--- /dev/null
+From ea9d0d771fcd32cd56070819749477d511ec9117 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 4 Nov 2014 16:52:28 +0100
+Subject: ASoC: dpcm: Fix race between FE/BE updates and trigger
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ea9d0d771fcd32cd56070819749477d511ec9117 upstream.
+
+DPCM can update the FE/BE connection states totally asynchronously
+from the FE's PCM state. Most of FE/BE state changes are protected by
+mutex, so that they won't race, but there are still some actions that
+are uncovered. For example, suppose to switch a BE while a FE's
+stream is running. This would call soc_dpcm_runtime_update(), which
+sets FE's runtime_update flag, then sets up and starts BEs, and clears
+FE's runtime_update flag again.
+
+When a device emits XRUN during this operation, the PCM core triggers
+snd_pcm_stop(XRUN). Since the trigger action is an atomic ops, this
+isn't blocked by the mutex, thus it kicks off DPCM's trigger action.
+It eventually updates and clears FE's runtime_update flag while
+soc_dpcm_runtime_update() is running concurrently, and it results in
+confusion.
+
+Usually, for avoiding such a race, we take a lock. There is a PCM
+stream lock for that purpose. However, as already mentioned, the
+trigger action is atomic, and we can't take the lock for the whole
+soc_dpcm_runtime_update() or other operations that include the lengthy
+jobs like hw_params or prepare.
+
+This patch provides an alternative solution. This adds a way to defer
+the conflicting trigger callback to be executed at the end of FE/BE
+state changes. For doing it, two things are introduced:
+
+- Each runtime_update state change of FEs is protected via PCM stream
+ lock.
+- The FE's trigger callback checks the runtime_update flag. If it's
+ not set, the trigger action is executed there. If set, mark the
+ pending trigger action and returns immediately.
+- At the exit of runtime_update state change, it checks whether the
+ pending trigger is present. If yes, it executes the trigger action
+ at this point.
+
+Reported-and-tested-by: Qiao Zhou <zhouqiao@marvell.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/soc-dpcm.h | 2 +
+ sound/soc/soc-pcm.c | 72 ++++++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 58 insertions(+), 16 deletions(-)
+
+--- a/include/sound/soc-dpcm.h
++++ b/include/sound/soc-dpcm.h
+@@ -102,6 +102,8 @@ struct snd_soc_dpcm_runtime {
+ /* state and update */
+ enum snd_soc_dpcm_update runtime_update;
+ enum snd_soc_dpcm_state state;
++
++ int trigger_pending; /* trigger cmd + 1 if pending, 0 if not */
+ };
+
+ /* can this BE stop and free */
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1258,13 +1258,36 @@ static void dpcm_set_fe_runtime(struct s
+ dpcm_init_runtime_hw(runtime, &cpu_dai_drv->capture);
+ }
+
++static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd);
++
++/* Set FE's runtime_update state; the state is protected via PCM stream lock
++ * for avoiding the race with trigger callback.
++ * If the state is unset and a trigger is pending while the previous operation,
++ * process the pending trigger action here.
++ */
++static void dpcm_set_fe_update_state(struct snd_soc_pcm_runtime *fe,
++ int stream, enum snd_soc_dpcm_update state)
++{
++ struct snd_pcm_substream *substream =
++ snd_soc_dpcm_get_substream(fe, stream);
++
++ snd_pcm_stream_lock_irq(substream);
++ if (state == SND_SOC_DPCM_UPDATE_NO && fe->dpcm[stream].trigger_pending) {
++ dpcm_fe_dai_do_trigger(substream,
++ fe->dpcm[stream].trigger_pending - 1);
++ fe->dpcm[stream].trigger_pending = 0;
++ }
++ fe->dpcm[stream].runtime_update = state;
++ snd_pcm_stream_unlock_irq(substream);
++}
++
+ static int dpcm_fe_dai_startup(struct snd_pcm_substream *fe_substream)
+ {
+ struct snd_soc_pcm_runtime *fe = fe_substream->private_data;
+ struct snd_pcm_runtime *runtime = fe_substream->runtime;
+ int stream = fe_substream->stream, ret = 0;
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
+
+ ret = dpcm_be_dai_startup(fe, fe_substream->stream);
+ if (ret < 0) {
+@@ -1286,13 +1309,13 @@ static int dpcm_fe_dai_startup(struct sn
+ dpcm_set_fe_runtime(fe_substream);
+ snd_pcm_limit_hw_rates(runtime);
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+ return 0;
+
+ unwind:
+ dpcm_be_dai_startup_unwind(fe, fe_substream->stream);
+ be_err:
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+ return ret;
+ }
+
+@@ -1339,7 +1362,7 @@ static int dpcm_fe_dai_shutdown(struct s
+ struct snd_soc_pcm_runtime *fe = substream->private_data;
+ int stream = substream->stream;
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
+
+ /* shutdown the BEs */
+ dpcm_be_dai_shutdown(fe, substream->stream);
+@@ -1353,7 +1376,7 @@ static int dpcm_fe_dai_shutdown(struct s
+ dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_STOP);
+
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_CLOSE;
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+ return 0;
+ }
+
+@@ -1401,7 +1424,7 @@ static int dpcm_fe_dai_hw_free(struct sn
+ int err, stream = substream->stream;
+
+ mutex_lock_nested(&fe->card->mutex, SND_SOC_CARD_CLASS_RUNTIME);
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
+
+ dev_dbg(fe->dev, "ASoC: hw_free FE %s\n", fe->dai_link->name);
+
+@@ -1416,7 +1439,7 @@ static int dpcm_fe_dai_hw_free(struct sn
+ err = dpcm_be_dai_hw_free(fe, stream);
+
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+
+ mutex_unlock(&fe->card->mutex);
+ return 0;
+@@ -1509,7 +1532,7 @@ static int dpcm_fe_dai_hw_params(struct
+ int ret, stream = substream->stream;
+
+ mutex_lock_nested(&fe->card->mutex, SND_SOC_CARD_CLASS_RUNTIME);
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
+
+ memcpy(&fe->dpcm[substream->stream].hw_params, params,
+ sizeof(struct snd_pcm_hw_params));
+@@ -1532,7 +1555,7 @@ static int dpcm_fe_dai_hw_params(struct
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_PARAMS;
+
+ out:
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+ mutex_unlock(&fe->card->mutex);
+ return ret;
+ }
+@@ -1646,7 +1669,7 @@ int dpcm_be_dai_trigger(struct snd_soc_p
+ }
+ EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger);
+
+-static int dpcm_fe_dai_trigger(struct snd_pcm_substream *substream, int cmd)
++static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ {
+ struct snd_soc_pcm_runtime *fe = substream->private_data;
+ int stream = substream->stream, ret;
+@@ -1720,6 +1743,23 @@ out:
+ return ret;
+ }
+
++static int dpcm_fe_dai_trigger(struct snd_pcm_substream *substream, int cmd)
++{
++ struct snd_soc_pcm_runtime *fe = substream->private_data;
++ int stream = substream->stream;
++
++ /* if FE's runtime_update is already set, we're in race;
++ * process this trigger later at exit
++ */
++ if (fe->dpcm[stream].runtime_update != SND_SOC_DPCM_UPDATE_NO) {
++ fe->dpcm[stream].trigger_pending = cmd + 1;
++ return 0; /* delayed, assuming it's successful */
++ }
++
++ /* we're alone, let's trigger */
++ return dpcm_fe_dai_do_trigger(substream, cmd);
++}
++
+ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
+ {
+ struct snd_soc_dpcm *dpcm;
+@@ -1763,7 +1803,7 @@ static int dpcm_fe_dai_prepare(struct sn
+
+ dev_dbg(fe->dev, "ASoC: prepare FE %s\n", fe->dai_link->name);
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_FE);
+
+ /* there is no point preparing this FE if there are no BEs */
+ if (list_empty(&fe->dpcm[stream].be_clients)) {
+@@ -1790,7 +1830,7 @@ static int dpcm_fe_dai_prepare(struct sn
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
+
+ out:
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+ mutex_unlock(&fe->card->mutex);
+
+ return ret;
+@@ -1937,11 +1977,11 @@ static int dpcm_run_new_update(struct sn
+ {
+ int ret;
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_BE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_BE);
+ ret = dpcm_run_update_startup(fe, stream);
+ if (ret < 0)
+ dev_err(fe->dev, "ASoC: failed to startup some BEs\n");
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+
+ return ret;
+ }
+@@ -1950,11 +1990,11 @@ static int dpcm_run_old_update(struct sn
+ {
+ int ret;
+
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_BE;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_BE);
+ ret = dpcm_run_update_shutdown(fe, stream);
+ if (ret < 0)
+ dev_err(fe->dev, "ASoC: failed to shutdown some BEs\n");
+- fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
++ dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
+
+ return ret;
+ }
--- /dev/null
+From c1b9b9b1ad2df6144ca3fbe6989f7bd9ea5c5562 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Tue, 28 Oct 2014 21:01:53 -0700
+Subject: ASoC: fsi: remove unsupported PAUSE flag
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit c1b9b9b1ad2df6144ca3fbe6989f7bd9ea5c5562 upstream.
+
+FSI doesn't support PAUSE.
+Remove SNDRV_PCM_INFO_PAUSE flags from snd_pcm_hardware info
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/sh/fsi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/sh/fsi.c
++++ b/sound/soc/sh/fsi.c
+@@ -1785,8 +1785,7 @@ static const struct snd_soc_dai_ops fsi_
+ static struct snd_pcm_hardware fsi_pcm_hardware = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_MMAP |
+- SNDRV_PCM_INFO_MMAP_VALID |
+- SNDRV_PCM_INFO_PAUSE,
++ SNDRV_PCM_INFO_MMAP_VALID,
+ .buffer_bytes_max = 64 * 1024,
+ .period_bytes_min = 32,
+ .period_bytes_max = 8192,
--- /dev/null
+From 706c66213e5e623e23f521b1acbd8171af7a3549 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Tue, 28 Oct 2014 21:02:03 -0700
+Subject: ASoC: rsnd: remove unsupported PAUSE flag
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit 706c66213e5e623e23f521b1acbd8171af7a3549 upstream.
+
+R-Car sound doesn't support PAUSE.
+Remove SNDRV_PCM_INFO_PAUSE flags from snd_pcm_hardware info
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/sh/rcar/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -626,8 +626,7 @@ static void rsnd_dai_remove(struct platf
+ static struct snd_pcm_hardware rsnd_pcm_hardware = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_MMAP |
+- SNDRV_PCM_INFO_MMAP_VALID |
+- SNDRV_PCM_INFO_PAUSE,
++ SNDRV_PCM_INFO_MMAP_VALID,
+ .buffer_bytes_max = 64 * 1024,
+ .period_bytes_min = 32,
+ .period_bytes_max = 8192,
--- /dev/null
+From c251ea7bd7a04f1f2575467e0de76e803cf59149 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Fri, 14 Nov 2014 02:14:47 -0200
+Subject: ASoC: sgtl5000: Fix SMALL_POP bit definition
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit c251ea7bd7a04f1f2575467e0de76e803cf59149 upstream.
+
+On a mx28evk with a sgtl5000 codec we notice a loud 'click' sound to happen
+5 seconds after the end of a playback.
+
+The SMALL_POP bit should fix this, but its definition is incorrect:
+according to the sgtl5000 manual it is bit 0 of CHIP_REF_CTRL register, not
+bit 1.
+
+Fix the definition accordingly and enable the bit as intended per the code
+comment.
+
+After applying this change, no loud 'click' sound is heard after playback
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sgtl5000.c | 3 +--
+ sound/soc/codecs/sgtl5000.h | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1369,8 +1369,7 @@ static int sgtl5000_probe(struct snd_soc
+
+ /* enable small pop, introduce 400ms delay in turning off */
+ snd_soc_update_bits(codec, SGTL5000_CHIP_REF_CTRL,
+- SGTL5000_SMALL_POP,
+- SGTL5000_SMALL_POP);
++ SGTL5000_SMALL_POP, 1);
+
+ /* disable short cut detector */
+ snd_soc_write(codec, SGTL5000_CHIP_SHORT_CTRL, 0);
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -275,7 +275,7 @@
+ #define SGTL5000_BIAS_CTRL_MASK 0x000e
+ #define SGTL5000_BIAS_CTRL_SHIFT 1
+ #define SGTL5000_BIAS_CTRL_WIDTH 3
+-#define SGTL5000_SMALL_POP 0x0001
++#define SGTL5000_SMALL_POP 0
+
+ /*
+ * SGTL5000_CHIP_MIC_CTRL
--- /dev/null
+From 9da7a5a9fdeeb76b2243f6b473363a7e6147ab6f Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Mon, 17 Nov 2014 10:48:21 +0000
+Subject: ASoC: wm_adsp: Avoid attempt to free buffers that might still be in use
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 9da7a5a9fdeeb76b2243f6b473363a7e6147ab6f upstream.
+
+We should not free any buffers associated with writing out coefficients
+to the DSP until all the async writes have completed. This patch updates
+the out of memory path when allocating a new buffer to include a call to
+regmap_async_complete.
+
+Reported-by: JS Park <aitdark.park@samsung.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_adsp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1341,6 +1341,7 @@ static int wm_adsp_load_coeff(struct wm_
+ file, blocks, pos - firmware->size);
+
+ out_fw:
++ regmap_async_complete(regmap);
+ release_firmware(firmware);
+ wm_adsp_buf_free(&buf_list);
+ out:
--- /dev/null
+From 4e6ce4dc7ce71d0886908d55129d5d6482a27ff9 Mon Sep 17 00:00:00 2001
+From: Miaoqing Pan <miaoqing@qca.qualcomm.com>
+Date: Thu, 6 Nov 2014 10:52:23 +0530
+Subject: ath9k: Fix RTC_DERIVED_CLK usage
+
+From: Miaoqing Pan <miaoqing@qca.qualcomm.com>
+
+commit 4e6ce4dc7ce71d0886908d55129d5d6482a27ff9 upstream.
+
+Based on the reference clock, which could be 25MHz or 40MHz,
+AR_RTC_DERIVED_CLK is programmed differently for AR9340 and AR9550.
+But, when a chip reset is done, processing the initvals
+sets the register back to the default value.
+
+Fix this by moving the code in ath9k_hw_init_pll() to
+ar9003_hw_override_ini(). Also, do this override for AR9531.
+
+Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_phy.c | 13 +++++++++++++
+ drivers/net/wireless/ath/ath9k/hw.c | 13 -------------
+ 2 files changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -647,6 +647,19 @@ static void ar9003_hw_override_ini(struc
+ ah->enabled_cals |= TX_CL_CAL;
+ else
+ ah->enabled_cals &= ~TX_CL_CAL;
++
++ if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
++ if (ah->is_clk_25mhz) {
++ REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
++ REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
++ REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
++ } else {
++ REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
++ REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
++ REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
++ }
++ udelay(100);
++ }
+ }
+
+ static void ar9003_hw_prog_ini(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -858,19 +858,6 @@ static void ath9k_hw_init_pll(struct ath
+ udelay(RTC_PLL_SETTLE_DELAY);
+
+ REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
+-
+- if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
+- if (ah->is_clk_25mhz) {
+- REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+- REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+- REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+- } else {
+- REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+- REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+- REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+- }
+- udelay(100);
+- }
+ }
+
+ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
--- /dev/null
+From 6bab4a8a1888729f17f4923cc5867e4674f66333 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Tue, 18 Nov 2014 23:59:33 +0100
+Subject: clockevent: sun4i: Fix race condition in the probe code
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit 6bab4a8a1888729f17f4923cc5867e4674f66333 upstream.
+
+The interrupts were activated and the handler registered before the clockevent
+was registered in the probe function.
+
+The interrupt handler, however, was making the assumption that the clockevent
+device was registered.
+
+That could cause a null pointer dereference if the timer interrupt was firing
+during this narrow window.
+
+Fix that by moving the clockevent registration before the interrupt is enabled.
+
+Reported-by: Roman Byshko <rbyshko@gmail.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/sun4i_timer.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/clocksource/sun4i_timer.c
++++ b/drivers/clocksource/sun4i_timer.c
+@@ -182,6 +182,12 @@ static void __init sun4i_timer_init(stru
+ /* Make sure timer is stopped before playing with interrupts */
+ sun4i_clkevt_time_stop(0);
+
++ sun4i_clockevent.cpumask = cpu_possible_mask;
++ sun4i_clockevent.irq = irq;
++
++ clockevents_config_and_register(&sun4i_clockevent, rate,
++ TIMER_SYNC_TICKS, 0xffffffff);
++
+ ret = setup_irq(irq, &sun4i_timer_irq);
+ if (ret)
+ pr_warn("failed to setup irq %d\n", irq);
+@@ -189,12 +195,6 @@ static void __init sun4i_timer_init(stru
+ /* Enable timer0 interrupt */
+ val = readl(timer_base + TIMER_IRQ_EN_REG);
+ writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+-
+- sun4i_clockevent.cpumask = cpu_possible_mask;
+- sun4i_clockevent.irq = irq;
+-
+- clockevents_config_and_register(&sun4i_clockevent, rate,
+- TIMER_SYNC_TICKS, 0xffffffff);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun4i, "allwinner,sun4i-timer",
+ sun4i_timer_init);
--- /dev/null
+From b1a5ad006b34ded9dc7ec64988deba1b3ecad367 Mon Sep 17 00:00:00 2001
+From: Chris Moore <Chris.Moore@Emulex.Com>
+Date: Tue, 4 Nov 2014 16:28:29 +0000
+Subject: IB/isert: Adjust CQ size to HW limits
+
+From: Chris Moore <Chris.Moore@Emulex.Com>
+
+commit b1a5ad006b34ded9dc7ec64988deba1b3ecad367 upstream.
+
+isert has an issue of trying to create a CQ with more CQEs than are
+supported by the hardware, that currently results in failures during
+isert_device creation during first session login.
+
+This is the isert version of the patch that Minh Tran submitted for
+iser, and is simple a workaround required to function with existing
+ocrdma hardware.
+
+Signed-off-by: Chris Moore <chris.moore@emulex.com>
+Reviewied-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -220,12 +220,16 @@ isert_create_device_ib_res(struct isert_
+ struct isert_cq_desc *cq_desc;
+ struct ib_device_attr *dev_attr;
+ int ret = 0, i, j;
++ int max_rx_cqe, max_tx_cqe;
+
+ dev_attr = &device->dev_attr;
+ ret = isert_query_device(ib_dev, dev_attr);
+ if (ret)
+ return ret;
+
++ max_rx_cqe = min(ISER_MAX_RX_CQ_LEN, dev_attr->max_cqe);
++ max_tx_cqe = min(ISER_MAX_TX_CQ_LEN, dev_attr->max_cqe);
++
+ /* asign function handlers */
+ if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) {
+ device->use_fastreg = 1;
+@@ -261,7 +265,7 @@ isert_create_device_ib_res(struct isert_
+ isert_cq_rx_callback,
+ isert_cq_event_callback,
+ (void *)&cq_desc[i],
+- ISER_MAX_RX_CQ_LEN, i);
++ max_rx_cqe, i);
+ if (IS_ERR(device->dev_rx_cq[i])) {
+ ret = PTR_ERR(device->dev_rx_cq[i]);
+ device->dev_rx_cq[i] = NULL;
+@@ -273,7 +277,7 @@ isert_create_device_ib_res(struct isert_
+ isert_cq_tx_callback,
+ isert_cq_event_callback,
+ (void *)&cq_desc[i],
+- ISER_MAX_TX_CQ_LEN, i);
++ max_tx_cqe, i);
+ if (IS_ERR(device->dev_tx_cq[i])) {
+ ret = PTR_ERR(device->dev_tx_cq[i]);
+ device->dev_tx_cq[i] = NULL;
--- /dev/null
+From f57915cfa5b2b14c1cffa2e83c034f55e3f0e70d Mon Sep 17 00:00:00 2001
+From: Or Gerlitz <ogerlitz@mellanox.com>
+Date: Wed, 22 Oct 2014 14:55:49 -0700
+Subject: ib_isert: Add max_send_sge=2 minimum for control PDU responses
+
+From: Or Gerlitz <ogerlitz@mellanox.com>
+
+commit f57915cfa5b2b14c1cffa2e83c034f55e3f0e70d upstream.
+
+This patch adds a max_send_sge=2 minimum in isert_conn_setup_qp()
+to ensure outgoing control PDU responses with tx_desc->num_sge=2
+are able to function correctly.
+
+This addresses a bug with RDMA hardware using dev_attr.max_sge=3,
+that in the original code with the ConnectX-2 work-around would
+result in isert_conn->max_sge=1 being negotiated.
+
+Originally reported by Chris with ocrdma driver.
+
+Reported-by: Chris Moore <Chris.Moore@emulex.com>
+Tested-by: Chris Moore <Chris.Moore@emulex.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -112,9 +112,12 @@ isert_conn_setup_qp(struct isert_conn *i
+ attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS;
+ /*
+ * FIXME: Use devattr.max_sge - 2 for max_send_sge as
+- * work-around for RDMA_READ..
++ * work-around for RDMA_READs with ConnectX-2.
++ *
++ * Also, still make sure to have at least two SGEs for
++ * outgoing control PDU responses.
+ */
+- attr.cap.max_send_sge = device->dev_attr.max_sge - 2;
++ attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
+ isert_conn->max_sge = attr.cap.max_send_sge;
+
+ attr.cap.max_recv_sge = 1;
--- /dev/null
+From ccf54555da9a5e91e454b909ca6a5303c7d6b910 Mon Sep 17 00:00:00 2001
+From: Cristina Ciocan <cristina.ciocan@intel.com>
+Date: Tue, 11 Nov 2014 16:07:42 +0200
+Subject: iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask
+
+From: Cristina Ciocan <cristina.ciocan@intel.com>
+
+commit ccf54555da9a5e91e454b909ca6a5303c7d6b910 upstream.
+
+The direction field is set on 7 bits, thus we need to AND it with 0111 111 mask
+in order to retrieve it, that is 0x7F, not 0xCF as it is now.
+
+Fixes: ade7ef7ba (staging:iio: Differential channel handling)
+Signed-off-by: Cristina Ciocan <cristina.ciocan@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/iio/events.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/iio/events.h
++++ b/include/linux/iio/events.h
+@@ -72,7 +72,7 @@ struct iio_event_data {
+
+ #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF)
+
+-#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF)
++#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F)
+
+ #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF)
+
--- /dev/null
+From 746c9e9f92dde2789908e51a354ba90a1962a2eb Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 14 Nov 2014 17:55:03 +1100
+Subject: of/base: Fix PowerPC address parsing hack
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 746c9e9f92dde2789908e51a354ba90a1962a2eb upstream.
+
+We have a historical hack that treats missing ranges properties as the
+equivalent of an empty one. This is needed for ancient PowerMac "bad"
+device-trees, and shouldn't be enabled for any other PowerPC platform,
+otherwise we get some nasty layout of devices in sysfs or even
+duplication when a set of otherwise identically named devices is
+created multiple times under a different parent node with no ranges
+property.
+
+This fix is needed for the PowerNV i2c busses to be exposed properly
+and will fix a number of other embedded cases.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Grant Likely <grant.likely@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/address.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -401,6 +401,21 @@ static struct of_bus *of_match_bus(struc
+ return NULL;
+ }
+
++static int of_empty_ranges_quirk(void)
++{
++ if (IS_ENABLED(CONFIG_PPC)) {
++ /* To save cycles, we cache the result */
++ static int quirk_state = -1;
++
++ if (quirk_state < 0)
++ quirk_state =
++ of_machine_is_compatible("Power Macintosh") ||
++ of_machine_is_compatible("MacRISC");
++ return quirk_state;
++ }
++ return false;
++}
++
+ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+ struct of_bus *pbus, __be32 *addr,
+ int na, int ns, int pna, const char *rprop)
+@@ -426,12 +441,10 @@ static int of_translate_one(struct devic
+ * This code is only enabled on powerpc. --gcl
+ */
+ ranges = of_get_property(parent, rprop, &rlen);
+-#if !defined(CONFIG_PPC)
+- if (ranges == NULL) {
++ if (ranges == NULL && !of_empty_ranges_quirk()) {
+ pr_err("OF: no ranges; cannot translate\n");
+ return 1;
+ }
+-#endif /* !defined(CONFIG_PPC) */
+ if (ranges == NULL || rlen == 0) {
+ offset = of_read_number(addr, na);
+ memset(addr, 0, pna * 4);
--- /dev/null
+From 3b8a3c01096925a824ed3272601082289d9c23a5 Mon Sep 17 00:00:00 2001
+From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+Date: Mon, 24 Nov 2014 15:07:53 +0100
+Subject: powerpc/pseries: Fix endiannes issue in RTAS call from xmon
+
+From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+
+commit 3b8a3c01096925a824ed3272601082289d9c23a5 upstream.
+
+On pseries system (LPAR) xmon failed to enter when running in LE mode,
+system is hunging. Inititating xmon will lead to such an output on the
+console:
+
+SysRq : Entering xmon
+cpu 0x15: Vector: 0 at [c0000003f39ffb10]
+ pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
+ lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70
+ sp: c0000003f39ffc70
+ msr: 8000000000009033
+ current = 0xc0000003fafa7180
+ paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01
+ pid = 14617, comm = bash
+Bad kernel stack pointer fafb4b0 at eca7cc4
+cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40]
+ pc: 000000000eca7cc4
+ lr: 000000000eca7c44
+ sp: fafb4b0
+ msr: 8000000000001000
+ dar: 10000000
+ dsisr: 42000000
+ current = 0xc0000003fafa7180
+ paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01
+ pid = 14617, comm = bash
+cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop
+xmon: WARNING: bad recursive fault on cpu 0x15
+
+The root cause is that xmon is calling RTAS to turn off the surveillance
+when entering xmon, and RTAS is requiring big endian parameters.
+
+This patch is byte swapping the RTAS arguments when running in LE mode.
+
+Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/xmon/xmon.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -288,10 +288,10 @@ static inline void disable_surveillance(
+ args.token = rtas_token("set-indicator");
+ if (args.token == RTAS_UNKNOWN_SERVICE)
+ return;
+- args.nargs = 3;
+- args.nret = 1;
++ args.nargs = cpu_to_be32(3);
++ args.nret = cpu_to_be32(1);
+ args.rets = &args.args[3];
+- args.args[0] = SURVEILLANCE_TOKEN;
++ args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN);
+ args.args[1] = 0;
+ args.args[2] = 0;
+ enter_rtas(__pa(&args));
--- /dev/null
+From 415072a041bf50dbd6d56934ffc0cbbe14c97be8 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Tue, 7 Oct 2014 16:12:55 +1100
+Subject: powerpc/pseries: Honor the generic "no_64bit_msi" flag
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 415072a041bf50dbd6d56934ffc0cbbe14c97be8 upstream.
+
+Instead of the arch specific quirk which we are deprecating
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/msi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/pseries/msi.c
++++ b/arch/powerpc/platforms/pseries/msi.c
+@@ -428,7 +428,7 @@ static int rtas_setup_msi_irqs(struct pc
+ */
+ again:
+ if (type == PCI_CAP_ID_MSI) {
+- if (pdn->force_32bit_msi) {
++ if (pdev->no_64bit_msi) {
+ rc = rtas_change_msi(pdn, RTAS_CHANGE_32MSI_FN, nvec);
+ if (rc < 0) {
+ /*
ipx-fix-locking-regression-in-ipx_sendmsg-and-ipx_recvmsg.patch
pci-support-64-bit-bridge-windows-if-we-have-64-bit-dma_addr_t.patch
pci-msi-add-device-flag-indicating-that-64-bit-msis-don-t-work.patch
+clockevent-sun4i-fix-race-condition-in-the-probe-code.patch
+ib-isert-adjust-cq-size-to-hw-limits.patch
+ib_isert-add-max_send_sge-2-minimum-for-control-pdu-responses.patch
+asoc-rsnd-remove-unsupported-pause-flag.patch
+asoc-fsi-remove-unsupported-pause-flag.patch
+asoc-sgtl5000-fix-small_pop-bit-definition.patch
+asoc-wm_adsp-avoid-attempt-to-free-buffers-that-might-still-be-in-use.patch
+asoc-dpcm-fix-race-between-fe-be-updates-and-trigger.patch
+ath9k-fix-rtc_derived_clk-usage.patch
+of-base-fix-powerpc-address-parsing-hack.patch
+powerpc-pseries-honor-the-generic-no_64bit_msi-flag.patch
+powerpc-pseries-fix-endiannes-issue-in-rtas-call-from-xmon.patch
+iio-fix-iio_event_code_extract_dir-bit-mask.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
