From: Greg Kroah-Hartman Date: Fri, 17 Jul 2015 03:13:01 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v4.0.9~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b43071b5b93517b53cc3a878f735ed56c479479d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch regmap-fix-possible-shift-overflow-in-regmap_field_init.patch regmap-fix-regmap_bulk_read-in-be-mode.patch regulator-core-fix-constraints-output-buffer.patch scsi_transport_srp-fix-a-race-condition.patch scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch --- diff --git a/queue-3.14/genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch b/queue-3.14/genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch new file mode 100644 index 00000000000..f363c4e675d --- /dev/null +++ b/queue-3.14/genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch @@ -0,0 +1,47 @@ +From 63781394c540dd9e666a6b21d70b64dd52bce76e Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 11 May 2015 17:02:58 +0800 +Subject: genirq: devres: Fix testing return value of request_any_context_irq() + +From: Axel Lin + +commit 63781394c540dd9e666a6b21d70b64dd52bce76e upstream. + +request_any_context_irq() returns a negative value on failure. +It returns either IRQC_IS_HARDIRQ or IRQC_IS_NESTED on success. +So fix testing return value of request_any_context_irq(). + +Also fixup the return value of devm_request_any_context_irq() to make it +consistent with request_any_context_irq(). + +Fixes: 0668d3065128 ("genirq: Add devm_request_any_context_irq()") +Signed-off-by: Axel Lin +Reviewed-by: Stephen Boyd +Link: http://lkml.kernel.org/r/1431334978.17783.4.camel@ingics.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/devres.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/irq/devres.c ++++ b/kernel/irq/devres.c +@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct + return -ENOMEM; + + rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id); +- if (rc) { ++ if (rc < 0) { + devres_free(dr); + return rc; + } +@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct + dr->dev_id = dev_id; + devres_add(dev, dr); + +- return 0; ++ return rc; + } + EXPORT_SYMBOL(devm_request_any_context_irq); + diff --git a/queue-3.14/leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch b/queue-3.14/leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch new file mode 100644 index 00000000000..bb55362c348 --- /dev/null +++ b/queue-3.14/leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch @@ -0,0 +1,67 @@ +From 084609bf727981c7a2e6e69aefe0052c9d793300 Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Fri, 24 Apr 2015 14:57:10 +0300 +Subject: leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger + +From: Grygorii Strashko + +commit 084609bf727981c7a2e6e69aefe0052c9d793300 upstream. + +Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of +hibernation callbacks means those pm functions will not be +called upon hibernation - that leads to system crash on ARM during +freezing if gpio-led is used in combination with CPU led trigger. +It may happen after freeze_noirq stage (GPIO is suspended) +and before syscore_suspend stage (CPU led trigger is suspended) +- usually when disable_nonboot_cpus() is called. + +Log: + PM: noirq freeze of devices complete after 1.425 msecs + Disabling non-boot CPUs ... + ^ system may crash or stuck here with message (TI AM572x) + + WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370() + 44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access + + CPU1: shutdown + ^ or here + +Fix this by using SIMPLE_DEV_PM_OPS, which appropriately +assigns the suspend and hibernation callbacks and move +led_suspend/led_resume under CONFIG_PM_SLEEP to avoid +build warnings. + +Fixes: 73e1ab41a80d (leds: Convert led class driver from legacy pm ops to dev_pm_ops) +Signed-off-by: Grygorii Strashko +Acked-by: Jacek Anaszewski +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/leds/led-class.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_clas + } + EXPORT_SYMBOL_GPL(led_classdev_resume); + ++#ifdef CONFIG_PM_SLEEP + static int led_suspend(struct device *dev) + { + struct led_classdev *led_cdev = dev_get_drvdata(dev); +@@ -197,11 +198,9 @@ static int led_resume(struct device *dev + + return 0; + } ++#endif + +-static const struct dev_pm_ops leds_class_dev_pm_ops = { +- .suspend = led_suspend, +- .resume = led_resume, +-}; ++static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume); + + /** + * led_classdev_register - register a new object of led_classdev class. diff --git a/queue-3.14/mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch b/queue-3.14/mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch new file mode 100644 index 00000000000..9cb0fd31279 --- /dev/null +++ b/queue-3.14/mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch @@ -0,0 +1,63 @@ +From e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Thu, 28 May 2015 10:22:10 +0200 +Subject: mtd: dc21285: use raw spinlock functions for nw_gpio_lock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= + +commit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream. + +Since commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock +that needs usage of the corresponding raw functions. + +This fixes: + + drivers/mtd/maps/dc21285.c: In function 'nw_en_write': + drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type + spin_lock_irqsave(&nw_gpio_lock, flags); + + In file included from include/linux/seqlock.h:35:0, + from include/linux/time.h:5, + from include/linux/stat.h:18, + from include/linux/module.h:10, + from drivers/mtd/maps/dc21285.c:8: + include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *' + static inline raw_spinlock_t *spinlock_check(spinlock_t *lock) + ^ + drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type + spin_unlock_irqrestore(&nw_gpio_lock, flags); + ^ + In file included from include/linux/seqlock.h:35:0, + from include/linux/time.h:5, + from include/linux/stat.h:18, + from include/linux/module.h:10, + from drivers/mtd/maps/dc21285.c:8: + include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *' + static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags) + +Fixes: bd31b85960a7 ("locking, ARM: Annotate low level hw locks as raw") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Brian Norris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/maps/dc21285.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/maps/dc21285.c ++++ b/drivers/mtd/maps/dc21285.c +@@ -38,9 +38,9 @@ static void nw_en_write(void) + * we want to write a bit pattern XXX1 to Xilinx to enable + * the write gate, which will be open for about the next 2ms. + */ +- spin_lock_irqsave(&nw_gpio_lock, flags); ++ raw_spin_lock_irqsave(&nw_gpio_lock, flags); + nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); +- spin_unlock_irqrestore(&nw_gpio_lock, flags); ++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); + + /* + * let the ISA bus to catch on... diff --git a/queue-3.14/mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch b/queue-3.14/mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch new file mode 100644 index 00000000000..a8410e5a747 --- /dev/null +++ b/queue-3.14/mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch @@ -0,0 +1,96 @@ +From 073db4a51ee43ccb827f54a4261c0583b028d5ab Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Thu, 7 May 2015 17:55:16 -0700 +Subject: mtd: fix: avoid race condition when accessing mtd->usecount + +From: Brian Norris + +commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream. + +On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to +mtd->usecount were done without taking mtd_table_mutex. +kernel: Call Trace: +kernel: [] __put_mtd_device+0x20/0x50 +kernel: [] blktrans_release+0x8c/0xd8 +kernel: [] __blkdev_put+0x1a8/0x200 +kernel: [] blkdev_close+0x1c/0x30 +kernel: [] __fput+0xac/0x250 +kernel: [] task_work_run+0xd8/0x120 +kernel: [] work_notifysig+0x10/0x18 +kernel: +kernel: + Code: 2442ffff ac8202d8 000217fe <00020336> dc820128 10400003 + 00000000 0040f809 00000000 +kernel: ---[ end trace 080fbb4579b47a73 ]--- + +Fixed by taking the mutex in blktrans_open and blktrans_release. + +Note that this locking is already suggested in +include/linux/mtd/blktrans.h: + +struct mtd_blktrans_ops { +... + /* Called with mtd_table_mutex held; no race with add/remove */ + int (*open)(struct mtd_blktrans_dev *dev); + void (*release)(struct mtd_blktrans_dev *dev); +... +}; + +But we weren't following it. + +Originally reported by (and patched by) Zhang and Giuseppe, +independently. Improved and rewritten. + +Reported-by: Zhang Xingcai +Reported-by: Giuseppe Cantavenera +Tested-by: Giuseppe Cantavenera +Acked-by: Alexander Sverdlin +Signed-off-by: Brian Norris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtd_blkdevs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -199,6 +199,7 @@ static int blktrans_open(struct block_de + return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (dev->open) + goto unlock; +@@ -222,6 +223,7 @@ static int blktrans_open(struct block_de + + unlock: + dev->open++; ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -232,6 +234,7 @@ error_release: + error_put: + module_put(dev->tr->owner); + kref_put(&dev->ref, blktrans_dev_release); ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -245,6 +248,7 @@ static void blktrans_release(struct gend + return; + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (--dev->open) + goto unlock; +@@ -258,6 +262,7 @@ static void blktrans_release(struct gend + __put_mtd_device(dev->mtd); + } + unlock: ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + } diff --git a/queue-3.14/regmap-fix-possible-shift-overflow-in-regmap_field_init.patch b/queue-3.14/regmap-fix-possible-shift-overflow-in-regmap_field_init.patch new file mode 100644 index 00000000000..686d82311b2 --- /dev/null +++ b/queue-3.14/regmap-fix-possible-shift-overflow-in-regmap_field_init.patch @@ -0,0 +1,42 @@ +From 921cc29473a0d7c109105c1876ddb432f4a4be7d Mon Sep 17 00:00:00 2001 +From: Maxime Coquelin +Date: Tue, 16 Jun 2015 13:53:19 +0200 +Subject: regmap: Fix possible shift overflow in regmap_field_init() + +From: Maxime Coquelin + +commit 921cc29473a0d7c109105c1876ddb432f4a4be7d upstream. + +The way the mask is generated in regmap_field_init() is wrong. +Indeed, a field initialized with msb = 31 and lsb = 0 provokes a shift +overflow while calculating the mask field. + +On some 32 bits architectures, such as x86, the generated mask is 0, +instead of the expected 0xffffffff. + +This patch uses GENMASK() to fix the problem, as this macro is already safe +regarding shift overflow. + +Signed-off-by: Maxime Coquelin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regmap.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init); + static void regmap_field_init(struct regmap_field *rm_field, + struct regmap *regmap, struct reg_field reg_field) + { +- int field_bits = reg_field.msb - reg_field.lsb + 1; + rm_field->regmap = regmap; + rm_field->reg = reg_field.reg; + rm_field->shift = reg_field.lsb; +- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb); ++ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb); + rm_field->id_size = reg_field.id_size; + rm_field->id_offset = reg_field.id_offset; + } diff --git a/queue-3.14/regmap-fix-regmap_bulk_read-in-be-mode.patch b/queue-3.14/regmap-fix-regmap_bulk_read-in-be-mode.patch new file mode 100644 index 00000000000..3f14356f1ad --- /dev/null +++ b/queue-3.14/regmap-fix-regmap_bulk_read-in-be-mode.patch @@ -0,0 +1,35 @@ +From 15b8d2c41fe5839582029f65c5f7004db451cc2b Mon Sep 17 00:00:00 2001 +From: Arun Chandran +Date: Mon, 15 Jun 2015 15:59:02 +0530 +Subject: regmap: Fix regmap_bulk_read in BE mode + +From: Arun Chandran + +commit 15b8d2c41fe5839582029f65c5f7004db451cc2b upstream. + +In big endian mode regmap_bulk_read gives incorrect data +for byte reads. + +This is because memcpy of a single byte from an address +after full word read gives different results when +endianness differs. ie. we get little-end in LE and big-end in BE. + +Signed-off-by: Arun Chandran +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1947,7 +1947,7 @@ int regmap_bulk_read(struct regmap *map, + &ival); + if (ret != 0) + return ret; +- memcpy(val + (i * val_bytes), &ival, val_bytes); ++ map->format.format_val(val + (i * val_bytes), ival, 0); + } + } + diff --git a/queue-3.14/regulator-core-fix-constraints-output-buffer.patch b/queue-3.14/regulator-core-fix-constraints-output-buffer.patch new file mode 100644 index 00000000000..9cb9f53c964 --- /dev/null +++ b/queue-3.14/regulator-core-fix-constraints-output-buffer.patch @@ -0,0 +1,31 @@ +From a7068e3932eee8268c4ce4e080a338ee7b8a27bf Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Tue, 9 Jun 2015 20:09:42 +0000 +Subject: regulator: core: fix constraints output buffer + +From: Stefan Wahren + +commit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream. + +The buffer for condtraints debug isn't big enough to hold the output +in all cases. So fix this issue by increasing the buffer. + +Signed-off-by: Stefan Wahren +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -773,7 +773,7 @@ static int suspend_prepare(struct regula + static void print_constraints(struct regulator_dev *rdev) + { + struct regulation_constraints *constraints = rdev->constraints; +- char buf[80] = ""; ++ char buf[160] = ""; + int count = 0; + int ret; + diff --git a/queue-3.14/scsi_transport_srp-fix-a-race-condition.patch b/queue-3.14/scsi_transport_srp-fix-a-race-condition.patch new file mode 100644 index 00000000000..5677239db75 --- /dev/null +++ b/queue-3.14/scsi_transport_srp-fix-a-race-condition.patch @@ -0,0 +1,54 @@ +From 535fb906225fb7436cb658144d0c0cea14a26f3e Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 18 May 2015 13:22:44 +0200 +Subject: scsi_transport_srp: Fix a race condition + +From: Bart Van Assche + +commit 535fb906225fb7436cb658144d0c0cea14a26f3e upstream. + +Avoid that srp_terminate_io() can get invoked while srp_queuecommand() +is in progress. This patch avoids that an I/O timeout can trigger the +following kernel warning: + +WARNING: at drivers/infiniband/ulp/srp/ib_srp.c:1447 srp_terminate_io+0xef/0x100 [ib_srp]() +Call Trace: + [] dump_stack+0x4e/0x68 + [] warn_slowpath_common+0x81/0xa0 + [] warn_slowpath_null+0x1a/0x20 + [] srp_terminate_io+0xef/0x100 [ib_srp] + [] __rport_fail_io_fast+0xba/0xc0 [scsi_transport_srp] + [] rport_fast_io_fail_timedout+0xe0/0xf0 [scsi_transport_srp] + [] process_one_work+0x1db/0x780 + [] worker_thread+0x11b/0x450 + [] kthread+0xe4/0x100 + [] ret_from_fork+0x7c/0xb0 + +See also patch "scsi_transport_srp: Add transport layer error +handling" (commit ID 29c17324803c). + +Signed-off-by: Bart Van Assche +Cc: James Bottomley +Cc: Sagi Grimberg +Cc: Sebastian Parschauer +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_srp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -440,8 +440,10 @@ static void __rport_fail_io_fast(struct + + /* Involve the LLD if possible to terminate all I/O on the rport. */ + i = to_srp_internal(shost->transportt); +- if (i->f->terminate_rport_io) ++ if (i->f->terminate_rport_io) { ++ srp_wait_for_queuecommand(shost); + i->f->terminate_rport_io(rport); ++ } + } + + /** diff --git a/queue-3.14/scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch b/queue-3.14/scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch new file mode 100644 index 00000000000..0be02533c25 --- /dev/null +++ b/queue-3.14/scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch @@ -0,0 +1,105 @@ +From be34c62ddf39d1931780b07a6f4241393e4ba2ee Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 18 May 2015 13:22:19 +0200 +Subject: scsi_transport_srp: Introduce srp_wait_for_queuecommand() + +From: Bart Van Assche + +commit be34c62ddf39d1931780b07a6f4241393e4ba2ee upstream. + +Introduce the helper function srp_wait_for_queuecommand(). +Move the definition of scsi_request_fn_active(). Add a comment +above srp_wait_for_queuecommand() that support for scsi-mq needs +to be added. + +This patch does not change any functionality. A second call to +srp_wait_for_queuecommand() will be introduced in the next patch. + +Signed-off-by: Bart Van Assche +Cc: James Bottomley +Cc: Sagi Grimberg +Cc: Sebastian Parschauer +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_srp.c | 54 +++++++++++++++++++++----------------- + 1 file changed, 31 insertions(+), 23 deletions(-) + +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct wo + } + } + ++/** ++ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() ++ * @shost: SCSI host for which to count the number of scsi_request_fn() callers. ++ * ++ * To do: add support for scsi-mq in this function. ++ */ ++static int scsi_request_fn_active(struct Scsi_Host *shost) ++{ ++ struct scsi_device *sdev; ++ struct request_queue *q; ++ int request_fn_active = 0; ++ ++ shost_for_each_device(sdev, shost) { ++ q = sdev->request_queue; ++ ++ spin_lock_irq(q->queue_lock); ++ request_fn_active += q->request_fn_active; ++ spin_unlock_irq(q->queue_lock); ++ } ++ ++ return request_fn_active; ++} ++ ++/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */ ++static void srp_wait_for_queuecommand(struct Scsi_Host *shost) ++{ ++ while (scsi_request_fn_active(shost)) ++ msleep(20); ++} ++ + static void __rport_fail_io_fast(struct srp_rport *rport) + { + struct Scsi_Host *shost = rport_to_shost(rport); +@@ -505,27 +535,6 @@ void srp_start_tl_fail_timers(struct srp + EXPORT_SYMBOL(srp_start_tl_fail_timers); + + /** +- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() +- * @shost: SCSI host for which to count the number of scsi_request_fn() callers. +- */ +-static int scsi_request_fn_active(struct Scsi_Host *shost) +-{ +- struct scsi_device *sdev; +- struct request_queue *q; +- int request_fn_active = 0; +- +- shost_for_each_device(sdev, shost) { +- q = sdev->request_queue; +- +- spin_lock_irq(q->queue_lock); +- request_fn_active += q->request_fn_active; +- spin_unlock_irq(q->queue_lock); +- } +- +- return request_fn_active; +-} +- +-/** + * srp_reconnect_rport() - reconnect to an SRP target port + * @rport: SRP target port. + * +@@ -560,8 +569,7 @@ int srp_reconnect_rport(struct srp_rport + if (res) + goto out; + scsi_target_block(&shost->shost_gendev); +- while (scsi_request_fn_active(shost)) +- msleep(20); ++ srp_wait_for_queuecommand(shost); + res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV; + pr_debug("%s (state %d): transport.reconnect() returned %d\n", + dev_name(&shost->shost_gendev), rport->state, res); diff --git a/queue-3.14/series b/queue-3.14/series index b5daa62653a..f873d9afccc 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -9,3 +9,14 @@ arm64-do-not-attempt-to-use-init_mm-in-reset_context.patch arm64-mm-fix-freeing-of-the-wrong-memmap-entries-with-sparsemem_vmemmap.patch arm64-vdso-work-around-broken-elf-toolchains-in-makefile.patch cpuidle-menu-return-1-if-there-are-no-suitable-states.patch +regmap-fix-regmap_bulk_read-in-be-mode.patch +regmap-fix-possible-shift-overflow-in-regmap_field_init.patch +regulator-core-fix-constraints-output-buffer.patch +spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch +spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch +scsi_transport_srp-introduce-srp_wait_for_queuecommand.patch +scsi_transport_srp-fix-a-race-condition.patch +genirq-devres-fix-testing-return-value-of-request_any_context_irq.patch +leds-pm-fix-hibernation-on-arm-when-gpio-led-used-with-cpu-led-trigger.patch +mtd-fix-avoid-race-condition-when-accessing-mtd-usecount.patch +mtd-dc21285-use-raw-spinlock-functions-for-nw_gpio_lock.patch diff --git a/queue-3.14/spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch b/queue-3.14/spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch new file mode 100644 index 00000000000..39d0615f797 --- /dev/null +++ b/queue-3.14/spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch @@ -0,0 +1,62 @@ +From 8e76ef88f607174082023f50b87fe12dcdbe5db5 Mon Sep 17 00:00:00 2001 +From: Martin Sperl +Date: Sun, 10 May 2015 07:50:45 +0000 +Subject: spi: fix race freeing dummy_tx/rx before it is unmapped +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Sperl + +commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream. + +Fix a race (with some kernel configurations) where a queued +master->pump_messages runs and frees dummy_tx/rx before +spi_unmap_msg is running (or is finished). + +This results in the following messages: + BUG: Bad page state in process + page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0 + flags: 0x200(arch_1) + page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set + ... + +Reported-by: Noralf Trønnes +Suggested-by: Noralf Trønnes +Tested-by: Noralf Trønnes +Signed-off-by: Martin Sperl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct + + spin_lock_irqsave(&master->queue_lock, flags); + mesg = master->cur_msg; +- master->cur_msg = NULL; +- +- queue_kthread_work(&master->kworker, &master->pump_messages); + spin_unlock_irqrestore(&master->queue_lock, flags); + + if (master->cur_msg_prepared && master->unprepare_message) { +@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct + } + } + +- trace_spi_message_done(mesg); +- ++ spin_lock_irqsave(&master->queue_lock, flags); ++ master->cur_msg = NULL; + master->cur_msg_prepared = false; ++ queue_kthread_work(&master->kworker, &master->pump_messages); ++ spin_unlock_irqrestore(&master->queue_lock, flags); ++ ++ trace_spi_message_done(mesg); + + mesg->state = NULL; + if (mesg->complete) diff --git a/queue-3.14/spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch b/queue-3.14/spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch new file mode 100644 index 00000000000..16b8a7c4058 --- /dev/null +++ b/queue-3.14/spi-pl022-specify-num-cs-property-as-required-in-devicetree-binding.patch @@ -0,0 +1,37 @@ +From ea6055c46eda1e19e02209814955e13f334bbe1b Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Mon, 11 May 2015 12:20:18 -0300 +Subject: spi: pl022: Specify 'num-cs' property as required in devicetree binding + +From: Ezequiel Garcia + +commit ea6055c46eda1e19e02209814955e13f334bbe1b upstream. + +Since commit 39a6ac11df65 ("spi/pl022: Devicetree support w/o platform data") +the 'num-cs' parameter cannot be passed through platform data when probing +with devicetree. Instead, it's a required devicetree property. + +Fix the binding documentation so the property is properly specified. + +Fixes: 39a6ac11df65 ("spi/pl022: Devicetree support w/o platform data") +Signed-off-by: Ezequiel Garcia +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/spi/spi_pl022.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/spi/spi_pl022.txt ++++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt +@@ -4,9 +4,9 @@ Required properties: + - compatible : "arm,pl022", "arm,primecell" + - reg : Offset and length of the register set for the device + - interrupts : Should contain SPI controller interrupt ++- num-cs : total number of chipselects + + Optional properties: +-- num-cs : total number of chipselects + - cs-gpios : should specify GPIOs used for chipselects. + The gpios will be referred to as reg = in the SPI child nodes. + If unspecified, a single SPI device without a chip select can be used.