--- /dev/null
+From 5b9ab3f7324a1b94a5a5a76d44cf92dfeb3b5e80 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:57:55 +0200
+Subject: ALSA: 6fire: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5b9ab3f7324a1b94a5a5a76d44cf92dfeb3b5e80 upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/6fire/pcm.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -641,17 +641,25 @@ int usb6fire_pcm_init(struct sfire_chip
+ void usb6fire_pcm_abort(struct sfire_chip *chip)
+ {
+ struct pcm_runtime *rt = chip->pcm;
++ unsigned long flags;
+ int i;
+
+ if (rt) {
+ rt->panic = true;
+
+- if (rt->playback.instance)
++ if (rt->playback.instance) {
++ snd_pcm_stream_lock_irqsave(rt->playback.instance, flags);
+ snd_pcm_stop(rt->playback.instance,
+ SNDRV_PCM_STATE_XRUN);
+- if (rt->capture.instance)
++ snd_pcm_stream_unlock_irqrestore(rt->playback.instance, flags);
++ }
++
++ if (rt->capture.instance) {
++ snd_pcm_stream_lock_irqsave(rt->capture.instance, flags);
+ snd_pcm_stop(rt->capture.instance,
+ SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock_irqrestore(rt->capture.instance, flags);
++ }
+
+ for (i = 0; i < PCM_N_URBS; i++) {
+ usb_poison_urb(&rt->in_urbs[i].instance);
--- /dev/null
+From 60478295d6876619f8f47f6d1a5c25eaade69ee3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:55:57 +0200
+Subject: ALSA: asihpi: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 60478295d6876619f8f47f6d1a5c25eaade69ee3 upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/asihpi/asihpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/asihpi/asihpi.c
++++ b/sound/pci/asihpi/asihpi.c
+@@ -769,7 +769,10 @@ static void snd_card_asihpi_timer_functi
+ s->number);
+ ds->drained_count++;
+ if (ds->drained_count > 20) {
++ unsigned long flags;
++ snd_pcm_stream_lock_irqsave(s, flags);
+ snd_pcm_stop(s, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock_irqrestore(s, flags);
+ continue;
+ }
+ } else {
--- /dev/null
+From cc7282b8d5abbd48c81d1465925d464d9e3eaa8f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:56:56 +0200
+Subject: ALSA: atiixp: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit cc7282b8d5abbd48c81d1465925d464d9e3eaa8f upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/atiixp.c | 2 ++
+ sound/pci/atiixp_modem.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/sound/pci/atiixp.c
++++ b/sound/pci/atiixp.c
+@@ -689,7 +689,9 @@ static void snd_atiixp_xrun_dma(struct a
+ if (! dma->substream || ! dma->running)
+ return;
+ snd_printdd("atiixp: XRUN detected (DMA %d)\n", dma->ops->type);
++ snd_pcm_stream_lock(dma->substream);
+ snd_pcm_stop(dma->substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock(dma->substream);
+ }
+
+ /*
+--- a/sound/pci/atiixp_modem.c
++++ b/sound/pci/atiixp_modem.c
+@@ -638,7 +638,9 @@ static void snd_atiixp_xrun_dma(struct a
+ if (! dma->substream || ! dma->running)
+ return;
+ snd_printdd("atiixp-modem: XRUN detected (DMA %d)\n", dma->ops->type);
++ snd_pcm_stream_lock(dma->substream);
+ snd_pcm_stop(dma->substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock(dma->substream);
+ }
+
+ /*
--- /dev/null
+From d52392b1a80458c0510810789c7db4a39b88022a Mon Sep 17 00:00:00 2001
+From: Aaron Plattner <aplattner@nvidia.com>
+Date: Fri, 12 Jul 2013 11:01:37 -0700
+Subject: ALSA: hda - Add new GPU codec ID to snd-hda
+
+From: Aaron Plattner <aplattner@nvidia.com>
+
+commit d52392b1a80458c0510810789c7db4a39b88022a upstream.
+
+Vendor ID 0x10de0060 is used by a yet-to-be-named GPU chip.
+
+Reviewed-by: Andy Ritger <aritger@nvidia.com>
+Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2536,6 +2536,7 @@ static const struct hda_codec_preset snd
+ { .id = 0x10de0043, .name = "GPU 43 HDMI/DP", .patch = patch_generic_hdmi },
+ { .id = 0x10de0044, .name = "GPU 44 HDMI/DP", .patch = patch_generic_hdmi },
+ { .id = 0x10de0051, .name = "GPU 51 HDMI/DP", .patch = patch_generic_hdmi },
++{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP", .patch = patch_generic_hdmi },
+ { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+@@ -2588,6 +2589,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0042"
+ MODULE_ALIAS("snd-hda-codec-id:10de0043");
+ MODULE_ALIAS("snd-hda-codec-id:10de0044");
+ MODULE_ALIAS("snd-hda-codec-id:10de0051");
++MODULE_ALIAS("snd-hda-codec-id:10de0060");
+ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
--- /dev/null
+From bddee96b5d0db869f47b195fe48c614ca824203c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Jun 2013 16:14:22 +0200
+Subject: ALSA: hda - Cache the MUX selection for generic HDMI
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit bddee96b5d0db869f47b195fe48c614ca824203c upstream.
+
+When a selection to a converter MUX is changed in hdmi_pcm_open(), it
+should be cached so that the given connection can be restored properly
+at PM resume. We need just to replace the corresponding
+snd_hda_codec_write() call with snd_hda_codec_write_cache().
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1146,7 +1146,7 @@ static int hdmi_pcm_open(struct hda_pcm_
+ per_cvt->assigned = 1;
+ hinfo->nid = per_cvt->cvt_nid;
+
+- snd_hda_codec_write(codec, per_pin->pin_nid, 0,
++ snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
+ AC_VERB_SET_CONNECT_SEL,
+ mux_idx);
+ snd_hda_spdif_ctls_assign(codec, pin_idx, per_cvt->cvt_nid);
--- /dev/null
+From 8f0b3b7e222383a21f7d58bd97d5552b3a5dbced Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Jul 2013 12:54:22 +0200
+Subject: ALSA: hda - Fix EAPD vmaster hook for AD1884 & co
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8f0b3b7e222383a21f7d58bd97d5552b3a5dbced upstream.
+
+ad1884_fixup_hp_eapd() tries to set the NID for controlling the
+speaker EAPD from the pin configuration. But the current code can't
+work expectedly since it sets spec->eapd_nid before calling the
+generic parser where the autocfg pins are set up.
+
+This patch changes the function to set spec->eapd_nid after the
+generic parser call while it sets vmaster hook unconditionally. The
+spec->eapd_nid check is moved in the hook function itself instead.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_analog.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -2112,6 +2112,9 @@ static void ad_vmaster_eapd_hook(void *p
+ {
+ struct hda_codec *codec = private_data;
+ struct ad198x_spec *spec = codec->spec;
++
++ if (!spec->eapd_nid)
++ return;
+ snd_hda_codec_update_cache(codec, spec->eapd_nid, 0,
+ AC_VERB_SET_EAPD_BTLENABLE,
+ enabled ? 0x02 : 0x00);
+@@ -3601,13 +3604,16 @@ static void ad1884_fixup_hp_eapd(struct
+ {
+ struct ad198x_spec *spec = codec->spec;
+
+- if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
++ break;
++ case HDA_FIXUP_ACT_PROBE:
+ if (spec->gen.autocfg.line_out_type == AUTO_PIN_SPEAKER_OUT)
+ spec->eapd_nid = spec->gen.autocfg.line_out_pins[0];
+ else
+ spec->eapd_nid = spec->gen.autocfg.speaker_pins[0];
+- if (spec->eapd_nid)
+- spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
++ break;
+ }
+ }
+
--- /dev/null
+From d045c5dc43d829df9f067d363c3b42b14dacf434 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 19 Jun 2013 07:54:09 +0200
+Subject: ALSA: hda - Fix missing Mic Boost controls for VIA codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d045c5dc43d829df9f067d363c3b42b14dacf434 upstream.
+
+Some VIA codecs like VT1708S have Mic boost amps in the mic pins but
+they aren't exposed in the capability bits. In the past driver code,
+we override the pin caps and create mic boost controls forcibly.
+While transition to the generic parser, we lost the mic boost controls
+although the pin caps are still overridden, because the generic parser
+code checks the widget caps, too.
+
+So this patch adds a new helper function to allow the override of the
+given widget capability bits, and makes VIA codecs driver to add the
+missing input-amp capability bit.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=59861
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_local.h | 8 ++++++++
+ sound/pci/hda/patch_via.c | 2 ++
+ 2 files changed, 10 insertions(+)
+
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -562,6 +562,14 @@ static inline unsigned int get_wcaps_cha
+ return chans;
+ }
+
++static inline void snd_hda_override_wcaps(struct hda_codec *codec,
++ hda_nid_t nid, u32 val)
++{
++ if (nid >= codec->start_nid &&
++ nid < codec->start_nid + codec->num_nodes)
++ codec->wcaps[nid - codec->start_nid] = val;
++}
++
+ u32 query_amp_caps(struct hda_codec *codec, hda_nid_t nid, int direction);
+ int snd_hda_override_amp_caps(struct hda_codec *codec, hda_nid_t nid, int dir,
+ unsigned int caps);
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -910,6 +910,8 @@ static const struct hda_verb vt1708S_ini
+ static void override_mic_boost(struct hda_codec *codec, hda_nid_t pin,
+ int offset, int num_steps, int step_size)
+ {
++ snd_hda_override_wcaps(codec, pin,
++ get_wcaps(codec, pin) | AC_WCAP_IN_AMP);
+ snd_hda_override_amp_caps(codec, pin, HDA_INPUT,
+ (offset << AC_AMPCAP_OFFSET_SHIFT) |
+ (num_steps << AC_AMPCAP_NUM_STEPS_SHIFT) |
--- /dev/null
+From 06ec56d3c60238f27bfa50d245592fccc1b4ef0f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Jun 2013 07:55:02 +0200
+Subject: ALSA: hda - Fix return value of snd_hda_check_power_state()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 06ec56d3c60238f27bfa50d245592fccc1b4ef0f upstream.
+
+The refactoring by commit 9040d102 introduced the new function
+snd_hda_check_power_state(). This function is supposed to return true
+if the state already reached to the target state, but it actually
+returns false for that. An utterly stupid typo while copy & paste.
+
+Fortunately this didn't influence on much behavior because powering up
+AFG usually powers up the child widgets, too. But the finer power
+control must have been broken by this bug.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_local.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -667,7 +667,7 @@ snd_hda_check_power_state(struct hda_cod
+ if (state & AC_PWRST_ERROR)
+ return true;
+ state = (state >> 4) & 0x0f;
+- return (state != target_state);
++ return (state == target_state);
+ }
+
+ unsigned int snd_hda_codec_eapd_power_filter(struct hda_codec *codec,
--- /dev/null
+From 0c055b3413868227f2e85701c4e6938c9581f0e2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 28 Jun 2013 11:51:32 +0200
+Subject: ALSA: hda - Fix the max length of control name in generic parser
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0c055b3413868227f2e85701c4e6938c9581f0e2 upstream.
+
+add_control_with_pfx() in hda_generic.c assumes a shorter name string
+for the control element, and this resulted in the truncation of the
+long but valid string like "Headphone Surround Switch" in the middle.
+
+This patch aligns the max size to the actual limit of snd_ctl_elem_id,
+44.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -840,7 +840,7 @@ static int add_control_with_pfx(struct h
+ const char *pfx, const char *dir,
+ const char *sfx, int cidx, unsigned long val)
+ {
+- char name[32];
++ char name[44];
+ snprintf(name, sizeof(name), "%s %s %s", pfx, dir, sfx);
+ if (!add_control(spec, type, name, cidx, val))
+ return -ENOMEM;
--- /dev/null
+From 46f6c1aaf790be9ea3c8ddfc8f235a5f677d08e2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:59:33 +0200
+Subject: ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 46f6c1aaf790be9ea3c8ddfc8f235a5f677d08e2 upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Acked-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/arm/pxa2xx-pcm-lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/arm/pxa2xx-pcm-lib.c
++++ b/sound/arm/pxa2xx-pcm-lib.c
+@@ -166,7 +166,9 @@ void pxa2xx_pcm_dma_irq(int dma_ch, void
+ } else {
+ printk(KERN_ERR "%s: DMA error on channel %d (DCSR=%#x)\n",
+ rtd->params->name, dma_ch, dcsr);
++ snd_pcm_stream_lock(substream);
+ snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock(substream);
+ }
+ }
+ EXPORT_SYMBOL(pxa2xx_pcm_dma_irq);
--- /dev/null
+From 256ca9c3ad5013ff8a8f165e5a82fab437628c8e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Jul 2013 12:17:49 +0200
+Subject: ALSA: seq-oss: Initialize MIDI clients asynchronously
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 256ca9c3ad5013ff8a8f165e5a82fab437628c8e upstream.
+
+We've got bug reports that the module loading stuck on Debian system
+with 3.10 kernel. The debugging session revealed that the initial
+registration of OSS sequencer clients stuck at module loading time,
+which involves again with request_module() at the init phase. This is
+triggered only by special --install stuff Debian is using, but it's
+still not good to have such loops.
+
+As a workaround, call the registration part asynchronously. This is a
+better approach irrespective of the hang fix, in anyway.
+
+Reported-and-tested-by: Philipp Matthias Hahn <pmhahn@pmhahn.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/oss/seq_oss_init.c | 16 +++++++++++++---
+ sound/core/seq/oss/seq_oss_midi.c | 2 +-
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -31,6 +31,7 @@
+ #include <linux/export.h>
+ #include <linux/moduleparam.h>
+ #include <linux/slab.h>
++#include <linux/workqueue.h>
+
+ /*
+ * common variables
+@@ -60,6 +61,14 @@ static void free_devinfo(void *private);
+ #define call_ctl(type,rec) snd_seq_kernel_client_ctl(system_client, type, rec)
+
+
++/* call snd_seq_oss_midi_lookup_ports() asynchronously */
++static void async_call_lookup_ports(struct work_struct *work)
++{
++ snd_seq_oss_midi_lookup_ports(system_client);
++}
++
++static DECLARE_WORK(async_lookup_work, async_call_lookup_ports);
++
+ /*
+ * create sequencer client for OSS sequencer
+ */
+@@ -85,9 +94,6 @@ snd_seq_oss_create_client(void)
+ system_client = rc;
+ debug_printk(("new client = %d\n", rc));
+
+- /* look up midi devices */
+- snd_seq_oss_midi_lookup_ports(system_client);
+-
+ /* create annoucement receiver port */
+ memset(port, 0, sizeof(*port));
+ strcpy(port->name, "Receiver");
+@@ -115,6 +121,9 @@ snd_seq_oss_create_client(void)
+ }
+ rc = 0;
+
++ /* look up midi devices */
++ schedule_work(&async_lookup_work);
++
+ __error:
+ kfree(port);
+ return rc;
+@@ -160,6 +169,7 @@ receive_announce(struct snd_seq_event *e
+ int
+ snd_seq_oss_delete_client(void)
+ {
++ cancel_work_sync(&async_lookup_work);
+ if (system_client >= 0)
+ snd_seq_delete_kernel_client(system_client);
+
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -72,7 +72,7 @@ static int send_midi_event(struct seq_os
+ * look up the existing ports
+ * this looks a very exhausting job.
+ */
+-int __init
++int
+ snd_seq_oss_midi_lookup_ports(int client)
+ {
+ struct snd_seq_client_info *clinfo;
--- /dev/null
+From 9538aa46c2427d6782aa10036c4da4c541605e0e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:58:25 +0200
+Subject: ALSA: ua101: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9538aa46c2427d6782aa10036c4da4c541605e0e upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/misc/ua101.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/misc/ua101.c
++++ b/sound/usb/misc/ua101.c
+@@ -613,14 +613,24 @@ static int start_usb_playback(struct ua1
+
+ static void abort_alsa_capture(struct ua101 *ua)
+ {
+- if (test_bit(ALSA_CAPTURE_RUNNING, &ua->states))
++ unsigned long flags;
++
++ if (test_bit(ALSA_CAPTURE_RUNNING, &ua->states)) {
++ snd_pcm_stream_lock_irqsave(ua->capture.substream, flags);
+ snd_pcm_stop(ua->capture.substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock_irqrestore(ua->capture.substream, flags);
++ }
+ }
+
+ static void abort_alsa_playback(struct ua101 *ua)
+ {
+- if (test_bit(ALSA_PLAYBACK_RUNNING, &ua->states))
++ unsigned long flags;
++
++ if (test_bit(ALSA_PLAYBACK_RUNNING, &ua->states)) {
++ snd_pcm_stream_lock_irqsave(ua->playback.substream, flags);
+ snd_pcm_stop(ua->playback.substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock_irqrestore(ua->playback.substream, flags);
++ }
+ }
+
+ static int set_stream_hw(struct ua101 *ua, struct snd_pcm_substream *substream,
--- /dev/null
+From 5be1efb4c2ed79c3d7c0cbcbecae768377666e84 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 17:58:47 +0200
+Subject: ALSA: usx2y: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5be1efb4c2ed79c3d7c0cbcbecae768377666e84 upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/usx2y/usbusx2yaudio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/usb/usx2y/usbusx2yaudio.c
++++ b/sound/usb/usx2y/usbusx2yaudio.c
+@@ -273,7 +273,11 @@ static void usX2Y_clients_stop(struct us
+ struct snd_usX2Y_substream *subs = usX2Y->subs[s];
+ if (subs) {
+ if (atomic_read(&subs->state) >= state_PRERUNNING) {
++ unsigned long flags;
++
++ snd_pcm_stream_lock_irqsave(subs->pcm_substream, flags);
+ snd_pcm_stop(subs->pcm_substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock_irqrestore(subs->pcm_substream, flags);
+ }
+ for (u = 0; u < NRURBS; u++) {
+ struct urb *urb = subs->urb[u];
--- /dev/null
+From db6f41063cbdb58b14846e600e6bc3f4e4c2e888 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 19 Jul 2013 15:37:12 +0100
+Subject: arm64: mm: don't treat user cache maintenance faults as writes
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit db6f41063cbdb58b14846e600e6bc3f4e4c2e888 upstream.
+
+On arm64, cache maintenance faults appear as data aborts with the CM
+bit set in the ESR. The WnR bit, usually used to distinguish between
+faulting loads and stores, always reads as 1 and (slightly confusingly)
+the instructions are treated as reads by the architecture.
+
+This patch fixes our fault handling code to treat cache maintenance
+faults in the same way as loads.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/fault.c | 46 ++++++++++++++++++++--------------------------
+ 1 file changed, 20 insertions(+), 26 deletions(-)
+
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -152,25 +152,8 @@ void do_bad_area(unsigned long addr, uns
+ #define ESR_CM (1 << 8)
+ #define ESR_LNX_EXEC (1 << 24)
+
+-/*
+- * Check that the permissions on the VMA allow for the fault which occurred.
+- * If we encountered a write fault, we must have write permission, otherwise
+- * we allow any permission.
+- */
+-static inline bool access_error(unsigned int esr, struct vm_area_struct *vma)
+-{
+- unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
+-
+- if (esr & ESR_WRITE)
+- mask = VM_WRITE;
+- if (esr & ESR_LNX_EXEC)
+- mask = VM_EXEC;
+-
+- return vma->vm_flags & mask ? false : true;
+-}
+-
+ static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
+- unsigned int esr, unsigned int flags,
++ unsigned int mm_flags, unsigned long vm_flags,
+ struct task_struct *tsk)
+ {
+ struct vm_area_struct *vma;
+@@ -188,12 +171,17 @@ static int __do_page_fault(struct mm_str
+ * it.
+ */
+ good_area:
+- if (access_error(esr, vma)) {
++ /*
++ * Check that the permissions on the VMA allow for the fault which
++ * occurred. If we encountered a write or exec fault, we must have
++ * appropriate permissions, otherwise we allow any permission.
++ */
++ if (!(vma->vm_flags & vm_flags)) {
+ fault = VM_FAULT_BADACCESS;
+ goto out;
+ }
+
+- return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
++ return handle_mm_fault(mm, vma, addr & PAGE_MASK, mm_flags);
+
+ check_stack:
+ if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+@@ -208,9 +196,15 @@ static int __kprobes do_page_fault(unsig
+ struct task_struct *tsk;
+ struct mm_struct *mm;
+ int fault, sig, code;
+- bool write = (esr & ESR_WRITE) && !(esr & ESR_CM);
+- unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+- (write ? FAULT_FLAG_WRITE : 0);
++ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
++ unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
++
++ if (esr & ESR_LNX_EXEC) {
++ vm_flags = VM_EXEC;
++ } else if ((esr & ESR_WRITE) && !(esr & ESR_CM)) {
++ vm_flags = VM_WRITE;
++ mm_flags |= FAULT_FLAG_WRITE;
++ }
+
+ tsk = current;
+ mm = tsk->mm;
+@@ -248,7 +242,7 @@ retry:
+ #endif
+ }
+
+- fault = __do_page_fault(mm, addr, esr, flags, tsk);
++ fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
+
+ /*
+ * If we need to retry but a fatal signal is pending, handle the
+@@ -265,7 +259,7 @@ retry:
+ */
+
+ perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
+- if (flags & FAULT_FLAG_ALLOW_RETRY) {
++ if (mm_flags & FAULT_FLAG_ALLOW_RETRY) {
+ if (fault & VM_FAULT_MAJOR) {
+ tsk->maj_flt++;
+ perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
+@@ -280,7 +274,7 @@ retry:
+ * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
+ * starvation.
+ */
+- flags &= ~FAULT_FLAG_ALLOW_RETRY;
++ mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
+ goto retry;
+ }
+ }
--- /dev/null
+From 571185717f8d7f2a088a7ac38d94a9ad5fd9da5c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 18:00:01 +0200
+Subject: ASoC: atmel: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 571185717f8d7f2a088a7ac38d94a9ad5fd9da5c upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Acked-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/atmel/atmel-pcm-dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/atmel/atmel-pcm-dma.c
++++ b/sound/soc/atmel/atmel-pcm-dma.c
+@@ -81,7 +81,9 @@ static void atmel_pcm_dma_irq(u32 ssc_sr
+
+ /* stop RX and capture: will be enabled again at restart */
+ ssc_writex(prtd->ssc->regs, SSC_CR, prtd->mask->ssc_disable);
++ snd_pcm_stream_lock(substream);
+ snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock(substream);
+
+ /* now drain RHR and read status to remove xrun condition */
+ ssc_readx(prtd->ssc->regs, SSC_RHR);
--- /dev/null
+From 61be2b9a18ec70f3cbe3deef7a5f77869c71b5ae Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Jul 2013 18:00:25 +0200
+Subject: ASoC: s6000: Fix unlocked snd_pcm_stop() call
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 61be2b9a18ec70f3cbe3deef7a5f77869c71b5ae upstream.
+
+snd_pcm_stop() must be called in the PCM substream lock context.
+
+Acked-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/s6000/s6000-pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/s6000/s6000-pcm.c
++++ b/sound/soc/s6000/s6000-pcm.c
+@@ -128,7 +128,9 @@ static irqreturn_t s6000_pcm_irq(int irq
+ substream->runtime &&
+ snd_pcm_running(substream)) {
+ dev_dbg(pcm->dev, "xrun\n");
++ snd_pcm_stream_lock(substream);
+ snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++ snd_pcm_stream_unlock(substream);
+ ret = IRQ_HANDLED;
+ }
+
--- /dev/null
+From 5c78dfe87ea04b501ee000a7f03b9432ac9d008c Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Thu, 4 Jul 2013 20:01:03 -0300
+Subject: ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 5c78dfe87ea04b501ee000a7f03b9432ac9d008c upstream.
+
+SGTL5000_PLL_FRAC_DIV_MASK is used to mask bits 0-10 (11 bits in total) of
+register CHIP_PLL_CTRL, so fix the mask to accomodate all this bit range.
+
+Reported-by: Oskar Schirmer <oskar@scara.com>
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sgtl5000.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -347,7 +347,7 @@
+ #define SGTL5000_PLL_INT_DIV_MASK 0xf800
+ #define SGTL5000_PLL_INT_DIV_SHIFT 11
+ #define SGTL5000_PLL_INT_DIV_WIDTH 5
+-#define SGTL5000_PLL_FRAC_DIV_MASK 0x0700
++#define SGTL5000_PLL_FRAC_DIV_MASK 0x07ff
+ #define SGTL5000_PLL_FRAC_DIV_SHIFT 0
+ #define SGTL5000_PLL_FRAC_DIV_WIDTH 11
+
--- /dev/null
+From c7e8695bfa0611b39493a9dfe8bab9f63f9809bd Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Wed, 19 Jun 2013 16:25:37 -0700
+Subject: ata_piix: IDE-mode SATA patch for Intel Coleto Creek DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit c7e8695bfa0611b39493a9dfe8bab9f63f9809bd upstream.
+
+This patch adds the IDE-mode SATA DeviceIDs for the Intel Coleto Creek PCH.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ata_piix.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -338,6 +338,8 @@ static const struct pci_device_id piix_p
+ /* SATA Controller IDE (BayTrail) */
+ { 0x8086, 0x0F20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
++ /* SATA Controller IDE (Coleto Creek) */
++ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+
+ { } /* terminate list */
+ };
--- /dev/null
+From d3bcb7b24bbf09fde8405770e676fe0c11c79662 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Mon, 10 Jun 2013 13:49:40 +0530
+Subject: ath9k: Do not assign noise for NULL caldata
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit d3bcb7b24bbf09fde8405770e676fe0c11c79662 upstream.
+
+ah->noise is maintained globally and not per-channel. This
+is updated in the reset() routine after the NF history has been
+filled for the *current channel*, just before switching to
+the new channel. There is no need to do it inside getnf(), since
+ah->noise must contain a value for the new channel.
+
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/calib.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/calib.c
++++ b/drivers/net/wireless/ath/ath9k/calib.c
+@@ -387,7 +387,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, s
+
+ if (!caldata) {
+ chan->noisefloor = nf;
+- ah->noise = ath9k_hw_getchan_noise(ah, chan);
+ return false;
+ }
+
--- /dev/null
+From 696df78509d1f81b651dd98ecdc1aecab616db6b Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Mon, 10 Jun 2013 13:49:39 +0530
+Subject: ath9k: Fix noisefloor calibration
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 696df78509d1f81b651dd98ecdc1aecab616db6b upstream.
+
+The commits,
+
+"ath9k: Fix regression in channelwidth switch at the same channel"
+"ath9k: Fix invalid noisefloor reading due to channel update"
+
+attempted to fix noisefloor calibration when a channel switch
+happens due to HT20/HT40 bandwidth change. This is causing invalid
+readings resulting in messages like:
+
+"ath: phy16: NF[0] (-45) > MAX (-95), correcting to MAX".
+
+This results in an incorrect noise being used initially for reporting
+the signal level of received packets, until NF calibration is done
+and the history buffer is updated via the ANI timer, which happens
+much later.
+
+When a bandwidth change happens, it is appropriate to reset
+the internal history data for the channel. Do this correctly in the
+reset() routine by checking the "chanmode" variable.
+
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 3 ++-
+ drivers/net/wireless/ath/ath9k/main.c | 7 -------
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1872,7 +1872,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+
+ ah->caldata = caldata;
+ if (caldata && (chan->channel != caldata->channel ||
+- chan->channelFlags != caldata->channelFlags)) {
++ chan->channelFlags != caldata->channelFlags ||
++ chan->chanmode != caldata->chanmode)) {
+ /* Operating channel changed, reset channel calibration data */
+ memset(caldata, 0, sizeof(*caldata));
+ ath9k_init_nfcal_hist_buffer(ah, chan);
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1211,13 +1211,6 @@ static int ath9k_config(struct ieee80211
+ ath_update_survey_stats(sc);
+ spin_unlock_irqrestore(&common->cc_lock, flags);
+
+- /*
+- * Preserve the current channel values, before updating
+- * the same channel
+- */
+- if (ah->curchan && (old_pos == pos))
+- ath9k_hw_getnf(ah, ah->curchan);
+-
+ ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
+ curchan, channel_type);
+
--- /dev/null
+From 30d5b709da23f4ab9836c7f66d2d2e780a69cf12 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Mon, 10 Jun 2013 13:49:38 +0530
+Subject: ath9k_hw: Assign default xlna config for AR9485
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 30d5b709da23f4ab9836c7f66d2d2e780a69cf12 upstream.
+
+For AR9485 boards with XLNA, the default gpio config
+is not set correctly, fix this.
+
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 8 ++++++--
+ drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 ++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -3563,14 +3563,18 @@ static void ar9003_hw_ant_ctrl_apply(str
+ {
+ struct ath9k_hw_capabilities *pCap = &ah->caps;
+ int chain;
+- u32 regval;
++ u32 regval, value;
+ static const u32 switch_chain_reg[AR9300_MAX_CHAINS] = {
+ AR_PHY_SWITCH_CHAIN_0,
+ AR_PHY_SWITCH_CHAIN_1,
+ AR_PHY_SWITCH_CHAIN_2,
+ };
+
+- u32 value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
++ if (AR_SREV_9485(ah) && (ar9003_hw_get_rx_gain_idx(ah) == 0))
++ ath9k_hw_cfg_output(ah, AR9300_EXT_LNA_CTL_GPIO_AR9485,
++ AR_GPIO_OUTPUT_MUX_AS_PCIE_ATTENTION_LED);
++
++ value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
+
+ if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+ REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+@@ -351,6 +351,8 @@
+
+ #define AR_PHY_CCA_NOM_VAL_9330_2GHZ -118
+
++#define AR9300_EXT_LNA_CTL_GPIO_AR9485 9
++
+ /*
+ * AGC Field Definitions
+ */
--- /dev/null
+From 1a33bd2be705cbb3f57d7223b60baea441039307 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Wed, 29 May 2013 10:11:17 +0200
+Subject: clocksource: dw_apb: Fix error check
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 1a33bd2be705cbb3f57d7223b60baea441039307 upstream.
+
+irq_of_parse_and_map() returns 0 on error, while the code checks for NO_IRQ.
+This breaks on platforms that have NO_IRQ != 0.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/dw_apb_timer_of.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clocksource/dw_apb_timer_of.c
++++ b/drivers/clocksource/dw_apb_timer_of.c
+@@ -44,7 +44,7 @@ static void add_clockevent(struct device
+ u32 irq, rate;
+
+ irq = irq_of_parse_and_map(event_timer, 0);
+- if (irq == NO_IRQ)
++ if (irq == 0)
+ panic("No IRQ for clock event timer");
+
+ timer_get_base_and_rate(event_timer, &iobase, &rate);
--- /dev/null
+From e8d05276f236ee6435e78411f62be9714e0b9377 Mon Sep 17 00:00:00 2001
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+Date: Tue, 16 Jul 2013 22:46:48 +0200
+Subject: cpufreq: Revert commit 2f7021a8 to fix CPU hotplug regression
+
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+
+commit e8d05276f236ee6435e78411f62be9714e0b9377 upstream.
+
+commit 2f7021a8 "cpufreq: protect 'policy->cpus' from offlining
+during __gov_queue_work()" caused a regression in CPU hotplug,
+because it lead to a deadlock between cpufreq governor worker thread
+and the CPU hotplug writer task.
+
+Lockdep splat corresponding to this deadlock is shown below:
+
+[ 60.277396] ======================================================
+[ 60.277400] [ INFO: possible circular locking dependency detected ]
+[ 60.277407] 3.10.0-rc7-dbg-01385-g241fd04-dirty #1744 Not tainted
+[ 60.277411] -------------------------------------------------------
+[ 60.277417] bash/2225 is trying to acquire lock:
+[ 60.277422] ((&(&j_cdbs->work)->work)){+.+...}, at: [<ffffffff810621b5>] flush_work+0x5/0x280
+[ 60.277444] but task is already holding lock:
+[ 60.277449] (cpu_hotplug.lock){+.+.+.}, at: [<ffffffff81042d8b>] cpu_hotplug_begin+0x2b/0x60
+[ 60.277465] which lock already depends on the new lock.
+
+[ 60.277472] the existing dependency chain (in reverse order) is:
+[ 60.277477] -> #2 (cpu_hotplug.lock){+.+.+.}:
+[ 60.277490] [<ffffffff810ac6d4>] lock_acquire+0xa4/0x200
+[ 60.277503] [<ffffffff815b6157>] mutex_lock_nested+0x67/0x410
+[ 60.277514] [<ffffffff81042cbc>] get_online_cpus+0x3c/0x60
+[ 60.277522] [<ffffffff814b842a>] gov_queue_work+0x2a/0xb0
+[ 60.277532] [<ffffffff814b7891>] cs_dbs_timer+0xc1/0xe0
+[ 60.277543] [<ffffffff8106302d>] process_one_work+0x1cd/0x6a0
+[ 60.277552] [<ffffffff81063d31>] worker_thread+0x121/0x3a0
+[ 60.277560] [<ffffffff8106ae2b>] kthread+0xdb/0xe0
+[ 60.277569] [<ffffffff815bb96c>] ret_from_fork+0x7c/0xb0
+[ 60.277580] -> #1 (&j_cdbs->timer_mutex){+.+...}:
+[ 60.277592] [<ffffffff810ac6d4>] lock_acquire+0xa4/0x200
+[ 60.277600] [<ffffffff815b6157>] mutex_lock_nested+0x67/0x410
+[ 60.277608] [<ffffffff814b785d>] cs_dbs_timer+0x8d/0xe0
+[ 60.277616] [<ffffffff8106302d>] process_one_work+0x1cd/0x6a0
+[ 60.277624] [<ffffffff81063d31>] worker_thread+0x121/0x3a0
+[ 60.277633] [<ffffffff8106ae2b>] kthread+0xdb/0xe0
+[ 60.277640] [<ffffffff815bb96c>] ret_from_fork+0x7c/0xb0
+[ 60.277649] -> #0 ((&(&j_cdbs->work)->work)){+.+...}:
+[ 60.277661] [<ffffffff810ab826>] __lock_acquire+0x1766/0x1d30
+[ 60.277669] [<ffffffff810ac6d4>] lock_acquire+0xa4/0x200
+[ 60.277677] [<ffffffff810621ed>] flush_work+0x3d/0x280
+[ 60.277685] [<ffffffff81062d8a>] __cancel_work_timer+0x8a/0x120
+[ 60.277693] [<ffffffff81062e53>] cancel_delayed_work_sync+0x13/0x20
+[ 60.277701] [<ffffffff814b89d9>] cpufreq_governor_dbs+0x529/0x6f0
+[ 60.277709] [<ffffffff814b76a7>] cs_cpufreq_governor_dbs+0x17/0x20
+[ 60.277719] [<ffffffff814b5df8>] __cpufreq_governor+0x48/0x100
+[ 60.277728] [<ffffffff814b6b80>] __cpufreq_remove_dev.isra.14+0x80/0x3c0
+[ 60.277737] [<ffffffff815adc0d>] cpufreq_cpu_callback+0x38/0x4c
+[ 60.277747] [<ffffffff81071a4d>] notifier_call_chain+0x5d/0x110
+[ 60.277759] [<ffffffff81071b0e>] __raw_notifier_call_chain+0xe/0x10
+[ 60.277768] [<ffffffff815a0a68>] _cpu_down+0x88/0x330
+[ 60.277779] [<ffffffff815a0d46>] cpu_down+0x36/0x50
+[ 60.277788] [<ffffffff815a2748>] store_online+0x98/0xd0
+[ 60.277796] [<ffffffff81452a28>] dev_attr_store+0x18/0x30
+[ 60.277806] [<ffffffff811d9edb>] sysfs_write_file+0xdb/0x150
+[ 60.277818] [<ffffffff8116806d>] vfs_write+0xbd/0x1f0
+[ 60.277826] [<ffffffff811686fc>] SyS_write+0x4c/0xa0
+[ 60.277834] [<ffffffff815bbbbe>] tracesys+0xd0/0xd5
+[ 60.277842] other info that might help us debug this:
+
+[ 60.277848] Chain exists of:
+ (&(&j_cdbs->work)->work) --> &j_cdbs->timer_mutex --> cpu_hotplug.lock
+
+[ 60.277864] Possible unsafe locking scenario:
+
+[ 60.277869] CPU0 CPU1
+[ 60.277873] ---- ----
+[ 60.277877] lock(cpu_hotplug.lock);
+[ 60.277885] lock(&j_cdbs->timer_mutex);
+[ 60.277892] lock(cpu_hotplug.lock);
+[ 60.277900] lock((&(&j_cdbs->work)->work));
+[ 60.277907] *** DEADLOCK ***
+
+[ 60.277915] 6 locks held by bash/2225:
+[ 60.277919] #0: (sb_writers#6){.+.+.+}, at: [<ffffffff81168173>] vfs_write+0x1c3/0x1f0
+[ 60.277937] #1: (&buffer->mutex){+.+.+.}, at: [<ffffffff811d9e3c>] sysfs_write_file+0x3c/0x150
+[ 60.277954] #2: (s_active#61){.+.+.+}, at: [<ffffffff811d9ec3>] sysfs_write_file+0xc3/0x150
+[ 60.277972] #3: (x86_cpu_hotplug_driver_mutex){+.+...}, at: [<ffffffff81024cf7>] cpu_hotplug_driver_lock+0x17/0x20
+[ 60.277990] #4: (cpu_add_remove_lock){+.+.+.}, at: [<ffffffff815a0d32>] cpu_down+0x22/0x50
+[ 60.278007] #5: (cpu_hotplug.lock){+.+.+.}, at: [<ffffffff81042d8b>] cpu_hotplug_begin+0x2b/0x60
+[ 60.278023] stack backtrace:
+[ 60.278031] CPU: 3 PID: 2225 Comm: bash Not tainted 3.10.0-rc7-dbg-01385-g241fd04-dirty #1744
+[ 60.278037] Hardware name: Acer Aspire 5741G /Aspire 5741G , BIOS V1.20 02/08/2011
+[ 60.278042] ffffffff8204e110 ffff88014df6b9f8 ffffffff815b3d90 ffff88014df6ba38
+[ 60.278055] ffffffff815b0a8d ffff880150ed3f60 ffff880150ed4770 3871c4002c8980b2
+[ 60.278068] ffff880150ed4748 ffff880150ed4770 ffff880150ed3f60 ffff88014df6bb00
+[ 60.278081] Call Trace:
+[ 60.278091] [<ffffffff815b3d90>] dump_stack+0x19/0x1b
+[ 60.278101] [<ffffffff815b0a8d>] print_circular_bug+0x2b6/0x2c5
+[ 60.278111] [<ffffffff810ab826>] __lock_acquire+0x1766/0x1d30
+[ 60.278123] [<ffffffff81067e08>] ? __kernel_text_address+0x58/0x80
+[ 60.278134] [<ffffffff810ac6d4>] lock_acquire+0xa4/0x200
+[ 60.278142] [<ffffffff810621b5>] ? flush_work+0x5/0x280
+[ 60.278151] [<ffffffff810621ed>] flush_work+0x3d/0x280
+[ 60.278159] [<ffffffff810621b5>] ? flush_work+0x5/0x280
+[ 60.278169] [<ffffffff810a9b14>] ? mark_held_locks+0x94/0x140
+[ 60.278178] [<ffffffff81062d77>] ? __cancel_work_timer+0x77/0x120
+[ 60.278188] [<ffffffff810a9cbd>] ? trace_hardirqs_on_caller+0xfd/0x1c0
+[ 60.278196] [<ffffffff81062d8a>] __cancel_work_timer+0x8a/0x120
+[ 60.278206] [<ffffffff81062e53>] cancel_delayed_work_sync+0x13/0x20
+[ 60.278214] [<ffffffff814b89d9>] cpufreq_governor_dbs+0x529/0x6f0
+[ 60.278225] [<ffffffff814b76a7>] cs_cpufreq_governor_dbs+0x17/0x20
+[ 60.278234] [<ffffffff814b5df8>] __cpufreq_governor+0x48/0x100
+[ 60.278244] [<ffffffff814b6b80>] __cpufreq_remove_dev.isra.14+0x80/0x3c0
+[ 60.278255] [<ffffffff815adc0d>] cpufreq_cpu_callback+0x38/0x4c
+[ 60.278265] [<ffffffff81071a4d>] notifier_call_chain+0x5d/0x110
+[ 60.278275] [<ffffffff81071b0e>] __raw_notifier_call_chain+0xe/0x10
+[ 60.278284] [<ffffffff815a0a68>] _cpu_down+0x88/0x330
+[ 60.278292] [<ffffffff81024cf7>] ? cpu_hotplug_driver_lock+0x17/0x20
+[ 60.278302] [<ffffffff815a0d46>] cpu_down+0x36/0x50
+[ 60.278311] [<ffffffff815a2748>] store_online+0x98/0xd0
+[ 60.278320] [<ffffffff81452a28>] dev_attr_store+0x18/0x30
+[ 60.278329] [<ffffffff811d9edb>] sysfs_write_file+0xdb/0x150
+[ 60.278337] [<ffffffff8116806d>] vfs_write+0xbd/0x1f0
+[ 60.278347] [<ffffffff81185950>] ? fget_light+0x320/0x4b0
+[ 60.278355] [<ffffffff811686fc>] SyS_write+0x4c/0xa0
+[ 60.278364] [<ffffffff815bbbbe>] tracesys+0xd0/0xd5
+[ 60.280582] smpboot: CPU 1 is now offline
+
+The intention of that commit was to avoid warnings during CPU
+hotplug, which indicated that offline CPUs were getting IPIs from the
+cpufreq governor's work items. But the real root-cause of that
+problem was commit a66b2e5 (cpufreq: Preserve sysfs files across
+suspend/resume) because it totally skipped all the cpufreq callbacks
+during CPU hotplug in the suspend/resume path, and hence it never
+actually shut down the cpufreq governor's worker threads during CPU
+offline in the suspend/resume path.
+
+Reflecting back, the reason why we never suspected that commit as the
+root-cause earlier, was that the original issue was reported with
+just the halt command and nobody had brought in suspend/resume to the
+equation.
+
+The reason for _that_ in turn, as it turns out, is that earlier
+halt/shutdown was being done by disabling non-boot CPUs while tasks
+were frozen, just like suspend/resume.... but commit cf7df378a
+(reboot: migrate shutdown/reboot to boot cpu) which came somewhere
+along that very same time changed that logic: shutdown/halt no longer
+takes CPUs offline. Thus, the test-cases for reproducing the bug
+were vastly different and thus we went totally off the trail.
+
+Overall, it was one hell of a confusion with so many commits
+affecting each other and also affecting the symptoms of the problems
+in subtle ways. Finally, now since the original problematic commit
+(a66b2e5) has been completely reverted, revert this intermediate fix
+too (2f7021a8), to fix the CPU hotplug deadlock. Phew!
+
+Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Reported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Tested-by: Peter Wu <lekensteyn@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq_governor.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -26,7 +26,6 @@
+ #include <linux/tick.h>
+ #include <linux/types.h>
+ #include <linux/workqueue.h>
+-#include <linux/cpu.h>
+
+ #include "cpufreq_governor.h"
+
+@@ -181,10 +180,8 @@ void gov_queue_work(struct dbs_data *dbs
+ if (!all_cpus) {
+ __gov_queue_work(smp_processor_id(), dbs_data, delay);
+ } else {
+- get_online_cpus();
+ for_each_cpu(i, policy->cpus)
+ __gov_queue_work(i, dbs_data, delay);
+- put_online_cpus();
+ }
+ }
+ EXPORT_SYMBOL_GPL(gov_queue_work);
--- /dev/null
+From aae760ed21cd690fe8a6db9f3a177ad55d7e12ab Mon Sep 17 00:00:00 2001
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+Date: Fri, 12 Jul 2013 03:45:37 +0530
+Subject: cpufreq: Revert commit a66b2e to fix suspend/resume regression
+
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+
+commit aae760ed21cd690fe8a6db9f3a177ad55d7e12ab upstream.
+
+commit a66b2e (cpufreq: Preserve sysfs files across suspend/resume)
+has unfortunately caused several things in the cpufreq subsystem to
+break subtly after a suspend/resume cycle.
+
+The intention of that patch was to retain the file permissions of the
+cpufreq related sysfs files across suspend/resume. To achieve that,
+the commit completely removed the calls to cpufreq_add_dev() and
+__cpufreq_remove_dev() during suspend/resume transitions. But the
+problem is that those functions do 2 kinds of things:
+ 1. Low-level initialization/tear-down that are critical to the
+ correct functioning of cpufreq-core.
+ 2. Kobject and sysfs related initialization/teardown.
+
+Ideally we should have reorganized the code to cleanly separate these
+two responsibilities, and skipped only the sysfs related parts during
+suspend/resume. Since we skipped the entire callbacks instead (which
+also included some CPU and cpufreq-specific critical components),
+cpufreq subsystem started behaving erratically after suspend/resume.
+
+So revert the commit to fix the regression. We'll revisit and address
+the original goal of that commit separately, since it involves quite a
+bit of careful code reorganization and appears to be non-trivial.
+
+(While reverting the commit, note that another commit f51e1eb
+ (cpufreq: Fix cpufreq regression after suspend/resume) already
+ reverted part of the original set of changes. So revert only the
+ remaining ones).
+
+Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Tested-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 4 +++-
+ drivers/cpufreq/cpufreq_stats.c | 6 ++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1837,13 +1837,15 @@ static int __cpuinit cpufreq_cpu_callbac
+ if (dev) {
+ switch (action) {
+ case CPU_ONLINE:
++ case CPU_ONLINE_FROZEN:
+ cpufreq_add_dev(dev, NULL);
+ break;
+ case CPU_DOWN_PREPARE:
+- case CPU_UP_CANCELED_FROZEN:
++ case CPU_DOWN_PREPARE_FROZEN:
+ __cpufreq_remove_dev(dev, NULL);
+ break;
+ case CPU_DOWN_FAILED:
++ case CPU_DOWN_FAILED_FROZEN:
+ cpufreq_add_dev(dev, NULL);
+ break;
+ }
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -353,13 +353,11 @@ static int __cpuinit cpufreq_stat_cpu_ca
+ cpufreq_update_policy(cpu);
+ break;
+ case CPU_DOWN_PREPARE:
++ case CPU_DOWN_PREPARE_FROZEN:
+ cpufreq_stats_free_sysfs(cpu);
+ break;
+ case CPU_DEAD:
+- cpufreq_stats_free_table(cpu);
+- break;
+- case CPU_UP_CANCELED_FROZEN:
+- cpufreq_stats_free_sysfs(cpu);
++ case CPU_DEAD_FROZEN:
+ cpufreq_stats_free_table(cpu);
+ break;
+ }
--- /dev/null
+From 41fa9a944fce1d7efd5ee3d50ac85b92f42dcc3d Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 23 Jun 2013 13:04:04 -0700
+Subject: hwmon: (nct6775) Drop unsupported fan alarm attributes for NCT6775
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 41fa9a944fce1d7efd5ee3d50ac85b92f42dcc3d upstream.
+
+NCT6775 does not support alarms for fans 4 and 5. Drop the attributes.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct6775.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -199,7 +199,7 @@ static const s8 NCT6775_ALARM_BITS[] = {
+ 0, 1, 2, 3, 8, 21, 20, 16, /* in0.. in7 */
+ 17, -1, -1, -1, -1, -1, -1, /* in8..in14 */
+ -1, /* unused */
+- 6, 7, 11, 10, 23, /* fan1..fan5 */
++ 6, 7, 11, -1, -1, /* fan1..fan5 */
+ -1, -1, -1, /* unused */
+ 4, 5, 13, -1, -1, -1, /* temp1..temp6 */
+ 12, -1 }; /* intrusion0, intrusion1 */
+@@ -3877,10 +3877,12 @@ static int nct6775_probe(struct platform
+ &sda_fan_input[i].dev_attr);
+ if (err)
+ goto exit_remove;
+- err = device_create_file(dev,
+- &sda_fan_alarm[i].dev_attr);
+- if (err)
+- goto exit_remove;
++ if (data->ALARM_BITS[FAN_ALARM_BASE + i] >= 0) {
++ err = device_create_file(dev,
++ &sda_fan_alarm[i].dev_attr);
++ if (err)
++ goto exit_remove;
++ }
+ if (data->kind != nct6776 &&
+ data->kind != nct6779) {
+ err = device_create_file(dev,
--- /dev/null
+From b1d2bff6a61140454b9d203519cc686a2e9ef32f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 22 Jun 2013 16:15:31 -0700
+Subject: hwmon: (nct6775) Fix temperature alarm attributes
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit b1d2bff6a61140454b9d203519cc686a2e9ef32f upstream.
+
+Driver displays wrong alarms for temperature attributes.
+
+Turns out that temperature alarm bits are not fixed, but determined
+by temperature source mapping. To fix the problem, walk through
+the temperature sources to determine the correct alarm bit associated
+with a given attribute.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct6775.c | 80 ++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 57 insertions(+), 23 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -625,6 +625,7 @@ struct nct6775_data {
+ u8 has_fan_min; /* some fans don't have min register */
+ bool has_fan_div;
+
++ u8 num_temp_alarms; /* 2 or 3 */
+ u8 temp_fixed_num; /* 3 or 6 */
+ u8 temp_type[NUM_TEMP_FIXED];
+ s8 temp_offset[NUM_TEMP_FIXED];
+@@ -1193,6 +1194,42 @@ show_alarm(struct device *dev, struct de
+ (unsigned int)((data->alarms >> nr) & 0x01));
+ }
+
++static int find_temp_source(struct nct6775_data *data, int index, int count)
++{
++ int source = data->temp_src[index];
++ int nr;
++
++ for (nr = 0; nr < count; nr++) {
++ int src;
++
++ src = nct6775_read_value(data,
++ data->REG_TEMP_SOURCE[nr]) & 0x1f;
++ if (src == source)
++ return nr;
++ }
++ return -1;
++}
++
++static ssize_t
++show_temp_alarm(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ struct sensor_device_attribute *sattr = to_sensor_dev_attr(attr);
++ struct nct6775_data *data = nct6775_update_device(dev);
++ unsigned int alarm = 0;
++ int nr;
++
++ /*
++ * For temperatures, there is no fixed mapping from registers to alarm
++ * bits. Alarm bits are determined by the temperature source mapping.
++ */
++ nr = find_temp_source(data, sattr->index, data->num_temp_alarms);
++ if (nr >= 0) {
++ int bit = data->ALARM_BITS[nr + TEMP_ALARM_BASE];
++ alarm = (data->alarms >> bit) & 0x01;
++ }
++ return sprintf(buf, "%u\n", alarm);
++}
++
+ static SENSOR_DEVICE_ATTR_2(in0_input, S_IRUGO, show_in_reg, NULL, 0, 0);
+ static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO, show_in_reg, NULL, 1, 0);
+ static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO, show_in_reg, NULL, 2, 0);
+@@ -1874,22 +1911,18 @@ static struct sensor_device_attribute sd
+ };
+
+ static struct sensor_device_attribute sda_temp_alarm[] = {
+- SENSOR_ATTR(temp1_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE),
+- SENSOR_ATTR(temp2_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE + 1),
+- SENSOR_ATTR(temp3_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE + 2),
+- SENSOR_ATTR(temp4_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE + 3),
+- SENSOR_ATTR(temp5_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE + 4),
+- SENSOR_ATTR(temp6_alarm, S_IRUGO, show_alarm, NULL,
+- TEMP_ALARM_BASE + 5),
++ SENSOR_ATTR(temp1_alarm, S_IRUGO, show_temp_alarm, NULL, 0),
++ SENSOR_ATTR(temp2_alarm, S_IRUGO, show_temp_alarm, NULL, 1),
++ SENSOR_ATTR(temp3_alarm, S_IRUGO, show_temp_alarm, NULL, 2),
++ SENSOR_ATTR(temp4_alarm, S_IRUGO, show_temp_alarm, NULL, 3),
++ SENSOR_ATTR(temp5_alarm, S_IRUGO, show_temp_alarm, NULL, 4),
++ SENSOR_ATTR(temp6_alarm, S_IRUGO, show_temp_alarm, NULL, 5),
++ SENSOR_ATTR(temp7_alarm, S_IRUGO, show_temp_alarm, NULL, 6),
++ SENSOR_ATTR(temp8_alarm, S_IRUGO, show_temp_alarm, NULL, 7),
++ SENSOR_ATTR(temp9_alarm, S_IRUGO, show_temp_alarm, NULL, 8),
++ SENSOR_ATTR(temp10_alarm, S_IRUGO, show_temp_alarm, NULL, 9),
+ };
+
+-#define NUM_TEMP_ALARM ARRAY_SIZE(sda_temp_alarm)
+-
+ static ssize_t
+ show_pwm_mode(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+@@ -3215,13 +3248,11 @@ static void nct6775_device_remove_files(
+ device_remove_file(dev, &sda_temp_max[i].dev_attr);
+ device_remove_file(dev, &sda_temp_max_hyst[i].dev_attr);
+ device_remove_file(dev, &sda_temp_crit[i].dev_attr);
++ device_remove_file(dev, &sda_temp_alarm[i].dev_attr);
+ if (!(data->have_temp_fixed & (1 << i)))
+ continue;
+ device_remove_file(dev, &sda_temp_type[i].dev_attr);
+ device_remove_file(dev, &sda_temp_offset[i].dev_attr);
+- if (i >= NUM_TEMP_ALARM)
+- continue;
+- device_remove_file(dev, &sda_temp_alarm[i].dev_attr);
+ }
+
+ device_remove_file(dev, &sda_caseopen[0].dev_attr);
+@@ -3419,6 +3450,7 @@ static int nct6775_probe(struct platform
+ data->auto_pwm_num = 6;
+ data->has_fan_div = true;
+ data->temp_fixed_num = 3;
++ data->num_temp_alarms = 3;
+
+ data->ALARM_BITS = NCT6775_ALARM_BITS;
+
+@@ -3483,6 +3515,7 @@ static int nct6775_probe(struct platform
+ data->auto_pwm_num = 4;
+ data->has_fan_div = false;
+ data->temp_fixed_num = 3;
++ data->num_temp_alarms = 3;
+
+ data->ALARM_BITS = NCT6776_ALARM_BITS;
+
+@@ -3547,6 +3580,7 @@ static int nct6775_probe(struct platform
+ data->auto_pwm_num = 4;
+ data->has_fan_div = false;
+ data->temp_fixed_num = 6;
++ data->num_temp_alarms = 2;
+
+ data->ALARM_BITS = NCT6779_ALARM_BITS;
+
+@@ -3897,6 +3931,12 @@ static int nct6775_probe(struct platform
+ if (err)
+ goto exit_remove;
+ }
++ if (find_temp_source(data, i, data->num_temp_alarms) >= 0) {
++ err = device_create_file(dev,
++ &sda_temp_alarm[i].dev_attr);
++ if (err)
++ goto exit_remove;
++ }
+ if (!(data->have_temp_fixed & (1 << i)))
+ continue;
+ err = device_create_file(dev, &sda_temp_type[i].dev_attr);
+@@ -3905,12 +3945,6 @@ static int nct6775_probe(struct platform
+ err = device_create_file(dev, &sda_temp_offset[i].dev_attr);
+ if (err)
+ goto exit_remove;
+- if (i >= NUM_TEMP_ALARM ||
+- data->ALARM_BITS[TEMP_ALARM_BASE + i] < 0)
+- continue;
+- err = device_create_file(dev, &sda_temp_alarm[i].dev_attr);
+- if (err)
+- goto exit_remove;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(sda_caseopen); i++) {
--- /dev/null
+From b996ac90f595dda271cbd858b136b45557fc1a57 Mon Sep 17 00:00:00 2001
+From: Shane Huang <shane.huang@amd.com>
+Date: Mon, 3 Jun 2013 18:24:55 +0800
+Subject: i2c-piix4: Add AMD CZ SMBus device ID
+
+From: Shane Huang <shane.huang@amd.com>
+
+commit b996ac90f595dda271cbd858b136b45557fc1a57 upstream.
+
+To add AMD CZ SMBus controller device ID.
+
+[bhelgaas: drop pci_ids.h update]
+Signed-off-by: Shane Huang <shane.huang@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/i2c/busses/i2c-piix4 | 2 +-
+ drivers/i2c/busses/Kconfig | 1 +
+ drivers/i2c/busses/i2c-piix4.c | 3 ++-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/Documentation/i2c/busses/i2c-piix4
++++ b/Documentation/i2c/busses/i2c-piix4
+@@ -13,7 +13,7 @@ Supported adapters:
+ * AMD SP5100 (SB700 derivative found on some server mainboards)
+ Datasheet: Publicly available at the AMD website
+ http://support.amd.com/us/Embedded_TechDocs/44413.pdf
+- * AMD Hudson-2
++ * AMD Hudson-2, CZ
+ Datasheet: Not publicly available
+ * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
+ Datasheet: Publicly available at the SMSC website http://www.smsc.com
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -150,6 +150,7 @@ config I2C_PIIX4
+ ATI SB700/SP5100
+ ATI SB800
+ AMD Hudson-2
++ AMD CZ
+ Serverworks OSB4
+ Serverworks CSB5
+ Serverworks CSB6
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -22,7 +22,7 @@
+ Intel PIIX4, 440MX
+ Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
+ ATI IXP200, IXP300, IXP400, SB600, SB700/SP5100, SB800
+- AMD Hudson-2
++ AMD Hudson-2, CZ
+ SMSC Victory66
+
+ Note: we assume there can only be one device, with one or more
+@@ -522,6 +522,7 @@ static DEFINE_PCI_DEVICE_TABLE(piix4_ids
+ { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x790b) },
+ { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ PCI_DEVICE_ID_SERVERWORKS_OSB4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
--- /dev/null
+From 1c297a66654a3295ae87e2b7f3724d214eb2b5ec Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Mon, 1 Jul 2013 15:20:00 +0100
+Subject: iio: Fix iio_channel_has_info
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit 1c297a66654a3295ae87e2b7f3724d214eb2b5ec upstream.
+
+Since the info_mask split, iio_channel_has_info() is not working correctly.
+info_mask_separate and info_mask_shared_by_type, it is not possible to compare
+them directly with the iio_chan_info_enum enum. Correct that bit using the BIT()
+macro.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/iio/iio.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/iio/iio.h
++++ b/include/linux/iio/iio.h
+@@ -211,8 +211,8 @@ struct iio_chan_spec {
+ static inline bool iio_channel_has_info(const struct iio_chan_spec *chan,
+ enum iio_chan_info_enum type)
+ {
+- return (chan->info_mask_separate & type) |
+- (chan->info_mask_shared_by_type & type);
++ return (chan->info_mask_separate & BIT(type)) |
++ (chan->info_mask_shared_by_type & BIT(type));
+ }
+
+ #define IIO_ST(si, rb, sb, sh) \
--- /dev/null
+From f91d1b63a4e096d3023aaaafec9d9d3aff25997f Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Mon, 1 Jul 2013 17:40:00 +0100
+Subject: iio: inkern: fix iio_convert_raw_to_processed_unlocked
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit f91d1b63a4e096d3023aaaafec9d9d3aff25997f upstream.
+
+When reading IIO_CHAN_INFO_OFFSET, the return value of iio_channel_read() for
+success will be IIO_VAL*, checking for 0 is not correct.
+
+Without this fix the offset applied by iio drivers will be ignored when
+converting a raw value to one in appropriate base units (e.g mV) in
+a IIO client drivers that use iio_convert_raw_to_processed including
+iio-hwmon.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -451,7 +451,7 @@ static int iio_convert_raw_to_processed_
+ int ret;
+
+ ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET);
+- if (ret == 0)
++ if (ret >= 0)
+ raw64 += offset;
+
+ scale_type = iio_channel_read(chan, &scale_val, &scale_val2,
--- /dev/null
+From 7a87718d92760fc688628ad6a430643dafa16f1f Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 11 Jun 2013 00:11:36 -0700
+Subject: libata: skip SRST for all SIMG [34]7x port-multipliers
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 7a87718d92760fc688628ad6a430643dafa16f1f upstream.
+
+For some reason, a lot of port-multipliers have issues with softreset.
+SIMG [34]7x series port-multipliers have been quite erratic in this
+regard. I recall that it was better with some firmware revisions and
+the current list of quirks worked fine for a while. I think it got
+worse with later firmwares or maybe my test coverage wasn't good
+enough. Anyways, HPA is reporting that his 3726 setup suffers SRST
+failures and then the PMP gets confused and fails to probe the last
+port.
+
+The hope was that we try to stick to the standard as much as possible
+and soonish the PMPs and their firmwares will improve in quality, so
+the quirk list was kept to minimum. Well, it seems like that's never
+gonna happen.
+
+Let's set NO_SRST for all [34]7x PMPs so that whatever remaining
+userbase of the device suffer the least. Maybe we should do the same
+for 57xx's but unfortunately I don't have any device left to test and
+I'm not even sure 57xx's have ever been made widely available, so
+let's leave those alone for now.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-pmp.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -389,9 +389,13 @@ static void sata_pmp_quirks(struct ata_p
+ /* link reports offline after LPM */
+ link->flags |= ATA_LFLAG_NO_LPM;
+
+- /* Class code report is unreliable. */
++ /*
++ * Class code report is unreliable and SRST times
++ * out under certain configurations.
++ */
+ if (link->pmp < 5)
+- link->flags |= ATA_LFLAG_ASSUME_ATA;
++ link->flags |= ATA_LFLAG_NO_SRST |
++ ATA_LFLAG_ASSUME_ATA;
+
+ /* port 5 is for SEMB device and it doesn't like SRST */
+ if (link->pmp == 5)
+@@ -399,20 +403,17 @@ static void sata_pmp_quirks(struct ata_p
+ ATA_LFLAG_ASSUME_SEMB;
+ }
+ } else if (vendor == 0x1095 && devid == 0x4723) {
+- /* sil4723 quirks */
+- ata_for_each_link(link, ap, EDGE) {
+- /* link reports offline after LPM */
+- link->flags |= ATA_LFLAG_NO_LPM;
+-
+- /* class code report is unreliable */
+- if (link->pmp < 2)
+- link->flags |= ATA_LFLAG_ASSUME_ATA;
+-
+- /* the config device at port 2 locks up on SRST */
+- if (link->pmp == 2)
+- link->flags |= ATA_LFLAG_NO_SRST |
+- ATA_LFLAG_ASSUME_ATA;
+- }
++ /*
++ * sil4723 quirks
++ *
++ * Link reports offline after LPM. Class code report is
++ * unreliable. SIMG PMPs never got SRST reliable and the
++ * config device at port 2 locks up on SRST.
++ */
++ ata_for_each_link(link, ap, EDGE)
++ link->flags |= ATA_LFLAG_NO_LPM |
++ ATA_LFLAG_NO_SRST |
++ ATA_LFLAG_ASSUME_ATA;
+ } else if (vendor == 0x1095 && devid == 0x4726) {
+ /* sil4726 quirks */
+ ata_for_each_link(link, ap, EDGE) {
--- /dev/null
+From d0887c43f51c308b01605346e55d906ba858a6f9 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Sun, 23 Jun 2013 23:25:04 +0400
+Subject: libata-zpodd: must use ata_tf_init()
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+commit d0887c43f51c308b01605346e55d906ba858a6f9 upstream.
+
+There are some SATA controllers which have both devices 0 and 1 but this module
+just zeroes out taskfile and sets then ATA_TFLAG_DEVICE (not sure that's needed)
+which could lead to a wrong device being selected just before issuing command.
+Thus we should call ata_tf_init() which sets up the device register value
+properly, like all other users of ata_exec_internal() do...
+
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-zpodd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -32,13 +32,14 @@ struct zpodd {
+
+ static int eject_tray(struct ata_device *dev)
+ {
+- struct ata_taskfile tf = {};
++ struct ata_taskfile tf;
+ const char cdb[] = { GPCMD_START_STOP_UNIT,
+ 0, 0, 0,
+ 0x02, /* LoEj */
+ 0, 0, 0, 0, 0, 0, 0,
+ };
+
++ ata_tf_init(dev, &tf);
+ tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ tf.command = ATA_CMD_PACKET;
+ tf.protocol = ATAPI_PROT_NODATA;
+@@ -52,8 +53,7 @@ static enum odd_mech_type zpodd_get_mech
+ char buf[16];
+ unsigned int ret;
+ struct rm_feature_desc *desc = (void *)(buf + 8);
+- struct ata_taskfile tf = {};
+-
++ struct ata_taskfile tf;
+ char cdb[] = { GPCMD_GET_CONFIGURATION,
+ 2, /* only 1 feature descriptor requested */
+ 0, 3, /* 3, removable medium feature */
+@@ -62,6 +62,7 @@ static enum odd_mech_type zpodd_get_mech
+ 0, 0, 0,
+ };
+
++ ata_tf_init(dev, &tf);
+ tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ tf.command = ATA_CMD_PACKET;
+ tf.protocol = ATAPI_PROT_PIO;
--- /dev/null
+From 1376512065b23f39d5f9a160948f313397dde972 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 4 Jul 2013 16:41:53 +1000
+Subject: md/raid10: fix bug which causes all RAID10 reshapes to move no data.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 1376512065b23f39d5f9a160948f313397dde972 upstream.
+
+The recent comment:
+commit 7e83ccbecd608b971f340e951c9e84cd0343002f
+ md/raid10: Allow skipping recovery when clean arrays are assembled
+
+Causes raid10 to skip a recovery in certain cases where it is safe to
+do so. Unfortunately it also causes a reshape to be skipped which is
+never safe. The result is that an attempt to reshape a RAID10 will
+appear to complete instantly, but no data will have been moves so the
+array will now contain garbage.
+(If nothing is written, you can recovery by simple performing the
+reverse reshape which will also complete instantly).
+
+Bug was introduced in 3.10, so this is suitable for 3.10-stable.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Cc: Martin Wilck <mwilck@arcor.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2909,14 +2909,13 @@ static sector_t sync_request(struct mdde
+ */
+ if (mddev->bitmap == NULL &&
+ mddev->recovery_cp == MaxSector &&
++ mddev->reshape_position == MaxSector &&
++ !test_bit(MD_RECOVERY_SYNC, &mddev->recovery) &&
+ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
++ !test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ conf->fullsync == 0) {
+ *skipped = 1;
+- max_sector = mddev->dev_sectors;
+- if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ||
+- test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
+- max_sector = mddev->resync_max_sectors;
+- return max_sector - sector_nr;
++ return mddev->dev_sectors - sector_nr;
+ }
+
+ skipped:
--- /dev/null
+From 78eaa0d4cbcdb345992fa3dd22b3bcbb473cc064 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 2 Jul 2013 15:58:05 +1000
+Subject: md/raid10: fix two bugs affecting RAID10 reshape.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 78eaa0d4cbcdb345992fa3dd22b3bcbb473cc064 upstream.
+
+1/ If a RAID10 is being reshaped to a fewer number of devices
+ and is stopped while this is ongoing, then when the array is
+ reassembled the 'mirrors' array will be allocated too small.
+ This will lead to an access error or memory corruption.
+
+2/ A sanity test for a reshaping RAID10 array is restarted
+ is slightly incorrect.
+
+Due to the first bug, this is suitable for any -stable
+kernel since 3.5 where this code was introduced.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3531,7 +3531,7 @@ static struct r10conf *setup_conf(struct
+
+ /* FIXME calc properly */
+ conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks +
+- max(0,mddev->delta_disks)),
++ max(0,-mddev->delta_disks)),
+ GFP_KERNEL);
+ if (!conf->mirrors)
+ goto out;
+@@ -3690,7 +3690,7 @@ static int run(struct mddev *mddev)
+ conf->geo.far_offset == 0)
+ goto out_free_conf;
+ if (conf->prev.far_copies != 1 &&
+- conf->geo.far_offset == 0)
++ conf->prev.far_offset == 0)
+ goto out_free_conf;
+ }
+
--- /dev/null
+From 7bb23c4934059c64cbee2e41d5d24ce122285176 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 16 Jul 2013 16:50:47 +1000
+Subject: md/raid10: fix two problems with RAID10 resync.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 7bb23c4934059c64cbee2e41d5d24ce122285176 upstream.
+
+1/ When an different between blocks is found, data is copied from
+ one bio to the other. However bv_len is used as the length to
+ copy and this could be zero. So use r10_bio->sectors to calculate
+ length instead.
+ Using bv_len was probably always a bit dubious, but the introduction
+ of bio_advance made it much more likely to be a problem.
+
+2/ When preparing some blocks for sync, we don't set BIO_UPTODATE
+ except on bios that we schedule for a read. This ensures that
+ missing/failed devices don't confuse the loop at the top of
+ sync_request write.
+ Commit 8be185f2c9d54d6 "raid10: Use bio_reset()"
+ removed a loop which set BIO_UPTDATE on all appropriate bios.
+ So we need to re-add that flag.
+
+These bugs were introduced in 3.10, so this patch is suitable for
+3.10-stable, and can remove a potential for data corruption.
+
+Reported-by: Brassow Jonathan <jbrassow@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2075,11 +2075,17 @@ static void sync_request_write(struct md
+ * both 'first' and 'i', so we just compare them.
+ * All vec entries are PAGE_SIZE;
+ */
+- for (j = 0; j < vcnt; j++)
++ int sectors = r10_bio->sectors;
++ for (j = 0; j < vcnt; j++) {
++ int len = PAGE_SIZE;
++ if (sectors < (len / 512))
++ len = sectors * 512;
+ if (memcmp(page_address(fbio->bi_io_vec[j].bv_page),
+ page_address(tbio->bi_io_vec[j].bv_page),
+- fbio->bi_io_vec[j].bv_len))
++ len))
+ break;
++ sectors -= len/512;
++ }
+ if (j == vcnt)
+ continue;
+ atomic64_add(r10_bio->sectors, &mddev->resync_mismatches);
+@@ -3385,6 +3391,7 @@ static sector_t sync_request(struct mdde
+
+ if (bio->bi_end_io == end_sync_read) {
+ md_sync_acct(bio->bi_bdev, nr_sectors);
++ set_bit(BIO_UPTODATE, &bio->bi_flags);
+ generic_make_request(bio);
+ }
+ }
--- /dev/null
+From 0a6f3a8ebaf13407523c2c7d575b4ca2debd23ba Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sat, 22 Jun 2013 13:13:25 +0200
+Subject: rt2x00: read 5GHz TX power values from the correct offset
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+commit 0a6f3a8ebaf13407523c2c7d575b4ca2debd23ba upstream.
+
+The current code uses the same index value both
+for the channel information array and for the TX
+power table. The index starts from 14, however the
+index of the TX power table must start from zero.
+
+Fix it, in order to get the correct TX power value
+for a given channel.
+
+The changes in rt61pci.c and rt73usb.c are compile
+tested only.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c | 4 ++--
+ drivers/net/wireless/rt2x00/rt61pci.c | 3 ++-
+ drivers/net/wireless/rt2x00/rt73usb.c | 3 ++-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -6056,8 +6056,8 @@ static int rt2800_probe_hw_mode(struct r
+ default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+
+ for (i = 14; i < spec->num_channels; i++) {
+- info[i].default_power1 = default_power1[i];
+- info[i].default_power2 = default_power2[i];
++ info[i].default_power1 = default_power1[i - 14];
++ info[i].default_power2 = default_power2[i - 14];
+ }
+ }
+
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2825,7 +2825,8 @@ static int rt61pci_probe_hw_mode(struct
+ tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+- info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
++ info[i].default_power1 =
++ TXPOWER_FROM_DEV(tx_power[i - 14]);
+ }
+ }
+
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2167,7 +2167,8 @@ static int rt73usb_probe_hw_mode(struct
+ tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
+ for (i = 14; i < spec->num_channels; i++) {
+ info[i].max_power = MAX_TXPOWER;
+- info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
++ info[i].default_power1 =
++ TXPOWER_FROM_DEV(tx_power[i - 14]);
+ }
+ }
+
--- /dev/null
+From 0847beb2865f5ef1c8626ec1a37def18f3d6c41a Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Tue, 25 Jun 2013 22:57:29 +0200
+Subject: rt2x00: rt2800lib: fix default TX power check for RT55xx
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+commit 0847beb2865f5ef1c8626ec1a37def18f3d6c41a upstream.
+
+The code writes the default_power2 value into the TX field
+of the RFCSR50 register, however the condition in the if
+statement uses default_power1. Due to this, wrong TX power
+value might be written into the register.
+
+Use the correct value in the condition to fix the issue.
+
+Compile tested only.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -2392,7 +2392,7 @@ static void rt2800_config_channel_rf55xx
+ rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
+
+ rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
+- if (info->default_power1 > power_bound)
++ if (info->default_power2 > power_bound)
+ rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
+ else
+ rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
--- /dev/null
+From ddfef5de3d716f77bad32dbbba6b280158dfd721 Mon Sep 17 00:00:00 2001
+From: Mark Langsdorf <mark.langsdorf@calxeda.com>
+Date: Mon, 3 Jun 2013 08:22:54 -0500
+Subject: sata_highbank: increase retry count but shorten duration for
+ Calxeda controller
+
+From: Mark Langsdorf <mark.langsdorf@calxeda.com>
+
+commit ddfef5de3d716f77bad32dbbba6b280158dfd721 upstream.
+
+Increase the retry count for the hard reset function to 100 but
+shorten the time out period to 500 ms. See the comment for
+ahci_highbank_hardreset for the reasons why those vaulues were
+chosen.
+
+Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/sata_highbank.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/sata_highbank.c
++++ b/drivers/ata/sata_highbank.c
+@@ -196,10 +196,26 @@ static int highbank_initialize_phys(stru
+ return 0;
+ }
+
++/*
++ * The Calxeda SATA phy intermittently fails to bring up a link with Gen3
++ * Retrying the phy hard reset can work around the issue, but the drive
++ * may fail again. In less than 150 out of 15000 test runs, it took more
++ * than 10 tries for the link to be established (but never more than 35).
++ * Triple the maximum observed retry count to provide plenty of margin for
++ * rare events and to guarantee that the link is established.
++ *
++ * Also, the default 2 second time-out on a failed drive is too long in
++ * this situation. The uboot implementation of the same driver function
++ * uses a much shorter time-out period and never experiences a time out
++ * issue. Reducing the time-out to 500ms improves the responsiveness.
++ * The other timing constants were kept the same as the stock AHCI driver.
++ * This change was also tested 15000 times on 24 drives and none of them
++ * experienced a time out.
++ */
+ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline)
+ {
+- const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++ static const unsigned long timing[] = { 5, 100, 500};
+ struct ata_port *ap = link->ap;
+ struct ahci_port_priv *pp = ap->private_data;
+ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
+@@ -207,7 +223,7 @@ static int ahci_highbank_hardreset(struc
+ bool online;
+ u32 sstatus;
+ int rc;
+- int retry = 10;
++ int retry = 100;
+
+ ahci_stop_engine(ap);
+
powerpc-perf-freeze-pmc5-6-if-we-re-not-using-them.patch
powerpc-perf-use-existing-out-label-in-power_pmu_enable.patch
powerpc-perf-don-t-enable-if-we-have-zero-events.patch
+cpufreq-revert-commit-a66b2e-to-fix-suspend-resume-regression.patch
+cpufreq-revert-commit-2f7021a8-to-fix-cpu-hotplug-regression.patch
+arm64-mm-don-t-treat-user-cache-maintenance-faults-as-writes.patch
+iio-fix-iio_channel_has_info.patch
+iio-inkern-fix-iio_convert_raw_to_processed_unlocked.patch
+alsa-hda-fix-eapd-vmaster-hook-for-ad1884-co.patch
+alsa-hda-fix-return-value-of-snd_hda_check_power_state.patch
+alsa-hda-cache-the-mux-selection-for-generic-hdmi.patch
+alsa-hda-fix-missing-mic-boost-controls-for-via-codecs.patch
+alsa-hda-fix-the-max-length-of-control-name-in-generic-parser.patch
+alsa-hda-add-new-gpu-codec-id-to-snd-hda.patch
+alsa-seq-oss-initialize-midi-clients-asynchronously.patch
+alsa-6fire-fix-unlocked-snd_pcm_stop-call.patch
+alsa-ua101-fix-unlocked-snd_pcm_stop-call.patch
+alsa-pxa2xx-fix-unlocked-snd_pcm_stop-call.patch
+alsa-atiixp-fix-unlocked-snd_pcm_stop-call.patch
+alsa-asihpi-fix-unlocked-snd_pcm_stop-call.patch
+alsa-usx2y-fix-unlocked-snd_pcm_stop-call.patch
+hwmon-nct6775-fix-temperature-alarm-attributes.patch
+hwmon-nct6775-drop-unsupported-fan-alarm-attributes-for-nct6775.patch
+libata-zpodd-must-use-ata_tf_init.patch
+libata-skip-srst-for-all-simg-7x-port-multipliers.patch
+ata_piix-ide-mode-sata-patch-for-intel-coleto-creek-deviceids.patch
+sata_highbank-increase-retry-count-but-shorten-duration-for.patch
+i2c-piix4-add-amd-cz-smbus-device-id.patch
+asoc-s6000-fix-unlocked-snd_pcm_stop-call.patch
+asoc-atmel-fix-unlocked-snd_pcm_stop-call.patch
+asoc-sglt5000-fix-sgtl5000_pll_frac_div_mask.patch
+md-raid10-fix-bug-which-causes-all-raid10-reshapes-to-move-no-data.patch
+md-raid10-fix-two-bugs-affecting-raid10-reshape.patch
+md-raid10-fix-two-problems-with-raid10-resync.patch
+tick-sanitize-broadcast-control-logic.patch
+tick-prevent-uncontrolled-switch-to-oneshot-mode.patch
+clocksource-dw_apb-fix-error-check.patch
+rt2x00-read-5ghz-tx-power-values-from-the-correct-offset.patch
+rt2x00-rt2800lib-fix-default-tx-power-check-for-rt55xx.patch
+ath9k_hw-assign-default-xlna-config-for-ar9485.patch
+ath9k-fix-noisefloor-calibration.patch
+ath9k-do-not-assign-noise-for-null-caldata.patch
--- /dev/null
+From 1f73a9806bdd07a5106409bbcab3884078bd34fe Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 1 Jul 2013 22:14:10 +0200
+Subject: tick: Prevent uncontrolled switch to oneshot mode
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 1f73a9806bdd07a5106409bbcab3884078bd34fe upstream.
+
+When the system switches from periodic to oneshot mode, the broadcast
+logic causes a possibility that a CPU which has not yet switched to
+oneshot mode puts its own clock event device into oneshot mode without
+updating the state and the timer handler.
+
+CPU0 CPU1
+ per cpu tickdev is in periodic mode
+ and switched to broadcast
+
+Switch to oneshot mode
+ tick_broadcast_switch_to_oneshot()
+ cpumask_copy(tick_oneshot_broacast_mask,
+ tick_broadcast_mask);
+
+ broadcast device mode = oneshot
+
+ Timer interrupt
+
+ irq_enter()
+ tick_check_oneshot_broadcast()
+ dev->set_mode(ONESHOT);
+
+ tick_handle_periodic()
+ if (dev->mode == ONESHOT)
+ dev->next_event += period;
+ FAIL.
+
+We fail, because dev->next_event contains KTIME_MAX, if the device was
+in periodic mode before the uncontrolled switch to oneshot happened.
+
+We must copy the broadcast bits over to the oneshot mask, because
+otherwise a CPU which relies on the broadcast would not been woken up
+anymore after the broadcast device switched to oneshot mode.
+
+So we need to verify in tick_check_oneshot_broadcast() whether the CPU
+has already switched to oneshot mode. If not, leave the device
+untouched and let the CPU switch controlled into oneshot mode.
+
+This is a long standing bug, which was never noticed, because the main
+user of the broadcast x86 cannot run into that scenario, AFAICT. The
+nonarchitected timer mess of ARM creates a gazillion of differently
+broken abominations which trigger the shortcomings of that broadcast
+code, which better had never been necessary in the first place.
+
+Reported-and-tested-by: Stehle Vincent-B46079 <B46079@freescale.com>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Cc: John Stultz <john.stultz@linaro.org>,
+Cc: Mark Rutland <mark.rutland@arm.com>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1307012153060.4013@ionos.tec.linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/tick-broadcast.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -522,7 +522,15 @@ void tick_check_oneshot_broadcast(int cp
+ if (cpumask_test_cpu(cpu, tick_broadcast_oneshot_mask)) {
+ struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
+
+- clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_ONESHOT);
++ /*
++ * We might be in the middle of switching over from
++ * periodic to oneshot. If the CPU has not yet
++ * switched over, leave the device alone.
++ */
++ if (td->mode == TICKDEV_MODE_ONESHOT) {
++ clockevents_set_mode(td->evtdev,
++ CLOCK_EVT_MODE_ONESHOT);
++ }
+ }
+ }
+
--- /dev/null
+From 07bd1172902e782f288e4d44b1fde7dec0f08b6f Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 1 Jul 2013 22:14:10 +0200
+Subject: tick: Sanitize broadcast control logic
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 07bd1172902e782f288e4d44b1fde7dec0f08b6f upstream.
+
+The recent implementation of a generic dummy timer resulted in a
+different registration order of per cpu local timers which made the
+broadcast control logic go belly up.
+
+If the dummy timer is the first clock event device which is registered
+for a CPU, then it is installed, the broadcast timer is initialized
+and the CPU is marked as broadcast target.
+
+If a real clock event device is installed after that, we can fail to
+take the CPU out of the broadcast mask. In the worst case we end up
+with two periodic timer events firing for the same CPU. One from the
+per cpu hardware device and one from the broadcast.
+
+Now the problem is that we have no way to distinguish whether the
+system is in a state which makes broadcasting necessary or the
+broadcast bit was set due to the nonfunctional dummy timer
+installment.
+
+To solve this we need to keep track of the system state seperately and
+provide a more detailed decision logic whether we keep the CPU in
+broadcast mode or not.
+
+The old decision logic only clears the broadcast mode, if the newly
+installed clock event device is not affected by power states.
+
+The new logic clears the broadcast mode if one of the following is
+true:
+
+ - The new device is not affected by power states.
+
+ - The system is not in a power state affected mode
+
+ - The system has switched to oneshot mode. The oneshot broadcast is
+ controlled from the deep idle state. The CPU is not in idle at
+ this point, so it's safe to remove it from the mask.
+
+If we clear the broadcast bit for the CPU when a new device is
+installed, we also shutdown the broadcast device when this was the
+last CPU in the broadcast mask.
+
+If the broadcast bit is kept, then we leave the new device in shutdown
+state and rely on the broadcast to deliver the timer interrupts via
+the broadcast ipis.
+
+Reported-and-tested-by: Stehle Vincent-B46079 <B46079@freescale.com>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Cc: John Stultz <john.stultz@linaro.org>,
+Cc: Mark Rutland <mark.rutland@arm.com>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1307012153060.4013@ionos.tec.linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/tick-broadcast.c | 70 ++++++++++++++++++++++++++++++++++++-------
+ kernel/time/tick-common.c | 3 +
+ 2 files changed, 61 insertions(+), 12 deletions(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -29,6 +29,7 @@
+
+ static struct tick_device tick_broadcast_device;
+ static cpumask_var_t tick_broadcast_mask;
++static cpumask_var_t tick_broadcast_on;
+ static cpumask_var_t tmpmask;
+ static DEFINE_RAW_SPINLOCK(tick_broadcast_lock);
+ static int tick_broadcast_force;
+@@ -123,8 +124,9 @@ static void tick_device_setup_broadcast_
+ */
+ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+ {
++ struct clock_event_device *bc = tick_broadcast_device.evtdev;
+ unsigned long flags;
+- int ret = 0;
++ int ret;
+
+ raw_spin_lock_irqsave(&tick_broadcast_lock, flags);
+
+@@ -138,20 +140,59 @@ int tick_device_uses_broadcast(struct cl
+ dev->event_handler = tick_handle_periodic;
+ tick_device_setup_broadcast_func(dev);
+ cpumask_set_cpu(cpu, tick_broadcast_mask);
+- tick_broadcast_start_periodic(tick_broadcast_device.evtdev);
++ tick_broadcast_start_periodic(bc);
+ ret = 1;
+ } else {
+ /*
+- * When the new device is not affected by the stop
+- * feature and the cpu is marked in the broadcast mask
+- * then clear the broadcast bit.
++ * Clear the broadcast bit for this cpu if the
++ * device is not power state affected.
+ */
+- if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+- int cpu = smp_processor_id();
++ if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
+ cpumask_clear_cpu(cpu, tick_broadcast_mask);
+- tick_broadcast_clear_oneshot(cpu);
+- } else {
++ else
+ tick_device_setup_broadcast_func(dev);
++
++ /*
++ * Clear the broadcast bit if the CPU is not in
++ * periodic broadcast on state.
++ */
++ if (!cpumask_test_cpu(cpu, tick_broadcast_on))
++ cpumask_clear_cpu(cpu, tick_broadcast_mask);
++
++ switch (tick_broadcast_device.mode) {
++ case TICKDEV_MODE_ONESHOT:
++ /*
++ * If the system is in oneshot mode we can
++ * unconditionally clear the oneshot mask bit,
++ * because the CPU is running and therefore
++ * not in an idle state which causes the power
++ * state affected device to stop. Let the
++ * caller initialize the device.
++ */
++ tick_broadcast_clear_oneshot(cpu);
++ ret = 0;
++ break;
++
++ case TICKDEV_MODE_PERIODIC:
++ /*
++ * If the system is in periodic mode, check
++ * whether the broadcast device can be
++ * switched off now.
++ */
++ if (cpumask_empty(tick_broadcast_mask) && bc)
++ clockevents_shutdown(bc);
++ /*
++ * If we kept the cpu in the broadcast mask,
++ * tell the caller to leave the per cpu device
++ * in shutdown state. The periodic interrupt
++ * is delivered by the broadcast device.
++ */
++ ret = cpumask_test_cpu(cpu, tick_broadcast_mask);
++ break;
++ default:
++ /* Nothing to do */
++ ret = 0;
++ break;
+ }
+ }
+ raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+@@ -281,6 +322,7 @@ static void tick_do_broadcast_on_off(uns
+ switch (*reason) {
+ case CLOCK_EVT_NOTIFY_BROADCAST_ON:
+ case CLOCK_EVT_NOTIFY_BROADCAST_FORCE:
++ cpumask_set_cpu(cpu, tick_broadcast_on);
+ if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_mask)) {
+ if (tick_broadcast_device.mode ==
+ TICKDEV_MODE_PERIODIC)
+@@ -290,8 +332,12 @@ static void tick_do_broadcast_on_off(uns
+ tick_broadcast_force = 1;
+ break;
+ case CLOCK_EVT_NOTIFY_BROADCAST_OFF:
+- if (!tick_broadcast_force &&
+- cpumask_test_and_clear_cpu(cpu, tick_broadcast_mask)) {
++ if (tick_broadcast_force)
++ break;
++ cpumask_clear_cpu(cpu, tick_broadcast_on);
++ if (!tick_device_is_functional(dev))
++ break;
++ if (cpumask_test_and_clear_cpu(cpu, tick_broadcast_mask)) {
+ if (tick_broadcast_device.mode ==
+ TICKDEV_MODE_PERIODIC)
+ tick_setup_periodic(dev, 0);
+@@ -349,6 +395,7 @@ void tick_shutdown_broadcast(unsigned in
+
+ bc = tick_broadcast_device.evtdev;
+ cpumask_clear_cpu(cpu, tick_broadcast_mask);
++ cpumask_clear_cpu(cpu, tick_broadcast_on);
+
+ if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC) {
+ if (bc && cpumask_empty(tick_broadcast_mask))
+@@ -792,6 +839,7 @@ bool tick_broadcast_oneshot_available(vo
+ void __init tick_broadcast_init(void)
+ {
+ zalloc_cpumask_var(&tick_broadcast_mask, GFP_NOWAIT);
++ zalloc_cpumask_var(&tick_broadcast_on, GFP_NOWAIT);
+ zalloc_cpumask_var(&tmpmask, GFP_NOWAIT);
+ #ifdef CONFIG_TICK_ONESHOT
+ zalloc_cpumask_var(&tick_broadcast_oneshot_mask, GFP_NOWAIT);
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -194,7 +194,8 @@ static void tick_setup_device(struct tic
+ * When global broadcasting is active, check if the current
+ * device is registered as a placeholder for broadcast mode.
+ * This allows us to handle this x86 misfeature in a generic
+- * way.
++ * way. This function also returns !=0 when we keep the
++ * current active broadcast state for this CPU.
+ */
+ if (tick_device_uses_broadcast(newdev, cpu))
+ return;
projects / thirdparty / kernel / stable-queue.git / commitdiff
