbg() up before
+the usb_put_dev() call.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
+Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
+Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1618,6 +1618,7 @@ static int unlink1(struct usb_hcd *hcd,
+ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ {
+ struct usb_hcd *hcd;
++ struct usb_device *udev = urb->dev;
+ int retval = -EIDRM;
+ unsigned long flags;
+
+@@ -1629,20 +1630,19 @@ int usb_hcd_unlink_urb (struct urb *urb,
+ spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
+ if (atomic_read(&urb->use_count) > 0) {
+ retval = 0;
+- usb_get_dev(urb->dev);
++ usb_get_dev(udev);
+ }
+ spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
+ if (retval == 0) {
+ hcd = bus_to_hcd(urb->dev->bus);
+ retval = unlink1(hcd, urb, status);
+- usb_put_dev(urb->dev);
++ if (retval == 0)
++ retval = -EINPROGRESS;
++ else if (retval != -EIDRM && retval != -EBUSY)
++ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
++ urb, retval);
++ usb_put_dev(udev);
+ }
+-
+- if (retval == 0)
+- retval = -EINPROGRESS;
+- else if (retval != -EIDRM && retval != -EBUSY)
+- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
+- urb, retval);
+ return retval;
+ }
+
--- /dev/null
+From fbba7db3990cb707ff91cd6507d53a0a730afe97 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 28 Jan 2015 22:51:04 +0100
+Subject: usb: musb: add omap-control dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit fbba7db3990cb707ff91cd6507d53a0a730afe97 upstream.
+
+The omap musb front-end calls into the phy driver directly
+instead of using a generic phy interface, which causes a link
+error when the specific driver is not built-in:
+
+drivers/built-in.o: In function `omap2430_musb_disable':
+usb/musb/omap2430.c:480: undefined reference to `omap_control_usb_set_mode'
+drivers/built-in.o: In function `omap2430_musb_enable':
+usb/musb/omap2430.c:466: undefined reference to `omap_control_usb_set_mode'
+usb/musb/omap2430.c:447: undefined reference to `omap_control_usb_set_mode'
+drivers/built-in.o: In function `omap_musb_set_mailbox':
+usb/musb/omap2430.c:273: undefined reference to `omap_control_usb_set_mode'
+usb/musb/omap2430.c:304: undefined reference to `omap_control_usb_set_mode'
+drivers/built-in.o:(.debug_addr+0xbd9e0): more undefined references to `omap_control_usb_set_mode' follow
+
+This adds an explicit dependency.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: ca784be36cc725 ("usb: start using the control module driver")
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/Kconfig
++++ b/drivers/usb/musb/Kconfig
+@@ -76,7 +76,7 @@ config USB_MUSB_TUSB6010
+
+ config USB_MUSB_OMAP2PLUS
+ tristate "OMAP2430 and onwards"
+- depends on ARCH_OMAP2PLUS && USB
++ depends on ARCH_OMAP2PLUS && USB && OMAP_CONTROL_PHY
+ select GENERIC_PHY
+
+ config USB_MUSB_AM35X
--- /dev/null
+From 19e3ae6b4f07a87822c1c9e7ed99d31860e701af Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Fri, 23 Jan 2015 17:07:21 -0500
+Subject: vt: provide notifications on selection changes
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.
+
+The vcs device's poll/fasync support relies on the vt notifier to signal
+changes to the screen content. Notifier invocations were missing for
+changes that comes through the selection interface though. Fix that.
+
+Tested with BRLTTY 5.2.
+
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Cc: Dave Mielke <dave@mielke.cc>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, i
+ #endif
+ if (DO_UPDATE(vc))
+ do_update_region(vc, (unsigned long) p, count);
++ notify_update(vc);
+ }
+
+ /* used by selection: complement pointer position */
+@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc,
+ scr_writew(old, screenpos(vc, old_offset, 1));
+ if (DO_UPDATE(vc))
+ vc->vc_sw->con_putc(vc, old, oldy, oldx);
++ notify_update(vc);
+ }
+
+ old_offset = offset;
+@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc,
+ oldy = (offset >> 1) / vc->vc_cols;
+ vc->vc_sw->con_putc(vc, new, oldy, oldx);
+ }
++ notify_update(vc);
+ }
+-
+ }
+
+ static void insert_char(struct vc_data *vc, unsigned int nr)
--- /dev/null
+From 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Mon, 19 Jan 2015 13:19:38 +0000
+Subject: xen/manage: Fix USB interaction issues when resuming
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+commit 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 upstream.
+
+Commit 61a734d305e1 ("xen/manage: Always freeze/thaw processes when
+suspend/resuming") ensured that userspace processes were always frozen
+before suspending to reduce interaction issues when resuming devices.
+However, freeze_processes() does not freeze kernel threads. Freeze
+kernel threads as well to prevent deadlocks with the khubd thread when
+resuming devices.
+
+This is what native suspend and resume does.
+
+Example deadlock:
+[ 7279.648010] [<ffffffff81446bde>] ? xen_poll_irq_timeout+0x3e/0x50
+[ 7279.648010] [<ffffffff81448d60>] xen_poll_irq+0x10/0x20
+[ 7279.648010] [<ffffffff81011723>] xen_lock_spinning+0xb3/0x120
+[ 7279.648010] [<ffffffff810115d1>] __raw_callee_save_xen_lock_spinning+0x11/0x20
+[ 7279.648010] [<ffffffff815620b6>] ? usb_control_msg+0xe6/0x120
+[ 7279.648010] [<ffffffff81747e50>] ? _raw_spin_lock_irq+0x50/0x60
+[ 7279.648010] [<ffffffff8174522c>] wait_for_completion+0xac/0x160
+[ 7279.648010] [<ffffffff8109c520>] ? try_to_wake_up+0x2c0/0x2c0
+[ 7279.648010] [<ffffffff814b60f2>] dpm_wait+0x32/0x40
+[ 7279.648010] [<ffffffff814b6eb0>] device_resume+0x90/0x210
+[ 7279.648010] [<ffffffff814b7d71>] dpm_resume+0x121/0x250
+[ 7279.648010] [<ffffffff8144c570>] ? xenbus_dev_request_and_reply+0xc0/0xc0
+[ 7279.648010] [<ffffffff814b80d5>] dpm_resume_end+0x15/0x30
+[ 7279.648010] [<ffffffff81449fba>] do_suspend+0x10a/0x200
+[ 7279.648010] [<ffffffff8144a2f0>] ? xen_pre_suspend+0x20/0x20
+[ 7279.648010] [<ffffffff8144a1d0>] shutdown_handler+0x120/0x150
+[ 7279.648010] [<ffffffff8144c60f>] xenwatch_thread+0x9f/0x160
+[ 7279.648010] [<ffffffff810ac510>] ? finish_wait+0x80/0x80
+[ 7279.648010] [<ffffffff8108d189>] kthread+0xc9/0xe0
+[ 7279.648010] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+[ 7279.648010] [<ffffffff8175087c>] ret_from_fork+0x7c/0xb0
+[ 7279.648010] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+
+[ 7441.216287] INFO: task khubd:89 blocked for more than 120 seconds.
+[ 7441.219457] Tainted: G X 3.13.11-ckt12.kz #1
+[ 7441.222176] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 7441.225827] khubd D ffff88003f433440 0 89 2 0x00000000
+[ 7441.229258] ffff88003ceb9b98 0000000000000046 ffff88003ce83000 0000000000013440
+[ 7441.232959] ffff88003ceb9fd8 0000000000013440 ffff88003cd13000 ffff88003ce83000
+[ 7441.236658] 0000000000000286 ffff88003d3e0000 ffff88003ceb9bd0 00000001001aa01e
+[ 7441.240415] Call Trace:
+[ 7441.241614] [<ffffffff817442f9>] schedule+0x29/0x70
+[ 7441.243930] [<ffffffff81743406>] schedule_timeout+0x166/0x2c0
+[ 7441.246681] [<ffffffff81075b80>] ? call_timer_fn+0x110/0x110
+[ 7441.249339] [<ffffffff8174357e>] schedule_timeout_uninterruptible+0x1e/0x20
+[ 7441.252644] [<ffffffff81077710>] msleep+0x20/0x30
+[ 7441.254812] [<ffffffff81555f00>] hub_port_reset+0xf0/0x580
+[ 7441.257400] [<ffffffff81558465>] hub_port_init+0x75/0xb40
+[ 7441.259981] [<ffffffff814bb3c9>] ? update_autosuspend+0x39/0x60
+[ 7441.262817] [<ffffffff814bb4f0>] ? pm_runtime_set_autosuspend_delay+0x50/0xa0
+[ 7441.266212] [<ffffffff8155a64a>] hub_thread+0x71a/0x1750
+[ 7441.268728] [<ffffffff810ac510>] ? finish_wait+0x80/0x80
+[ 7441.271272] [<ffffffff81559f30>] ? usb_port_resume+0x670/0x670
+[ 7441.274067] [<ffffffff8108d189>] kthread+0xc9/0xe0
+[ 7441.276305] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+[ 7441.279131] [<ffffffff8175087c>] ret_from_fork+0x7c/0xb0
+[ 7441.281659] [<ffffffff8108d0c0>] ? flush_kthread_worker+0x80/0x80
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/manage.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -105,10 +105,16 @@ static void do_suspend(void)
+
+ err = freeze_processes();
+ if (err) {
+- pr_err("%s: freeze failed %d\n", __func__, err);
++ pr_err("%s: freeze processes failed %d\n", __func__, err);
+ goto out;
+ }
+
++ err = freeze_kernel_threads();
++ if (err) {
++ pr_err("%s: freeze kernel threads failed %d\n", __func__, err);
++ goto out_thaw;
++ }
++
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+ pr_err("%s: dpm_suspend_start %d\n", __func__, err);
--- /dev/null
+From facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 17 Feb 2015 08:02:47 +0100
+Subject: xen-scsiback: mark pvscsi frontend request consumed only after last read
+
+From: Juergen Gross <jgross@suse.com>
+
+commit facb5732b0bb59ebbc11b5d5abc249e677ddbeb6 upstream.
+
+A request in the ring buffer mustn't be read after it has been marked
+as consumed. Otherwise it might already have been reused by the
+frontend without violating the ring protocol.
+
+To avoid inconsistencies in the backend only work on a private copy
+of the request. This will ensure a malicious guest not being able to
+bypass consistency checks of the backend by modifying an active
+request.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/xen-scsiback.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -712,12 +712,11 @@ static int prepare_pending_reqs(struct v
+ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ {
+ struct vscsiif_back_ring *ring = &info->ring;
+- struct vscsiif_request *ring_req;
++ struct vscsiif_request ring_req;
+ struct vscsibk_pend *pending_req;
+ RING_IDX rc, rp;
+ int err, more_to_do;
+ uint32_t result;
+- uint8_t act;
+
+ rc = ring->req_cons;
+ rp = ring->sring->req_prod;
+@@ -738,11 +737,10 @@ static int scsiback_do_cmd_fn(struct vsc
+ if (!pending_req)
+ return 1;
+
+- ring_req = RING_GET_REQUEST(ring, rc);
++ ring_req = *RING_GET_REQUEST(ring, rc);
+ ring->req_cons = ++rc;
+
+- act = ring_req->act;
+- err = prepare_pending_reqs(info, ring_req, pending_req);
++ err = prepare_pending_reqs(info, &ring_req, pending_req);
+ if (err) {
+ switch (err) {
+ case -ENODEV:
+@@ -758,9 +756,9 @@ static int scsiback_do_cmd_fn(struct vsc
+ return 1;
+ }
+
+- switch (act) {
++ switch (ring_req.act) {
+ case VSCSIIF_ACT_SCSI_CDB:
+- if (scsiback_gnttab_data_map(ring_req, pending_req)) {
++ if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
+ scsiback_fast_flush_area(pending_req);
+ scsiback_do_resp_with_sense(NULL,
+ DRIVER_ERROR << 24, 0, pending_req);
+@@ -771,7 +769,7 @@ static int scsiback_do_cmd_fn(struct vsc
+ break;
+ case VSCSIIF_ACT_SCSI_ABORT:
+ scsiback_device_action(pending_req, TMR_ABORT_TASK,
+- ring_req->ref_rqid);
++ ring_req.ref_rqid);
+ break;
+ case VSCSIIF_ACT_SCSI_RESET:
+ scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
--- /dev/null
+From 0d612fb570b71ea2e49554a770cff4c489018b2c Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Thu, 22 Jan 2015 09:29:05 +1100
+Subject: xfs: ensure buffer types are set correctly
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit 0d612fb570b71ea2e49554a770cff4c489018b2c upstream.
+
+Jan Kara reported that log recovery was finding buffers with invalid
+types in them. This should not happen, and indicates a bug in the
+logging of buffers. To catch this, add asserts to the buffer
+formatting code to ensure that the buffer type is in range when the
+transaction is committed.
+
+We don't set a type on buffers being marked stale - they are not
+going to get replayed, the format item exists only for recovery to
+be able to prevent replay of the buffer, so the type does not
+matter. Hence that needs special casing here.
+
+Reported-by: Jan Kara <jack@suse.cz>
+Tested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_buf_item.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/xfs/xfs_buf_item.c
++++ b/fs/xfs/xfs_buf_item.c
+@@ -319,6 +319,10 @@ xfs_buf_item_format(
+ ASSERT(atomic_read(&bip->bli_refcount) > 0);
+ ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
+ (bip->bli_flags & XFS_BLI_STALE));
++ ASSERT((bip->bli_flags & XFS_BLI_STALE) ||
++ (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF
++ && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF));
++
+
+ /*
+ * If it is an inode buffer, transfer the in-memory state to the
--- /dev/null
+From f19b872b086711bb4b22c3a0f52f16aa920bcc61 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Thu, 22 Jan 2015 09:29:40 +1100
+Subject: xfs: inode unlink does not set AGI buffer type
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit f19b872b086711bb4b22c3a0f52f16aa920bcc61 upstream.
+
+This leads to log recovery throwing errors like:
+
+XFS (md0): Mounting V5 Filesystem
+XFS (md0): Starting recovery (logdev: internal)
+XFS (md0): Unknown buffer type 0!
+XFS (md0): _xfs_buf_ioapply: no ops on block 0xaea8802/0x1
+ffff8800ffc53800: 58 41 47 49 .....
+
+Which is the AGI buffer magic number.
+
+Ensure that we set the type appropriately in both unlink list
+addition and removal.
+
+Tested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2000,6 +2000,7 @@ xfs_iunlink(
+ agi->agi_unlinked[bucket_index] = cpu_to_be32(agino);
+ offset = offsetof(xfs_agi_t, agi_unlinked) +
+ (sizeof(xfs_agino_t) * bucket_index);
++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ xfs_trans_log_buf(tp, agibp, offset,
+ (offset + sizeof(xfs_agino_t) - 1));
+ return 0;
+@@ -2091,6 +2092,7 @@ xfs_iunlink_remove(
+ agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino);
+ offset = offsetof(xfs_agi_t, agi_unlinked) +
+ (sizeof(xfs_agino_t) * bucket_index);
++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
+ xfs_trans_log_buf(tp, agibp, offset,
+ (offset + sizeof(xfs_agino_t) - 1));
+ } else {
--- /dev/null
+From fe22d552b82d7cc7de1851233ae8bef579198637 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Thu, 22 Jan 2015 09:30:06 +1100
+Subject: xfs: set buf types when converting extent formats
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit fe22d552b82d7cc7de1851233ae8bef579198637 upstream.
+
+Conversion from local to extent format does not set the buffer type
+correctly on the new extent buffer when a symlink data is moved out
+of line.
+
+Fix the symlink code and leave a comment in the generic bmap code
+reminding us that the format-specific data copy needs to set the
+destination buffer type appropriately.
+
+Tested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/libxfs/xfs_bmap.c | 6 +++++-
+ fs/xfs/libxfs/xfs_symlink_remote.c | 2 ++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -976,7 +976,11 @@ xfs_bmap_local_to_extents(
+ *firstblock = args.fsbno;
+ bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
+
+- /* initialise the block and copy the data */
++ /*
++ * Initialise the block and copy the data
++ *
++ * Note: init_fn must set the buffer log item type correctly!
++ */
+ init_fn(tp, bp, ip, ifp);
+
+ /* account for the change in fork size and log everything */
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -180,6 +180,8 @@ xfs_symlink_local_to_remote(
+ struct xfs_mount *mp = ip->i_mount;
+ char *buf;
+
++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SYMLINK_BUF);
++
+ if (!xfs_sb_version_hascrc(&mp->m_sb)) {
+ bp->b_ops = NULL;
+ memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
--- /dev/null
+From 3443a3bca54588f43286b725d8648d33a38c86f1 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Thu, 22 Jan 2015 09:30:23 +1100
+Subject: xfs: set superblock buffer type correctly
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit 3443a3bca54588f43286b725d8648d33a38c86f1 upstream.
+
+When the superblock is modified in a transaction, the commonly
+modified fields are not actually copied to the superblock buffer to
+avoid the buffer lock becoming a serialisation point. However, there
+are some other operations that modify the superblock fields within
+the transaction that don't directly log to the superblock but rely
+on the changes to be applied during the transaction commit (to
+minimise the buffer lock hold time).
+
+When we do this, we fail to mark the buffer log item as being a
+superblock buffer and that can lead to the buffer not being marked
+with the corect type in the log and hence causing recovery issues.
+Fix it by setting the type correctly, similar to xfs_mod_sb()...
+
+Tested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_trans.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/xfs/xfs_trans.c
++++ b/fs/xfs/xfs_trans.c
+@@ -474,6 +474,7 @@ xfs_trans_apply_sb_deltas(
+ whole = 1;
+ }
+
++ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF);
+ if (whole)
+ /*
+ * Log the whole thing, the fields are noncontiguous.
projects / thirdparty / kernel / stable-queue.git / commitdiff
