--- /dev/null
+From 63781394c540dd9e666a6b21d70b64dd52bce76e Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Mon, 11 May 2015 17:02:58 +0800
+Subject: genirq: devres: Fix testing return value of request_any_context_irq()
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 63781394c540dd9e666a6b21d70b64dd52bce76e upstream.
+
+request_any_context_irq() returns a negative value on failure.
+It returns either IRQC_IS_HARDIRQ or IRQC_IS_NESTED on success.
+So fix testing return value of request_any_context_irq().
+
+Also fixup the return value of devm_request_any_context_irq() to make it
+consistent with request_any_context_irq().
+
+Fixes: 0668d3065128 ("genirq: Add devm_request_any_context_irq()")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Link: http://lkml.kernel.org/r/1431334978.17783.4.camel@ingics.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/devres.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/irq/devres.c
++++ b/kernel/irq/devres.c
+@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct
+ return -ENOMEM;
+
+ rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
+- if (rc) {
++ if (rc < 0) {
+ devres_free(dr);
+ return rc;
+ }
+@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct
+ dr->dev_id = dev_id;
+ devres_add(dev, dr);
+
+- return 0;
++ return rc;
+ }
+ EXPORT_SYMBOL(devm_request_any_context_irq);
+
--- /dev/null
+From 084609bf727981c7a2e6e69aefe0052c9d793300 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <Grygorii.Strashko@linaro.org>
+Date: Fri, 24 Apr 2015 14:57:10 +0300
+Subject: leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger
+
+From: Grygorii Strashko <Grygorii.Strashko@linaro.org>
+
+commit 084609bf727981c7a2e6e69aefe0052c9d793300 upstream.
+
+Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of
+hibernation callbacks means those pm functions will not be
+called upon hibernation - that leads to system crash on ARM during
+freezing if gpio-led is used in combination with CPU led trigger.
+It may happen after freeze_noirq stage (GPIO is suspended)
+and before syscore_suspend stage (CPU led trigger is suspended)
+- usually when disable_nonboot_cpus() is called.
+
+Log:
+ PM: noirq freeze of devices complete after 1.425 msecs
+ Disabling non-boot CPUs ...
+ ^ system may crash or stuck here with message (TI AM572x)
+
+ WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370()
+ 44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access
+
+ CPU1: shutdown
+ ^ or here
+
+Fix this by using SIMPLE_DEV_PM_OPS, which appropriately
+assigns the suspend and hibernation callbacks and move
+led_suspend/led_resume under CONFIG_PM_SLEEP to avoid
+build warnings.
+
+Fixes: 73e1ab41a80d (leds: Convert led class driver from legacy pm ops to dev_pm_ops)
+Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
+Acked-by: Jacek Anaszewski <j.anaszewski@samsung.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/leds/led-class.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_clas
+ }
+ EXPORT_SYMBOL_GPL(led_classdev_resume);
+
++#ifdef CONFIG_PM_SLEEP
+ static int led_suspend(struct device *dev)
+ {
+ struct led_classdev *led_cdev = dev_get_drvdata(dev);
+@@ -197,11 +198,9 @@ static int led_resume(struct device *dev
+
+ return 0;
+ }
++#endif
+
+-static const struct dev_pm_ops leds_class_dev_pm_ops = {
+- .suspend = led_suspend,
+- .resume = led_resume,
+-};
++static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
+
+ /**
+ * led_classdev_register - register a new object of led_classdev class.
--- /dev/null
+From e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Thu, 28 May 2015 10:22:10 +0200
+Subject: mtd: dc21285: use raw spinlock functions for nw_gpio_lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+
+commit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream.
+
+Since commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock
+that needs usage of the corresponding raw functions.
+
+This fixes:
+
+ drivers/mtd/maps/dc21285.c: In function 'nw_en_write':
+ drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type
+ spin_lock_irqsave(&nw_gpio_lock, flags);
+
+ In file included from include/linux/seqlock.h:35:0,
+ from include/linux/time.h:5,
+ from include/linux/stat.h:18,
+ from include/linux/module.h:10,
+ from drivers/mtd/maps/dc21285.c:8:
+ include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
+ static inline raw_spinlock_t *spinlock_check(spinlock_t *lock)
+ ^
+ drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type
+ spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ ^
+ In file included from include/linux/seqlock.h:35:0,
+ from include/linux/time.h:5,
+ from include/linux/stat.h:18,
+ from include/linux/module.h:10,
+ from drivers/mtd/maps/dc21285.c:8:
+ include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
+ static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)
+
+Fixes: bd31b85960a7 ("locking, ARM: Annotate low level hw locks as raw")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/maps/dc21285.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/maps/dc21285.c
++++ b/drivers/mtd/maps/dc21285.c
+@@ -38,9 +38,9 @@ static void nw_en_write(void)
+ * we want to write a bit pattern XXX1 to Xilinx to enable
+ * the write gate, which will be open for about the next 2ms.
+ */
+- spin_lock_irqsave(&nw_gpio_lock, flags);
++ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
+ nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
+- spin_unlock_irqrestore(&nw_gpio_lock, flags);
++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+
+ /*
+ * let the ISA bus to catch on...
--- /dev/null
+From 073db4a51ee43ccb827f54a4261c0583b028d5ab Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Thu, 7 May 2015 17:55:16 -0700
+Subject: mtd: fix: avoid race condition when accessing mtd->usecount
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.
+
+On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to
+mtd->usecount were done without taking mtd_table_mutex.
+kernel: Call Trace:
+kernel: [<ffffffff80401818>] __put_mtd_device+0x20/0x50
+kernel: [<ffffffff804086f4>] blktrans_release+0x8c/0xd8
+kernel: [<ffffffff802577e0>] __blkdev_put+0x1a8/0x200
+kernel: [<ffffffff802579a4>] blkdev_close+0x1c/0x30
+kernel: [<ffffffff8022006c>] __fput+0xac/0x250
+kernel: [<ffffffff80171208>] task_work_run+0xd8/0x120
+kernel: [<ffffffff8012c23c>] work_notifysig+0x10/0x18
+kernel:
+kernel:
+ Code: 2442ffff ac8202d8 000217fe <00020336> dc820128 10400003
+ 00000000 0040f809 00000000
+kernel: ---[ end trace 080fbb4579b47a73 ]---
+
+Fixed by taking the mutex in blktrans_open and blktrans_release.
+
+Note that this locking is already suggested in
+include/linux/mtd/blktrans.h:
+
+struct mtd_blktrans_ops {
+...
+ /* Called with mtd_table_mutex held; no race with add/remove */
+ int (*open)(struct mtd_blktrans_dev *dev);
+ void (*release)(struct mtd_blktrans_dev *dev);
+...
+};
+
+But we weren't following it.
+
+Originally reported by (and patched by) Zhang and Giuseppe,
+independently. Improved and rewritten.
+
+Reported-by: Zhang Xingcai <zhangxingcai@huawei.com>
+Reported-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
+Tested-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
+Acked-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/mtd_blkdevs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -199,6 +199,7 @@ static int blktrans_open(struct block_de
+ return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (dev->open)
+ goto unlock;
+@@ -222,6 +223,7 @@ static int blktrans_open(struct block_de
+
+ unlock:
+ dev->open++;
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -232,6 +234,7 @@ error_release:
+ error_put:
+ module_put(dev->tr->owner);
+ kref_put(&dev->ref, blktrans_dev_release);
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -245,6 +248,7 @@ static void blktrans_release(struct gend
+ return;
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (--dev->open)
+ goto unlock;
+@@ -258,6 +262,7 @@ static void blktrans_release(struct gend
+ __put_mtd_device(dev->mtd);
+ }
+ unlock:
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ }
--- /dev/null
+From 921cc29473a0d7c109105c1876ddb432f4a4be7d Mon Sep 17 00:00:00 2001
+From: Maxime Coquelin <maxime.coquelin@st.com>
+Date: Tue, 16 Jun 2015 13:53:19 +0200
+Subject: regmap: Fix possible shift overflow in regmap_field_init()
+
+From: Maxime Coquelin <maxime.coquelin@st.com>
+
+commit 921cc29473a0d7c109105c1876ddb432f4a4be7d upstream.
+
+The way the mask is generated in regmap_field_init() is wrong.
+Indeed, a field initialized with msb = 31 and lsb = 0 provokes a shift
+overflow while calculating the mask field.
+
+On some 32 bits architectures, such as x86, the generated mask is 0,
+instead of the expected 0xffffffff.
+
+This patch uses GENMASK() to fix the problem, as this macro is already safe
+regarding shift overflow.
+
+Signed-off-by: Maxime Coquelin <maxime.coquelin@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/regmap/regmap.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
+ static void regmap_field_init(struct regmap_field *rm_field,
+ struct regmap *regmap, struct reg_field reg_field)
+ {
+- int field_bits = reg_field.msb - reg_field.lsb + 1;
+ rm_field->regmap = regmap;
+ rm_field->reg = reg_field.reg;
+ rm_field->shift = reg_field.lsb;
+- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
++ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
+ rm_field->id_size = reg_field.id_size;
+ rm_field->id_offset = reg_field.id_offset;
+ }
--- /dev/null
+From 15b8d2c41fe5839582029f65c5f7004db451cc2b Mon Sep 17 00:00:00 2001
+From: Arun Chandran <achandran@mvista.com>
+Date: Mon, 15 Jun 2015 15:59:02 +0530
+Subject: regmap: Fix regmap_bulk_read in BE mode
+
+From: Arun Chandran <achandran@mvista.com>
+
+commit 15b8d2c41fe5839582029f65c5f7004db451cc2b upstream.
+
+In big endian mode regmap_bulk_read gives incorrect data
+for byte reads.
+
+This is because memcpy of a single byte from an address
+after full word read gives different results when
+endianness differs. ie. we get little-end in LE and big-end in BE.
+
+Signed-off-by: Arun Chandran <achandran@mvista.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1947,7 +1947,7 @@ int regmap_bulk_read(struct regmap *map,
+ &ival);
+ if (ret != 0)
+ return ret;
+- memcpy(val + (i * val_bytes), &ival, val_bytes);
++ map->format.format_val(val + (i * val_bytes), ival, 0);
+ }
+ }
+
--- /dev/null
+From a7068e3932eee8268c4ce4e080a338ee7b8a27bf Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Tue, 9 Jun 2015 20:09:42 +0000
+Subject: regulator: core: fix constraints output buffer
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream.
+
+The buffer for condtraints debug isn't big enough to hold the output
+in all cases. So fix this issue by increasing the buffer.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -773,7 +773,7 @@ static int suspend_prepare(struct regula
+ static void print_constraints(struct regulator_dev *rdev)
+ {
+ struct regulation_constraints *constraints = rdev->constraints;
+- char buf[80] = "";
++ char buf[160] = "";
+ int count = 0;
+ int ret;
+
--- /dev/null
+From 535fb906225fb7436cb658144d0c0cea14a26f3e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Mon, 18 May 2015 13:22:44 +0200
+Subject: scsi_transport_srp: Fix a race condition
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 535fb906225fb7436cb658144d0c0cea14a26f3e upstream.
+
+Avoid that srp_terminate_io() can get invoked while srp_queuecommand()
+is in progress. This patch avoids that an I/O timeout can trigger the
+following kernel warning:
+
+WARNING: at drivers/infiniband/ulp/srp/ib_srp.c:1447 srp_terminate_io+0xef/0x100 [ib_srp]()
+Call Trace:
+ [<ffffffff814c65a2>] dump_stack+0x4e/0x68
+ [<ffffffff81051f71>] warn_slowpath_common+0x81/0xa0
+ [<ffffffff8105204a>] warn_slowpath_null+0x1a/0x20
+ [<ffffffffa075f51f>] srp_terminate_io+0xef/0x100 [ib_srp]
+ [<ffffffffa07495da>] __rport_fail_io_fast+0xba/0xc0 [scsi_transport_srp]
+ [<ffffffffa0749a90>] rport_fast_io_fail_timedout+0xe0/0xf0 [scsi_transport_srp]
+ [<ffffffff8106e09b>] process_one_work+0x1db/0x780
+ [<ffffffff8106e75b>] worker_thread+0x11b/0x450
+ [<ffffffff81073c64>] kthread+0xe4/0x100
+ [<ffffffff814cf26c>] ret_from_fork+0x7c/0xb0
+
+See also patch "scsi_transport_srp: Add transport layer error
+handling" (commit ID 29c17324803c).
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: James Bottomley <JBottomley@Odin.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_srp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -440,8 +440,10 @@ static void __rport_fail_io_fast(struct
+
+ /* Involve the LLD if possible to terminate all I/O on the rport. */
+ i = to_srp_internal(shost->transportt);
+- if (i->f->terminate_rport_io)
++ if (i->f->terminate_rport_io) {
++ srp_wait_for_queuecommand(shost);
+ i->f->terminate_rport_io(rport);
++ }
+ }
+
+ /**
--- /dev/null
+From be34c62ddf39d1931780b07a6f4241393e4ba2ee Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Mon, 18 May 2015 13:22:19 +0200
+Subject: scsi_transport_srp: Introduce srp_wait_for_queuecommand()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit be34c62ddf39d1931780b07a6f4241393e4ba2ee upstream.
+
+Introduce the helper function srp_wait_for_queuecommand().
+Move the definition of scsi_request_fn_active(). Add a comment
+above srp_wait_for_queuecommand() that support for scsi-mq needs
+to be added.
+
+This patch does not change any functionality. A second call to
+srp_wait_for_queuecommand() will be introduced in the next patch.
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: James Bottomley <JBottomley@Odin.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_srp.c | 54 +++++++++++++++++++++-----------------
+ 1 file changed, 31 insertions(+), 23 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct wo
+ }
+ }
+
++/**
++ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
++ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
++ *
++ * To do: add support for scsi-mq in this function.
++ */
++static int scsi_request_fn_active(struct Scsi_Host *shost)
++{
++ struct scsi_device *sdev;
++ struct request_queue *q;
++ int request_fn_active = 0;
++
++ shost_for_each_device(sdev, shost) {
++ q = sdev->request_queue;
++
++ spin_lock_irq(q->queue_lock);
++ request_fn_active += q->request_fn_active;
++ spin_unlock_irq(q->queue_lock);
++ }
++
++ return request_fn_active;
++}
++
++/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
++static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
++{
++ while (scsi_request_fn_active(shost))
++ msleep(20);
++}
++
+ static void __rport_fail_io_fast(struct srp_rport *rport)
+ {
+ struct Scsi_Host *shost = rport_to_shost(rport);
+@@ -505,27 +535,6 @@ void srp_start_tl_fail_timers(struct srp
+ EXPORT_SYMBOL(srp_start_tl_fail_timers);
+
+ /**
+- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
+- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
+- */
+-static int scsi_request_fn_active(struct Scsi_Host *shost)
+-{
+- struct scsi_device *sdev;
+- struct request_queue *q;
+- int request_fn_active = 0;
+-
+- shost_for_each_device(sdev, shost) {
+- q = sdev->request_queue;
+-
+- spin_lock_irq(q->queue_lock);
+- request_fn_active += q->request_fn_active;
+- spin_unlock_irq(q->queue_lock);
+- }
+-
+- return request_fn_active;
+-}
+-
+-/**
+ * srp_reconnect_rport() - reconnect to an SRP target port
+ * @rport: SRP target port.
+ *
+@@ -560,8 +569,7 @@ int srp_reconnect_rport(struct srp_rport
+ if (res)
+ goto out;
+ scsi_target_block(&shost->shost_gendev);
+- while (scsi_request_fn_active(shost))
+- msleep(20);
++ srp_wait_for_queuecommand(shost);
+ res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
+ pr_debug("%s (state %d): transport.reconnect() returned %d\n",
+ dev_name(&shost->shost_gendev), rport->state, res);
arm64-mm-fix-freeing-of-the-wrong-memmap-entries-with-sparsemem_vmemmap.patch
arm64-vdso-work-around-broken-elf-toolchains-in-makefile.patch
cpuidle-menu-return-1-if-there-are-no-suitable-states.patch
+regmap-fix-regmap_bulk_read-in-be-mode.patch
+regmap-fix-possible-shift-overflow-in-regmap_field_init.patch
+regulator-core-fix-constraints-output-buffer.patch
+spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch
+spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch
+scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch
+scsi_transport_srp-fix-a-race-condition.patch
+genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch
+leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch
+mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch
+mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch
--- /dev/null
+From 8e76ef88f607174082023f50b87fe12dcdbe5db5 Mon Sep 17 00:00:00 2001
+From: Martin Sperl <kernel@martin.sperl.org>
+Date: Sun, 10 May 2015 07:50:45 +0000
+Subject: spi: fix race freeing dummy_tx/rx before it is unmapped
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.
+
+Fix a race (with some kernel configurations) where a queued
+master->pump_messages runs and frees dummy_tx/rx before
+spi_unmap_msg is running (or is finished).
+
+This results in the following messages:
+ BUG: Bad page state in process
+ page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0
+ flags: 0x200(arch_1)
+ page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
+ ...
+
+Reported-by: Noralf Trønnes <noralf@tronnes.org>
+Suggested-by: Noralf Trønnes <noralf@tronnes.org>
+Tested-by: Noralf Trønnes <noralf@tronnes.org>
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct
+
+ spin_lock_irqsave(&master->queue_lock, flags);
+ mesg = master->cur_msg;
+- master->cur_msg = NULL;
+-
+- queue_kthread_work(&master->kworker, &master->pump_messages);
+ spin_unlock_irqrestore(&master->queue_lock, flags);
+
+ if (master->cur_msg_prepared && master->unprepare_message) {
+@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct
+ }
+ }
+
+- trace_spi_message_done(mesg);
+-
++ spin_lock_irqsave(&master->queue_lock, flags);
++ master->cur_msg = NULL;
+ master->cur_msg_prepared = false;
++ queue_kthread_work(&master->kworker, &master->pump_messages);
++ spin_unlock_irqrestore(&master->queue_lock, flags);
++
++ trace_spi_message_done(mesg);
+
+ mesg->state = NULL;
+ if (mesg->complete)
--- /dev/null
+From ea6055c46eda1e19e02209814955e13f334bbe1b Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Date: Mon, 11 May 2015 12:20:18 -0300
+Subject: spi: pl022: Specify 'num-cs' property as required in devicetree binding
+
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+
+commit ea6055c46eda1e19e02209814955e13f334bbe1b upstream.
+
+Since commit 39a6ac11df65 ("spi/pl022: Devicetree support w/o platform data")
+the 'num-cs' parameter cannot be passed through platform data when probing
+with devicetree. Instead, it's a required devicetree property.
+
+Fix the binding documentation so the property is properly specified.
+
+Fixes: 39a6ac11df65 ("spi/pl022: Devicetree support w/o platform data")
+Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/spi/spi_pl022.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
++++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
+@@ -4,9 +4,9 @@ Required properties:
+ - compatible : "arm,pl022", "arm,primecell"
+ - reg : Offset and length of the register set for the device
+ - interrupts : Should contain SPI controller interrupt
++- num-cs : total number of chipselects
+
+ Optional properties:
+-- num-cs : total number of chipselects
+ - cs-gpios : should specify GPIOs used for chipselects.
+ The gpios will be referred to as reg = <index> in the SPI child nodes.
+ If unspecified, a single SPI device without a chip select can be used.
projects / thirdparty / kernel / stable-queue.git / commitdiff
