--- /dev/null
+From f6e6e1b9fee88c90586787b71dc49bb3ce62bb89 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 5 May 2014 11:38:09 +0200
+Subject: ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit f6e6e1b9fee88c90586787b71dc49bb3ce62bb89 upstream.
+
+Without this this EEE PC exports a non working WMI interface, with this it
+exports a working "good old" eeepc_laptop interface, fixing brightness control
+not working as well as rfkill being stuck in a permanent wireless blocked
+state.
+
+This is not an ideal way to fix this, but various attempts to fix this
+otherwise have failed, see:
+
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1067181
+Reported-and-tested-by: lou.cardone@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/blacklist.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -374,6 +374,19 @@ static struct dmi_system_id acpi_osi_dmi
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
+ },
+ },
++ /*
++ * Without this this EEEpc exports a non working WMI interface, with
++ * this it exports a working "good old" eeepc_laptop interface, fixing
++ * both brightness control, and rfkill not working.
++ */
++ {
++ .callback = dmi_enable_osi_linux,
++ .ident = "Asus EEE PC 1015PX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+From b753631b3576bf343151a82513c5d56fcda1e24f Mon Sep 17 00:00:00 2001
+From: Edward Lin <yidi.lin@canonical.com>
+Date: Wed, 7 May 2014 10:47:24 +0800
+Subject: ACPI: blacklist win8 OSI for Dell Inspiron 7737
+
+From: Edward Lin <yidi.lin@canonical.com>
+
+commit b753631b3576bf343151a82513c5d56fcda1e24f upstream.
+
+With win8 capabiltiy, the machine will boot itself immediately after
+shutdown command has executed.
+
+Work around this issue by disabling win8 capcability. This workaround
+also makes wireless hotkey work.
+
+Signed-off-by: Edward Lin <yidi.lin@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/blacklist.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -314,6 +314,14 @@ static struct dmi_system_id acpi_osi_dmi
+ DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
+ },
+ },
++ {
++ .callback = dmi_disable_osi_win8,
++ .ident = "Dell Inspiron 7737",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7737"),
++ },
++ },
+
+ /*
+ * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
--- /dev/null
+From 0b9d46dd7debf8e6dc8614106f1c1909fa8de64d Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <imammedo@redhat.com>
+Date: Mon, 5 May 2014 22:49:49 +0200
+Subject: ACPI / processor: do not mark present at boot but not onlined CPU as onlined
+
+From: Igor Mammedov <imammedo@redhat.com>
+
+commit 0b9d46dd7debf8e6dc8614106f1c1909fa8de64d upstream.
+
+acpi_processor_add() assumes that present at boot CPUs
+are always onlined, it is not so if a CPU failed to become
+onlined. As result acpi_processor_add() will mark such CPU
+device as onlined in sysfs and following attempts to
+online/offline it using /sys/device/system/cpu/cpuX/online
+attribute will fail.
+
+Do not poke into device internals in acpi_processor_add()
+and touch "struct device { .offline }" attribute, since
+for CPUs onlined at boot it's set by:
+ topology_init() -> arch_register_cpu() -> register_cpu()
+before ACPI device tree is parsed, and for hotplugged
+CPUs it's set when userspace onlines CPU via sysfs.
+
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Acked-by: Toshi Kani <toshi.kani@hp.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_processor.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -405,7 +405,6 @@ static int acpi_processor_add(struct acp
+ goto err;
+
+ pr->dev = dev;
+- dev->offline = pr->flags.need_hotplug_init;
+
+ /* Trigger the processor driver's .probe() if present. */
+ if (device_attach(dev) >= 0)
--- /dev/null
+From 98012849e0cbf980326f8e34d571f4474866a88e Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 6 May 2014 19:18:28 -0700
+Subject: ACPI: Revert "ACPI / AC: convert ACPI ac driver to platform bus"
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 98012849e0cbf980326f8e34d571f4474866a88e upstream.
+
+Revert commit cc8ef5270734 (ACPI / AC: convert ACPI ac driver to
+platform bus) that is reported to break thermal management on
+MacBook Air 2013 with ArchLinux.
+
+Fixes: cc8ef5270734 (ACPI / AC: convert ACPI ac driver to platform bus)
+References: https://bugzilla.kernel.org/show_bug.cgi?id=71711
+Cc: Zhang Rui <rui.zhang@intel.com>
+Reported-and-tested-by: Manuel Krause <manuelkrause@netscape.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ac.c | 117 +++++++++++++++++++++----------------------
+ drivers/acpi/acpi_platform.c | 1
+ 2 files changed, 58 insertions(+), 60 deletions(-)
+
+--- a/drivers/acpi/ac.c
++++ b/drivers/acpi/ac.c
+@@ -51,11 +51,39 @@ MODULE_AUTHOR("Paul Diefenbaugh");
+ MODULE_DESCRIPTION("ACPI AC Adapter Driver");
+ MODULE_LICENSE("GPL");
+
++static int acpi_ac_add(struct acpi_device *device);
++static int acpi_ac_remove(struct acpi_device *device);
++static void acpi_ac_notify(struct acpi_device *device, u32 event);
++
++static const struct acpi_device_id ac_device_ids[] = {
++ {"ACPI0003", 0},
++ {"", 0},
++};
++MODULE_DEVICE_TABLE(acpi, ac_device_ids);
++
++#ifdef CONFIG_PM_SLEEP
++static int acpi_ac_resume(struct device *dev);
++#endif
++static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
++
+ static int ac_sleep_before_get_state_ms;
+
++static struct acpi_driver acpi_ac_driver = {
++ .name = "ac",
++ .class = ACPI_AC_CLASS,
++ .ids = ac_device_ids,
++ .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
++ .ops = {
++ .add = acpi_ac_add,
++ .remove = acpi_ac_remove,
++ .notify = acpi_ac_notify,
++ },
++ .drv.pm = &acpi_ac_pm,
++};
++
+ struct acpi_ac {
+ struct power_supply charger;
+- struct platform_device *pdev;
++ struct acpi_device * device;
+ unsigned long long state;
+ };
+
+@@ -67,10 +95,12 @@ struct acpi_ac {
+
+ static int acpi_ac_get_state(struct acpi_ac *ac)
+ {
+- acpi_status status;
+- acpi_handle handle = ACPI_HANDLE(&ac->pdev->dev);
++ acpi_status status = AE_OK;
++
++ if (!ac)
++ return -EINVAL;
+
+- status = acpi_evaluate_integer(handle, "_PSR", NULL,
++ status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL,
+ &ac->state);
+ if (ACPI_FAILURE(status)) {
+ ACPI_EXCEPTION((AE_INFO, status,
+@@ -115,10 +145,9 @@ static enum power_supply_property ac_pro
+ Driver Model
+ -------------------------------------------------------------------------- */
+
+-static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
++static void acpi_ac_notify(struct acpi_device *device, u32 event)
+ {
+- struct acpi_ac *ac = data;
+- struct acpi_device *adev;
++ struct acpi_ac *ac = acpi_driver_data(device);
+
+ if (!ac)
+ return;
+@@ -141,11 +170,10 @@ static void acpi_ac_notify_handler(acpi_
+ msleep(ac_sleep_before_get_state_ms);
+
+ acpi_ac_get_state(ac);
+- adev = ACPI_COMPANION(&ac->pdev->dev);
+- acpi_bus_generate_netlink_event(adev->pnp.device_class,
+- dev_name(&ac->pdev->dev),
+- event, (u32) ac->state);
+- acpi_notifier_call_chain(adev, event, (u32) ac->state);
++ acpi_bus_generate_netlink_event(device->pnp.device_class,
++ dev_name(&device->dev), event,
++ (u32) ac->state);
++ acpi_notifier_call_chain(device, event, (u32) ac->state);
+ kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
+ }
+
+@@ -170,49 +198,39 @@ static struct dmi_system_id ac_dmi_table
+ {},
+ };
+
+-static int acpi_ac_probe(struct platform_device *pdev)
++static int acpi_ac_add(struct acpi_device *device)
+ {
+ int result = 0;
+ struct acpi_ac *ac = NULL;
+- struct acpi_device *adev;
+
+- if (!pdev)
+- return -EINVAL;
+
+- adev = ACPI_COMPANION(&pdev->dev);
+- if (!adev)
+- return -ENODEV;
++ if (!device)
++ return -EINVAL;
+
+ ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
+ if (!ac)
+ return -ENOMEM;
+
+- strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
+- strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
+- ac->pdev = pdev;
+- platform_set_drvdata(pdev, ac);
++ ac->device = device;
++ strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
++ strcpy(acpi_device_class(device), ACPI_AC_CLASS);
++ device->driver_data = ac;
+
+ result = acpi_ac_get_state(ac);
+ if (result)
+ goto end;
+
+- ac->charger.name = acpi_device_bid(adev);
++ ac->charger.name = acpi_device_bid(device);
+ ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
+ ac->charger.properties = ac_props;
+ ac->charger.num_properties = ARRAY_SIZE(ac_props);
+ ac->charger.get_property = get_ac_property;
+- result = power_supply_register(&pdev->dev, &ac->charger);
++ result = power_supply_register(&ac->device->dev, &ac->charger);
+ if (result)
+ goto end;
+
+- result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
+- ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
+- if (result) {
+- power_supply_unregister(&ac->charger);
+- goto end;
+- }
+ printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
+- acpi_device_name(adev), acpi_device_bid(adev),
++ acpi_device_name(device), acpi_device_bid(device),
+ ac->state ? "on-line" : "off-line");
+
+ end:
+@@ -232,7 +250,7 @@ static int acpi_ac_resume(struct device
+ if (!dev)
+ return -EINVAL;
+
+- ac = platform_get_drvdata(to_platform_device(dev));
++ ac = acpi_driver_data(to_acpi_device(dev));
+ if (!ac)
+ return -EINVAL;
+
+@@ -246,19 +264,17 @@ static int acpi_ac_resume(struct device
+ #else
+ #define acpi_ac_resume NULL
+ #endif
+-static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
+
+-static int acpi_ac_remove(struct platform_device *pdev)
++static int acpi_ac_remove(struct acpi_device *device)
+ {
+- struct acpi_ac *ac;
++ struct acpi_ac *ac = NULL;
+
+- if (!pdev)
++
++ if (!device || !acpi_driver_data(device))
+ return -EINVAL;
+
+- acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
+- ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
++ ac = acpi_driver_data(device);
+
+- ac = platform_get_drvdata(pdev);
+ if (ac->charger.dev)
+ power_supply_unregister(&ac->charger);
+
+@@ -267,23 +283,6 @@ static int acpi_ac_remove(struct platfor
+ return 0;
+ }
+
+-static const struct acpi_device_id acpi_ac_match[] = {
+- { "ACPI0003", 0 },
+- { }
+-};
+-MODULE_DEVICE_TABLE(acpi, acpi_ac_match);
+-
+-static struct platform_driver acpi_ac_driver = {
+- .probe = acpi_ac_probe,
+- .remove = acpi_ac_remove,
+- .driver = {
+- .name = "acpi-ac",
+- .owner = THIS_MODULE,
+- .pm = &acpi_ac_pm_ops,
+- .acpi_match_table = ACPI_PTR(acpi_ac_match),
+- },
+-};
+-
+ static int __init acpi_ac_init(void)
+ {
+ int result;
+@@ -291,7 +290,7 @@ static int __init acpi_ac_init(void)
+ if (acpi_disabled)
+ return -ENODEV;
+
+- result = platform_driver_register(&acpi_ac_driver);
++ result = acpi_bus_register_driver(&acpi_ac_driver);
+ if (result < 0)
+ return -ENODEV;
+
+@@ -300,7 +299,7 @@ static int __init acpi_ac_init(void)
+
+ static void __exit acpi_ac_exit(void)
+ {
+- platform_driver_unregister(&acpi_ac_driver);
++ acpi_bus_unregister_driver(&acpi_ac_driver);
+ }
+ module_init(acpi_ac_init);
+ module_exit(acpi_ac_exit);
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -29,7 +29,6 @@ ACPI_MODULE_NAME("platform");
+ static const struct acpi_device_id acpi_platform_device_ids[] = {
+
+ { "PNP0D40" },
+- { "ACPI0003" },
+ { "VPC2004" },
+ { "BCM4752" },
+
--- /dev/null
+From 3a670cc79342c36d308decd5f90351830ed1685c Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Sun, 4 May 2014 11:07:25 +0800
+Subject: ACPI: Revert "ACPI / Battery: Remove battery's proc directory"
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 3a670cc79342c36d308decd5f90351830ed1685c upstream.
+
+The commit 1e2d9cd and 7d7ee95 remove ACPI Proc Battery
+directory and breaks some old userspace tools. This patch
+is to revert commit 1e2d9cd.
+
+Fixes: 1e2d9cdfb449 (ACPI / Battery: Remove battery's proc directory)
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/battery.c | 329 ++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 328 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -36,6 +36,12 @@
+ #include <linux/suspend.h>
+ #include <asm/unaligned.h>
+
++#ifdef CONFIG_ACPI_PROCFS_POWER
++#include <linux/proc_fs.h>
++#include <linux/seq_file.h>
++#include <asm/uaccess.h>
++#endif
++
+ #include <linux/acpi.h>
+ #include <linux/power_supply.h>
+
+@@ -66,6 +72,19 @@ static unsigned int cache_time = 1000;
+ module_param(cache_time, uint, 0644);
+ MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+
++#ifdef CONFIG_ACPI_PROCFS_POWER
++extern struct proc_dir_entry *acpi_lock_battery_dir(void);
++extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
++
++enum acpi_battery_files {
++ info_tag = 0,
++ state_tag,
++ alarm_tag,
++ ACPI_BATTERY_NUMFILES,
++};
++
++#endif
++
+ static const struct acpi_device_id battery_device_ids[] = {
+ {"PNP0C0A", 0},
+ {"", 0},
+@@ -301,6 +320,14 @@ static enum power_supply_property energy
+ POWER_SUPPLY_PROP_SERIAL_NUMBER,
+ };
+
++#ifdef CONFIG_ACPI_PROCFS_POWER
++inline char *acpi_battery_units(struct acpi_battery *battery)
++{
++ return (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) ?
++ "mA" : "mW";
++}
++#endif
++
+ /* --------------------------------------------------------------------------
+ Battery Management
+ -------------------------------------------------------------------------- */
+@@ -719,6 +746,279 @@ static void acpi_battery_refresh(struct
+ }
+
+ /* --------------------------------------------------------------------------
++ FS Interface (/proc)
++ -------------------------------------------------------------------------- */
++
++#ifdef CONFIG_ACPI_PROCFS_POWER
++static struct proc_dir_entry *acpi_battery_dir;
++
++static int acpi_battery_print_info(struct seq_file *seq, int result)
++{
++ struct acpi_battery *battery = seq->private;
++
++ if (result)
++ goto end;
++
++ seq_printf(seq, "present: %s\n",
++ acpi_battery_present(battery) ? "yes" : "no");
++ if (!acpi_battery_present(battery))
++ goto end;
++ if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "design capacity: unknown\n");
++ else
++ seq_printf(seq, "design capacity: %d %sh\n",
++ battery->design_capacity,
++ acpi_battery_units(battery));
++
++ if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "last full capacity: unknown\n");
++ else
++ seq_printf(seq, "last full capacity: %d %sh\n",
++ battery->full_charge_capacity,
++ acpi_battery_units(battery));
++
++ seq_printf(seq, "battery technology: %srechargeable\n",
++ (!battery->technology)?"non-":"");
++
++ if (battery->design_voltage == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "design voltage: unknown\n");
++ else
++ seq_printf(seq, "design voltage: %d mV\n",
++ battery->design_voltage);
++ seq_printf(seq, "design capacity warning: %d %sh\n",
++ battery->design_capacity_warning,
++ acpi_battery_units(battery));
++ seq_printf(seq, "design capacity low: %d %sh\n",
++ battery->design_capacity_low,
++ acpi_battery_units(battery));
++ seq_printf(seq, "cycle count: %i\n", battery->cycle_count);
++ seq_printf(seq, "capacity granularity 1: %d %sh\n",
++ battery->capacity_granularity_1,
++ acpi_battery_units(battery));
++ seq_printf(seq, "capacity granularity 2: %d %sh\n",
++ battery->capacity_granularity_2,
++ acpi_battery_units(battery));
++ seq_printf(seq, "model number: %s\n", battery->model_number);
++ seq_printf(seq, "serial number: %s\n", battery->serial_number);
++ seq_printf(seq, "battery type: %s\n", battery->type);
++ seq_printf(seq, "OEM info: %s\n", battery->oem_info);
++ end:
++ if (result)
++ seq_printf(seq, "ERROR: Unable to read battery info\n");
++ return result;
++}
++
++static int acpi_battery_print_state(struct seq_file *seq, int result)
++{
++ struct acpi_battery *battery = seq->private;
++
++ if (result)
++ goto end;
++
++ seq_printf(seq, "present: %s\n",
++ acpi_battery_present(battery) ? "yes" : "no");
++ if (!acpi_battery_present(battery))
++ goto end;
++
++ seq_printf(seq, "capacity state: %s\n",
++ (battery->state & 0x04) ? "critical" : "ok");
++ if ((battery->state & 0x01) && (battery->state & 0x02))
++ seq_printf(seq,
++ "charging state: charging/discharging\n");
++ else if (battery->state & 0x01)
++ seq_printf(seq, "charging state: discharging\n");
++ else if (battery->state & 0x02)
++ seq_printf(seq, "charging state: charging\n");
++ else
++ seq_printf(seq, "charging state: charged\n");
++
++ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "present rate: unknown\n");
++ else
++ seq_printf(seq, "present rate: %d %s\n",
++ battery->rate_now, acpi_battery_units(battery));
++
++ if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "remaining capacity: unknown\n");
++ else
++ seq_printf(seq, "remaining capacity: %d %sh\n",
++ battery->capacity_now, acpi_battery_units(battery));
++ if (battery->voltage_now == ACPI_BATTERY_VALUE_UNKNOWN)
++ seq_printf(seq, "present voltage: unknown\n");
++ else
++ seq_printf(seq, "present voltage: %d mV\n",
++ battery->voltage_now);
++ end:
++ if (result)
++ seq_printf(seq, "ERROR: Unable to read battery state\n");
++
++ return result;
++}
++
++static int acpi_battery_print_alarm(struct seq_file *seq, int result)
++{
++ struct acpi_battery *battery = seq->private;
++
++ if (result)
++ goto end;
++
++ if (!acpi_battery_present(battery)) {
++ seq_printf(seq, "present: no\n");
++ goto end;
++ }
++ seq_printf(seq, "alarm: ");
++ if (!battery->alarm)
++ seq_printf(seq, "unsupported\n");
++ else
++ seq_printf(seq, "%u %sh\n", battery->alarm,
++ acpi_battery_units(battery));
++ end:
++ if (result)
++ seq_printf(seq, "ERROR: Unable to read battery alarm\n");
++ return result;
++}
++
++static ssize_t acpi_battery_write_alarm(struct file *file,
++ const char __user * buffer,
++ size_t count, loff_t * ppos)
++{
++ int result = 0;
++ char alarm_string[12] = { '\0' };
++ struct seq_file *m = file->private_data;
++ struct acpi_battery *battery = m->private;
++
++ if (!battery || (count > sizeof(alarm_string) - 1))
++ return -EINVAL;
++ if (!acpi_battery_present(battery)) {
++ result = -ENODEV;
++ goto end;
++ }
++ if (copy_from_user(alarm_string, buffer, count)) {
++ result = -EFAULT;
++ goto end;
++ }
++ alarm_string[count] = '\0';
++ battery->alarm = simple_strtol(alarm_string, NULL, 0);
++ result = acpi_battery_set_alarm(battery);
++ end:
++ if (!result)
++ return count;
++ return result;
++}
++
++typedef int(*print_func)(struct seq_file *seq, int result);
++
++static print_func acpi_print_funcs[ACPI_BATTERY_NUMFILES] = {
++ acpi_battery_print_info,
++ acpi_battery_print_state,
++ acpi_battery_print_alarm,
++};
++
++static int acpi_battery_read(int fid, struct seq_file *seq)
++{
++ struct acpi_battery *battery = seq->private;
++ int result = acpi_battery_update(battery);
++ return acpi_print_funcs[fid](seq, result);
++}
++
++#define DECLARE_FILE_FUNCTIONS(_name) \
++static int acpi_battery_read_##_name(struct seq_file *seq, void *offset) \
++{ \
++ return acpi_battery_read(_name##_tag, seq); \
++} \
++static int acpi_battery_##_name##_open_fs(struct inode *inode, struct file *file) \
++{ \
++ return single_open(file, acpi_battery_read_##_name, PDE_DATA(inode)); \
++}
++
++DECLARE_FILE_FUNCTIONS(info);
++DECLARE_FILE_FUNCTIONS(state);
++DECLARE_FILE_FUNCTIONS(alarm);
++
++#undef DECLARE_FILE_FUNCTIONS
++
++#define FILE_DESCRIPTION_RO(_name) \
++ { \
++ .name = __stringify(_name), \
++ .mode = S_IRUGO, \
++ .ops = { \
++ .open = acpi_battery_##_name##_open_fs, \
++ .read = seq_read, \
++ .llseek = seq_lseek, \
++ .release = single_release, \
++ .owner = THIS_MODULE, \
++ }, \
++ }
++
++#define FILE_DESCRIPTION_RW(_name) \
++ { \
++ .name = __stringify(_name), \
++ .mode = S_IFREG | S_IRUGO | S_IWUSR, \
++ .ops = { \
++ .open = acpi_battery_##_name##_open_fs, \
++ .read = seq_read, \
++ .llseek = seq_lseek, \
++ .write = acpi_battery_write_##_name, \
++ .release = single_release, \
++ .owner = THIS_MODULE, \
++ }, \
++ }
++
++static const struct battery_file {
++ struct file_operations ops;
++ umode_t mode;
++ const char *name;
++} acpi_battery_file[] = {
++ FILE_DESCRIPTION_RO(info),
++ FILE_DESCRIPTION_RO(state),
++ FILE_DESCRIPTION_RW(alarm),
++};
++
++#undef FILE_DESCRIPTION_RO
++#undef FILE_DESCRIPTION_RW
++
++static int acpi_battery_add_fs(struct acpi_device *device)
++{
++ struct proc_dir_entry *entry = NULL;
++ int i;
++
++ printk(KERN_WARNING PREFIX "Deprecated procfs I/F for battery is loaded,"
++ " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
++ if (!acpi_device_dir(device)) {
++ acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
++ acpi_battery_dir);
++ if (!acpi_device_dir(device))
++ return -ENODEV;
++ }
++
++ for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i) {
++ entry = proc_create_data(acpi_battery_file[i].name,
++ acpi_battery_file[i].mode,
++ acpi_device_dir(device),
++ &acpi_battery_file[i].ops,
++ acpi_driver_data(device));
++ if (!entry)
++ return -ENODEV;
++ }
++ return 0;
++}
++
++static void acpi_battery_remove_fs(struct acpi_device *device)
++{
++ int i;
++ if (!acpi_device_dir(device))
++ return;
++ for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i)
++ remove_proc_entry(acpi_battery_file[i].name,
++ acpi_device_dir(device));
++
++ remove_proc_entry(acpi_device_bid(device), acpi_battery_dir);
++ acpi_device_dir(device) = NULL;
++}
++
++#endif
++
++/* --------------------------------------------------------------------------
+ Driver Interface
+ -------------------------------------------------------------------------- */
+
+@@ -791,6 +1091,15 @@ static int acpi_battery_add(struct acpi_
+ result = acpi_battery_update(battery);
+ if (result)
+ goto fail;
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ result = acpi_battery_add_fs(device);
++#endif
++ if (result) {
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ acpi_battery_remove_fs(device);
++#endif
++ goto fail;
++ }
+
+ printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
+ ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
+@@ -817,6 +1126,9 @@ static int acpi_battery_remove(struct ac
+ return -EINVAL;
+ battery = acpi_driver_data(device);
+ unregister_pm_notifier(&battery->pm_nb);
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ acpi_battery_remove_fs(device);
++#endif
+ sysfs_remove_battery(battery);
+ mutex_destroy(&battery->lock);
+ mutex_destroy(&battery->sysfs_lock);
+@@ -867,7 +1179,19 @@ static void __init acpi_battery_init_asy
+
+ if (dmi_check_system(bat_dmi_table))
+ battery_bix_broken_package = 1;
+- acpi_bus_register_driver(&acpi_battery_driver);
++
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ acpi_battery_dir = acpi_lock_battery_dir();
++ if (!acpi_battery_dir)
++ return;
++#endif
++ if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ acpi_unlock_battery_dir(acpi_battery_dir);
++#endif
++ return;
++ }
++ return;
+ }
+
+ static int __init acpi_battery_init(void)
+@@ -879,6 +1203,9 @@ static int __init acpi_battery_init(void
+ static void __exit acpi_battery_exit(void)
+ {
+ acpi_bus_unregister_driver(&acpi_battery_driver);
++#ifdef CONFIG_ACPI_PROCFS_POWER
++ acpi_unlock_battery_dir(acpi_battery_dir);
++#endif
+ }
+
+ module_init(acpi_battery_init);
--- /dev/null
+From e2a7c3d7812369daae56f069eab2e8f3e548d231 Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Sun, 4 May 2014 11:07:24 +0800
+Subject: ACPI: Revert "ACPI: Remove CONFIG_ACPI_PROCFS_POWER and cm_sbsc.c"
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit e2a7c3d7812369daae56f069eab2e8f3e548d231 upstream.
+
+The commit 1e2d9cd and 7d7ee95 remove ACPI Proc Battery
+directory and breaks some old userspace tools. This patch
+is to revert 7d7ee95.
+
+Fixes: 7d7ee958867a (ACPI: Remove CONFIG_ACPI_PROCFS_POWER and cm_sbsc.c)
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/Kconfig | 17 ++++++++
+ drivers/acpi/Makefile | 1
+ drivers/acpi/cm_sbs.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 123 insertions(+)
+
+--- a/drivers/acpi/Kconfig
++++ b/drivers/acpi/Kconfig
+@@ -56,6 +56,23 @@ config ACPI_PROCFS
+
+ Say N to delete /proc/acpi/ files that have moved to /sys/
+
++config ACPI_PROCFS_POWER
++ bool "Deprecated power /proc/acpi directories"
++ depends on PROC_FS
++ help
++ For backwards compatibility, this option allows
++ deprecated power /proc/acpi/ directories to exist, even when
++ they have been replaced by functions in /sys.
++ The deprecated directories (and their replacements) include:
++ /proc/acpi/battery/* (/sys/class/power_supply/*)
++ /proc/acpi/ac_adapter/* (sys/class/power_supply/*)
++ This option has no effect on /proc/acpi/ directories
++ and functions, which do not yet exist in /sys
++ This option, together with the proc directories, will be
++ deleted in 2.6.39.
++
++ Say N to delete power /proc/acpi/ directories that have moved to /sys/
++
+ config ACPI_EC_DEBUGFS
+ tristate "EC read/write access through /sys/kernel/debug/ec"
+ default n
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -47,6 +47,7 @@ acpi-y += sysfs.o
+ acpi-$(CONFIG_X86) += acpi_cmos_rtc.o
+ acpi-$(CONFIG_DEBUG_FS) += debugfs.o
+ acpi-$(CONFIG_ACPI_NUMA) += numa.o
++acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
+ ifdef CONFIG_ACPI_VIDEO
+ acpi-y += video_detect.o
+ endif
+--- /dev/null
++++ b/drivers/acpi/cm_sbs.c
+@@ -0,0 +1,105 @@
++/*
++ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or (at
++ * your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License along
++ * with this program; if not, write to the Free Software Foundation, Inc.,
++ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
++ *
++ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/acpi.h>
++#include <linux/types.h>
++#include <linux/proc_fs.h>
++#include <linux/seq_file.h>
++#include <acpi/acpi_bus.h>
++#include <acpi/acpi_drivers.h>
++
++#define PREFIX "ACPI: "
++
++ACPI_MODULE_NAME("cm_sbs");
++#define ACPI_AC_CLASS "ac_adapter"
++#define ACPI_BATTERY_CLASS "battery"
++#define _COMPONENT ACPI_SBS_COMPONENT
++static struct proc_dir_entry *acpi_ac_dir;
++static struct proc_dir_entry *acpi_battery_dir;
++
++static DEFINE_MUTEX(cm_sbs_mutex);
++
++static int lock_ac_dir_cnt;
++static int lock_battery_dir_cnt;
++
++struct proc_dir_entry *acpi_lock_ac_dir(void)
++{
++ mutex_lock(&cm_sbs_mutex);
++ if (!acpi_ac_dir)
++ acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
++ if (acpi_ac_dir) {
++ lock_ac_dir_cnt++;
++ } else {
++ printk(KERN_ERR PREFIX
++ "Cannot create %s\n", ACPI_AC_CLASS);
++ }
++ mutex_unlock(&cm_sbs_mutex);
++ return acpi_ac_dir;
++}
++EXPORT_SYMBOL(acpi_lock_ac_dir);
++
++void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
++{
++ mutex_lock(&cm_sbs_mutex);
++ if (acpi_ac_dir_param)
++ lock_ac_dir_cnt--;
++ if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
++ remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
++ acpi_ac_dir = NULL;
++ }
++ mutex_unlock(&cm_sbs_mutex);
++}
++EXPORT_SYMBOL(acpi_unlock_ac_dir);
++
++struct proc_dir_entry *acpi_lock_battery_dir(void)
++{
++ mutex_lock(&cm_sbs_mutex);
++ if (!acpi_battery_dir) {
++ acpi_battery_dir =
++ proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
++ }
++ if (acpi_battery_dir) {
++ lock_battery_dir_cnt++;
++ } else {
++ printk(KERN_ERR PREFIX
++ "Cannot create %s\n", ACPI_BATTERY_CLASS);
++ }
++ mutex_unlock(&cm_sbs_mutex);
++ return acpi_battery_dir;
++}
++EXPORT_SYMBOL(acpi_lock_battery_dir);
++
++void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
++{
++ mutex_lock(&cm_sbs_mutex);
++ if (acpi_battery_dir_param)
++ lock_battery_dir_cnt--;
++ if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
++ && acpi_battery_dir) {
++ remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
++ acpi_battery_dir = NULL;
++ }
++ mutex_unlock(&cm_sbs_mutex);
++ return;
++}
++EXPORT_SYMBOL(acpi_unlock_battery_dir);
--- /dev/null
+From f759546498d820670934c901a2fdf1ce948d2e5c Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Mon, 12 May 2014 01:13:28 +0200
+Subject: ACPI / TPM: Fix resume regression on Chromebooks
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit f759546498d820670934c901a2fdf1ce948d2e5c upstream.
+
+Chromebooks (at least Acer C720 and Pixel) implement an ACPI object
+for TPM, but don't implement the _DSM method to support PPI. As
+a result, the TPM driver fails to load on those machines after
+commit 1569a4c4ceba (ACPI / TPM: detect PPI features by checking
+availability of _DSM functions) which causes them to fail to
+resume from system suspend, becuase they require the TPM hardware
+to be put into the right state during resume and the TPM driver
+is necessary for that.
+
+Fix the problem by making tpm_add_ppi() return 0 when tpm_ppi_handle
+is still NULL after walking the ACPI namespace in search for the PPI
+_DSM, which allows the TPM driver to load and operate the hardware
+(during system resume in particular), but avoid creating the PPI
+sysfs group in that case.
+
+This change is based on a prototype patch from Jiang Liu.
+
+Fixes: 1569a4c4ceba (ACPI / TPM: detect PPI features by checking availability of _DSM functions)
+References: https://bugzilla.kernel.org/show_bug.cgi?id=74021
+Reported-by: James Duley <jagduley@gmail.com>
+Reported-by: Phillip Dixon <phil@dixon.gen.nz>
+Tested-by: Brandon Casey <drafnel@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_ppi.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/char/tpm/tpm_ppi.c
++++ b/drivers/char/tpm/tpm_ppi.c
+@@ -328,13 +328,11 @@ int tpm_add_ppi(struct kobject *parent)
+ /* Cache TPM ACPI handle and version string */
+ acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+ ppi_callback, NULL, NULL, &tpm_ppi_handle);
+- if (tpm_ppi_handle == NULL)
+- return -ENODEV;
+-
+- return sysfs_create_group(parent, &ppi_attr_grp);
++ return tpm_ppi_handle ? sysfs_create_group(parent, &ppi_attr_grp) : 0;
+ }
+
+ void tpm_remove_ppi(struct kobject *parent)
+ {
+- sysfs_remove_group(parent, &ppi_attr_grp);
++ if (tpm_ppi_handle)
++ sysfs_remove_group(parent, &ppi_attr_grp);
+ }
--- /dev/null
+From 43d9490244254d2d6adb0f3c6275c7b8d032a2dd Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 5 May 2014 11:38:08 +0200
+Subject: ACPI / video: Add use_native_backlight quirks for more systems
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 43d9490244254d2d6adb0f3c6275c7b8d032a2dd upstream.
+
+ThinkPad T430: extend the T430s entry to also cover the T430 (note we also
+have another entry for T430's with a different DMI_PRODUCT_VERSION).
+
+ThinkPad T430
+Reported-and-tested-by: edm <fuffi.il.fuffo@gmail.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=51231
+
+Thinkpad T530
+Reported-and-tested-by: Balint Szigeti <balint.szgt@gmail.com>
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1089545
+
+Acer Aspire 5742G
+Reported-and-tested-by: AnAkkk <anakin.cs@gmail.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=35622
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -459,10 +459,10 @@ static struct dmi_system_id video_dmi_ta
+ },
+ {
+ .callback = video_set_use_native_backlight,
+- .ident = "ThinkPad T430s",
++ .ident = "ThinkPad T430 and T430s",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430"),
+ },
+ },
+ {
+@@ -474,6 +474,14 @@ static struct dmi_system_id video_dmi_ta
+ },
+ },
+ {
++ .callback = video_set_use_native_backlight,
++ .ident = "ThinkPad T530",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T530"),
++ },
++ },
++ {
+ .callback = video_set_use_native_backlight,
+ .ident = "ThinkPad X1 Carbon",
+ .matches = {
+@@ -506,6 +514,14 @@ static struct dmi_system_id video_dmi_ta
+ },
+ },
+ {
++ .callback = video_set_use_native_backlight,
++ .ident = "Acer Aspire 5742G",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5742G"),
++ },
++ },
++ {
+ .callback = video_set_use_native_backlight,
+ .ident = "Acer Aspire V5-431",
+ .matches = {
--- /dev/null
+From 5ff365fb6aed4c7ee5aae7b0239ce0b514aefabc Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Tue, 13 May 2014 09:51:50 +0800
+Subject: ACPI / video: correct DMI tag for Dell Inspiron 7520
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+commit 5ff365fb6aed4c7ee5aae7b0239ce0b514aefabc upstream.
+
+The DMI tag used to identify Dell Inspiron 7520 should be product name
+instead of product version.
+
+Fixes: 0e9f81d3b7cd (ACPI / video: Add systems that should favour native backlight interface)
+Reported-and-tested-by: Téo Mazars <teomazars@gmail.com>
+References: https://bugzilla.redhat.com/show_bug.cgi?id=909552
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -502,7 +502,7 @@ static struct dmi_system_id video_dmi_ta
+ .ident = "Dell Inspiron 7520",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
+ },
+ },
+ {
--- /dev/null
+From 07d1d29ee1e194b932328ad2dc1d40297062ab7f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 16 May 2014 21:10:41 +0200
+Subject: ACPI / video: Revert native brightness quirk for ThinkPad T530
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 07d1d29ee1e194b932328ad2dc1d40297062ab7f upstream.
+
+Seems it helps some users, but causes issues for other users:
+https://bugzilla.redhat.com/show_bug.cgi?id=1089545
+
+So lets drop it for now until we've figured out a better fix.
+
+Fixes: 43d949024425 (ACPI / video: Add use_native_backlight quirks for more systems)
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1089545
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -475,14 +475,6 @@ static struct dmi_system_id video_dmi_ta
+ },
+ {
+ .callback = video_set_use_native_backlight,
+- .ident = "ThinkPad T530",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T530"),
+- },
+- },
+- {
+- .callback = video_set_use_native_backlight,
+ .ident = "ThinkPad X1 Carbon",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--- /dev/null
+From d48dc067450d84324067f4472dc0b169e9af4454 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Wed, 30 Apr 2014 10:05:40 +0800
+Subject: ACPICA: Tables: Fix invalid pointer accesses in acpi_tb_parse_root_table().
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit d48dc067450d84324067f4472dc0b169e9af4454 upstream.
+
+Linux XSDT validation mechanism backport has introduced a regreession:
+ Commit: 671cc68dc61f029d44b43a681356078e02d8dab8
+ Subject: ACPICA: Back port and refine validation of the XSDT root table.
+There is a pointer still accessed after unmapping.
+
+This patch fixes this issue. Lv Zheng.
+
+Fixes: 671cc68dc61f (ACPICA: Back port and refine validation of the XSDT root table.)
+References: https://bugzilla.kernel.org/show_bug.cgi?id=73911
+References: https://bugs.archlinux.org/task/39811
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Reported-and-tested-by: Bruce Chiarelli <mano155@gmail.com>
+Reported-and-tested-by: Spyros Stathopoulos <spystath@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/tbutils.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -461,6 +461,7 @@ acpi_status __init acpi_tb_parse_root_ta
+ u32 table_count;
+ struct acpi_table_header *table;
+ acpi_physical_address address;
++ acpi_physical_address rsdt_address;
+ u32 length;
+ u8 *table_entry;
+ acpi_status status;
+@@ -488,11 +489,14 @@ acpi_status __init acpi_tb_parse_root_ta
+ * as per the ACPI specification.
+ */
+ address = (acpi_physical_address) rsdp->xsdt_physical_address;
++ rsdt_address =
++ (acpi_physical_address) rsdp->rsdt_physical_address;
+ table_entry_size = ACPI_XSDT_ENTRY_SIZE;
+ } else {
+ /* Root table is an RSDT (32-bit physical addresses) */
+
+ address = (acpi_physical_address) rsdp->rsdt_physical_address;
++ rsdt_address = address;
+ table_entry_size = ACPI_RSDT_ENTRY_SIZE;
+ }
+
+@@ -515,8 +519,7 @@ acpi_status __init acpi_tb_parse_root_ta
+
+ /* Fall back to the RSDT */
+
+- address =
+- (acpi_physical_address) rsdp->rsdt_physical_address;
++ address = rsdt_address;
+ table_entry_size = ACPI_RSDT_ENTRY_SIZE;
+ }
+ }
--- /dev/null
+From 85dbd5801f62b66e2aa7826aaefcaebead44c8a6 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Tue, 13 May 2014 16:50:30 +0800
+Subject: ACPICA: Tables: Restore old behavor to favor 32-bit FADT addresses.
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 85dbd5801f62b66e2aa7826aaefcaebead44c8a6 upstream.
+
+We need to find a smarter way to switch to 64-bit FADT addresses according
+to the bug report. This patch reverts Linux to the original behavior.
+
+Fixes: 0249ed2444d6 (ACPICA: Add option to favor 32-bit FADT addresses.)
+References: https://bugzilla.kernel.org/show_bug.cgi?id=74021
+Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/acglobal.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/acpica/acglobal.h
++++ b/drivers/acpi/acpica/acglobal.h
+@@ -132,9 +132,9 @@ u8 ACPI_INIT_GLOBAL(acpi_gbl_do_not_use_
+ * address. Although ACPICA adheres to the ACPI specification which
+ * requires the use of the corresponding 64-bit address if it is non-zero,
+ * some machines have been found to have a corrupted non-zero 64-bit
+- * address. Default is FALSE, do not favor the 32-bit addresses.
++ * address. Default is TRUE, favor the 32-bit addresses.
+ */
+-u8 ACPI_INIT_GLOBAL(acpi_gbl_use32_bit_fadt_addresses, FALSE);
++u8 ACPI_INIT_GLOBAL(acpi_gbl_use32_bit_fadt_addresses, TRUE);
+
+ /*
+ * Optionally truncate I/O addresses to 16 bits. Provides compatibility
--- /dev/null
+From 610f2de3559c383caf8fbbf91e9968102dff7ca0 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 20 Feb 2014 18:01:01 -0500
+Subject: dm crypt: fix cpu hotplug crash by removing per-cpu structure
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 610f2de3559c383caf8fbbf91e9968102dff7ca0 upstream.
+
+The DM crypt target used per-cpu structures to hold pointers to a
+ablkcipher_request structure. The code assumed that the work item keeps
+executing on a single CPU, so it didn't use synchronization when
+accessing this structure.
+
+If a CPU is disabled by writing 0 to /sys/devices/system/cpu/cpu*/online,
+the work item could be moved to another CPU. This causes dm-crypt
+crashes, like the following, because the code starts using an incorrect
+ablkcipher_request:
+
+ smpboot: CPU 7 is now offline
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000130
+ IP: [<ffffffffa1862b3d>] crypt_convert+0x12d/0x3c0 [dm_crypt]
+ ...
+ Call Trace:
+ [<ffffffffa1864415>] ? kcryptd_crypt+0x305/0x470 [dm_crypt]
+ [<ffffffff81062060>] ? finish_task_switch+0x40/0xc0
+ [<ffffffff81052a28>] ? process_one_work+0x168/0x470
+ [<ffffffff8105366b>] ? worker_thread+0x10b/0x390
+ [<ffffffff81053560>] ? manage_workers.isra.26+0x290/0x290
+ [<ffffffff81058d9f>] ? kthread+0xaf/0xc0
+ [<ffffffff81058cf0>] ? kthread_create_on_node+0x120/0x120
+ [<ffffffff813464ac>] ? ret_from_fork+0x7c/0xb0
+ [<ffffffff81058cf0>] ? kthread_create_on_node+0x120/0x120
+
+Fix this bug by removing the per-cpu definition. The structure
+ablkcipher_request is accessed via a pointer from convert_context.
+Consequently, if the work item is rescheduled to a different CPU, the
+thread still uses the same ablkcipher_request.
+
+This change may undermine performance improvements intended by commit
+c0297721 ("dm crypt: scale to multiple cpus") on select hardware. In
+practice no performance difference was observed on recent hardware. But
+regardless, correctness is more important than performance.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 61 +++++++++-----------------------------------------
+ 1 file changed, 12 insertions(+), 49 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -19,7 +19,6 @@
+ #include <linux/crypto.h>
+ #include <linux/workqueue.h>
+ #include <linux/backing-dev.h>
+-#include <linux/percpu.h>
+ #include <linux/atomic.h>
+ #include <linux/scatterlist.h>
+ #include <asm/page.h>
+@@ -43,6 +42,7 @@ struct convert_context {
+ struct bvec_iter iter_out;
+ sector_t cc_sector;
+ atomic_t cc_pending;
++ struct ablkcipher_request *req;
+ };
+
+ /*
+@@ -111,15 +111,7 @@ struct iv_tcw_private {
+ enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID };
+
+ /*
+- * Duplicated per-CPU state for cipher.
+- */
+-struct crypt_cpu {
+- struct ablkcipher_request *req;
+-};
+-
+-/*
+- * The fields in here must be read only after initialization,
+- * changing state should be in crypt_cpu.
++ * The fields in here must be read only after initialization.
+ */
+ struct crypt_config {
+ struct dm_dev *dev;
+@@ -150,12 +142,6 @@ struct crypt_config {
+ sector_t iv_offset;
+ unsigned int iv_size;
+
+- /*
+- * Duplicated per cpu state. Access through
+- * per_cpu_ptr() only.
+- */
+- struct crypt_cpu __percpu *cpu;
+-
+ /* ESSIV: struct crypto_cipher *essiv_tfm */
+ void *iv_private;
+ struct crypto_ablkcipher **tfms;
+@@ -192,11 +178,6 @@ static void clone_init(struct dm_crypt_i
+ static void kcryptd_queue_crypt(struct dm_crypt_io *io);
+ static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq);
+
+-static struct crypt_cpu *this_crypt_config(struct crypt_config *cc)
+-{
+- return this_cpu_ptr(cc->cpu);
+-}
+-
+ /*
+ * Use this to access cipher attributes that are the same for each CPU.
+ */
+@@ -903,16 +884,15 @@ static void kcryptd_async_done(struct cr
+ static void crypt_alloc_req(struct crypt_config *cc,
+ struct convert_context *ctx)
+ {
+- struct crypt_cpu *this_cc = this_crypt_config(cc);
+ unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
+
+- if (!this_cc->req)
+- this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
++ if (!ctx->req)
++ ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+
+- ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]);
+- ablkcipher_request_set_callback(this_cc->req,
++ ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]);
++ ablkcipher_request_set_callback(ctx->req,
+ CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+- kcryptd_async_done, dmreq_of_req(cc, this_cc->req));
++ kcryptd_async_done, dmreq_of_req(cc, ctx->req));
+ }
+
+ /*
+@@ -921,7 +901,6 @@ static void crypt_alloc_req(struct crypt
+ static int crypt_convert(struct crypt_config *cc,
+ struct convert_context *ctx)
+ {
+- struct crypt_cpu *this_cc = this_crypt_config(cc);
+ int r;
+
+ atomic_set(&ctx->cc_pending, 1);
+@@ -932,7 +911,7 @@ static int crypt_convert(struct crypt_co
+
+ atomic_inc(&ctx->cc_pending);
+
+- r = crypt_convert_block(cc, ctx, this_cc->req);
++ r = crypt_convert_block(cc, ctx, ctx->req);
+
+ switch (r) {
+ /* async */
+@@ -941,7 +920,7 @@ static int crypt_convert(struct crypt_co
+ reinit_completion(&ctx->restart);
+ /* fall through*/
+ case -EINPROGRESS:
+- this_cc->req = NULL;
++ ctx->req = NULL;
+ ctx->cc_sector++;
+ continue;
+
+@@ -1040,6 +1019,7 @@ static struct dm_crypt_io *crypt_io_allo
+ io->sector = sector;
+ io->error = 0;
+ io->base_io = NULL;
++ io->ctx.req = NULL;
+ atomic_set(&io->io_pending, 0);
+
+ return io;
+@@ -1065,6 +1045,8 @@ static void crypt_dec_pending(struct dm_
+ if (!atomic_dec_and_test(&io->io_pending))
+ return;
+
++ if (io->ctx.req)
++ mempool_free(io->ctx.req, cc->req_pool);
+ mempool_free(io, cc->io_pool);
+
+ if (likely(!base_io))
+@@ -1492,8 +1474,6 @@ static int crypt_wipe_key(struct crypt_c
+ static void crypt_dtr(struct dm_target *ti)
+ {
+ struct crypt_config *cc = ti->private;
+- struct crypt_cpu *cpu_cc;
+- int cpu;
+
+ ti->private = NULL;
+
+@@ -1505,13 +1485,6 @@ static void crypt_dtr(struct dm_target *
+ if (cc->crypt_queue)
+ destroy_workqueue(cc->crypt_queue);
+
+- if (cc->cpu)
+- for_each_possible_cpu(cpu) {
+- cpu_cc = per_cpu_ptr(cc->cpu, cpu);
+- if (cpu_cc->req)
+- mempool_free(cpu_cc->req, cc->req_pool);
+- }
+-
+ crypt_free_tfms(cc);
+
+ if (cc->bs)
+@@ -1530,9 +1503,6 @@ static void crypt_dtr(struct dm_target *
+ if (cc->dev)
+ dm_put_device(ti, cc->dev);
+
+- if (cc->cpu)
+- free_percpu(cc->cpu);
+-
+ kzfree(cc->cipher);
+ kzfree(cc->cipher_string);
+
+@@ -1588,13 +1558,6 @@ static int crypt_ctr_cipher(struct dm_ta
+ if (tmp)
+ DMWARN("Ignoring unexpected additional cipher options");
+
+- cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)),
+- __alignof__(struct crypt_cpu));
+- if (!cc->cpu) {
+- ti->error = "Cannot allocate per cpu state";
+- goto bad_mem;
+- }
+-
+ /*
+ * For compatibility with the original dm-crypt mapping format, if
+ * only the cipher name is supplied, use cbc-plain.
--- /dev/null
+From 85ad643b7e7e52d37620fb272a9fd577a8095647 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Fri, 9 May 2014 15:59:38 +0100
+Subject: dm thin: add timeout to stop out-of-data-space mode holding
+ IO forever
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 85ad643b7e7e52d37620fb272a9fd577a8095647 upstream.
+
+If the pool runs out of data space, dm-thin can be configured to
+either error IOs that would trigger provisioning, or hold those IOs
+until the pool is resized. Unfortunately, holding IOs until the pool is
+resized can result in a cascade of tasks hitting the hung_task_timeout,
+which may render the system unavailable.
+
+Add a fixed timeout so IOs can only be held for a maximum of 60 seconds.
+If LVM is going to resize a thin-pool that is out of data space it needs
+to be prompt about it.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -25,6 +25,7 @@
+ #define MAPPING_POOL_SIZE 1024
+ #define PRISON_CELLS 1024
+ #define COMMIT_PERIOD HZ
++#define NO_SPACE_TIMEOUT (HZ * 60)
+
+ DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
+ "A percentage of time allocated for copy on write");
+@@ -173,6 +174,7 @@ struct pool {
+ struct workqueue_struct *wq;
+ struct work_struct worker;
+ struct delayed_work waker;
++ struct delayed_work no_space_timeout;
+
+ unsigned long last_commit_jiffies;
+ unsigned ref_count;
+@@ -1449,6 +1451,20 @@ static void do_waker(struct work_struct
+ queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
+ }
+
++/*
++ * We're holding onto IO to allow userland time to react. After the
++ * timeout either the pool will have been resized (and thus back in
++ * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
++ */
++static void do_no_space_timeout(struct work_struct *ws)
++{
++ struct pool *pool = container_of(to_delayed_work(ws), struct pool,
++ no_space_timeout);
++
++ if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
++ set_pool_mode(pool, PM_READ_ONLY);
++}
++
+ /*----------------------------------------------------------------*/
+
+ struct noflush_work {
+@@ -1574,6 +1590,9 @@ static void set_pool_mode(struct pool *p
+ pool->process_discard = process_discard;
+ pool->process_prepared_mapping = process_prepared_mapping;
+ pool->process_prepared_discard = process_prepared_discard_passdown;
++
++ if (!pool->pf.error_if_no_space)
++ queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT);
+ break;
+
+ case PM_WRITE:
+@@ -1956,6 +1975,7 @@ static struct pool *pool_create(struct m
+
+ INIT_WORK(&pool->worker, do_worker);
+ INIT_DELAYED_WORK(&pool->waker, do_waker);
++ INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
+ spin_lock_init(&pool->lock);
+ bio_list_init(&pool->deferred_bios);
+ bio_list_init(&pool->deferred_flush_bios);
+@@ -2519,6 +2539,7 @@ static void pool_postsuspend(struct dm_t
+ struct pool *pool = pt->pool;
+
+ cancel_delayed_work(&pool->waker);
++ cancel_delayed_work(&pool->no_space_timeout);
+ flush_workqueue(pool->wq);
+ (void) commit(pool);
+ }
--- /dev/null
+From 8d07e8a5f5bc7b90f755d9b427ea930024f4c986 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Tue, 6 May 2014 16:28:14 +0100
+Subject: dm thin: allow metadata commit if pool is in PM_OUT_OF_DATA_SPACE mode
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 8d07e8a5f5bc7b90f755d9b427ea930024f4c986 upstream.
+
+Commit 3e1a0699 ("dm thin: fix out of data space handling") introduced
+a regression in the metadata commit() method by returning an error if
+the pool is in PM_OUT_OF_DATA_SPACE mode. This oversight caused a thin
+device to return errors even if the default queue_if_no_space ENOSPC
+handling mode is used.
+
+Fix commit() to only fail if pool is in PM_READ_ONLY or PM_FAIL mode.
+
+Reported-by: qindehua@163.com
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -920,7 +920,7 @@ static int commit(struct pool *pool)
+ {
+ int r;
+
+- if (get_pool_mode(pool) != PM_WRITE)
++ if (get_pool_mode(pool) >= PM_READ_ONLY)
+ return -EINVAL;
+
+ r = dm_pool_commit_metadata(pool->pmd);
--- /dev/null
+From 5a9a55bf9157d3490b0c8c4c81d4708602c26e07 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+Date: Wed, 21 May 2014 14:02:35 -0700
+Subject: dma: mv_xor: Flush descriptors before activating a channel
+
+From: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+
+commit 5a9a55bf9157d3490b0c8c4c81d4708602c26e07 upstream.
+
+We need to use writel() instead of writel_relaxed() when starting
+a channel, to ensure all the descriptors have been flushed before
+the activation.
+
+While at it, remove the unneeded read-modify-write and make the
+code simpler.
+
+Signed-off-by: Lior Amsalem <alior@marvell.com>
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/mv_xor.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -191,12 +191,10 @@ static void mv_set_mode(struct mv_xor_ch
+
+ static void mv_chan_activate(struct mv_xor_chan *chan)
+ {
+- u32 activation;
+-
+ dev_dbg(mv_chan_to_devp(chan), " activate chan.\n");
+- activation = readl_relaxed(XOR_ACTIVATION(chan));
+- activation |= 0x1;
+- writel_relaxed(activation, XOR_ACTIVATION(chan));
++
++ /* writel ensures all descriptors are flushed before activation */
++ writel(BIT(0), XOR_ACTIVATION(chan));
+ }
+
+ static char mv_chan_is_busy(struct mv_xor_chan *chan)
--- /dev/null
+From 97977f7576a89cb9436c000ae703c0d515e748ac Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 7 May 2014 10:56:24 +0300
+Subject: dmaengine: dw: went back to plain {request,free}_irq() calls
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 97977f7576a89cb9436c000ae703c0d515e748ac upstream.
+
+The commit dbde5c29 "dw_dmac: use devm_* functions to simplify code" turns
+probe function to use devm_* helpers and simultaneously brings a regression. We
+need to ensure irq is disabled, followed by ensuring that don't schedule any
+more tasklets and then its safe to use tasklet_kill().
+
+The free_irq() will ensure that the irq is disabled and also wait till all
+scheduled interrupts are executed by invoking synchronize_irq(). So we need to
+only do tasklet_kill() after invoking free_irq().
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/dw/core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -1545,11 +1545,6 @@ int dw_dma_probe(struct dw_dma_chip *chi
+ /* Disable BLOCK interrupts as well */
+ channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+
+- err = devm_request_irq(chip->dev, chip->irq, dw_dma_interrupt,
+- IRQF_SHARED, "dw_dmac", dw);
+- if (err)
+- return err;
+-
+ /* Create a pool of consistent memory blocks for hardware descriptors */
+ dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
+ sizeof(struct dw_desc), 4, 0);
+@@ -1560,6 +1555,11 @@ int dw_dma_probe(struct dw_dma_chip *chi
+
+ tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
+
++ err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
++ "dw_dmac", dw);
++ if (err)
++ return err;
++
+ INIT_LIST_HEAD(&dw->dma.channels);
+ for (i = 0; i < nr_channels; i++) {
+ struct dw_dma_chan *dwc = &dw->chan[i];
+@@ -1664,6 +1664,7 @@ int dw_dma_remove(struct dw_dma_chip *ch
+ dw_dma_off(dw);
+ dma_async_device_unregister(&dw->dma);
+
++ free_irq(chip->irq, dw);
+ tasklet_kill(&dw->tasklet);
+
+ list_for_each_entry_safe(dwc, _dwc, &dw->dma.channels,
--- /dev/null
+From c1f43dd9c20d85e66c4d77e284f64ac114abe3f8 Mon Sep 17 00:00:00 2001
+From: Xuelin Shi <xuelin.shi@freescale.com>
+Date: Wed, 21 May 2014 14:02:37 -0700
+Subject: dmaengine: fix dmaengine_unmap failure
+
+From: Xuelin Shi <xuelin.shi@freescale.com>
+
+commit c1f43dd9c20d85e66c4d77e284f64ac114abe3f8 upstream.
+
+The count which is used to get_unmap_data maybe not the same as the
+count computed in dmaengine_unmap which causes to free data in a
+wrong pool.
+
+This patch fixes this issue by keeping the map count with unmap_data
+structure and use this count to get the pool.
+
+Signed-off-by: Xuelin Shi <xuelin.shi@freescale.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/dmaengine.c | 2 ++
+ include/linux/dmaengine.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -1014,6 +1014,7 @@ static void dmaengine_unmap(struct kref
+ dma_unmap_page(dev, unmap->addr[i], unmap->len,
+ DMA_BIDIRECTIONAL);
+ }
++ cnt = unmap->map_cnt;
+ mempool_free(unmap, __get_unmap_pool(cnt)->pool);
+ }
+
+@@ -1079,6 +1080,7 @@ dmaengine_get_unmap_data(struct device *
+ memset(unmap, 0, sizeof(*unmap));
+ kref_init(&unmap->kref);
+ unmap->dev = dev;
++ unmap->map_cnt = nr;
+
+ return unmap;
+ }
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -433,6 +433,7 @@ typedef bool (*dma_filter_fn)(struct dma
+ typedef void (*dma_async_tx_callback)(void *dma_async_param);
+
+ struct dmaengine_unmap_data {
++ u8 map_cnt;
+ u8 to_cnt;
+ u8 from_cnt;
+ u8 bidi_cnt;
--- /dev/null
+From 47bb27e78867997040a228328f2a631c3c7f2c82 Mon Sep 17 00:00:00 2001
+From: "Du, Wenkai" <wenkai.du@intel.com>
+Date: Thu, 10 Apr 2014 23:03:19 +0000
+Subject: i2c: designware: Mask all interrupts during i2c controller enable
+
+From: "Du, Wenkai" <wenkai.du@intel.com>
+
+commit 47bb27e78867997040a228328f2a631c3c7f2c82 upstream.
+
+There have been "i2c_designware 80860F41:00: controller timed out" errors
+on a number of Baytrail platforms. The issue is caused by incorrect value in
+Interrupt Mask Register (DW_IC_INTR_MASK) when i2c core is being enabled.
+This causes call to __i2c_dw_enable() to immediately start the transfer which
+leads to timeout. There are 3 failure modes observed:
+
+1. Failure in S0 to S3 resume path
+
+The default value after reset for DW_IC_INTR_MASK is 0x8ff. When we start
+the first transaction after resuming from system sleep, TX_EMPTY interrupt
+is already unmasked because of the hardware default.
+
+2. Failure in normal operational path
+
+This failure happens rarely and is hard to reproduce. Debug trace showed that
+DW_IC_INTR_MASK had value of 0x254 when failure occurred, which meant
+TX_EMPTY was unmasked.
+
+3. Failure in S3 to S0 suspend path
+
+This failure also happens rarely and is hard to reproduce. Adding debug trace
+that read DW_IC_INTR_MASK made this failure not reproducible. But from ISR
+call trace we could conclude TX_EMPTY was unmasked when problem occurred.
+
+The patch masks all interrupts before the controller is enabled to resolve the
+faulty DW_IC_INTR_MASK conditions.
+
+Signed-off-by: Wenkai Du <wenkai.du@intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+[wsa: improved the comment and removed typo in commit msg]
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-designware-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-core.c
++++ b/drivers/i2c/busses/i2c-designware-core.c
+@@ -417,6 +417,9 @@ static void i2c_dw_xfer_init(struct dw_i
+ */
+ dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
+
++ /* enforce disabled interrupts (due to HW issues) */
++ i2c_dw_disable_int(dev);
++
+ /* Enable the adapter */
+ __i2c_dw_enable(dev, true);
+
--- /dev/null
+From d7653964c590ba846aa11a8f6edf409773cbc492 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Mon, 5 May 2014 18:36:21 +0200
+Subject: i2c: rcar: bail out on zero length transfers
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit d7653964c590ba846aa11a8f6edf409773cbc492 upstream.
+
+This hardware does not support zero length transfers. Instead, the
+driver does one (random) byte transfers currently with undefined results
+for the slaves. We now bail out.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-rcar.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -561,6 +561,12 @@ static int rcar_i2c_master_xfer(struct i
+
+ ret = -EINVAL;
+ for (i = 0; i < num; i++) {
++ /* This HW can't send STOP after address phase */
++ if (msgs[i].len == 0) {
++ ret = -EOPNOTSUPP;
++ break;
++ }
++
+ /*-------------- spin lock -----------------*/
+ spin_lock_irqsave(&priv->lock, flags);
+
+@@ -625,7 +631,8 @@ static int rcar_i2c_master_xfer(struct i
+
+ static u32 rcar_i2c_func(struct i2c_adapter *adap)
+ {
+- return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
++ /* This HW can't do SMBUS_QUICK and NOSTART */
++ return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
+ }
+
+ static const struct i2c_algorithm rcar_i2c_algo = {
--- /dev/null
+From ce78cc071f5f541480e381cc0241d37590041a9d Mon Sep 17 00:00:00 2001
+From: Olof Johansson <olof@lixom.net>
+Date: Fri, 11 Apr 2014 15:19:41 -0700
+Subject: i2c: s3c2410: resume race fix
+
+From: Olof Johansson <olof@lixom.net>
+
+commit ce78cc071f5f541480e381cc0241d37590041a9d upstream.
+
+Don't unmark the device as suspended until after it's been re-setup.
+
+The main race would be w.r.t. an i2c driver that gets resumed at the same
+time (asyncronously), that is allowed to do a transfer since suspended
+is set to 0 before reinit, but really should have seen the -EIO return
+instead.
+
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Doug Anderson <dianders@chromium.org>
+Acked-by: Kukjin Kim <kgene.kim@samsung.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-s3c2410.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1247,10 +1247,10 @@ static int s3c24xx_i2c_resume(struct dev
+ struct platform_device *pdev = to_platform_device(dev);
+ struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+
+- i2c->suspended = 0;
+ clk_prepare_enable(i2c->clk);
+ s3c24xx_i2c_init(i2c);
+ clk_disable_unprepare(i2c->clk);
++ i2c->suspended = 0;
+
+ return 0;
+ }
--- /dev/null
+From a6f9bf4d2f965b862b95213303d154e02957eed8 Mon Sep 17 00:00:00 2001
+From: Levente Kurusa <levex@linux.com>
+Date: Tue, 6 May 2014 15:57:48 +0200
+Subject: libata: clean up ZPODD when a port is detached
+
+From: Levente Kurusa <levex@linux.com>
+
+commit a6f9bf4d2f965b862b95213303d154e02957eed8 upstream.
+
+When a ZPODD device is unbound via sysfs, the ACPI notify handler
+is not removed. This causes panics as observed in Bug #74601. The
+panic only happens when the wake happens from outside the kernel
+(i.e. inserting a media or pressing a button). Add a loop to
+ata_port_detach which loops through the port's devices and checks
+if zpodd is enabled, if so call zpodd_exit.
+
+Reviewed-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Levente Kurusa <levex@linux.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6329,6 +6329,8 @@ int ata_host_activate(struct ata_host *h
+ static void ata_port_detach(struct ata_port *ap)
+ {
+ unsigned long flags;
++ struct ata_link *link;
++ struct ata_device *dev;
+
+ if (!ap->ops->error_handler)
+ goto skip_eh;
+@@ -6348,6 +6350,13 @@ static void ata_port_detach(struct ata_p
+ cancel_delayed_work_sync(&ap->hotplug_task);
+
+ skip_eh:
++ /* clean up zpodd on port removal */
++ ata_for_each_link(link, ap, HOST_FIRST) {
++ ata_for_each_dev(dev, link, ALL) {
++ if (zpodd_dev_enabled(dev))
++ zpodd_exit(dev);
++ }
++ }
+ if (ap->pmp_link) {
+ int i;
+ for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
--- /dev/null
+From d0b4cc4e32705ff00d90d32da7783c266c702c04 Mon Sep 17 00:00:00 2001
+From: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Date: Mon, 19 May 2014 13:06:46 +1000
+Subject: PCI: Wrong register used to check pending traffic
+
+From: Gavin Shan <gwshan@linux.vnet.ibm.com>
+
+commit d0b4cc4e32705ff00d90d32da7783c266c702c04 upstream.
+
+The incorrect register offset is passed to pci_wait_for_pending(), which is
+caused by commit 157e876ffe ("PCI: Add pci_wait_for_pending() (refactor
+pci_wait_for_pending_transaction())").
+
+Fixes: 157e876ffe ("PCI: Add pci_wait_for_pending() (refactor pci_wait_for_pending_transaction())
+Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Alex Williamson <alex.williamson@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pci.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3043,7 +3043,8 @@ int pci_wait_for_pending_transaction(str
+ if (!pci_is_pcie(dev))
+ return 1;
+
+- return pci_wait_for_pending(dev, PCI_EXP_DEVSTA, PCI_EXP_DEVSTA_TRPND);
++ return pci_wait_for_pending(dev, pci_pcie_cap(dev) + PCI_EXP_DEVSTA,
++ PCI_EXP_DEVSTA_TRPND);
+ }
+ EXPORT_SYMBOL(pci_wait_for_pending_transaction);
+
+@@ -3085,7 +3086,7 @@ static int pci_af_flr(struct pci_dev *de
+ return 0;
+
+ /* Wait for Transaction Pending bit clean */
+- if (pci_wait_for_pending(dev, PCI_AF_STATUS, PCI_AF_STATUS_TP))
++ if (pci_wait_for_pending(dev, pos + PCI_AF_STATUS, PCI_AF_STATUS_TP))
+ goto clear;
+
+ dev_err(&dev->dev, "transaction is not cleared; "
drm-i915-fix-unsafe-loop-iteration-over-vma-whilst-unbinding-them.patch
drm-i915-quirk-invert-brightness-for-acer-aspire-5336.patch
iwlwifi-mvm-bt-coex-fix-look-up-table.patch
+pci-wrong-register-used-to-check-pending-traffic.patch
+dm-crypt-fix-cpu-hotplug-crash-by-removing-per-cpu-structure.patch
+dm-thin-allow-metadata-commit-if-pool-is-in-pm_out_of_data_space-mode.patch
+dm-thin-add-timeout-to-stop-out-of-data-space-mode-holding.patch
+dmaengine-fix-dmaengine_unmap-failure.patch
+dma-mv_xor-flush-descriptors-before-activating-a-channel.patch
+dmaengine-dw-went-back-to-plain-request-free-_irq-calls.patch
+tcm_fc-fix-free-after-use-regression-in-ft_free_cmd.patch
+libata-clean-up-zpodd-when-a-port-is-detached.patch
+acpica-tables-fix-invalid-pointer-accesses-in-acpi_tb_parse_root_table.patch
+acpica-tables-restore-old-behavor-to-favor-32-bit-fadt-addresses.patch
+acpi-revert-acpi-remove-config_acpi_procfs_power-and-cm_sbsc.c.patch
+acpi-revert-acpi-battery-remove-battery-s-proc-directory.patch
+acpi-video-add-use_native_backlight-quirks-for-more-systems.patch
+acpi-blacklist-add-dmi_enable_osi_linux-quirk-for-asus-eee-pc-1015px.patch
+acpi-processor-do-not-mark-present-at-boot-but-not-onlined-cpu-as-onlined.patch
+acpi-revert-acpi-ac-convert-acpi-ac-driver-to-platform-bus.patch
+acpi-blacklist-win8-osi-for-dell-inspiron-7737.patch
+acpi-tpm-fix-resume-regression-on-chromebooks.patch
+acpi-video-correct-dmi-tag-for-dell-inspiron-7520.patch
+acpi-video-revert-native-brightness-quirk-for-thinkpad-t530.patch
+i2c-rcar-bail-out-on-zero-length-transfers.patch
+i2c-designware-mask-all-interrupts-during-i2c-controller-enable.patch
+i2c-s3c2410-resume-race-fix.patch
--- /dev/null
+From ed8ec8f707ed4760c124d47b27c93df8ec5b1eba Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 12 May 2014 12:18:32 -0700
+Subject: tcm_fc: Fix free-after-use regression in ft_free_cmd
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit ed8ec8f707ed4760c124d47b27c93df8ec5b1eba upstream.
+
+This patch fixes a free-after-use regression in ft_free_cmd(), where
+ft_sess_put() is called with cmd->sess after percpu_ida_free() has
+already released the tag.
+
+Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(),
+and pass it directly to ft_sess_put().
+
+The regression was originally introduced in v3.13-rc1 commit:
+
+ commit 5f544cfac956971099e906f94568bc3fd1a7108a
+ Author: Nicholas Bellinger <nab@daterainc.com>
+ Date: Mon Sep 23 12:12:42 2013 -0700
+
+ tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd
+
+Reported-by: Jun Wu <jwu@stormojo.com>
+Cc: Mark Rustad <mark.d.rustad@intel.com>
+Cc: Robert Love <robert.w.love@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/tcm_fc/tfc_cmd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/tcm_fc/tfc_cmd.c
++++ b/drivers/target/tcm_fc/tfc_cmd.c
+@@ -90,18 +90,18 @@ static void ft_free_cmd(struct ft_cmd *c
+ {
+ struct fc_frame *fp;
+ struct fc_lport *lport;
+- struct se_session *se_sess;
++ struct ft_sess *sess;
+
+ if (!cmd)
+ return;
+- se_sess = cmd->sess->se_sess;
++ sess = cmd->sess;
+ fp = cmd->req_frame;
+ lport = fr_dev(fp);
+ if (fr_seq(fp))
+ lport->tt.seq_release(fr_seq(fp));
+ fc_frame_free(fp);
+- percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
+- ft_sess_put(cmd->sess); /* undo get from lookup at recv */
++ percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
++ ft_sess_put(sess); /* undo get from lookup at recv */
+ }
+
+ void ft_release_cmd(struct se_cmd *se_cmd)
projects / thirdparty / kernel / stable-queue.git / commitdiff
