--- /dev/null
+From 6455931186bff407493135e74c5f32efd30860e2 Mon Sep 17 00:00:00 2001
+From: Jason Lee Cragg <jcragg@gmail.com>
+Date: Sat, 17 Jan 2015 12:28:29 -0500
+Subject: ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210
+
+From: Jason Lee Cragg <jcragg@gmail.com>
+
+commit 6455931186bff407493135e74c5f32efd30860e2 upstream.
+
+Signed-off-by: Jason Lee Cragg <jcragg@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -909,6 +909,7 @@ static void volume_control_quirks(struct
+ case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+ case USB_ID(0x046d, 0x0808):
+ case USB_ID(0x046d, 0x0809):
++ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
--- /dev/null
+From 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Mon, 5 Jan 2015 18:40:15 +0100
+Subject: can: dev: fix crtlmode_supported check
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream.
+
+When changing flags in the CAN drivers ctrlmode the provided new content has to
+be checked whether the bits are allowed to be changed. The bits that are to be
+changed are given as a bitfield in cm->mask. Therefore checking against
+cm->flags is wrong as the content can hold any kind of values.
+
+The iproute2 tool sets the bits in cm->mask and cm->flags depending on the
+detected command line options. To be robust against bogus user space
+applications additionally sanitize the provided flags with the provided mask.
+
+Cc: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -729,10 +729,14 @@ static int can_changelink(struct net_dev
+ if (dev->flags & IFF_UP)
+ return -EBUSY;
+ cm = nla_data(data[IFLA_CAN_CTRLMODE]);
+- if (cm->flags & ~priv->ctrlmode_supported)
++
++ /* check whether changed bits are allowed to be modified */
++ if (cm->mask & ~priv->ctrlmode_supported)
+ return -EOPNOTSUPP;
++
++ /* clear bits to be modified and copy the flag values */
+ priv->ctrlmode &= ~cm->mask;
+- priv->ctrlmode |= cm->flags;
++ priv->ctrlmode |= (cm->flags & cm->mask);
+
+ /* CAN_CTRLMODE_FD can only be set when driver supports FD */
+ if (priv->ctrlmode & CAN_CTRLMODE_FD)
--- /dev/null
+From 6cfda7fbebe8a4fd33ea5722fa0212f98f643c35 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Mon, 5 Jan 2015 19:47:43 +0100
+Subject: can: m_can: tag current CAN FD controllers as non-ISO
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 6cfda7fbebe8a4fd33ea5722fa0212f98f643c35 upstream.
+
+During the CAN FD standardization process within the ISO it turned out that
+the failure detection capability has to be improved.
+
+The CAN in Automation organization (CiA) defined the already implemented CAN
+FD controllers as 'non-ISO' and the upcoming improved CAN FD controllers as
+'ISO' compliant. See at http://www.can-cia.com/index.php?id=1937
+
+Finally there will be three types of CAN FD controllers in the future:
+
+1. ISO compliant (fixed)
+2. non-ISO compliant (fixed, like the M_CAN IP v3.0.1 in m_can.c)
+3. ISO/non-ISO CAN FD controllers (switchable, like the PEAK USB FD)
+
+So the current M_CAN driver for the M_CAN IP v3.0.1 has to expose its non-ISO
+implementation by setting the CAN_CTRLMODE_FD_NON_ISO ctrlmode at startup.
+As this bit cannot be switched at configuration time CAN_CTRLMODE_FD_NON_ISO
+must not be set in ctrlmode_supported of the current M_CAN driver.
+
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/m_can/m_can.c | 5 +++++
+ include/uapi/linux/can/netlink.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -955,6 +955,11 @@ static struct net_device *alloc_m_can_de
+ priv->can.data_bittiming_const = &m_can_data_bittiming_const;
+ priv->can.do_set_mode = m_can_set_mode;
+ priv->can.do_get_berr_counter = m_can_get_berr_counter;
++
++ /* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */
++ priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
++
++ /* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */
+ priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
+ CAN_CTRLMODE_LISTENONLY |
+ CAN_CTRLMODE_BERR_REPORTING |
+--- a/include/uapi/linux/can/netlink.h
++++ b/include/uapi/linux/can/netlink.h
+@@ -98,6 +98,7 @@ struct can_ctrlmode {
+ #define CAN_CTRLMODE_BERR_REPORTING 0x10 /* Bus-error reporting */
+ #define CAN_CTRLMODE_FD 0x20 /* CAN FD mode */
+ #define CAN_CTRLMODE_PRESUME_ACK 0x40 /* Ignore missing CAN ACKs */
++#define CAN_CTRLMODE_FD_NON_ISO 0x80 /* CAN FD in non-ISO mode */
+
+ /*
+ * CAN device statistics
--- /dev/null
+From 72dd299d5039a336493993dcc63413cf31d0e662 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 16 Jan 2015 15:13:02 -0800
+Subject: libata: allow sata_sil24 to opt-out of tag ordered submission
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 72dd299d5039a336493993dcc63413cf31d0e662 upstream.
+
+Ronny reports: https://bugzilla.kernel.org/show_bug.cgi?id=87101
+ "Since commit 8a4aeec8d "libata/ahci: accommodate tag ordered
+ controllers" the access to the harddisk on the first SATA-port is
+ failing on its first access. The access to the harddisk on the
+ second port is working normal.
+
+ When reverting the above commit, access to both harddisks is working
+ fine again."
+
+Maintain tag ordered submission as the default, but allow sata_sil24 to
+continue with the old behavior.
+
+Cc: Tejun Heo <tj@kernel.org>
+Reported-by: Ronny Hegewald <Ronny.Hegewald@online.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 5 ++++-
+ drivers/ata/sata_sil24.c | 2 +-
+ include/linux/libata.h | 1 +
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4740,7 +4740,10 @@ static struct ata_queued_cmd *ata_qc_new
+ return NULL;
+
+ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+- tag = tag < max_queue ? tag : 0;
++ if (ap->flags & ATA_FLAG_LOWTAG)
++ tag = i;
++ else
++ tag = tag < max_queue ? tag : 0;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -246,7 +246,7 @@ enum {
+ /* host flags */
+ SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+ ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
+- ATA_FLAG_AN | ATA_FLAG_PMP,
++ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
+ SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */
+
+ IRQ_STAT_4PORTS = 0xf,
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -230,6 +230,7 @@ enum {
+ ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity
+ * led */
+ ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */
++ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */
+
+ /* bits 24:31 of ap->flags are reserved for LLD specific flags */
+
--- /dev/null
+From ce7514526742c0898b837d4395f515b79dfb5a12 Mon Sep 17 00:00:00 2001
+From: David Jeffery <djeffery@redhat.com>
+Date: Mon, 19 Jan 2015 13:03:25 -0600
+Subject: libata: prevent HSM state change race between ISR and PIO
+
+From: David Jeffery <djeffery@redhat.com>
+
+commit ce7514526742c0898b837d4395f515b79dfb5a12 upstream.
+
+It is possible for ata_sff_flush_pio_task() to set ap->hsm_task_state to
+HSM_ST_IDLE in between the time __ata_sff_port_intr() checks for HSM_ST_IDLE
+and before it calls ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
+
+This problem is hard to reproduce making this patch hard to verify, but this
+fix will prevent the race.
+
+I have not been able to reproduce the problem, but here is a crash dump from
+a 2.6.32 kernel.
+
+On examining the ata port's state, its hsm_task_state field has a value of HSM_ST_IDLE:
+
+crash> struct ata_port.hsm_task_state ffff881c1121c000
+ hsm_task_state = 0
+
+Normally, this should not be possible as ata_sff_hsm_move() was called from ata_sff_host_intr(),
+which checks hsm_task_state and won't call ata_sff_hsm_move() if it has a HSM_ST_IDLE value.
+
+PID: 11053 TASK: ffff8816e846cae0 CPU: 0 COMMAND: "sshd"
+ #0 [ffff88008ba03960] machine_kexec at ffffffff81038f3b
+ #1 [ffff88008ba039c0] crash_kexec at ffffffff810c5d92
+ #2 [ffff88008ba03a90] oops_end at ffffffff8152b510
+ #3 [ffff88008ba03ac0] die at ffffffff81010e0b
+ #4 [ffff88008ba03af0] do_trap at ffffffff8152ad74
+ #5 [ffff88008ba03b50] do_invalid_op at ffffffff8100cf95
+ #6 [ffff88008ba03bf0] invalid_op at ffffffff8100bf9b
+ [exception RIP: ata_sff_hsm_move+317]
+ RIP: ffffffff813a77ad RSP: ffff88008ba03ca0 RFLAGS: 00010097
+ RAX: 0000000000000000 RBX: ffff881c1121dc60 RCX: 0000000000000000
+ RDX: ffff881c1121dd10 RSI: ffff881c1121dc60 RDI: ffff881c1121c000
+ RBP: ffff88008ba03d00 R8: 0000000000000000 R9: 000000000000002e
+ R10: 000000000001003f R11: 000000000000009b R12: ffff881c1121c000
+ R13: 0000000000000000 R14: 0000000000000050 R15: ffff881c1121dd78
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+ #7 [ffff88008ba03d08] ata_sff_host_intr at ffffffff813a7fbd
+ #8 [ffff88008ba03d38] ata_sff_interrupt at ffffffff813a821e
+ #9 [ffff88008ba03d78] handle_IRQ_event at ffffffff810e6ec0
+---
+ drivers/ata/libata-sff.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_p
+ DPRINTK("ENTER\n");
+
+ cancel_delayed_work_sync(&ap->sff_pio_task);
++
++ /*
++ * We wanna reset the HSM state to IDLE. If we do so without
++ * grabbing the port lock, critical sections protected by it which
++ * expect the HSM state to stay stable may get surprised. For
++ * example, we may set IDLE in between the time
++ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
++ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
++ */
++ spin_lock_irq(ap->lock);
+ ap->hsm_task_state = HSM_ST_IDLE;
++ spin_unlock_irq(ap->lock);
++
+ ap->sff_pio_task_link = NULL;
+
+ if (ata_msg_ctl(ap))
--- /dev/null
+From b166010f6afbadb896efa37ff85eb681a8f89392 Mon Sep 17 00:00:00 2001
+From: Roger Tseng <rogerable@realtek.com>
+Date: Thu, 15 Jan 2015 15:14:44 +0800
+Subject: mfd: rtsx_usb: Fix runtime PM deadlock
+
+From: Roger Tseng <rogerable@realtek.com>
+
+commit b166010f6afbadb896efa37ff85eb681a8f89392 upstream.
+
+sd_set_power_mode() in derived module drivers/mmc/host/rtsx_usb_sdmmc.c
+acquires dev_mutex and then calls pm_runtime_get_sync() to make sure the
+device is awake while initializing a newly inserted card. Once it is
+called during suspending state and explicitly before rtsx_usb_suspend()
+acquires the same dev_mutex, both routine deadlock and further hang the
+driver because pm_runtime_get_sync() waits the pending PM operations.
+
+Fix this by using an empty suspend method. mmc_core always turns the
+LED off after a request is done and thus it is ok to remove the only
+rtsx_usb_turn_off_led() here.
+
+Fixes: 730876be2566 ("mfd: Add realtek USB card reader driver")
+Signed-off-by: Roger Tseng <rogerable@realtek.com>
+[Lee: Removed newly unused variable]
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/rtsx_usb.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/drivers/mfd/rtsx_usb.c
++++ b/drivers/mfd/rtsx_usb.c
+@@ -681,21 +681,9 @@ static void rtsx_usb_disconnect(struct u
+ #ifdef CONFIG_PM
+ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)
+ {
+- struct rtsx_ucr *ucr =
+- (struct rtsx_ucr *)usb_get_intfdata(intf);
+-
+ dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n",
+ __func__, message.event);
+
+- /*
+- * Call to make sure LED is off during suspend to save more power.
+- * It is NOT a permanent state and could be turned on anytime later.
+- * Thus no need to call turn_on when resunming.
+- */
+- mutex_lock(&ucr->dev_mutex);
+- rtsx_usb_turn_off_led(ucr);
+- mutex_unlock(&ucr->dev_mutex);
+-
+ return 0;
+ }
+
--- /dev/null
+From 773328da243978bebac82bf4c45604281edb6975 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Fri, 26 Dec 2014 13:28:20 -0600
+Subject: mfd: tps65218: Make INT[12] and STATUS registers volatile
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit 773328da243978bebac82bf4c45604281edb6975 upstream.
+
+STATUS register can be modified by the HW, so we
+should bypass cache because of that.
+
+In the case of INT[12] registers, they are the ones
+that actually clear the IRQ source at the time they
+are read. If we rely on the cache for them, we will
+never be able to clear the interrupt, which will cause
+our IRQ line to be disabled due to IRQ throttling.
+
+Fixes: 44b4dc6 mfd: tps65218: Add driver for the TPS65218 PMIC
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/tps65218.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -125,10 +125,21 @@ int tps65218_clear_bits(struct tps65218
+ }
+ EXPORT_SYMBOL_GPL(tps65218_clear_bits);
+
++static const struct regmap_range tps65218_yes_ranges[] = {
++ regmap_reg_range(TPS65218_REG_INT1, TPS65218_REG_INT2),
++ regmap_reg_range(TPS65218_REG_STATUS, TPS65218_REG_STATUS),
++};
++
++static const struct regmap_access_table tps65218_volatile_table = {
++ .yes_ranges = tps65218_yes_ranges,
++ .n_yes_ranges = ARRAY_SIZE(tps65218_yes_ranges),
++};
++
+ static struct regmap_config tps65218_regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+ .cache_type = REGCACHE_RBTREE,
++ .volatile_table = &tps65218_volatile_table,
+ };
+
+ static const struct regmap_irq tps65218_irqs[] = {
--- /dev/null
+From f29ae369a412942e81035984fa3d7a22ddf91fcb Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Fri, 26 Dec 2014 13:28:21 -0600
+Subject: mfd: tps65218: Make INT1 our status_base register
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit f29ae369a412942e81035984fa3d7a22ddf91fcb upstream.
+
+If we don't tell regmap-irq that our first status
+register is at offset 1, it will try to read offset
+zero, which is the chipid register.
+
+Fixes: 44b4dc6 mfd: tps65218: Add driver for the TPS65218 PMIC
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/tps65218.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -204,6 +204,7 @@ static struct regmap_irq_chip tps65218_i
+
+ .num_regs = 2,
+ .mask_base = TPS65218_REG_INT_MASK1,
++ .status_base = TPS65218_REG_INT1,
+ };
+
+ static const struct of_device_id of_tps65218_match_table[] = {
--- /dev/null
+From db93facfb0ef542aa5d8079e47580b3e669a4d82 Mon Sep 17 00:00:00 2001
+From: Jim Lin <jilin@nvidia.com>
+Date: Thu, 8 Jan 2015 20:25:05 +0800
+Subject: pinctrl: Fix two deadlocks
+
+From: Jim Lin <jilin@nvidia.com>
+
+commit db93facfb0ef542aa5d8079e47580b3e669a4d82 upstream.
+
+This patch is to fix two deadlock cases.
+Deadlock 1:
+CPU #1
+ pinctrl_register-> pinctrl_get ->
+ create_pinctrl
+ (Holding lock pinctrl_maps_mutex)
+ -> get_pinctrl_dev_from_devname
+ (Trying to acquire lock pinctrldev_list_mutex)
+CPU #0
+ pinctrl_unregister
+ (Holding lock pinctrldev_list_mutex)
+ -> pinctrl_put ->> pinctrl_free ->
+ pinctrl_dt_free_maps -> pinctrl_unregister_map
+ (Trying to acquire lock pinctrl_maps_mutex)
+
+Simply to say
+CPU#1 is holding lock A and trying to acquire lock B,
+CPU#0 is holding lock B and trying to acquire lock A.
+
+Deadlock 2:
+CPU #3
+ pinctrl_register-> pinctrl_get ->
+ create_pinctrl
+ (Holding lock pinctrl_maps_mutex)
+ -> get_pinctrl_dev_from_devname
+ (Trying to acquire lock pinctrldev_list_mutex)
+CPU #2
+ pinctrl_unregister
+ (Holding lock pctldev->mutex)
+ -> pinctrl_put ->> pinctrl_free ->
+ pinctrl_dt_free_maps -> pinctrl_unregister_map
+ (Trying to acquire lock pinctrl_maps_mutex)
+CPU #0
+ tegra_gpio_request
+ (Holding lock pinctrldev_list_mutex)
+ -> pinctrl_get_device_gpio_range
+ (Trying to acquire lock pctldev->mutex)
+
+Simply to say
+CPU#3 is holding lock A and trying to acquire lock D,
+CPU#2 is holding lock B and trying to acquire lock A,
+CPU#0 is holding lock D and trying to acquire lock B.
+
+Signed-off-by: Jim Lin <jilin@nvidia.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1801,14 +1801,15 @@ void pinctrl_unregister(struct pinctrl_d
+ if (pctldev == NULL)
+ return;
+
+- mutex_lock(&pinctrldev_list_mutex);
+ mutex_lock(&pctldev->mutex);
+-
+ pinctrl_remove_device_debugfs(pctldev);
++ mutex_unlock(&pctldev->mutex);
+
+ if (!IS_ERR(pctldev->p))
+ pinctrl_put(pctldev->p);
+
++ mutex_lock(&pinctrldev_list_mutex);
++ mutex_lock(&pctldev->mutex);
+ /* TODO: check that no pinmuxes are still active? */
+ list_del(&pctldev->node);
+ /* Destroy descriptor tree */
--- /dev/null
+From bcd53f858d87f52843cc87764b283999126a50d6 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Mon, 19 Jan 2015 11:17:45 +0100
+Subject: pinctrl: qcom: Don't iterate past end of function array
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit bcd53f858d87f52843cc87764b283999126a50d6 upstream.
+
+Timur reports that this code crashes if nfunctions is 0. Fix the
+loop iteration to only consider valid elements of the functions
+array.
+
+Reported-by: Timur Tabi <timur@codeaurora.org>
+Cc: Pramod Gurav <pramod.gurav@smartplayin.com>
+Cc: Bjorn Andersson <bjorn.andersson@sonymobile.com>
+Cc: Ivan T. Ivanov <iivanov@mm-sol.com>
+Cc: Andy Gross <agross@codeaurora.org>
+Fixes: 327455817a92 "pinctrl: qcom: Add support for reset for apq8064"
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -865,10 +865,10 @@ static int msm_ps_hold_restart(struct no
+
+ static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl)
+ {
+- int i = 0;
++ int i;
+ const struct msm_function *func = pctrl->soc->functions;
+
+- for (; i <= pctrl->soc->nfunctions; i++)
++ for (i = 0; i < pctrl->soc->nfunctions; i++)
+ if (!strcmp(func[i].name, "ps_hold")) {
+ pctrl->restart_nb.notifier_call = msm_ps_hold_restart;
+ pctrl->restart_nb.priority = 128;
--- /dev/null
+From 1caf6aaaa47471831d77c75f094d4e00ad1ec808 Mon Sep 17 00:00:00 2001
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Date: Sun, 18 Jan 2015 00:36:15 +0100
+Subject: scripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+commit 1caf6aaaa47471831d77c75f094d4e00ad1ec808 upstream.
+
+Compiling SH with gcc-4.8 fails due to the -m32 option not being
+supported.
+
+From http://buildd.debian-ports.org/status/fetch.php?pkg=linux&arch=sh4&ver=3.16.7-ckt4-1&stamp=1421425783
+
+ CC init/main.o
+ gcc-4.8: error: unrecognized command line option '-m32'
+ ld: cannot find init/.tmp_mc_main.o: No such file or directory
+ objcopy: 'init/.tmp_mx_main.o': No such file
+ rm: cannot remove 'init/.tmp_mx_main.o': No such file or directory
+ rm: cannot remove 'init/.tmp_mc_main.o': No such file or directory
+
+Link: http://lkml.kernel.org/r/1421537778-29001-1-git-send-email-kernel@mkarcher.dialup.fu-berlin.de
+Link: http://lkml.kernel.org/r/54BCBDD4.10102@physik.fu-berlin.de
+
+Cc: Matt Fleming <matt@console-pimps.org>
+Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/recordmcount.pl | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -255,7 +255,6 @@ if ($arch eq "x86_64") {
+ # force flags for this arch
+ $ld .= " -m shlelf_linux";
+ $objcopy .= " -O elf32-sh-linux";
+- $cc .= " -m32";
+
+ } elsif ($arch eq "powerpc") {
+ $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
+can-dev-fix-crtlmode_supported-check.patch
+can-m_can-tag-current-can-fd-controllers-as-non-iso.patch
+pinctrl-qcom-don-t-iterate-past-end-of-function-array.patch
+pinctrl-fix-two-deadlocks.patch
+mfd-tps65218-make-int-and-status-registers-volatile.patch
+mfd-tps65218-make-int1-our-status_base-register.patch
+mfd-rtsx_usb-fix-runtime-pm-deadlock.patch
+libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch
+libata-prevent-hsm-state-change-race-between-isr-and-pio.patch
+alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch
+workqueue-fix-subtle-pool-management-issue-which-can-stall-whole-worker_pool.patch
+scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch
--- /dev/null
+From 29187a9eeaf362d8422e62e17a22a6e115277a49 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 16 Jan 2015 14:21:16 -0500
+Subject: workqueue: fix subtle pool management issue which can stall whole worker_pool
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 29187a9eeaf362d8422e62e17a22a6e115277a49 upstream.
+
+A worker_pool's forward progress is guaranteed by the fact that the
+last idle worker assumes the manager role to create more workers and
+summon the rescuers if creating workers doesn't succeed in timely
+manner before proceeding to execute work items.
+
+This manager role is implemented in manage_workers(), which indicates
+whether the worker may proceed to work item execution with its return
+value. This is necessary because multiple workers may contend for the
+manager role, and, if there already is a manager, others should
+proceed to work item execution.
+
+Unfortunately, the function also indicates that the worker may proceed
+to work item execution if need_to_create_worker() is false at the head
+of the function. need_to_create_worker() tests the following
+conditions.
+
+ pending work items && !nr_running && !nr_idle
+
+The first and third conditions are protected by pool->lock and thus
+won't change while holding pool->lock; however, nr_running can change
+asynchronously as other workers block and resume and while it's likely
+to be zero, as someone woke this worker up in the first place, some
+other workers could have become runnable inbetween making it non-zero.
+
+If this happens, manage_worker() could return false even with zero
+nr_idle making the worker, the last idle one, proceed to execute work
+items. If then all workers of the pool end up blocking on a resource
+which can only be released by a work item which is pending on that
+pool, the whole pool can deadlock as there's no one to create more
+workers or summon the rescuers.
+
+This patch fixes the problem by removing the early exit condition from
+maybe_create_worker() and making manage_workers() return false iff
+there's already another manager, which ensures that the last worker
+doesn't start executing work items.
+
+We can leave the early exit condition alone and just ignore the return
+value but the only reason it was put there is because the
+manage_workers() used to perform both creations and destructions of
+workers and thus the function may be invoked while the pool is trying
+to reduce the number of workers. Now that manage_workers() is called
+only when more workers are needed, the only case this early exit
+condition is triggered is rare race conditions rendering it pointless.
+
+Tested with simulated workload and modified workqueue code which
+trigger the pool deadlock reliably without this patch.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Eric Sandeen <sandeen@sandeen.net>
+Link: http://lkml.kernel.org/g/54B019F4.8030009@sandeen.net
+Cc: Dave Chinner <david@fromorbit.com>
+Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1841,17 +1841,11 @@ static void pool_mayday_timeout(unsigned
+ * spin_lock_irq(pool->lock) which may be released and regrabbed
+ * multiple times. Does GFP_KERNEL allocations. Called only from
+ * manager.
+- *
+- * Return:
+- * %false if no action was taken and pool->lock stayed locked, %true
+- * otherwise.
+ */
+-static bool maybe_create_worker(struct worker_pool *pool)
++static void maybe_create_worker(struct worker_pool *pool)
+ __releases(&pool->lock)
+ __acquires(&pool->lock)
+ {
+- if (!need_to_create_worker(pool))
+- return false;
+ restart:
+ spin_unlock_irq(&pool->lock);
+
+@@ -1877,7 +1871,6 @@ restart:
+ */
+ if (need_to_create_worker(pool))
+ goto restart;
+- return true;
+ }
+
+ /**
+@@ -1897,16 +1890,14 @@ restart:
+ * multiple times. Does GFP_KERNEL allocations.
+ *
+ * Return:
+- * %false if the pool don't need management and the caller can safely start
+- * processing works, %true indicates that the function released pool->lock
+- * and reacquired it to perform some management function and that the
+- * conditions that the caller verified while holding the lock before
+- * calling the function might no longer be true.
++ * %false if the pool doesn't need management and the caller can safely
++ * start processing works, %true if management function was performed and
++ * the conditions that the caller verified before calling the function may
++ * no longer be true.
+ */
+ static bool manage_workers(struct worker *worker)
+ {
+ struct worker_pool *pool = worker->pool;
+- bool ret = false;
+
+ /*
+ * Anyone who successfully grabs manager_arb wins the arbitration
+@@ -1919,12 +1910,12 @@ static bool manage_workers(struct worker
+ * actual management, the pool may stall indefinitely.
+ */
+ if (!mutex_trylock(&pool->manager_arb))
+- return ret;
++ return false;
+
+- ret |= maybe_create_worker(pool);
++ maybe_create_worker(pool);
+
+ mutex_unlock(&pool->manager_arb);
+- return ret;
++ return true;
+ }
+
+ /**
projects / thirdparty / kernel / stable-queue.git / commitdiff
