[PATCH 3.16 013/357] drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>

commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.

We can use "unsigned int" instead of "atomic_t" by updating start_pool
variable under _manager->lock. This patch will make it possible to avoid
skipping when choosing a pool to shrink in round-robin style, after next
patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).

Signed-off-by: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <air...@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1004,9 +1004,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
static unsigned long
ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
{
- static atomic_t start_pool = ATOMIC_INIT(0);
+ static unsigned start_pool;
unsigned idx = 0;
- unsigned pool_offset = atomic_add_return(1, &start_pool);
+ unsigned pool_offset;
unsigned shrink_pages = sc->nr_to_scan;
struct device_pools *p;
unsigned long freed = 0;
@@ -1017,7 +1017,7 @@ ttm_dma_pool_shrink_scan(struct shrinker
mutex_lock(&_manager->lock);
if (!_manager->npools)
goto out;
- pool_offset = pool_offset % _manager->npools;
+ pool_offset = ++start_pool % _manager->npools;
list_for_each_entry(p, &_manager->pools, pools) {
unsigned nr_free;



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <khoro...@ispras.ru>

commit 9ef7db7f38d0472dd9c444e42d5c5175ccbe5451 upstream.

Commit 0244756edc4b ("ufs: sb mutex merge + mutex_destroy") introduces
deadlocks in ufs_new_inode() and ufs_free_inode().
Most callers of that functions acqure the mutex by themselves and
ufs_{new,free}_inode() do that via lock_ufs(),
i.e we have an unavoidable double lock.

The patch proposes to resolve the issue by making sure that
ufs_{new,free}_inode() are not called with the mutex held.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoro...@ispras.ru>
Signed-off-by: Al Viro <vi...@zeniv.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/ufs/inode.c | 7 ++-----
fs/ufs/namei.c | 14 ++++++--------
2 files changed, 8 insertions(+), 13 deletions(-)

--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -902,9 +902,6 @@ void ufs_evict_inode(struct inode * inod
invalidate_inode_buffers(inode);
clear_inode(inode);

- if (want_delete) {
- lock_ufs(inode->i_sb);
- ufs_free_inode (inode);
- unlock_ufs(inode->i_sb);
- }
+ if (want_delete)
+ ufs_free_inode(inode);
}
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -126,12 +126,12 @@ static int ufs_symlink (struct inode * d
if (l > sb->s_blocksize)
goto out_notlocked;

- lock_ufs(dir->i_sb);
inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
err = PTR_ERR(inode);
if (IS_ERR(inode))
- goto out;
+ goto out_notlocked;

+ lock_ufs(dir->i_sb);
if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) {
/* slow symlink */
inode->i_op = &ufs_symlink_inode_operations;
@@ -181,13 +181,9 @@ static int ufs_mkdir(struct inode * dir,
struct inode * inode;
int err;

- lock_ufs(dir->i_sb);
- inode_inc_link_count(dir);
-
inode = ufs_new_inode(dir, S_IFDIR|mode);
- err = PTR_ERR(inode);
if (IS_ERR(inode))
- goto out_dir;
+ return PTR_ERR(inode);

inode->i_op = &ufs_dir_inode_operations;
inode->i_fop = &ufs_dir_operations;
@@ -195,6 +191,9 @@ static int ufs_mkdir(struct inode * dir,

inode_inc_link_count(inode);

+ lock_ufs(dir->i_sb);
+ inode_inc_link_count(dir);
+
err = ufs_make_empty(inode, dir);
if (err)
goto out_fail;
@@ -212,7 +211,6 @@ out_fail:
inode_dec_link_count(inode);
inode_dec_link_count(inode);
iput (inode);
-out_dir:
inode_dec_link_count(dir);
unlock_ufs(dir->i_sb);
goto out;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jani Nikula <jani....@intel.com>

commit c84db77010877da6c5da119868ed54c43d59e726 upstream.

Check the correct bit for audio. Seems like a copy-paste error from the
start:

commit 9ed109a7b445e3f073d8ea72f888ec80c0532465
Author: Daniel Vetter <daniel...@ffwll.ch>
Date: Thu Apr 24 23:54:52 2014 +0200

drm/i915: Track has_audio in the pipe config

Reported-by: Martin Andersen <martin.x...@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82756
Cc: Daniel Vetter <daniel...@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel...@ffwll.ch>
Signed-off-by: Jani Nikula <jani....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/i915/intel_hdmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -728,7 +728,7 @@ static void intel_hdmi_get_config(struct
if (tmp & HDMI_MODE_SELECT_HDMI)
pipe_config->has_hdmi_sink = true;

- if (tmp & HDMI_MODE_SELECT_HDMI)
+ if (tmp & SDVO_AUDIO_ENABLE)
pipe_config->has_audio = true;

pipe_config->adjusted_mode.flags |= flags;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit f0e4cba2534cd88476dff920727c81350130f3c5 upstream.

Do not log normal interrupt-urb shutdowns as errors.

The option driver has always been logging any nonzero interrupt-urb
status as an error, including when the urb is killed during normal
operation.

Commit 9096f1fbba91 ("USB: usb_wwan: fix potential NULL-deref at
resume") moved the interrupt urb submission from port probe and release
to open and close, thus potentially increasing the number of these
false-positive error messages dramatically.

Reported-by: Ed Butler <res...@ausics.net>
Tested-by: Ed Butler <res...@ausics.net>
Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1916,6 +1916,8 @@ static void option_instat_callback(struc
dev_dbg(dev, "%s: type %x req %x\n", __func__,
req_pkt->bRequestType, req_pkt->bRequest);
}
+ } else if (status == -ENOENT || status == -ESHUTDOWN) {
+ dev_dbg(dev, "%s: urb stopped: %d\n", __func__, status);
} else
dev_err(dev, "%s: error %d\n", __func__, status);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Felipe Balbi <ba...@ti.com>

commit 96908589a8b2584b1185f834d365f5cc360e8226 upstream.

Commit 71c731a (usb: host: xhci: Fix Compliance Mode
on SN65LVP3502CP Hardware) implemented a workaround
for a known issue with Texas Instruments' USB 3.0
redriver IC but it left a condition where any xHCI
host would be taken out of reset if port was placed
in compliance mode and there was no device connected
to the port.

That condition would trigger a fake connection to a
non-existent device so that usbcore would trigger a
warm reset of the port, thus taking the link out of
reset.

This has the side-effect of preventing any xHCI host
connected to a Linux machine from starting and running
the USB 3.0 Electrical Compliance Suite because the
port will mysteriously taken out of compliance mode
and, thus, xHCI won't step through the necessary
compliance patterns for link validation.

This patch fixes the issue by just adding a missing
check for XHCI_COMP_MODE_QUIRK inside
xhci_hub_report_usb3_link_state() when PORT_CAS isn't
set.

This patch should be backported to all kernels containing
commit 71c731a.

Fixes: 71c731a (usb: host: xhci: Fix Compliance Mode on SN65LVP3502CP Hardware)
Cc: Alexis R. Cortes <alexis...@ti.com>
Signed-off-by: Felipe Balbi <ba...@ti.com>
Acked-by: Mathias Nyman <mathia...@linux.intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/host/xhci-hub.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -468,7 +468,8 @@ static void xhci_hub_report_usb2_link_st
}

/* Updates Link Status for super Speed port */
-static void xhci_hub_report_usb3_link_state(u32 *status, u32 status_reg)
+static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ u32 *status, u32 status_reg)
{
u32 pls = status_reg & PORT_PLS_MASK;

@@ -507,7 +508,8 @@ static void xhci_hub_report_usb3_link_st
* in which sometimes the port enters compliance mode
* caused by a delay on the host-device negotiation.
*/
- if (pls == USB_SS_PORT_LS_COMP_MOD)
+ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+ (pls == USB_SS_PORT_LS_COMP_MOD))
pls |= USB_PORT_STAT_CONNECTION;
}

@@ -666,7 +668,7 @@ static u32 xhci_get_port_status(struct u
}
/* Update Port Link State */
if (hcd->speed == HCD_USB3) {
- xhci_hub_report_usb3_link_state(&status, raw_port_status);
+ xhci_hub_report_usb3_link_state(xhci, &status, raw_port_status);
/*
* Verify if all USB3 Ports Have entered U0 already.
* Delete Compliance Mode Timer if so.

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexande...@amd.com>

commit 1952f24d0fa6292d65f886887af87ba8ac79b3ba upstream.

Vbios connector table lists non-existent VGA port.

Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=83184

Signed-off-by: Alex Deucher <alexande...@amd.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -447,6 +447,13 @@ static bool radeon_atom_apply_quirks(str
}
}

+ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
+ if ((dev->pdev->device == 0x9805) &&
+ (dev->pdev->subsystem_vendor == 0x1734) &&
+ (dev->pdev->subsystem_device == 0x11bd)) {
+ if (*connector_type == DRM_MODE_CONNECTOR_VGA)
+ return false;
+ }

return true;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Hemminger <ste...@networkplumber.org>

commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.

I have a j5 create (JUA210) USB 2 video device and adding it device id
to SIS USB video gets it to work.

Signed-off-by: Stephen Hemminger <ste...@networkplumber.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/misc/sisusbvga/sisusb.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3250,6 +3250,7 @@ static const struct usb_device_id sisusb
{ USB_DEVICE(0x0711, 0x0918) },
{ USB_DEVICE(0x0711, 0x0920) },
{ USB_DEVICE(0x0711, 0x0950) },
+ { USB_DEVICE(0x0711, 0x5200) },
{ USB_DEVICE(0x182d, 0x021c) },
{ USB_DEVICE(0x182d, 0x0269) },
{ }

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexande...@amd.com>

commit e9f274b2a1bd4ecc569b823b1e7942e9bf92593e upstream.

Some hawaii boards use a different method for fetching the
voltage information from the vbios.

Signed-off-by: Alex Deucher <alexande...@amd.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/radeon/radeon.h | 3 ++
drivers/gpu/drm/radeon/radeon_atombios.c | 35 +++++++++++++++++++++++++++++++
2 files changed, 38 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -304,6 +304,9 @@ int radeon_atom_get_leakage_vddc_based_o
u16 *vddc, u16 *vddci,
u16 virtual_voltage_id,
u16 vbios_voltage_id);
+int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
+ u16 virtual_voltage_id,
+ u16 *voltage);
int radeon_atom_round_to_true_voltage(struct radeon_device *rdev,
u8 voltage_type,
u16 nominal_voltage,
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -3236,6 +3236,41 @@ int radeon_atom_get_leakage_vddc_based_o
return 0;
}

+union get_voltage_info {
+ struct _GET_VOLTAGE_INFO_INPUT_PARAMETER_V1_2 in;
+ struct _GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 evv_out;
+};
+
+int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
+ u16 virtual_voltage_id,
+ u16 *voltage)
+{
+ int index = GetIndexIntoMasterTable(COMMAND, GetVoltageInfo);
+ u32 entry_id;
+ u32 count = rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.count;
+ union get_voltage_info args;
+
+ for (entry_id = 0; entry_id < count; entry_id++) {
+ if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].v ==
+ virtual_voltage_id)
+ break;
+ }
+
+ if (entry_id >= count)
+ return -EINVAL;
+
+ args.in.ucVoltageType = VOLTAGE_TYPE_VDDC;
+ args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE;
+ args.in.ulSCLKFreq =
+ cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk);
+
+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+
+ *voltage = le16_to_cpu(args.evv_out.usVoltageLevel);
+
+ return 0;
+}
+
int radeon_atom_get_voltage_gpio_settings(struct radeon_device *rdev,
u16 voltage_level, u8 voltage_type,
u32 *gpio_value, u32 *gpio_mask)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Max Filippov <jcmv...@gmail.com>

commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.

This fixes userspace code that builds on other architectures but fails
on xtensa due to references to structures that other architectures don't
refer to. E.g. this fixes the following issue with python-2.7.8:

python-2.7.8/Modules/termios.c:861:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct'
{"TIOCSERGETMULTI", TIOCSERGETMULTI},
python-2.7.8/Modules/termios.c:870:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct'
{"TIOCSERSETMULTI", TIOCSERSETMULTI},
python-2.7.8/Modules/termios.c:900:24: error: invalid application
of 'sizeof' to incomplete type 'struct tty_struct'
{"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},

Signed-off-by: Max Filippov <jcmv...@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)

--- a/arch/xtensa/include/uapi/asm/ioctls.h
+++ b/arch/xtensa/include/uapi/asm/ioctls.h
@@ -28,17 +28,17 @@
#define TCSETSW 0x5403
#define TCSETSF 0x5404

-#define TCGETA _IOR('t', 23, struct termio)
-#define TCSETA _IOW('t', 24, struct termio)
-#define TCSETAW _IOW('t', 25, struct termio)
-#define TCSETAF _IOW('t', 28, struct termio)
+#define TCGETA 0x80127417 /* _IOR('t', 23, struct termio) */
+#define TCSETA 0x40127418 /* _IOW('t', 24, struct termio) */
+#define TCSETAW 0x40127419 /* _IOW('t', 25, struct termio) */
+#define TCSETAF 0x4012741C /* _IOW('t', 28, struct termio) */

#define TCSBRK _IO('t', 29)
#define TCXONC _IO('t', 30)
#define TCFLSH _IO('t', 31)

-#define TIOCSWINSZ _IOW('t', 103, struct winsize)
-#define TIOCGWINSZ _IOR('t', 104, struct winsize)
+#define TIOCSWINSZ 0x40087467 /* _IOW('t', 103, struct winsize) */
+#define TIOCGWINSZ 0x80087468 /* _IOR('t', 104, struct winsize) */
#define TIOCSTART _IO('t', 110) /* start output, like ^Q */
#define TIOCSTOP _IO('t', 111) /* stop output, like ^S */
#define TIOCOUTQ _IOR('t', 115, int) /* output queue size */
@@ -88,7 +88,6 @@
#define TIOCSETD _IOW('T', 35, int)
#define TIOCGETD _IOR('T', 36, int)
#define TCSBRKP _IOW('T', 37, int) /* Needed for POSIX tcsendbreak()*/
-#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct) /* For debugging only*/
#define TIOCSBRK _IO('T', 39) /* BSD compatibility */
#define TIOCCBRK _IO('T', 40) /* BSD compatibility */
#define TIOCGSID _IOR('T', 41, pid_t) /* Return the session ID of FD*/
@@ -114,8 +113,10 @@
#define TIOCSERGETLSR _IOR('T', 89, unsigned int) /* Get line status reg. */
/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
# define TIOCSER_TEMT 0x01 /* Transmitter physically empty */
-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config */
-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
+#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config */
+ /* _IOR('T', 90, struct serial_multiport_struct) */
+#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */
+ /* _IOW('T', 91, struct serial_multiport_struct) */

#define TIOCMIWAIT _IO('T', 92) /* wait for a change on serial input line(s) */
#define TIOCGICOUNT 0x545D /* read serial port inline interrupt counts */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Douglas <adou...@cadence.com>

commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.

Virtual address is translated to the XCHAL_KSEG_CACHED region in the
dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE
range.

Change check for end of the range from 'addr >= X' to 'addr > X - 1' to
handle the case of X == 0.

Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.

Signed-off-by: Alan Douglas <adou...@cadence.com>

Signed-off-by: Max Filippov <jcmv...@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/xtensa/kernel/pci-dma.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/xtensa/kernel/pci-dma.c
+++ b/arch/xtensa/kernel/pci-dma.c
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si

/* We currently don't support coherent memory outside KSEG */

- if (ret < XCHAL_KSEG_CACHED_VADDR
- || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE)
- BUG();
+ BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
+ ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);


if (ret != 0) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);
void dma_free_coherent(struct device *hwdev, size_t size,
void *vaddr, dma_addr_t dma_handle)
{
- long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR;
+ unsigned long addr = (unsigned long)vaddr +
+ XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;

- if (addr < 0 || addr >= XCHAL_KSEG_SIZE)
- BUG();
+ BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
+ addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);

free_pages(addr, get_order(size));

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit ee444609dbae8afee420c3243ce4c5f442efb622 upstream.

Add device id for NOVITUS Bono E thermal printer.

Reported-by: Emanuel Koczwara <poc...@emanuelkoczwara.pl>
Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
2 files changed, 7 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -741,6 +741,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
.driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
{ USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -837,6 +837,12 @@
#define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */

/*
+ * NOVITUS printers
+ */
+#define NOVITUS_VID 0x1a28
+#define NOVITUS_BONO_E_PID 0x6010
+
+/*
* RT Systems programming cables for various ham radios
*/
#define RTSYSTEMS_VID 0x2100 /* Vendor ID */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.

Make sure to verify the number of ports requested by subdriver to avoid
writing beyond the end of fixed-size array in interface data.

The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of ports requested by a
subdriver (which could have been determined from device descriptors) did
not exceed this limit.

Signed-off-by: Johan Hovold <jo...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/usb-serial.c | 5 +++++
1 file changed, 5 insertions(+)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -862,6 +862,11 @@ static int usb_serial_probe(struct usb_i
num_ports = type->num_ports;
}

+ if (num_ports > MAX_NUM_PORTS) {
+ dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+ num_ports = MAX_NUM_PORTS;
+ }
+
serial->num_ports = num_ports;
serial->num_bulk_in = num_bulk_in;
serial->num_bulk_out = num_bulk_out;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Brandenburger <filbr...@google.com>

commit bfcfd44cce2774f19daeb59fb4e43fc9aa80e7b8 upstream.

The guard was introduced in commit ea1a8217b06b ("xattr: guard against
simultaneous glibc header inclusion") but it is using #ifdef to check
for a define that is either set to 1 or 0. Fix it to use #if instead.

* Without this patch:

$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
include/uapi/linux/xattr.h:19:0: warning: "XATTR_CREATE" redefined [enabled by default]
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
^
/usr/include/x86_64-linux-gnu/sys/xattr.h:32:0: note: this is the location of the previous definition
#define XATTR_CREATE XATTR_CREATE
^

* With this patch:

$ { echo "#include <sys/xattr.h>"; echo "#include <linux/xattr.h>"; } | gcc -E -Iinclude/uapi - >/dev/null
(no warnings)

Signed-off-by: Filipe Brandenburger <filbr...@google.com>
Acked-by: Serge E. Hallyn <serge....@ubuntu.com>
Cc: Allan McRae <al...@archlinux.org>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

include/uapi/linux/xattr.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -13,7 +13,7 @@
#ifndef _UAPI_LINUX_XATTR_H
#define _UAPI_LINUX_XATTR_H

-#ifdef __UAPI_DEF_XATTR
+#if __UAPI_DEF_XATTR
#define __USE_KERNEL_XATTR_DEFS

#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrzej Pietrasiewicz <andr...@samsung.com>

commit 4546527350c3c508554dff53e9086e9d3de0b97b upstream.

f->os_desc_table[0].if_id is zero by default. If the actual id happens
to be different then no Feature Descriptors will be returned to the host
for this interface, so assign if_id as soon as it is known.

Acked-by: Michal Nazarewicz <min...@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andr...@samsung.com>
Signed-off-by: Felipe Balbi <ba...@ti.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>


---

drivers/usb/gadget/f_rndis.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -727,6 +727,10 @@ rndis_bind(struct usb_configuration *c,
rndis_control_intf.bInterfaceNumber = status;
rndis_union_desc.bMasterInterface0 = status;

+ if (cdev->use_os_string)
+ f->os_desc_table[0].if_id =
+ rndis_iad_descriptor.bFirstInterface;
+
status = usb_interface_id(c, f);
if (status < 0)
goto fail;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit 3096691011d01cef56b243a5e65431405c07d574 upstream.

Add back some PIDs that were mistakingly remove when reverting commit
73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to
zte_ev"), which apparently did more than its commit message claimed in
that it not only moved some PIDs from option to zte_ev but also added
some new ones.

Fixes: 63a901c06e3c ("Revert "USB: option,zte_ev: move most ZTE CDMA
devices to zte_ev"")

Reported-by: Lei Liu <lei3...@163.com>
Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/zte_ev.c | 8 ++++++++
1 file changed, 8 insertions(+)

--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -272,6 +272,14 @@ static void zte_ev_usb_serial_close(stru
}

static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x19d2, 0xffec) },
+ { USB_DEVICE(0x19d2, 0xffee) },
+ { USB_DEVICE(0x19d2, 0xfff6) },
+ { USB_DEVICE(0x19d2, 0xfff7) },
+ { USB_DEVICE(0x19d2, 0xfff8) },
+ { USB_DEVICE(0x19d2, 0xfff9) },
+ { USB_DEVICE(0x19d2, 0xfffb) },
+ { USB_DEVICE(0x19d2, 0xfffc) },
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
{ },

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexande...@amd.com>

commit 0a5f6e9d60e71e4b6dbeabd97bc887d6b2b0f0c8 upstream.

This is a port of cedb655a3a7764c3fd946077944383c9e0e68dd4
to older asics. Fixes a possible divide by 0 if the harvest
register is invalid.

v2: drop some additional harvest munging.

Signed-off-by: Alex Deucher <alexande...@amd.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/radeon/r600.c | 26 ++++++++------------------
drivers/gpu/drm/radeon/rv770.c | 23 ++++++++---------------
2 files changed, 16 insertions(+), 33 deletions(-)

--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1813,7 +1813,6 @@ static void r600_gpu_init(struct radeon_
{
u32 tiling_config;
u32 ramcfg;
- u32 cc_rb_backend_disable;
u32 cc_gc_shader_pipe_config;
u32 tmp;
int i, j;
@@ -1940,29 +1939,20 @@ static void r600_gpu_init(struct radeon_
}
tiling_config |= BANK_SWAPS(1);

- cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE) & 0x00ff0000;
- tmp = R6XX_MAX_BACKENDS -
- r600_count_pipe_bits((cc_rb_backend_disable >> 16) & R6XX_MAX_BACKENDS_MASK);
- if (tmp < rdev->config.r600.max_backends) {
- rdev->config.r600.max_backends = tmp;
- }
-
cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG) & 0x00ffff00;
- tmp = R6XX_MAX_PIPES -
- r600_count_pipe_bits((cc_gc_shader_pipe_config >> 8) & R6XX_MAX_PIPES_MASK);
- if (tmp < rdev->config.r600.max_pipes) {
- rdev->config.r600.max_pipes = tmp;
- }
- tmp = R6XX_MAX_SIMDS -
- r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R6XX_MAX_SIMDS_MASK);
- if (tmp < rdev->config.r600.max_simds) {
- rdev->config.r600.max_simds = tmp;
- }
tmp = rdev->config.r600.max_simds -
r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R6XX_MAX_SIMDS_MASK);
rdev->config.r600.active_simds = tmp;

disabled_rb_mask = (RREG32(CC_RB_BACKEND_DISABLE) >> 16) & R6XX_MAX_BACKENDS_MASK;
+ tmp = 0;
+ for (i = 0; i < rdev->config.r600.max_backends; i++)
+ tmp |= (1 << i);
+ /* if all the backends are disabled, fix it up here */
+ if ((disabled_rb_mask & tmp) == tmp) {
+ for (i = 0; i < rdev->config.r600.max_backends; i++)
+ disabled_rb_mask &= ~(1 << i);
+ }
tmp = (tiling_config & PIPE_TILING__MASK) >> PIPE_TILING__SHIFT;
tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.r600.max_backends,
R6XX_MAX_BACKENDS, disabled_rb_mask);
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1178,7 +1178,6 @@ static void rv770_gpu_init(struct radeon
u32 hdp_host_path_cntl;
u32 sq_dyn_gpr_size_simd_ab_0;
u32 gb_tiling_config = 0;
- u32 cc_rb_backend_disable = 0;
u32 cc_gc_shader_pipe_config = 0;
u32 mc_arb_ramcfg;
u32 db_debug4, tmp;
@@ -1312,21 +1311,7 @@ static void rv770_gpu_init(struct radeon
WREG32(SPI_CONFIG_CNTL, 0);
}

- cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE) & 0x00ff0000;
- tmp = R7XX_MAX_BACKENDS - r600_count_pipe_bits(cc_rb_backend_disable >> 16);
- if (tmp < rdev->config.rv770.max_backends) {
- rdev->config.rv770.max_backends = tmp;
- }
-
cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG) & 0xffffff00;
- tmp = R7XX_MAX_PIPES - r600_count_pipe_bits((cc_gc_shader_pipe_config >> 8) & R7XX_MAX_PIPES_MASK);
- if (tmp < rdev->config.rv770.max_pipes) {
- rdev->config.rv770.max_pipes = tmp;
- }
- tmp = R7XX_MAX_SIMDS - r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R7XX_MAX_SIMDS_MASK);
- if (tmp < rdev->config.rv770.max_simds) {
- rdev->config.rv770.max_simds = tmp;
- }
tmp = rdev->config.rv770.max_simds -
r600_count_pipe_bits((cc_gc_shader_pipe_config >> 16) & R7XX_MAX_SIMDS_MASK);
rdev->config.rv770.active_simds = tmp;
@@ -1349,6 +1334,14 @@ static void rv770_gpu_init(struct radeon
rdev->config.rv770.tiling_npipes = rdev->config.rv770.max_tile_pipes;

disabled_rb_mask = (RREG32(CC_RB_BACKEND_DISABLE) >> 16) & R7XX_MAX_BACKENDS_MASK;
+ tmp = 0;
+ for (i = 0; i < rdev->config.rv770.max_backends; i++)
+ tmp |= (1 << i);
+ /* if all the backends are disabled, fix it up here */
+ if ((disabled_rb_mask & tmp) == tmp) {
+ for (i = 0; i < rdev->config.rv770.max_backends; i++)
+ disabled_rb_mask &= ~(1 << i);
+ }
tmp = (gb_tiling_config & PIPE_TILING__MASK) >> PIPE_TILING__SHIFT;
tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.rv770.max_backends,
R7XX_MAX_BACKENDS, disabled_rb_mask);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jla...@primarydata.com>

commit e0b760ff71be168d4e623f7c3612e98902ab93e9 upstream.

The argument to locks_unlink_lock can't be just any pointer to a
pointer. It must be a pointer to the fl_next field in the previous
lock in the list.

Signed-off-by: Jeff Layton <jla...@primarydata.com>
Reviewed-by: Christoph Hellwig <h...@lst.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/locks.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1595,7 +1595,7 @@ static int generic_add_lease(struct file
smp_mb();
error = check_conflicting_open(dentry, arg);
if (error)
- locks_unlink_lock(flp);
+ locks_unlink_lock(before);
out:
if (is_deleg)
mutex_unlock(&inode->i_mutex);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexande...@amd.com>

commit 39da038479a81a35a7f8af3ab2c90effd5c8eff1 upstream.

Need to properly disable nb dpm on dpm disable.

Signed-off-by: Alex Deucher <alexande...@amd.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/radeon/kv_dpm.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)

--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -33,6 +33,8 @@
#define KV_MINIMUM_ENGINE_CLOCK 800
#define SMC_RAM_END 0x40000

+static int kv_enable_nb_dpm(struct radeon_device *rdev,
+ bool enable);
static void kv_init_graphics_levels(struct radeon_device *rdev);
static int kv_calculate_ds_divider(struct radeon_device *rdev);
static int kv_calculate_nbps_level_settings(struct radeon_device *rdev);
@@ -1295,6 +1297,9 @@ void kv_dpm_disable(struct radeon_device
{
kv_smc_bapm_enable(rdev, false);

+ if (rdev->family == CHIP_MULLINS)
+ kv_enable_nb_dpm(rdev, false);
+
/* powerup blocks */
kv_dpm_powergate_acp(rdev, false);
kv_dpm_powergate_samu(rdev, false);
@@ -1769,15 +1774,24 @@ static int kv_update_dfs_bypass_settings
return ret;
}

-static int kv_enable_nb_dpm(struct radeon_device *rdev)
+static int kv_enable_nb_dpm(struct radeon_device *rdev,
+ bool enable)
{
struct kv_power_info *pi = kv_get_pi(rdev);
int ret = 0;

- if (pi->enable_nb_dpm && !pi->nb_dpm_enabled) {
- ret = kv_notify_message_to_smu(rdev, PPSMC_MSG_NBDPM_Enable);
- if (ret == 0)
- pi->nb_dpm_enabled = true;
+ if (enable) {
+ if (pi->enable_nb_dpm && !pi->nb_dpm_enabled) {
+ ret = kv_notify_message_to_smu(rdev, PPSMC_MSG_NBDPM_Enable);
+ if (ret == 0)
+ pi->nb_dpm_enabled = true;
+ }
+ } else {
+ if (pi->enable_nb_dpm && pi->nb_dpm_enabled) {
+ ret = kv_notify_message_to_smu(rdev, PPSMC_MSG_NBDPM_Disable);
+ if (ret == 0)
+ pi->nb_dpm_enabled = false;
+ }
}

return ret;
@@ -1864,7 +1878,7 @@ int kv_dpm_set_power_state(struct radeon
}
kv_update_sclk_t(rdev);
if (rdev->family == CHIP_MULLINS)
- kv_enable_nb_dpm(rdev);
+ kv_enable_nb_dpm(rdev, true);
}
} else {
if (pi->enable_dpm) {
@@ -1889,7 +1903,7 @@ int kv_dpm_set_power_state(struct radeon
}
kv_update_acp_boot_level(rdev);
kv_update_sclk_t(rdev);
- kv_enable_nb_dpm(rdev);
+ kv_enable_nb_dpm(rdev, true);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Y.C. Chen" <yc_...@aspeedtech.com>

commit 83502a5d34386f7c6973bc70e1c423f55f5a2e3a upstream.

Type error and cause AST2000 cannot be detected correctly

Signed-off-by: Y.C. Chen <yc_...@aspeedtech.com>
Reviewed-by: Egbert Eich <ei...@suse.de>
Signed-off-by: Dave Airlie <air...@redhat.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/ast/ast_main.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -105,7 +105,7 @@ static int ast_detect_chip(struct drm_de
}
ast->vga2_clone = false;
} else {
- ast->chip = 2000;
+ ast->chip = AST2000;
DRM_INFO("AST 2000 detected\n");

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anton Blanchard <an...@samba.org>

commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.

Hidden away in the last 8 bytes of the buffer_list page is a solitary
statistic. It needs to be byte swapped or else ethtool -S will
produce numbers that terrify the user.

Since we do this in multiple places, create a helper function with a
comment explaining what is going on.

Signed-off-by: Anton Blanchard <an...@samba.org>
Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -292,6 +292,18 @@ failure:
atomic_add(buffers_added, &(pool->available));
}

+/*
+ * The final 8 bytes of the buffer list is a counter of frames dropped
+ * because there was not a buffer in the buffer list capable of holding
+ * the frame.
+ */
+static void ibmveth_update_rx_no_buffer(struct ibmveth_adapter *adapter)
+{
+ __be64 *p = adapter->buffer_list_addr + 4096 - 8;
+
+ adapter->rx_no_buffer = be64_to_cpup(p);
+}
+
/* replenish routine */
static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
{
@@ -307,8 +319,7 @@ static void ibmveth_replenish_task(struc
ibmveth_replenish_buffer_pool(adapter, pool);
}

- adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);
}

/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -698,8 +709,7 @@ static int ibmveth_close(struct net_devi

free_irq(netdev->irq, netdev);

- adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);

ibmveth_cleanup(adapter);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Max Filippov <jcmv...@gmail.com>

commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.

Current definition of TLBTEMP_BASE_2 is always 32K above the
TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP
region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER)
to determine TLBTEMP region where the fault happened. The size of the
TLBTEMP region is also checked incorrectly: not 64K, but twice data
cache way size (whicht may as well be less than the instruction cache
way size).

Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size.
Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or
the instruction cache way size, and use it to determine if the second
level TLB miss occured in the TLBTEMP region.

Practical occurence of page faults in the TLBTEMP area is extremely
rare, this code can be tested by deletion of all w[di]tlb instructions
in the tlbtemp_mapping region.

Signed-off-by: Max Filippov <jcmv...@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/xtensa/include/asm/pgtable.h | 7 ++++++-
arch/xtensa/kernel/entry.S | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)

--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -67,7 +67,12 @@
#define VMALLOC_START 0xC0000000
#define VMALLOC_END 0xC7FEFFFF
#define TLBTEMP_BASE_1 0xC7FF0000
-#define TLBTEMP_BASE_2 0xC7FF8000
+#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
+#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
+#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE)
+#else
+#define TLBTEMP_SIZE ICACHE_WAY_SIZE
+#endif

/*
* For the Xtensa architecture, the PTE layout is as follows:
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1565,7 +1565,7 @@ ENTRY(fast_second_level_miss)
rsr a0, excvaddr
bltu a0, a3, 2f

- addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT))
+ addi a1, a0, -TLBTEMP_SIZE
bgeu a1, a3, 2f

/* Check if we have to restore an ITLB mapping. */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Pugliese <thomas....@gmail.com>

commit 675f0ab2fe5a0f7325208e60b617a5f32b86d72c upstream.

Make sure the uwb_dev->bce entry is set before calling uwb_dev_add in
uwbd_dev_onair so that usermode will only see the device after it is
properly initialized. This fixes a kernel panic that can occur if
usermode tries to access the IEs sysfs attribute of a UWB device before
the driver has had a chance to set the beacon cache entry.

Signed-off-by: Thomas Pugliese <thomas....@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/uwb/lc-dev.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/uwb/lc-dev.c
+++ b/drivers/uwb/lc-dev.c
@@ -431,16 +431,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, s
uwb_dev->mac_addr = *bce->mac_addr;
uwb_dev->dev_addr = bce->dev_addr;
dev_set_name(&uwb_dev->dev, "%s", macbuf);
+
+ /* plug the beacon cache */
+ bce->uwb_dev = uwb_dev;
+ uwb_dev->bce = bce;
+ uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
+
result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc);
if (result < 0) {
dev_err(dev, "new device %s: cannot instantiate device\n",
macbuf);
goto error_dev_add;
}
- /* plug the beacon cache */
- bce->uwb_dev = uwb_dev;
- uwb_dev->bce = bce;
- uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
+
dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n",
macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,
dev_name(rc->uwb_dev.dev.parent));
@@ -448,6 +451,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, s
return;

error_dev_add:
+ bce->uwb_dev = NULL;
+ uwb_bce_put(bce);
kfree(uwb_dev);
return;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+k...@arm.linux.org.uk>

commit 3a44a2058747d71385eb69691c7f977cb58cc293 upstream.

When unbinding imx-drm, the following oops was observed:

Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = e995c000
[00000004] *pgd=4fea5831
Internal error: Oops: 817 [#1] SMP ARM
Modules linked in: bnep rfcomm bluetooth nfsd exportfs hid_cypress brcmfmac brcmutil snd_soc_fsl_ssi snd_soc_fsl_spdif imx_pcm_fiq imx_pcm_dma snd_soc_sgtl5000 imx_sdma imx2_wdt imx_ldb(C) imx_thermal snd_soc_imx_sgtl5000 snd_soc_imx_spdif snd_soc_imx_audmux
CPU: 1 PID: 779 Comm: bash Tainted: G C 3.16.0-rc2+ #1230
task: ea9eb180 ti: ea378000 task.ti: ea378000
PC is at ipu_dp_put+0x10/0x18
LR is at ipu_plane_dpms+0x60/0x8c
pc : [<c0350d20>] lr : [<c04bd9e8>] psr: 200f0013
sp : ea379d80 ip : ea379d90 fp : ea379d8c
r10: 00100100 r9 : 00000000 r8 : 00200200
r7 : e9ba0264 r6 : e9ba01f8 r5 : 00000000 r4 : ea34b800
r3 : 00000000 r2 : 00000000 r1 : 0000009b r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 3995c04a DAC: 00000015
Process bash (pid: 779, stack limit = 0xea378240)
Stack: (0xea379d80 to 0xea37a000)
...
Backtrace:
[<c0350d10>] (ipu_dp_put) from [<c04bd9e8>] (ipu_plane_dpms+0x60/0x8c)
[<c04bd988>] (ipu_plane_dpms) from [<c04bda40>] (ipu_disable_plane+0x2c/0x60)
[<c04bda14>] (ipu_disable_plane) from [<c04bda9c>] (ipu_plane_destroy+0x28/0x60)
[<c04bda74>] (ipu_plane_destroy) from [<c033ff84>] (drm_mode_config_cleanup+0x1b8/0x250)
[<c033fdcc>] (drm_mode_config_cleanup) from [<c04bc234>] (imx_drm_driver_unload+0x44/0x4c)
[<c04bc1f0>] (imx_drm_driver_unload) from [<c03394a4>] (drm_dev_unregister+0x2c/0xa0)
[<c0339478>] (drm_dev_unregister) from [<c0339f8c>] (drm_put_dev+0x30/0x6c)
[<c0339f5c>] (drm_put_dev) from [<c04bc1cc>] (imx_drm_unbind+0x14/0x18)
[<c04bc1b8>] (imx_drm_unbind) from [<c03530b4>] (component_master_del+0xbc/0xd8)
...
Code: e1a0c00d e92dd800 e24cb004 e3a03000 (e5c03004)

This is caused by a missing check in ipu_plane_dpms for a NULL pointer.

Fixes: b8d181e408af ("staging: drm/imx: add drm plane support")
Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/staging/imx-drm/ipuv3-plane.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/staging/imx-drm/ipuv3-plane.c
+++ b/drivers/staging/imx-drm/ipuv3-plane.c
@@ -281,7 +281,8 @@ static void ipu_plane_dpms(struct ipu_pl

ipu_idmac_put(ipu_plane->ipu_ch);
ipu_dmfc_put(ipu_plane->dmfc);
- ipu_dp_put(ipu_plane->dp);
+ if (ipu_plane->dp)
+ ipu_dp_put(ipu_plane->dp);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit d979e9f9ecab04c1ecca741370e30a8a498893f5 upstream.

Make sure to verify the maximum number of endpoints per type to avoid
writing beyond the end of a stack-allocated array.

The current usb-serial implementation is limited to eight ports per

interface but failed to verify that the number of endpoints of a certain
type reported by a device did not exceed this limit.

Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_i
if (usb_endpoint_is_bulk_in(endpoint)) {
/* we found a bulk in endpoint */
dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
- bulk_in_endpoint[num_bulk_in] = endpoint;
- ++num_bulk_in;
+ if (num_bulk_in < MAX_NUM_PORTS) {
+ bulk_in_endpoint[num_bulk_in] = endpoint;
+ ++num_bulk_in;
+ }
}

if (usb_endpoint_is_bulk_out(endpoint)) {
/* we found a bulk out endpoint */
dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
- bulk_out_endpoint[num_bulk_out] = endpoint;
- ++num_bulk_out;
+ if (num_bulk_out < MAX_NUM_PORTS) {
+ bulk_out_endpoint[num_bulk_out] = endpoint;
+ ++num_bulk_out;
+ }
}

if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
- interrupt_in_endpoint[num_interrupt_in] = endpoint;
- ++num_interrupt_in;
+ if (num_interrupt_in < MAX_NUM_PORTS) {
+ interrupt_in_endpoint[num_interrupt_in] =
+ endpoint;
+ ++num_interrupt_in;
+ }
}

if (usb_endpoint_is_int_out(endpoint)) {
/* we found an interrupt out endpoint */
dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
- interrupt_out_endpoint[num_interrupt_out] = endpoint;
- ++num_interrupt_out;
+ if (num_interrupt_out < MAX_NUM_PORTS) {
+ interrupt_out_endpoint[num_interrupt_out] =
+ endpoint;
+ ++num_interrupt_out;
+ }
}
}

@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_i
if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
- interrupt_in_endpoint[num_interrupt_in] = endpoint;
- ++num_interrupt_in;
+ if (num_interrupt_in < MAX_NUM_PORTS) {
+ interrupt_in_endpoint[num_interrupt_in] = endpoint;
+ ++num_interrupt_in;
+ }

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Y.C. Chen" <yc_...@aspeedtech.com>

commit 8f372e250ae5f4a5faf87ca1a629d0ae59db65b6 upstream.

Some config settings like 3rd TX chips will not get correctly
if the extended reg is protected

Signed-off-by: Y.C. Chen <yc_...@aspeedtech.com>
Reviewed-by: Egbert Eich <ei...@suse.de>
Signed-off-by: Dave Airlie <air...@redhat.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/ast/ast_main.c | 1 +

1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -67,6 +67,7 @@ static int ast_detect_chip(struct drm_de
{
struct ast_private *ast = dev->dev_private;
uint32_t data, jreg;
+ ast_open_key(ast);

if (dev->pdev->device == PCI_CHIP_AST1180) {
ast->chip = AST1100;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexande...@amd.com>

commit ff4377924f7e587c61bcbc704eafecf6c7bd2e00 upstream.

On systems with special thermal configurations make sure we make
note of the thermal setup. This is required for proper firmware
configuration on these systems.

Signed-off-by: Alex Deucher <alexande...@amd.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/radeon/radeon_atombios.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2281,19 +2281,31 @@ static void radeon_atombios_add_pplib_th
(controller->ucFanParameters &
ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with");
rdev->pm.int_thermal_type = THERMAL_TYPE_KV;
- } else if ((controller->ucType ==
- ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO) ||
- (controller->ucType ==
- ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL) ||
- (controller->ucType ==
- ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL)) {
- DRM_INFO("Special thermal controller config\n");
+ } else if (controller->ucType ==
+ ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO) {
+ DRM_INFO("External GPIO thermal controller %s fan control\n",
+ (controller->ucFanParameters &
+ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with");
+ rdev->pm.int_thermal_type = THERMAL_TYPE_EXTERNAL_GPIO;
+ } else if (controller->ucType ==
+ ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL) {
+ DRM_INFO("ADT7473 with internal thermal controller %s fan control\n",
+ (controller->ucFanParameters &
+ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with");
+ rdev->pm.int_thermal_type = THERMAL_TYPE_ADT7473_WITH_INTERNAL;
+ } else if (controller->ucType ==
+ ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL) {
+ DRM_INFO("EMC2103 with internal thermal controller %s fan control\n",
+ (controller->ucFanParameters &
+ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with");
+ rdev->pm.int_thermal_type = THERMAL_TYPE_EMC2103_WITH_INTERNAL;
} else if (controller->ucType < ARRAY_SIZE(pp_lib_thermal_controller_names)) {
DRM_INFO("Possible %s thermal controller at 0x%02x %s fan control\n",
pp_lib_thermal_controller_names[controller->ucType],
controller->ucI2cAddress >> 1,
(controller->ucFanParameters &
ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with");
+ rdev->pm.int_thermal_type = THERMAL_TYPE_EXTERNAL;
i2c_bus = radeon_lookup_i2c_gpio(rdev, controller->ucI2cLine);
rdev->pm.i2c_bus = radeon_i2c_lookup(rdev, &i2c_bus);
if (rdev->pm.i2c_bus) {

[Greg Kroah-Hartman]

---------------------------------
Note: This is a big stable release. Mostly my fault for being on the
road last week, combined with an unusually large number of patches being
tagged for the stable tree. Anyway, I've caught up with all pending
patches before 3.17-rc7, so if you have marked something for the stable
tree that I have not applied, or emailed the sta...@v.k.o list asking
for a patch, that is not here, please let me know.
---------------------------------

This is the start of the stable review cycle for the 3.16.4 release.
There are 357 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun Oct 5 21:28:42 UTC 2014.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.4-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gre...@linuxfoundation.org>
Linux 3.16.4-rc1

Stephen Boyd <sb...@codeaurora.org>
clk: qcom: Fix PLL rate configurations

Stephen Boyd <sb...@codeaurora.org>
clk: qcom: mdp_lut_clk is a child of mdp_src

Stephen Boyd <sb...@codeaurora.org>
clk: qcom: Fix MN frequency tables, parent map, and jpegd

Arnd Bergmann <ar...@arndb.de>
staging/lustre: disable virtual block device for 64K pages

Theodore Ts'o <ty...@mit.edu>
ext4: avoid trying to kfree an ERR_PTR pointer

Theodore Ts'o <ty...@mit.edu>
ext4: propagate errors up to ext4_find_entry()'s callers

Gu Zheng <guz....@cn.fujitsu.com>
aio: block exit_aio() until all context requests are completed

Suman Tripathi <stri...@apm.com>
ahci_xgene: Removing NCQ support from the APM X-Gene SoC AHCI SATA Host Controller driver.

Nishanth Menon <n...@ti.com>
clk: ti: divider: Provide error check for incoming parameters in set_rate

Tero Kristo <t-kr...@ti.com>
clk: prevent erronous parsing of children during rate change

Nishanth Menon <n...@ti.com>
clk: ti: dra7-atl: Provide error check for incoming parameters in set_rate

Viresh Kumar <viresh...@linaro.org>
cpufreq: update 'cpufreq_suspended' after stopping governors

Dan Carpenter <dan.ca...@oracle.com>
partitions: aix.c: off by one bug

Andy Shevchenko <andriy.s...@linux.intel.com>
dmaengine: dw: don't perform DMA when dmaengine_submit is called

Andy Shevchenko <andriy.s...@linux.intel.com>
dmaengine: dw: introduce dwc_dostart_first_queued() helper

Ulf Hansson <ulf.h...@linaro.org>
mmc: mmci: Reverse IRQ handling for the arm_variant

Pablo Neira Ayuso <pa...@netfilter.org>
netfilter: nf_tables: don't update chain with unset counters

Julian Anastasov <j...@ssi.bg>
ipvs: fix ipv6 hook registration for local replies

Daniel Borkmann <dbor...@redhat.com>
netfilter: x_tables: allow to use default cgroup match

Alex Gartrell <agar...@fb.com>
ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding

Eric Dumazet <edum...@google.com>
netfilter: xt_hashlimit: perform garbage collection from process context

NeilBrown <ne...@suse.de>
md/raid1: intialise start_next_window for READ case to avoid hang

NeilBrown <ne...@suse.de>
md/raid1: fix_read_error should act on all non-faulty devices.

NeilBrown <ne...@suse.de>
md/raid1: count resync requests in nr_pending.

NeilBrown <ne...@suse.de>
md/raid1: update next_resync under resync_lock.

NeilBrown <ne...@suse.de>
md/raid1: Don't use next_resync to determine how far resync has progressed

NeilBrown <ne...@suse.de>
md/raid1: make sure resync waits for conflicting writes to complete.

NeilBrown <ne...@suse.de>
md/raid1: be more cautious where we read-balance during resync.

NeilBrown <ne...@suse.de>
md/raid1: clean up request counts properly in close_sync()

Zhaowei Yuan <zhaowe...@samsung.com>
media: vb2: fix plane index sanity check in vb2_plane_cookie()

Hans Verkuil <hans.v...@cisco.com>
media: vb2: fix vb2 state check when start_streaming fails

Hans Verkuil <hver...@xs4all.nl>
media: videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages

Mauro Carvalho Chehab <mch...@osg.samsung.com>
media: em28xx: fix VBI handling logic

Hans Verkuil <hver...@xs4all.nl>
media: adv7604: fix inverted condition

Bimow Chen <Bimow...@ite.com.tw>
media: af9033: update IT9135 tuner inittabs

Hans Verkuil <hans.v...@cisco.com>
media: cx18: fix kernel oops with tda8290 tuner

Antti Palosaari <cr...@iki.fi>
media: af9033: feed clock to RF tuner

Malcolm Priestley <tvbo...@gmail.com>
media: af9035: new IDs: add support for PCTV 78e and PCTV 79e

Bimow Chen <Bimow...@ite.com.tw>
media: it913x: init tuner on attach

Lan Tianyu <tiany...@intel.com>
cpufreq: fix cpufreq suspend/resume for intel_pstate

Prarit Bhargava <pra...@redhat.com>
cpufreq: release policy->rwsem on error

Bjorn Helgaas <bhel...@google.com>
Revert "PCI: Make sure bus number resources stay within their parents bounds"

Johannes Berg <johann...@intel.com>
nl80211: clear skb cb before passing to netlink

Tom Lendacky <thomas....@amd.com>
crypto: ccp - Check for CCP before registering crypto algs

David Hildenbrand <da...@linux.vnet.ibm.com>
blk-mq: Avoid race condition with uninitialized requests

Anton Altaparmakov <ai...@cam.ac.uk>
Fix nasty 32-bit overflow bug in buffer i/o code.

Alex Deucher <alexande...@amd.com>
drm/radeon/px: fix module unload

Alex Deucher <alexande...@amd.com>
drm/nouveau/runpm: fix module unload

Alex Deucher <alexande...@amd.com>
vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops

Bjorn Helgaas <bhel...@google.com>
Revert "PCI: Don't scan random busses in pci_scan_bridge()"

Bjorn Helgaas <bhel...@google.com>
PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device

Zhiqiang Zhang <zhangzhiq...@huawei.com>
arm: armv7: perf: fix armv7 ref-cycles error

Cong Wang <cw...@twopensource.com>
perf: Fix a race condition in perf_remove_from_context()

Krzysztof Hałasa <kha...@piap.pl>
Fix unbalanced mutex in dma_pool_create().

Qipan Li <Qipa...@csr.com>
spi: sirf: enable RX_IO_DMA_INT interrupt

Axel Lin <axel...@ingics.com>
spi: dw: Don't use devm_kzalloc in master->setup callback

Axel Lin <axel...@ingics.com>
spi: fsl: Don't use devm_kzalloc in master->setup callback

Matan Barak <mat...@mellanox.com>
IB/core: When marshaling uverbs path, clear unused fields

Moni Shoua <mo...@mellanox.com>
IB/mlx4: Don't duplicate the default RoCE GID

Moni Shoua <mo...@mellanox.com>
IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()

Mike Marciniszyn <mike.mar...@intel.com>
IB/qib: Correct reference counting in debugfs qp_stats

Al Viro <vi...@ZenIV.linux.org.uk>
GFS2: fix d_splice_alias() misuses

Amit Shah <amit...@redhat.com>
Revert "hwrng: virtio - ensure reads happen after successful probe"

Amit Shah <amit...@redhat.com>
virtio: rng: delay hwrng_register() till driver is ready

Richard Larocque <rlar...@google.com>
alarmtimer: Lock k_itimer during timer callback

Richard Larocque <rlar...@google.com>
alarmtimer: Do not signal SIGEV_NONE timers

Richard Larocque <rlar...@google.com>
alarmtimer: Return relative times in timer_gettime

John David Anglin <dave....@bell.net>
parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds

Guy Martin <gms...@tuxicoman.be>
parisc: Implement new LWS CAS supporting 64 bit operations.

Al Viro <vi...@zeniv.linux.org.uk>
don't bugger nd->seq on set_root_rcu() from follow_dotdot_rcu()

Richard Genoud <richard...@gmail.com>
tty/serial: at91: BUG: disable interrupts when !UART_ENABLE_MS()

Michael Ellerman <m...@ellerman.id.au>
powerpc: Add smp_mb()s to arch_spin_unlock_wait()

Michael Ellerman <m...@ellerman.id.au>
powerpc: Add smp_mb() to arch_spin_is_locked()

Anton Blanchard <an...@samba.org>
powerpc/perf: Fix ABIv2 kernel backtraces

Johannes Stezenbach <j...@sig21.net>
ath9k_htc: fix random decryption failure

Arend van Spriel <ar...@broadcom.com>
brcmfmac: handle IF event for P2P_DEVICE interface

Wanpeng Li <wanpe...@linux.intel.com>
sched: Fix unreleased llc_shared_mask bit during CPU hotplug

Peter Feiner <pfe...@google.com>
mm: softdirty: keep bit when zapping file pte

Fabian Frederick <fa...@skynet.be>
fs/cachefiles: add missing \n to kerror conversions

David Rientjes <rien...@google.com>
mm, slab: initialize object alignment on cache creation

Joseph Qi <jose...@huawei.com>
ocfs2/dlm: do not get resource spinlock if lockres is new

Andreas Rohner <andreas...@gmx.net>
nilfs2: fix data loss with mmap()

Andrey Vagin <ava...@openvz.org>
fs/notify: don't show f_handle if exportfs_encode_inode_fh failed

Andrey Vagin <ava...@openvz.org>
fsnotify/fdinfo: use named constants instead of hardcoded values

Rasmus Villemoes <li...@rasmusvillemoes.dk>
kcmp: fix standard comparison bug

Nicolas Iooss <nicolas.i...@m4x.org>
eventpoll: fix uninitialized variable in epoll_ctl

Patrick Palka <pat...@parcs.ath.cx>
kernel/printk/printk.c: fix faulty logic in the case of recursive printk

Johannes Berg <johann...@intel.com>
Revert "mac80211: disable uAPSD if all ACs are under ACM"

Steven Rostedt (Red Hat) <ros...@goodmis.org>
ftrace: Update all ftrace_ops for a ftrace_hash_ops update

Steven Rostedt (Red Hat) <ros...@goodmis.org>
ftrace: Fix function_profiler and function tracer together

Steven Rostedt (Red Hat) <ros...@goodmis.org>
ftrace: Allow ftrace_ops to use the hashes from other ops

Felipe Balbi <ba...@ti.com>
usb: dwc3: fix TRB completion when multiple TRBs are started

Jens Axboe <ax...@fb.com>
genhd: fix leftover might_sleep() in blk_free_devt()

Trond Myklebust <trond.m...@primarydata.com>
lockdep: Revert lockdep check in raw_seqcount_begin()

J. Bruce Fields <bfi...@redhat.com>
lockd: fix rpcbind crash on lockd startup failure

Larry Finger <Larry....@lwfinger.net>
rtlwifi: rtl8192cu: Add new ID

Eliad Peller <el...@wizery.com>
regulatory: add NUL to alpha2

Tejun Heo <t...@kernel.org>
percpu: perform tlb flush after pcpu_map_pages() failure

Tejun Heo <t...@kernel.org>
percpu: fix pcpu_alloc_pages() failure path

Honggang Li <enjoym...@gmail.com>
percpu: free percpu allocation info for uniprocessor system

Jarkko Nikula <jarkko...@linux.intel.com>
gpio: Fix potential NULL handler data in chained irqchip handler

James Ralston <james.d...@intel.com>
ata_piix: Add Device IDs for Intel 9 Series PCH

Robert Coulson <rob.c...@gmail.com>
hwmon: (ds1621) Update zbits after conversion rate change

Hans de Goede <hdeg...@redhat.com>
Input: i8042 - add nomux quirk for Avatar AVIU-145A6

Hans de Goede <hdeg...@redhat.com>
Input: i8042 - add Fujitsu U574 to no_timeout dmi table

Dmitry Torokhov <dmitry....@gmail.com>
Input: atkbd - do not try 'deactivate' keyboard on any LG laptops

Hans de Goede <hdeg...@redhat.com>
Input: elantech - fix detection of touchpad on ASUS s301l

Dmitry Torokhov <dmitry....@gmail.com>
Input: synaptics - add support for ForcePads

John Sung <penmoun...@gmail.com>
Input: serport - add compat handling for SPIOCSTYPE ioctl

Mikulas Patocka <mpat...@redhat.com>
dm crypt: fix access beyond the end of allocated space

Anssi Hannula <anssi....@iki.fi>
dm cache: fix race causing dirty blocks to be marked as clean

Keith Busch <keith...@intel.com>
block: Fix dev_t minor allocation lifetime

Thomas Gleixner <tg...@linutronix.de>
futex: Unlock hb->lock in futex_wait_requeue_pi() error path

Tejun Heo <t...@kernel.org>
workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()

Luciano Coelho <luciano...@intel.com>
iwlwifi: mvm: set MAC_FILTER_IN_BEACON correctly for STA/P2P client

Eyal Shapira <ey...@wizery.com>
iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate

Eliad Peller <el...@wizery.com>
iwlwifi: increase DEFAULT_MAX_TX_POWER

Emmanuel Grumbach <emmanuel...@intel.com>
iwlwifi: mvm: fix endianity issues with Smart Fifo commands

Emmanuel Grumbach <emmanuel...@intel.com>
Revert "iwlwifi: dvm: don't enable CTS to self"

Mike Christie <mich...@cs.wisc.edu>
SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu

Dan Carpenter <dan.ca...@oracle.com>
NFC: microread: Potential overflows in microread_target_discovered()

Nicholas Bellinger <n...@linux-iscsi.org>
iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid

Joern Engel <jo...@logfs.org>
iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure

Sebastian Herbszt <her...@gmx.de>
target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE

Sagi Grimberg <sa...@mellanox.com>
Target/iser: Don't put isert_conn inside disconnected handler

Sagi Grimberg <sa...@mellanox.com>
Target/iser: Get isert_conn reference once got to connected_handler

Ludovic Desroches <ludovic....@atmel.com>
iio: adc: at91: don't use the last converted data register

Subbaraya Sundeep Bhatta <subbaraya.su...@xilinx.com>
iio: adc: xilinx-xadc: assign auxiliary channels address correctly

Johannes Pointner <johannes...@gmail.com>
iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name

Denis CIOCCA <denis....@st.com>
iio:magnetometer: bugfix magnetometers gain values

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: st_sensors: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: meter: ade7758: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: inv_mpu6050: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: gyro: itg3200: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: hid_sensor_hub: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio: accel: bma180: Fix indio_dev->trig assignment

Srinivas Pandruvada <srinivas....@linux.intel.com>
iio:trigger: modify return value for iio_trigger_get

Steve French <smfr...@gmail.com>
SMB3: Fix oops when creating symlinks on smb3

Peter Ujfalusi <peter.u...@ti.com>
ASoC: davinci-mcasp: Correct rx format unit configuration

Miklos Szeredi <msze...@suse.cz>
shmem: fix nlink for rename overwrite directory

Kees Cook <kees...@chromium.org>
x86/kaslr: Avoid the setup_data area when picking location

Dave Young <dyo...@redhat.com>
x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8

Stefan Bader <stefan...@canonical.com>
x86/xen: don't copy bogus duplicate entries into kernel page tables

Ross Lagerwall <ross.la...@citrix.com>
xen/manage: Always freeze/thaw processes when suspend/resuming

Christian Borntraeger <bornt...@de.ibm.com>
KVM: s390/mm: Fix guest storage key corruption in ptep_set_access_flags

Christian Borntraeger <bornt...@de.ibm.com>
KVM: s390/mm: Fix storage key corruption during swapping

Christian Borntraeger <bornt...@de.ibm.com>
KVM: s390/mm: try a cow on read only pages for key ops

Christian Borntraeger <bornt...@de.ibm.com>
KVM: s390: Fix user triggerable bug in dead code

Zefan Li <liz...@huawei.com>
cgroup: fix unbalanced locking

Li Zefan <liz...@huawei.com>
cgroup: delay the clearing of cgrp->kn->priv

Alban Crequy <alban....@collabora.co.uk>
cgroup: reject cgroup names with '\n'

Mark Brown <bro...@linaro.org>
regmap: Don't attempt block writes when syncing cache on single_rw devices

Mark Brown <bro...@linaro.org>
regmap: Fix handling of volatile registers for format_write() chips

Lars-Peter Clausen <la...@metafoo.de>
regmap: Fix regcache debugfs initialization

Tang Chen <tang...@cn.fujitsu.com>
memblock, memhotplug: fix wrong type in memblock_find_in_range_node().

Catalin Marinas <catalin...@arm.com>
arm64: Add brackets around user_stack_pointer()

Aaron Lu <aaro...@intel.com>
ACPI / video: disable native backlight for ThinkPad X201s

Mika Westerberg <mika.we...@linux.intel.com>
ACPI / scan: Correct error return value of create_modalias()

Rafael J. Wysocki <rafael.j...@intel.com>
ACPI / hotplug: Generate online uevents for ACPI containers

Fu Zhonghui <zhong...@linux.intel.com>
ACPI / platform / LPSS: disable async suspend/resume of LPSS devices

Srinivas Pandruvada <srinivas....@linux.intel.com>
gpio / ACPI: Use pin index and bit length

Bob Moore <Robert...@intel.com>
ACPICA: Update to GPIO region handler interface.

Markos Chandras <markos....@imgtec.com>
MIPS: mcount: Adjust stack pointer for static trace in MIPS32

Paul Burton <paul....@imgtec.com>
MIPS: Fix MFC1 & MFHC1 emulation for 64-bit MIPS systems

Aurelien Jarno <aure...@aurel32.net>
MIPS: ZBOOT: add missing <linux/string.h> include

Nathan Lynch <nathan...@mentor.com>
ARM: 8178/1: fix set_tls for !CONFIG_KUSER_HELPERS

Robin Murphy <robin....@arm.com>
ARM: 8165/1: alignment: don't break misaligned NEON load/store

Shawn Guo <shaw...@freescale.com>
ARM: imx: fix .is_enabled() of shared gate clock

Markus Niebel <Markus...@tq-group.com>
ARM: DT: imx53: fix lvds channel 1 port

Roger Quadros <rog...@ti.com>
ARM: dts: dra7-evm: Fix NAND GPMC timings

Stephen Boyd <sb...@codeaurora.org>
ARM: 8149/1: perf: Don't sleep while atomic when enabling per-cpu interrupts

Nathan Lynch <nathan...@mentor.com>
ARM: 8148/1: flush TLS and thumbee register state during exec

Sudeep Holla <sudeep...@arm.com>
ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs

Nishanth Menon <n...@ti.com>
ARM: dts: dra7-evm: Fix spi1 mux documentation

Peter Ujfalusi <peter.u...@ti.com>
ARM: edma: Fix configuration parsing for SoCs with multiple eDMA3 CC

Nishanth Menon <n...@ti.com>
ARM: dts: DRA7: fix interrupt-cells for GPIO

Rajendra Nayak <rna...@ti.com>
ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists

Fabio Estevam <fabio....@freescale.com>
ARM: dts: imx53-qsrb: Fix suspend/resume

Mark Rutland <mark.r...@arm.com>
ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex

Mark Rutland <mark.r...@arm.com>
ARM: 8128/1: abort: don't clear the exclusive monitors

Andy Shevchenko <andriy.s...@linux.intel.com>
spi: dw-pci: fix bug when regs left uninitialized

Andy Shevchenko <andriy.s...@linux.intel.com>
spi: dw: fix kernel crash due to NULL pointer dereference

Jorge A. Ventura <jorge.arau...@gmail.com>
spi/omap-mcspi: Fix the spi task hangs waiting dma_rx

Weston Andros Adamson <dr...@primarydata.com>
nfs: can_coalesce_requests must enforce contiguity

Weston Andros Adamson <dr...@primarydata.com>
nfs: disallow duplicate pages in pgio page vectors

Weston Andros Adamson <dr...@primarydata.com>
nfs: don't sleep with inode lock in lock_and_join_requests

Weston Andros Adamson <dr...@primarydata.com>
nfs: fix error handling in lock_and_join_requests

Weston Andros Adamson <dr...@primarydata.com>
nfs: use blocking page_group_lock in add_request

Weston Andros Adamson <dr...@primarydata.com>
nfs: fix nonblocking calls to nfs_page_group_lock

Weston Andros Adamson <dr...@primarydata.com>
nfs: change nfs_page_group_lock argument

Weston Andros Adamson <dr...@primarydata.com>
nfs: clear_request_commit while holding i_lock

Weston Andros Adamson <dr...@primarydata.com>
pnfs: add pnfs_put_lseg_async

Weston Andros Adamson <dr...@primarydata.com>
nfs: check wait_on_bit_lock err in page_group_lock

Weston Andros Adamson <dr...@primarydata.com>
nfs: remove pgio_header refcount, related cleanup

Weston Andros Adamson <dr...@primarydata.com>
nfs: merge nfs_pgio_data into _header

Weston Andros Adamson <dr...@primarydata.com>
nfs: rename members of nfs_pgio_data

Weston Andros Adamson <dr...@primarydata.com>
nfs: move nfs_pgio_data and remove nfs_rw_header

J. Bruce Fields <bfi...@redhat.com>
nfsd4: fix corruption of NFSv4 read data

Trond Myklebust <trond.m...@primarydata.com>
NFSv4: Fix another bug in the close/open_downgrade code

Steve Dickson <ste...@redhat.com>
NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()

Li Zefan <liz...@huawei.com>
cgroup: check cgroup liveliness before unbreaking kernfs

J. Bruce Fields <bfi...@redhat.com>
nfsd4: fix rd_dircount enforcement

Olav Haugan <oha...@codeaurora.org>
iommu/arm-smmu: fix programming of SMMU_CBn_TCR for stage 1

Varun Sethi <Varun...@freescale.com>
iommu/fsl: Fix warning resulting from adding PCI device twice

Joerg Roedel <jro...@suse.de>
iommu/vt-d: Check return value of acpi_bus_get_device()

Bjørn Mork <bj...@mork.no>
Revert "ACPI / battery: fix wrong value of capacity_now reported when fully charged"

Fu Zhonghui <zhong...@linux.intel.com>
ACPI / LPSS: complete PM entries for LPSS power domain

Lee, Chun-Yi <joeyli...@gmail.com>
ACPI / RTC: Fix CMOS RTC opregion handler accesses to wrong addresses

Robert Baldyga <r.ba...@samsung.com>
usb: dwc2/gadget: avoid disabling ep0

Marek Szyprowski <m.szyp...@samsung.com>
usb: dwc2/gadget: delay enabling irq once hardware is configured properly

Marek Szyprowski <m.szyp...@samsung.com>
usb: dwc2/gadget: do not call disconnect method in pullup

Marek Szyprowski <m.szyp...@samsung.com>
usb: dwc2/gadget: break infinite loop in endpoint disable code

Kamil Debski <k.de...@samsung.com>
usb: dwc2/gadget: fix phy initialization sequence

Kamil Debski <k.de...@samsung.com>
usb: dwc2/gadget: fix phy disable sequence

Felipe Balbi <ba...@ti.com>
usb: dwc3: omap: fix ordering for runtime pm calls

Felipe Balbi <ba...@ti.com>
usb: dwc3: core: fix ordering for PHY suspend

Felipe Balbi <ba...@ti.com>
usb: dwc3: core: fix order of PM runtime calls

Alan Stern <st...@rowland.harvard.edu>
USB: EHCI: unlink QHs even after the controller has stopped

Mark <ma...@clara.co.uk>
USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters

Mark <ma...@clara.co.uk>
USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter

Mark <ma...@clara.co.uk>
USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter

Mark <ma...@clara.co.uk>
storage: Add single-LUN quirk for Jaz USB Adapter

Alan Stern <st...@rowland.harvard.edu>
USB: document the 'u' flag for usb-storage quirks parameter

Joe Lawrence <joe.la...@stratus.com>
usb: hub: take hub->hdev reference when processing from eventlist

Mathias Nyman <mathia...@linux.intel.com>
xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices

Al Cooper <alco...@gmail.com>
usb: xhci: Fix OOPS in xhci error handling code

Mathias Nyman <mathia...@linux.intel.com>
xhci: Fix null pointer dereference if xhci initialization fails

Felipe Balbi <ba...@ti.com>
usb: host: xhci: fix compliance mode workaround

Thomas Pugliese <thomas....@gmail.com>
uwb: init beacon cache entry before registering uwb device

Johan Hovold <jo...@kernel.org>
USB: zte_ev: fix removed PIDs

Johan Hovold <jo...@kernel.org>
USB: ftdi_sio: add support for NOVITUS Bono E thermal printer

Taylor Braun-Jones <taylor.br...@ge.com>
USB: ftdi_sio: Add support for GE Healthcare Nemo Tracker device

Ivan T. Ivanov <iiv...@mm-sol.com>
usb: chipidea: msm: Initialize PHY on reset event

Ivan T. Ivanov <iiv...@mm-sol.com>
usb: chipidea: msm: Use USB PHY API to control PHY state

Tony Lindgren <to...@atomide.com>
usb: phy: twl4030-usb: Fix regressions to runtime PM on omaps

Tony Lindgren <to...@atomide.com>
usb: phy: twl4030-usb: Fix lost interrupts after ID pin goes down

Thierry Reding <tre...@nvidia.com>
usb: phy: tegra: Avoid use of sizeof(void)

Bjørn Mork <bj...@mork.no>
USB: sierra: add 1199:68AA device ID

Bjørn Mork <bj...@mork.no>
USB: sierra: avoid CDC class functions on "68A3" devices

Johan Hovold <jo...@kernel.org>
USB: zte_ev: remove duplicate Qualcom PID

Johan Hovold <jo...@kernel.org>
USB: zte_ev: remove duplicate Gobi PID

Johan Hovold <jo...@kernel.org>

Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"

Brennan Ashton <bas...@brennanashton.com>
USB: option: add VIA Telecom CDS7 chipset device id

Johan Hovold <jo...@kernel.org>
USB: option: reduce interrupt-urb logging verbosity

Johan Hovold <jo...@kernel.org>
USB: serial: fix potential heap buffer overflow

Stephen Hemminger <ste...@networkplumber.org>
USB: sisusb: add device id for Magic Control USB video

Johan Hovold <jo...@kernel.org>
USB: serial: fix potential stack buffer overflow

Greg KH <gre...@linuxfoundation.org>
USB: serial: pl2303: add device id for ztek device

Andrzej Pietrasiewicz <andr...@samsung.com>
usb: gadget: f_rndis: fix interface id for OS descriptors

Alexey Khoroshilov <khoro...@ispras.ru>
ufs: fix deadlocks introduced by sb mutex merge

Jeff Layton <jla...@primarydata.com>
locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease

Max Filippov <jcmv...@gmail.com>
xtensa: fix a6 and a7 handling in fast_syscall_xtensa

Max Filippov <jcmv...@gmail.com>
xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss

Max Filippov <jcmv...@gmail.com>
xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS

Alan Douglas <adou...@cadence.com>
xtensa: fix address checks in dma_{alloc,free}_coherent

Max Filippov <jcmv...@gmail.com>
xtensa: replace IOCTL code definitions with constants

Alex Deucher <alexande...@amd.com>
drm/radeon/cik: use a separate counter for CP init timeout

Alex Deucher <alexande...@amd.com>
drm/radeon/dpm: fix resume on mullins

Alex Deucher <alexande...@amd.com>
drm/radeon: don't reset dma on r6xx-evergreen init

Alex Deucher <alexande...@amd.com>
drm/radeon: don't reset sdma on CIK init

Alex Deucher <alexande...@amd.com>
drm/radeon: don't reset dma on NI/SI init

Alex Deucher <alexande...@amd.com>
drm/radeon: add connector quirk for fujitsu board

Alex Deucher <alexande...@amd.com>
drm/radeon/dpm: set the thermal type properly for special configs

Christian König <christia...@amd.com>
drm/radeon: fix semaphore value init

Alex Deucher <alexande...@amd.com>
drm/radeon: handle broken disabled rb mask gracefully (6xx/7xx) (v2)

Alex Deucher <alexande...@amd.com>
drm/radeon: fix active_cu mask on SI and CIK after re-init (v3)

Alex Deucher <alexande...@amd.com>
drm/radeon: fix active cu count for SI and CIK

Alex Deucher <alexande...@amd.com>
drm/radeon: fix pm handling in radeon_gpu_reset

Christian König <christia...@amd.com>
drm/radeon: properly document reloc priority mask

Alex Deucher <alexande...@amd.com>
drm/radeon/dpm: select the appropriate vce power state for KV/KB/ML

Oleg Chernovskiy <algo...@gmail.com>
drm/radeon: Add missing lines to ci_set_thermal_temperature_range

Pali Rohár <pali....@gmail.com>
drm/radeon: Add ability to get and change dpm state when radeon PX card is turned off

Thomas Hellstrom <thell...@vmware.com>
drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle

Russell King <rmk+k...@arm.linux.org.uk>
imx-drm: imx-ldb: fix NULL pointer in imx_ldb_unbind()

Russell King <rmk+k...@arm.linux.org.uk>
imx-drm: ipuv3-plane: fix ipu_plane_dpms()

Y.C. Chen <yc_...@aspeedtech.com>
drm/ast: AST2000 cannot be detected correctly

Y.C. Chen <yc_...@aspeedtech.com>
drm/ast: open key before detect chips

Brad Volkin <bradley....@intel.com>
drm/i915: Don't leak command parser tables on suspend/resume

Jani Nikula <jani....@intel.com>
drm/i915/hdmi: fix hdmi audio state readout

Ville Syrjälä <ville....@linux.intel.com>
drm/i915: Wait for vblank before enabling the TV encoder

Daniel Vetter <daniel...@ffwll.ch>
drm/i915: Fix EIO/wedged handling in gem fault handler

Ville Syrjälä <ville....@linux.intel.com>
drm/i915: Fix lock dropping in intel_tv_detect()

Mathias Krause <min...@googlemail.com>
drm/i915: Remove bogus __init annotation from DMI callbacks

Scot Doyle <lkm...@scotdoyle.com>
drm/i915: Ignore VBT backlight presence check on Acer C720 (4005U)

Paulo Zanoni <paulo.r...@intel.com>
drm/i915: fix plane/cursor handling when runtime suspended

Imre Deak <imre...@intel.com>
drm/i915: don't try to retrain a DP link on an inactive CRTC

Ville Syrjälä <ville....@linux.intel.com>
drm/i915: Fix locking for intel_enable_pipe_a()

Ville Syrjälä <ville....@linux.intel.com>
drm/i915: Skip load detect when intel_crtc->new_enable==true

Filipe Brandenburger <filbr...@google.com>
xattr: fix check for simultaneous glibc header inclusion

Benjamin Tissoires <benjamin....@redhat.com>
HID: logitech-dj: prevent false errors to be shown

Jiri Kosina <jko...@suse.cz>
HID: magicmouse: sanity check report size in raw_event() callback

Jiri Kosina <jko...@suse.cz>
HID: picolcd: sanity check report size in raw_event() callback

Toshiaki Makita <makita....@lab.ntt.co.jp>
cfq-iosched: Fix wrong children_weight calculation

Clemens Ladisch <cle...@ladisch.de>
ALSA: pcm: fix fifo_size frame calculation

Huacai Chen <che...@lemote.com>
ALSA: hda - Add fixup model name lookup for Lemote A1205

Takashi Iwai <ti...@suse.de>
ALSA: hda - Fix invalid pin powermap without jack detection

Takashi Iwai <ti...@suse.de>
ALSA: hda - Fix COEF setups for ALC1150 codec

Takashi Iwai <ti...@suse.de>
ALSA: hda - Fix digital mic on Acer Aspire 3830TG

Takashi Sakamoto <o-ta...@sakamocchi.jp>
ALSA: firewire-lib/dice: add arrangements of PCM pointer and interrupts for Dice quirk

Takashi Sakamoto <o-ta...@sakamocchi.jp>
ALSA: dice: fix wrong channel mappping at higher sampling rate

Clemens Ladisch <cle...@ladisch.de>
ALSA: core: fix buffer overflow in snd_info_get_line()

Will Deacon <will....@arm.com>
arm64: ptrace: fix compat hardware watchpoint reporting

Josef Bacik <jba...@fb.com>
trace: Fix epoll hang when we race with new entries

Steven Rostedt (Red Hat) <ros...@goodmis.org>
ftrace: Use current addr when converting to nop in __ftrace_replace_code()

Fan Du <fan...@intel.com>
i2c: ismt: use correct length when copy buffer

addy ke <add...@rock-chips.com>
i2c: rk3x: fix divisor calculation for SCL frequency

Sergei Shtylyov <sergei....@cogentembedded.com>
i2c: rcar: fix RCAR_IRQ_ACK_{RECV|SEND}

Sergei Shtylyov <sergei....@cogentembedded.com>
i2c: rcar: fix MNR interrupt handling

Sergei Shtylyov <sergei....@cogentembedded.com>
Revert "i2c: rcar: remove spinlock"

Simon Lindgren <si...@aqwary.com>
i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.

Marek Roszko <mark....@gmail.com>
i2c: at91: add bound checking on SMBus block length bytes

Chen-Yu Tsai <we...@csie.org>
i2c: mv64xxx: continue probe when clock-frequency is missing

addy ke <add...@rock-chips.com>
i2c: rk3x: fix bug that cause transfer fails in master receive mode

Pranavkumar Sawargaonkar <prana...@linaro.org>
ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU

Christoffer Dall <christof...@linaro.org>
arm/arm64: KVM: Complete WFI/WFE instructions

Sudeep Holla <sudeep...@arm.com>
arm64: use irq_set_affinity with force=false when migrating irqs

Will Deacon <will....@arm.com>
arm64: flush TLS registers during exec

Lothar Waßmann <L...@KARO-electronics.de>
ARM: dts: i.MX53: fix apparent bug in VPU clks

Bill Pringlemeir <bpring...@nbsps.com>
ARM: dts: vf610-twr: Fix pinctrl_esdhc1 pin definitions.

Shawn Guo <shaw...@freescale.com>
ARM: imx: fix TLB missing of IOMUXC base address during suspend

Jeff Moyer <jmo...@redhat.com>
aio: add missing smp_rmb() in read_events_ring

Benjamin LaHaise <bc...@kvack.org>
aio: fix reqs_available handling

Anton Blanchard <an...@samba.org>
ibmveth: Fix endian issues with rx_no_buffer statistic

Geert Uytterhoeven <geert+...@glider.be>
pwm: Fix period and polarity in pwm_get() for non-perfect matches

Murali Karicheri <m-kari...@ti.com>
ahci: add pcid for Marvel 0x9182 controller

James Ralston <james.d...@intel.com>
ahci: Add Device IDs for Intel 9 Series PCH

Arjun Sreedharan <arju...@gmail.com>
pata_scc: propagate return value of scc_wait_after_reset

Tejun Heo <t...@kernel.org>
libata: widen Crucial M550 blacklist matching

Florian Fainelli <f.fai...@gmail.com>
of/irq: Fix lookup to use 'interrupts-extended' property first

Al Cooper <alco...@gmail.com>
of: Allow mem_reserve of memory with a base address of zero

Chris Wilson <ch...@chris-wilson.co.uk>
drm/i915: Disable RCS flips on Ivybridge

Jiri Kosina <jko...@suse.cz>
drm/i915: read HEAD register back in init_ring_common() to enforce ordering

Rafael Barbalho <rafael....@intel.com>
drm/i915: Fix crash when failing to parse MIPI VBT

Alex Deucher <alexande...@amd.com>
drm/radeon: tweak ACCEL_WORKING2 query for hawaii

Alex Deucher <alexande...@amd.com>
drm/radeon/atom: add new voltage fetch function for hawaii

Christian König <christia...@amd.com>
drm/radeon: set VM base addr using the PFP v2

Alex Deucher <alexande...@amd.com>
drm/radeon: load the lm63 driver for an lm64 thermal chip.

Alex Deucher <alexande...@amd.com>
drm/radeon: re-enable dpm by default on BTC

Alex Deucher <alexande...@amd.com>
drm/radeon: re-enable dpm by default on cayman

Alex Deucher <alexande...@amd.com>
drm/radeon/dpm: handle voltage info fetching on hawaii

Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
drm/ttm: Pass GFP flags in order to avoid deadlock.

Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
drm/ttm: Fix possible stack overflow by recursive shrinker calls.

Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
drm/ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions.

Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().

Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().

Christian König <christia...@amd.com>
drm/ttm: fix handling of TTM_PL_FLAG_TOPDOWN v2

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: fix double kfree

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: fix release order on exit

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: panel: fix leak when unloading the module

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: tfp410: fix dangling sysfs connector node

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: slave: fix dangling sysfs connector node

Guido Martínez <gu...@vanguardiasur.com.ar>
drm/tilcdc: panel: fix dangling sysfs connector node

Stephen Warren <swa...@nvidia.com>
drm/tegra: add MODULE_DEVICE_TABLEs

Ronald Wahl <ronal...@raritan.com>
carl9170: fix sending URBs with wrong type when using full-speed

Stephen Boyd <sb...@codeaurora.org>
cpufreq: OPP: Avoid sleeping while atomic

Andy Lutomirski <lu...@amacapital.net>
module: Clean up ro/nx after early module load failures


-------------

Diffstat:

.../bindings/interrupt-controller/interrupts.txt | 12 +-
.../devicetree/bindings/staging/imx-drm/ldb.txt | 15 +-
Documentation/kernel-parameters.txt | 1 +
Makefile | 4 +-
arch/arm/boot/dts/dra7-evm.dts | 41 ++-
arch/arm/boot/dts/dra7.dtsi | 16 +-
arch/arm/boot/dts/imx53-qsrb.dts | 8 +
arch/arm/boot/dts/imx53.dtsi | 14 +-
arch/arm/boot/dts/vf610-twr.dts | 2 +-
arch/arm/common/edma.c | 9 +-
arch/arm/include/asm/cacheflush.h | 1 -
arch/arm/include/asm/tls.h | 64 +++++
arch/arm/kernel/entry-header.S | 29 ++-
arch/arm/kernel/irq.c | 2 +-
arch/arm/kernel/perf_event_cpu.c | 14 +-
arch/arm/kernel/perf_event_v7.c | 5 +
arch/arm/kernel/process.c | 2 +
arch/arm/kernel/thumbee.c | 2 +-
arch/arm/kernel/traps.c | 17 +-
arch/arm/kvm/handle_exit.c | 2 +
arch/arm/kvm/init.S | 4 +
arch/arm/mach-exynos/mcpm-exynos.c | 1 -
arch/arm/mach-imx/clk-gate2.c | 6 +-
arch/arm/mach-imx/suspend-imx6.S | 2 +
arch/arm/mach-omap2/omap_hwmod.c | 3 +
arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 22 +-
arch/arm/mm/abort-ev6.S | 6 -
arch/arm/mm/abort-ev7.S | 6 -
arch/arm/mm/alignment.c | 3 +
arch/arm64/include/asm/hw_breakpoint.h | 1 -
arch/arm64/include/asm/ptrace.h | 2 +-
arch/arm64/kernel/irq.c | 12 +-
arch/arm64/kernel/process.c | 18 ++
arch/arm64/kernel/ptrace.c | 3 +-
arch/arm64/kernel/sys_compat.c | 6 +
arch/arm64/kvm/handle_exit.c | 2 +
arch/arm64/kvm/hyp-init.S | 4 +
arch/mips/boot/compressed/decompress.c | 1 +
arch/mips/kernel/mcount.S | 12 +
arch/mips/math-emu/cp1emu.c | 6 +-
arch/parisc/Makefile | 7 +-
arch/parisc/kernel/syscall.S | 233 ++++++++++++++++-
arch/powerpc/include/asm/ptrace.h | 7 +
arch/powerpc/include/asm/spinlock.h | 1 +
arch/powerpc/lib/locks.c | 4 +
arch/powerpc/perf/callchain.c | 2 +-
arch/s390/include/asm/pgtable.h | 6 +-
arch/s390/kvm/kvm-s390.c | 13 -
arch/s390/mm/pgtable.c | 10 +
arch/x86/boot/compressed/aslr.c | 15 ++
arch/x86/include/asm/fixmap.h | 6 +-
arch/x86/include/asm/pgtable_64.h | 1 +
arch/x86/kernel/smpboot.c | 3 +
arch/x86/xen/mmu.c | 27 +-
arch/xtensa/include/asm/pgtable.h | 7 +-
arch/xtensa/include/asm/uaccess.h | 5 +
arch/xtensa/include/uapi/asm/ioctls.h | 19 +-
arch/xtensa/kernel/entry.S | 26 +-
arch/xtensa/kernel/pci-dma.c | 12 +-
block/blk-mq.c | 4 +-
block/cfq-iosched.c | 11 +-
block/genhd.c | 26 +-
block/partition-generic.c | 2 +-
block/partitions/aix.c | 2 +-
drivers/acpi/acpi_cmos_rtc.c | 2 +-
drivers/acpi/acpi_lpss.c | 11 +-
drivers/acpi/acpica/aclocal.h | 1 +
drivers/acpi/acpica/acobject.h | 1 +
drivers/acpi/acpica/dsfield.c | 2 +
drivers/acpi/acpica/evregion.c | 47 ++--
drivers/acpi/acpica/exfield.c | 67 +++++
drivers/acpi/acpica/exprep.c | 2 +
drivers/acpi/battery.c | 14 -
drivers/acpi/container.c | 8 +
drivers/acpi/scan.c | 5 +-
drivers/acpi/video.c | 8 +
drivers/ata/ahci.c | 10 +
drivers/ata/ahci_xgene.c | 4 +-
drivers/ata/ata_piix.c | 8 +
drivers/ata/libata-core.c | 2 +-
drivers/ata/pata_scc.c | 15 +-
drivers/base/regmap/internal.h | 3 +
drivers/base/regmap/regcache-rbtree.c | 9 +-
drivers/base/regmap/regcache.c | 2 +-
drivers/base/regmap/regmap-debugfs.c | 3 +
drivers/base/regmap/regmap.c | 2 +-
drivers/char/hw_random/core.c | 6 -
drivers/char/hw_random/virtio-rng.c | 34 ++-
drivers/clk/clk.c | 7 +-
drivers/clk/qcom/common.c | 39 ++-
drivers/clk/qcom/common.h | 6 +
drivers/clk/qcom/mmcc-msm8960.c | 84 +++---
drivers/clk/qcom/mmcc-msm8974.c | 10 +-
drivers/clk/ti/clk-dra7-atl.c | 6 +-
drivers/clk/ti/divider.c | 7 +-
drivers/cpufreq/cpufreq.c | 9 +-
drivers/cpufreq/cpufreq_opp.c | 2 +-
drivers/crypto/ccp/ccp-crypto-main.c | 4 +
drivers/crypto/ccp/ccp-dev.c | 14 +
drivers/dma/TODO | 1 -
drivers/dma/dw/core.c | 38 ++-
drivers/gpio/gpiolib-acpi.c | 5 +-
drivers/gpio/gpiolib.c | 2 +-
drivers/gpu/drm/ast/ast_main.c | 3 +-
drivers/gpu/drm/i915/i915_cmd_parser.c | 12 +-
drivers/gpu/drm/i915/i915_gem.c | 11 +-
drivers/gpu/drm/i915/intel_bios.c | 4 +-
drivers/gpu/drm/i915/intel_crt.c | 9 +-
drivers/gpu/drm/i915/intel_display.c | 62 +++--
drivers/gpu/drm/i915/intel_dp.c | 3 +
drivers/gpu/drm/i915/intel_drv.h | 3 +-
drivers/gpu/drm/i915/intel_hdmi.c | 2 +-
drivers/gpu/drm/i915/intel_lvds.c | 2 +-
drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +
drivers/gpu/drm/i915/intel_tv.c | 21 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 1 +
drivers/gpu/drm/nouveau/nouveau_ttm.c | 3 +
drivers/gpu/drm/nouveau/nouveau_vga.c | 9 +
drivers/gpu/drm/radeon/ci_dpm.c | 16 +-
drivers/gpu/drm/radeon/cik.c | 18 +-
drivers/gpu/drm/radeon/cik_sdma.c | 7 -
drivers/gpu/drm/radeon/kv_dpm.c | 34 ++-
drivers/gpu/drm/radeon/ni_dma.c | 6 -
drivers/gpu/drm/radeon/r600.c | 26 +-
drivers/gpu/drm/radeon/r600_dma.c | 9 -
drivers/gpu/drm/radeon/radeon.h | 3 +
drivers/gpu/drm/radeon/radeon_atombios.c | 72 +++++-
drivers/gpu/drm/radeon/radeon_cs.c | 3 +-
drivers/gpu/drm/radeon/radeon_device.c | 29 ++-
drivers/gpu/drm/radeon/radeon_drv.c | 1 +
drivers/gpu/drm/radeon/radeon_kms.c | 9 +-
drivers/gpu/drm/radeon/radeon_pm.c | 24 +-
drivers/gpu/drm/radeon/radeon_semaphore.c | 2 +-
drivers/gpu/drm/radeon/rv770.c | 23 +-
drivers/gpu/drm/radeon/si.c | 11 +-
drivers/gpu/drm/tegra/dc.c | 1 +
drivers/gpu/drm/tegra/dpaux.c | 1 +
drivers/gpu/drm/tegra/dsi.c | 1 +
drivers/gpu/drm/tegra/gr2d.c | 1 +
drivers/gpu/drm/tegra/gr3d.c | 1 +
drivers/gpu/drm/tegra/hdmi.c | 1 +
drivers/gpu/drm/tegra/sor.c | 1 +
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 7 +-
drivers/gpu/drm/tilcdc/tilcdc_panel.c | 5 +-
drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 +
drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 +
drivers/gpu/drm/ttm/ttm_bo.c | 6 +-
drivers/gpu/drm/ttm/ttm_bo_manager.c | 3 +-
drivers/gpu/drm/ttm/ttm_page_alloc.c | 29 ++-
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 34 +--
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 +-
drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 1 +
drivers/gpu/vga/vga_switcheroo.c | 6 +
drivers/hid/hid-logitech-dj.c | 43 ++--
drivers/hid/hid-logitech-dj.h | 1 +
drivers/hid/hid-magicmouse.c | 10 +
drivers/hid/hid-picolcd_core.c | 6 +
drivers/hwmon/ds1621.c | 1 +
drivers/i2c/busses/i2c-at91.c | 32 ++-
drivers/i2c/busses/i2c-ismt.c | 4 +-
drivers/i2c/busses/i2c-mv64xxx.c | 3 +-
drivers/i2c/busses/i2c-rcar.c | 41 ++-
drivers/i2c/busses/i2c-rk3x.c | 15 +-
drivers/iio/accel/bma180.c | 2 +-
drivers/iio/adc/ad_sigma_delta.c | 2 +-
drivers/iio/adc/at91_adc.c | 12 +-
drivers/iio/adc/xilinx-xadc-core.c | 2 +-
.../iio/common/hid-sensors/hid-sensor-trigger.c | 3 +-
drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +-
drivers/iio/gyro/itg3200_buffer.c | 2 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +-
drivers/iio/inkern.c | 2 +-
drivers/iio/magnetometer/st_magn_core.c | 52 ++--
drivers/infiniband/core/uverbs_marshall.c | 4 +
drivers/infiniband/hw/mlx4/main.c | 53 ++--
drivers/infiniband/hw/qib/qib_debugfs.c | 3 +-
drivers/infiniband/hw/qib/qib_qp.c | 8 -
drivers/infiniband/ulp/isert/ib_isert.c | 7 +-
drivers/input/keyboard/atkbd.c | 8 -
drivers/input/mouse/elantech.c | 7 +
drivers/input/mouse/synaptics.c | 68 +++--
drivers/input/mouse/synaptics.h | 11 +
drivers/input/serio/i8042-x86ia64io.h | 15 ++
drivers/input/serio/serport.c | 45 +++-
drivers/iommu/arm-smmu.c | 7 +-
drivers/iommu/dmar.c | 3 +-
drivers/iommu/fsl_pamu_domain.c | 10 +-
drivers/md/dm-cache-target.c | 4 +-
drivers/md/dm-crypt.c | 20 +-
drivers/md/raid1.c | 40 +--
drivers/media/dvb-core/dvb-usb-ids.h | 2 +
drivers/media/dvb-frontends/af9033.c | 13 +
drivers/media/dvb-frontends/af9033_priv.h | 20 +-
drivers/media/i2c/adv7604.c | 2 +-
drivers/media/pci/cx18/cx18-driver.c | 1 +
drivers/media/tuners/tuner_it913x.c | 6 +
drivers/media/usb/dvb-usb-v2/af9035.c | 4 +
drivers/media/usb/em28xx/em28xx-video.c | 2 +-
drivers/media/v4l2-core/videobuf2-core.c | 19 +-
drivers/media/v4l2-core/videobuf2-dma-sg.c | 2 +-
drivers/mmc/host/mmci.c | 12 +-
drivers/net/ethernet/ibm/ibmveth.c | 18 +-
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +-
drivers/net/wireless/ath/carl9170/carl9170.h | 1 +
drivers/net/wireless/ath/carl9170/usb.c | 31 ++-
drivers/net/wireless/brcm80211/brcmfmac/fweh.c | 12 +-
drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 2 +
drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 +
drivers/net/wireless/iwlwifi/iwl-config.h | 2 +
drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 4 +-
drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 +-
drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 10 +-
drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +-
drivers/net/wireless/iwlwifi/mvm/tx.c | 8 +-
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
drivers/nfc/microread/microread.c | 16 +-
drivers/of/fdt.c | 2 +-
drivers/of/irq.c | 17 +-
drivers/pci/hotplug/acpiphp_glue.c | 16 +-
drivers/pci/hotplug/pciehp_hpc.c | 12 +
drivers/pci/probe.c | 20 +-
drivers/phy/phy-twl4030-usb.c | 121 +++++----
drivers/pwm/core.c | 8 +-
drivers/scsi/libiscsi.c | 10 +
drivers/spi/spi-dw-pci.c | 2 +
drivers/spi/spi-dw.c | 14 +-
drivers/spi/spi-fsl-espi.c | 15 +-
drivers/spi/spi-fsl-spi.c | 10 +-
drivers/spi/spi-omap2-mcspi.c | 3 +-
drivers/spi/spi-sirf.c | 3 +-
drivers/staging/iio/meter/ade7758_trigger.c | 2 +-
drivers/staging/imx-drm/imx-ldb.c | 3 +
drivers/staging/imx-drm/ipuv3-plane.c | 3 +-
drivers/staging/lustre/lustre/Kconfig | 1 +
drivers/target/iscsi/iscsi_target.c | 4 +-
drivers/target/iscsi/iscsi_target_parameters.c | 2 +-
drivers/target/target_core_configfs.c | 2 +-
drivers/tty/serial/atmel_serial.c | 43 +++-
drivers/usb/chipidea/ci_hdrc_msm.c | 7 +-
drivers/usb/core/hub.c | 4 +-
drivers/usb/dwc2/gadget.c | 52 ++--
drivers/usb/dwc3/core.c | 13 +-
drivers/usb/dwc3/dwc3-omap.c | 2 +-
drivers/usb/dwc3/gadget.c | 8 +-
drivers/usb/gadget/f_rndis.c | 4 +
drivers/usb/host/ehci-hcd.c | 2 -
drivers/usb/host/xhci-hub.c | 8 +-
drivers/usb/host/xhci-mem.c | 3 +-
drivers/usb/host/xhci.c | 12 +-
drivers/usb/misc/sisusbvga/sisusb.c | 1 +
drivers/usb/phy/phy-tegra-usb.c | 4 +-
drivers/usb/serial/ftdi_sio.c | 3 +
drivers/usb/serial/ftdi_sio_ids.h | 12 +
drivers/usb/serial/option.c | 31 ++-
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/sierra.c | 9 +-
drivers/usb/serial/usb-serial.c | 37 ++-
drivers/usb/serial/zte_ev.c | 24 +-
drivers/usb/storage/unusual_devs.h | 38 +++
drivers/uwb/lc-dev.c | 13 +-
drivers/xen/manage.c | 7 -
fs/aio.c | 91 ++++++-
fs/buffer.c | 6 +-
fs/cachefiles/bind.c | 8 +-
fs/cachefiles/daemon.c | 30 +--
fs/cachefiles/internal.h | 2 +-
fs/cachefiles/main.c | 2 +-
fs/cachefiles/namei.c | 14 +-
fs/cachefiles/xattr.c | 10 +-
fs/cifs/link.c | 8 +-
fs/eventpoll.c | 3 +-
fs/ext4/ext4.h | 2 +-
fs/ext4/namei.c | 37 ++-
fs/ext4/resize.c | 2 +
fs/gfs2/inode.c | 5 +-
fs/lockd/svc.c | 4 +-
fs/locks.c | 2 +-
fs/namei.c | 33 +--
fs/nfs/blocklayout/blocklayout.c | 99 ++++---
fs/nfs/direct.c | 8 +-
fs/nfs/filelayout/filelayout.c | 175 ++++++-------
fs/nfs/internal.h | 10 +-
fs/nfs/nfs3proc.c | 21 +-
fs/nfs/nfs4_fs.h | 6 +-
fs/nfs/nfs4client.c | 38 +--
fs/nfs/nfs4proc.c | 135 +++++-----
fs/nfs/nfs4trace.h | 28 +-
fs/nfs/objlayout/objio_osd.c | 24 +-
fs/nfs/objlayout/objlayout.c | 81 +++---
fs/nfs/objlayout/objlayout.h | 8 +-
fs/nfs/pagelist.c | 284 ++++++++++-----------
fs/nfs/pnfs.c | 119 ++++-----
fs/nfs/pnfs.h | 17 +-
fs/nfs/proc.c | 27 +-
fs/nfs/read.c | 48 ++--
fs/nfs/write.c | 99 +++----
fs/nfsd/nfs4xdr.c | 17 +-
fs/nilfs2/inode.c | 7 +-
fs/notify/fdinfo.c | 4 +-
fs/ocfs2/dlm/dlmmaster.c | 18 +-
fs/ufs/inode.c | 7 +-
fs/ufs/namei.c | 14 +-
include/acpi/acpi_bus.h | 1 +
include/drm/ttm/ttm_bo_driver.h | 2 +
include/linux/ccp.h | 12 +
include/linux/ftrace.h | 13 +-
include/linux/iio/trigger.h | 4 +-
include/linux/nfs_page.h | 16 +-
include/linux/nfs_xdr.h | 32 +--
include/linux/pci.h | 6 +
include/linux/seqlock.h | 2 -
include/linux/vga_switcheroo.h | 2 +
include/linux/workqueue.h | 2 +-
include/net/regulatory.h | 2 +-
include/uapi/drm/radeon_drm.h | 1 +
include/uapi/linux/xattr.h | 2 +-
kernel/cgroup.c | 35 ++-
kernel/events/core.c | 10 +
kernel/futex.c | 1 +
kernel/kcmp.c | 7 +-
kernel/module.c | 5 +
kernel/printk/printk.c | 6 +-
kernel/time/alarmtimer.c | 34 ++-
kernel/trace/ftrace.c | 190 +++++++++-----
kernel/trace/ring_buffer.c | 16 +-
mm/dmapool.c | 2 +-
mm/memblock.c | 3 +-
mm/memory.c | 2 +-
mm/percpu-vm.c | 22 +-
mm/percpu.c | 2 +
mm/shmem.c | 4 +-
mm/slab.c | 11 +-
net/mac80211/mlme.c | 3 +-
net/netfilter/ipvs/ip_vs_core.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_tables_api.c | 3 +
net/netfilter/xt_cgroup.c | 2 +-
net/netfilter/xt_hashlimit.c | 31 +--
net/wireless/nl80211.c | 6 +
sound/core/info.c | 4 +-
sound/core/pcm_lib.c | 8 +-
sound/firewire/amdtp.c | 11 +-
sound/firewire/amdtp.h | 1 +
sound/firewire/dice.c | 29 ++-
sound/pci/hda/patch_conexant.c | 10 +-
sound/pci/hda/patch_realtek.c | 2 +
sound/pci/hda/patch_sigmatel.c | 17 +-
sound/soc/davinci/davinci-mcasp.c | 11 +-
349 files changed, 3486 insertions(+), 1896 deletions(-)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shawn Guo <shaw...@freescale.com>

commit 9e1ac462b982f496ed3b491f02c417dcc8e40347 upstream.

Commit 63288b721a80 ("ARM: imx: fix shared gate clock") attempted to fix
an issue with particular enable/disable sequence from two shared gate
clocks. But unfortunately, while it partially fixed the issue, it also
did something wrong in .is_enabled() function hook. In case of shared
gate, the function shouldn't really query the hardware state via
share_count, because the function is trying to query the enabling state
of the clock in question, not the hardware state which is shared by
multiple clocks.

Fix the issue by returning the enable_count of the clock itself which is
maintained by clock core, in case it's a clock sharing hardware gate
with others. As the result, the initialization of share_count per
hardware state is not needed now. So remove it.

Reported-by: Fabio Estevam <fabio....@freescale.com>
Fixes: 63288b721a80 ("ARM: imx: fix shared gate clock")
Signed-off-by: Shawn Guo <shaw...@freescale.com>
Tested-by: Fabio Estevam <fabio....@freescale.com>
Signed-off-by: Olof Johansson <ol...@lixom.net>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/mach-imx/clk-gate2.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

--- a/arch/arm/mach-imx/clk-gate2.c
+++ b/arch/arm/mach-imx/clk-gate2.c
@@ -97,7 +97,7 @@ static int clk_gate2_is_enabled(struct c
struct clk_gate2 *gate = to_clk_gate2(hw);

if (gate->share_count)
- return !!(*gate->share_count);
+ return !!__clk_get_enable_count(hw->clk);
else
return clk_gate2_reg_is_enabled(gate->reg, gate->bit_idx);
}
@@ -127,10 +127,6 @@ struct clk *clk_register_gate2(struct de
gate->bit_idx = bit_idx;
gate->flags = clk_gate2_flags;
gate->lock = lock;
-
- /* Initialize share_count per hardware state */
- if (share_count)
- *share_count = clk_gate2_reg_is_enabled(reg, bit_idx) ? 1 : 0;
gate->share_count = share_count;

init.name = name;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+k...@arm.linux.org.uk>

commit d9fdb9fba7ec08769594abede8f78523ed3f025a upstream.

When trying to unbind imx-drm, the following oops was observed from
the imx-ldb driver:

Unable to handle kernel NULL pointer dereference at virtual address 0000001c
pgd = de954000
[0000001c] *pgd=2e92c831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
Modules linked in: bnep rfcomm bluetooth nfsd exportfs hid_cypress brcmfmac brcmutil snd_soc_fsl_ssi snd_soc_fsl_spdif imx_pcm_fiq imx_pcm_dma imx_ldb(C) imx_thermal imx_sdma imx2_wdt snd_soc_sgtl5000 snd_soc_imx_sgtl5000 snd_soc_imx_spdif snd_soc_imx_audmux
CPU: 1 PID: 1228 Comm: bash Tainted: G C 3.16.0-rc2+ #1229
task: ea378d80 ti: de948000 task.ti: de948000
PC is at imx_ldb_unbind+0x1c/0x58 [imx_ldb]
LR is at component_unbind+0x38/0x70
pc : [<bf025068>] lr : [<c0353108>] psr: 200f0013
sp : de949da8 ip : de949dc0 fp : de949dbc
r10: e9a44b0c r9 : 00000000 r8 : de949f78
r7 : 00000012 r6 : e9b3f400 r5 : e9b133b8 r4 : e9b13010
r3 : 00000000 r2 : e9b3f400 r1 : ea9a0210 r0 : e9b13020

Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user

Control: 10c53c7d Table: 2e95404a DAC: 00000015
Process bash (pid: 1228, stack limit = 0xde948240)
Stack: (0xde949da8 to 0xde94a000)
...
Backtrace:
[<bf02504c>] (imx_ldb_unbind [imx_ldb]) from [<c0353108>] (component_unbind+0x38/0x70)
[<c03530d0>] (component_unbind) from [<c03531d4>] (component_unbind_all+0x94/0xc8)
[<c0353140>] (component_unbind_all) from [<c04bc224>] (imx_drm_driver_unload+0x34/0x4c)

[<c04bc1f0>] (imx_drm_driver_unload) from [<c03394a4>] (drm_dev_unregister+0x2c/0xa0)
[<c0339478>] (drm_dev_unregister) from [<c0339f8c>] (drm_put_dev+0x30/0x6c)
[<c0339f5c>] (drm_put_dev) from [<c04bc1cc>] (imx_drm_unbind+0x14/0x18)
[<c04bc1b8>] (imx_drm_unbind) from [<c03530b4>] (component_master_del+0xbc/0xd8)
...

Code: e5904058 e2840010 e2845fea e59430a0 (e593301c)
---[ end trace 4f211c6dbbcd4963 ]---

This is caused by only having one channel out of the pair configured in
DT; the second channel remains uninitialised, but upon unbind, the
driver attempts to clean up both, thereby dereferencing a NULL pointer.
Avoid this by checking that the second channel is initialised.

Fixes: 1b3f76756633 ("imx-drm: initialise drm components directly")
Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/staging/imx-drm/imx-ldb.c | 3 +++
1 file changed, 3 insertions(+)

--- a/drivers/staging/imx-drm/imx-ldb.c
+++ b/drivers/staging/imx-drm/imx-ldb.c
@@ -574,6 +574,9 @@ static void imx_ldb_unbind(struct device
for (i = 0; i < 2; i++) {
struct imx_ldb_channel *channel = &imx_ldb->channel[i];

+ if (!channel->connector.funcs)
+ continue;
+
channel->connector.funcs->destroy(&channel->connector);
channel->encoder.funcs->destroy(&channel->encoder);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brad Volkin <bradley....@intel.com>

commit 22cb99af39b5d4aae075a5bc9da615ba245227cd upstream.

Ring init and cleanup are not balanced because we re-init the rings on
resume without having cleaned them up on suspend. This leads to the
driver leaking the parser's hash tables with a kmemleak signature such
as this:

unreferenced object 0xffff880405960980 (size 32):
comm "systemd-udevd", pid 516, jiffies 4294896961 (age 10202.044s)
hex dump (first 32 bytes):
d0 85 46 c0 ff ff ff ff 00 00 00 00 00 00 00 00 ..F.............
98 60 28 04 04 88 ff ff 00 00 00 00 00 00 00 00 .`(.............
backtrace:
[<ffffffff81816f9e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff811fa678>] kmem_cache_alloc_trace+0x168/0x2f0
[<ffffffffc03e20a5>] i915_cmd_parser_init_ring+0x2a5/0x3e0 [i915]
[<ffffffffc04088a2>] intel_init_ring_buffer+0x202/0x470 [i915]
[<ffffffffc040c998>] intel_init_vebox_ring_buffer+0x1e8/0x2b0 [i915]
[<ffffffffc03eff59>] i915_gem_init_hw+0x2f9/0x3a0 [i915]
[<ffffffffc03f0057>] i915_gem_init+0x57/0x1d0 [i915]
[<ffffffffc045e26a>] i915_driver_load+0xc0a/0x10e0 [i915]
[<ffffffffc02e0d5d>] drm_dev_register+0xad/0x100 [drm]
[<ffffffffc02e3b9f>] drm_get_pci_dev+0x8f/0x200 [drm]
[<ffffffffc03c934b>] i915_pci_probe+0x3b/0x60 [i915]
[<ffffffff81436725>] local_pci_probe+0x45/0xa0
[<ffffffff81437a69>] pci_device_probe+0xd9/0x130
[<ffffffff81524f4d>] driver_probe_device+0x12d/0x3e0
[<ffffffff815252d3>] __driver_attach+0x93/0xa0
[<ffffffff81522e1b>] bus_for_each_dev+0x6b/0xb0

This patch extends the current convention of checking whether a
resource is already allocated before allocating it during ring init.
Longer term it might make sense to only init the rings once.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83794
Tested-by: Kari Suvanto <kari.tj...@gmail.com>
Signed-off-by: Brad Volkin <bradley....@intel.com>
Reviewed-by: Daniel Vetter <daniel...@ffwll.ch>
Signed-off-by: Jani Nikula <jani....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/i915/i915_cmd_parser.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
@@ -706,11 +706,13 @@ int i915_cmd_parser_init_ring(struct int
BUG_ON(!validate_cmds_sorted(ring, cmd_tables, cmd_table_count));
BUG_ON(!validate_regs_sorted(ring));

- ret = init_hash_table(ring, cmd_tables, cmd_table_count);
- if (ret) {
- DRM_ERROR("CMD: cmd_parser_init failed!\n");
- fini_hash_table(ring);
- return ret;
+ if (hash_empty(ring->cmd_hash)) {
+ ret = init_hash_table(ring, cmd_tables, cmd_table_count);
+ if (ret) {
+ DRM_ERROR("CMD: cmd_parser_init failed!\n");
+ fini_hash_table(ring);
+ return ret;
+ }
}

ring->needs_cmd_parser = true;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Pointner <johannes...@gmail.com>

commit 872687f626e033b4ddfaec1e410057cfc6636d77 upstream.

Fixes: a2c12493ed7e ('iio: of_iio_channel_get_by_name() returns non-null pointers for error legs')

which improperly assumes that of_iio_channel_get_by_name must always
return NULL and thus now hides -EPROBE_DEFER.

Signed-off-by: Johannes Pointner <johannes...@br-automation.com>
Reviewed-by: Guenter Roeck <li...@roeck-us.net>
Signed-off-by: Jonathan Cameron <ji...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/iio/inkern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -178,7 +178,7 @@ static struct iio_channel *of_iio_channe
index = of_property_match_string(np, "io-channel-names",
name);
chan = of_iio_channel_get(np, index);
- if (!IS_ERR(chan))
+ if (!IS_ERR(chan) || PTR_ERR(chan) == -EPROBE_DEFER)
break;
else if (name && index >= 0) {
pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brennan Ashton <bas...@brennanashton.com>

commit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.

This VIA Telecom baseband processor is used is used by by u-blox in both the
FW2770 and FW2760 products and may be used in others as well.

This patch has been tested on both of these modem versions.

Signed-off-by: Brennan Ashton <bas...@brennanashton.com>
Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/option.c | 5 +++++

1 file changed, 5 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -494,6 +494,10 @@ static void option_instat_callback(struc
#define INOVIA_VENDOR_ID 0x20a6
#define INOVIA_SEW858 0x1105

+/* VIA Telecom */
+#define VIATELECOM_VENDOR_ID 0x15eb
+#define VIATELECOM_PRODUCT_CDS7 0x0001
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -1724,6 +1728,7 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathia...@linux.intel.com>

commit c207e7c50f31113c24a9f536fcab1e8a256985d7 upstream.

If xhci initialization fails before the roothub bandwidth
domains (xhci->rh_bw[i]) are allocated it will oops when
trying to access rh_bw members in xhci_mem_cleanup().

Reported-by: Manuel Reimer <manuel...@gmx.de>
Signed-off-by: Mathias Nyman <mathia...@linux.intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/host/xhci-mem.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1819,7 +1819,7 @@ void xhci_mem_cleanup(struct xhci_hcd *x
xhci_cleanup_command_queue(xhci);

num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
- for (i = 0; i < num_ports; i++) {
+ for (i = 0; i < num_ports && xhci->rh_bw; i++) {
struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
struct list_head *ep = &bwt->interval_bw[j].endpoints;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <bornt...@de.ibm.com>

commit 1951497d90d6754201af3e65241a06f9ef6755cd upstream.

commit 0944fe3f4a32 ("s390/mm: implement software referenced bits")
triggered another paging/storage key corruption. There is an
unhandled invalid->valid pte change where we have to set the real
storage key from the pgste.
When doing paging a guest page might be swapcache or swap and when
faulted in it might be read-only and due to a parallel scan old.
An do_wp_page will make it writeable and young. Due to software
reference tracking this page was invalid and now becomes valid.

Signed-off-by: Christian Borntraeger <bornt...@de.ibm.com>
Acked-by: Martin Schwidefsky <schwi...@de.ibm.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/s390/include/asm/pgtable.h | 1 +

1 file changed, 1 insertion(+)

--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1319,6 +1319,7 @@ static inline int ptep_set_access_flags(
ptep_flush_direct(vma->vm_mm, address, ptep);

if (mm_has_pgste(vma->vm_mm)) {
+ pgste_set_key(ptep, pgste, entry, vma->vm_mm);
pgste = pgste_set_pte(ptep, pgste, entry);
pgste_set_unlock(ptep, pgste);
} else

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <rog...@ti.com>

commit 5990047cef0c6a36eefcb166bd32d99a8f95c75b upstream.

The nand timings were scaled down by 2 to account for
the 2x rate returned by clk_get_rate(gpmc_fclk).

As the clock data got fixed by [1], revert back to actual
timings (i.e. scale them up by 2).

Without this NAND doesn't work on dra7-evm.

[1] - commit dd94324b983afe114ba9e7ee3649313b451f63ce
ARM: dts: dra7xx-clocks: Fix the l3 and l4 clock rates

Fixes: ff66a3c86e00 ("ARM: dts: dra7: add support for parallel NAND flash")
Signed-off-by: Roger Quadros <rog...@ti.com>
Signed-off-by: Tony Lindgren <to...@atomide.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/boot/dts/dra7-evm.dts | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)

--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -427,22 +427,19 @@
gpmc,device-width = <2>;
gpmc,sync-clk-ps = <0>;
gpmc,cs-on-ns = <0>;
- gpmc,cs-rd-off-ns = <40>;
- gpmc,cs-wr-off-ns = <40>;
+ gpmc,cs-rd-off-ns = <80>;
+ gpmc,cs-wr-off-ns = <80>;
gpmc,adv-on-ns = <0>;
- gpmc,adv-rd-off-ns = <30>;
- gpmc,adv-wr-off-ns = <30>;
- gpmc,we-on-ns = <5>;
- gpmc,we-off-ns = <25>;
- gpmc,oe-on-ns = <2>;
- gpmc,oe-off-ns = <20>;
- gpmc,access-ns = <20>;
- gpmc,wr-access-ns = <40>;
- gpmc,rd-cycle-ns = <40>;
- gpmc,wr-cycle-ns = <40>;
- gpmc,wait-pin = <0>;
- gpmc,wait-on-read;
- gpmc,wait-on-write;
+ gpmc,adv-rd-off-ns = <60>;
+ gpmc,adv-wr-off-ns = <60>;
+ gpmc,we-on-ns = <10>;
+ gpmc,we-off-ns = <50>;
+ gpmc,oe-on-ns = <4>;
+ gpmc,oe-off-ns = <40>;
+ gpmc,access-ns = <40>;
+ gpmc,wr-access-ns = <80>;
+ gpmc,rd-cycle-ns = <80>;
+ gpmc,wr-cycle-ns = <80>;
gpmc,bus-turnaround-ns = <0>;
gpmc,cycle2cycle-delay-ns = <0>;
gpmc,clk-activation-ns = <0>;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nathan Lynch <nathan...@mentor.com>

commit fbfb872f5f417cea48760c535e0ff027c88b507a upstream.

The TPIDRURO and TPIDRURW registers need to be flushed during exec;
otherwise TLS information is potentially leaked. TPIDRURO in
particular needs careful treatment. Since flush_thread basically
needs the same code used to set the TLS in arm_syscall, pull that into
a common set_tls helper in tls.h and use it in both places.

Similarly, TEEHBR needs to be cleared during exec as well. Clearing
its save slot in thread_info isn't right as there is no guarantee
that a thread switch will occur before the new program runs. Just
setting the register directly is sufficient.

Signed-off-by: Nathan Lynch <nathan...@mentor.com>
Acked-by: Will Deacon <will....@arm.com>
Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/include/asm/tls.h | 62 +++++++++++++++++++++++++++++++++++++++++++++
arch/arm/kernel/process.c | 2 +
arch/arm/kernel/thumbee.c | 2 -
arch/arm/kernel/traps.c | 17 ------------
4 files changed, 66 insertions(+), 17 deletions(-)

--- a/arch/arm/include/asm/tls.h
+++ b/arch/arm/include/asm/tls.h
@@ -1,6 +1,9 @@
#ifndef __ASMARM_TLS_H
#define __ASMARM_TLS_H

+#include <linux/compiler.h>
+#include <asm/thread_info.h>
+
#ifdef __ASSEMBLY__
#include <asm/asm-offsets.h>
.macro switch_tls_none, base, tp, tpuser, tmp1, tmp2
@@ -50,6 +53,47 @@
#endif

#ifndef __ASSEMBLY__
+
+static inline void set_tls(unsigned long val)
+{
+ struct thread_info *thread;
+
+ thread = current_thread_info();
+
+ thread->tp_value[0] = val;
+
+ /*
+ * This code runs with preemption enabled and therefore must
+ * be reentrant with respect to switch_tls.
+ *
+ * We need to ensure ordering between the shadow state and the
+ * hardware state, so that we don't corrupt the hardware state
+ * with a stale shadow state during context switch.
+ *
+ * If we're preempted here, switch_tls will load TPIDRURO from
+ * thread_info upon resuming execution and the following mcr
+ * is merely redundant.
+ */
+ barrier();
+
+ if (!tls_emu) {
+ if (has_tls_reg) {
+ asm("mcr p15, 0, %0, c13, c0, 3"
+ : : "r" (val));
+ } else {
+ /*
+ * User space must never try to access this
+ * directly. Expect your app to break
+ * eventually if you do so. The user helper
+ * at 0xffff0fe0 must be used instead. (see
+ * entry-armv.S for details)
+ */
+ *((unsigned int *)0xffff0ff0) = val;
+ }
+
+ }
+}
+
static inline unsigned long get_tpuser(void)
{
unsigned long reg = 0;
@@ -59,5 +103,23 @@ static inline unsigned long get_tpuser(v

return reg;
}
+
+static inline void set_tpuser(unsigned long val)
+{
+ /* Since TPIDRURW is fully context-switched (unlike TPIDRURO),
+ * we need not update thread_info.
+ */
+ if (has_tls_reg && !tls_emu) {
+ asm("mcr p15, 0, %0, c13, c0, 2"
+ : : "r" (val));
+ }
+}
+
+static inline void flush_tls(void)
+{
+ set_tls(0);
+ set_tpuser(0);
+}
+
#endif
#endif /* __ASMARM_TLS_H */
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -334,6 +334,8 @@ void flush_thread(void)
memset(&tsk->thread.debug, 0, sizeof(struct debug_info));
memset(&thread->fpstate, 0, sizeof(union fp_state));

+ flush_tls();
+
thread_notify(THREAD_NOTIFY_FLUSH, thread);
}

--- a/arch/arm/kernel/thumbee.c
+++ b/arch/arm/kernel/thumbee.c
@@ -45,7 +45,7 @@ static int thumbee_notifier(struct notif

switch (cmd) {
case THREAD_NOTIFY_FLUSH:
- thread->thumbee_state = 0;
+ teehbr_write(0);
break;
case THREAD_NOTIFY_SWITCH:
current_thread_info()->thumbee_state = teehbr_read();
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -579,7 +579,6 @@ do_cache_op(unsigned long start, unsigne
#define NR(x) ((__ARM_NR_##x) - __ARM_NR_BASE)
asmlinkage int arm_syscall(int no, struct pt_regs *regs)
{
- struct thread_info *thread = current_thread_info();
siginfo_t info;

if ((no >> 16) != (__ARM_NR_BASE>> 16))
@@ -630,21 +629,7 @@ asmlinkage int arm_syscall(int no, struc
return regs->ARM_r0;

case NR(set_tls):
- thread->tp_value[0] = regs->ARM_r0;
- if (tls_emu)
- return 0;
- if (has_tls_reg) {
- asm ("mcr p15, 0, %0, c13, c0, 3"
- : : "r" (regs->ARM_r0));
- } else {
- /*
- * User space must never try to access this directly.
- * Expect your app to break eventually if you do so.
- * The user helper at 0xffff0fe0 must be used instead.
- * (see entry-armv.S for details)
- */
- *((unsigned int *)0xffff0ff0) = regs->ARM_r0;
- }
+ set_tls(regs->ARM_r0);
return 0;

#ifdef CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Kosina <jko...@suse.cz>

commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.

Reported-by: Steven Vittitoe <scv...@google.com>
Signed-off-by: Jiri Kosina <jko...@suse.cz>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/hid/hid-picolcd_core.c | 6 ++++++
1 file changed, 6 insertions(+)

--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_
if (!data)
return 1;

+ if (size > 64) {
+ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
+ size);
+ return 0;
+ }
+
if (report->id == REPORT_KEY_STATE) {
if (data->input_keys)
ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Toshiaki Makita <makita....@lab.ntt.co.jp>

commit e15693ef18e13e3e6bffe891fe140f18b8ff6d07 upstream.

cfq_group_service_tree_add() is applying new_weight at the beginning of
the function via cfq_update_group_weight().
This actually allows weight to change between adding it to and subtracting
it from children_weight, and triggers WARN_ON_ONCE() in
cfq_group_service_tree_del(), or even causes oops by divide error during
vfr calculation in cfq_group_service_tree_add().

The detailed scenario is as follows:
1. Create blkio cgroups X and Y as a child of X.
Set X's weight to 500 and perform some I/O to apply new_weight.
This X's I/O completes before starting Y's I/O.
2. Y starts I/O and cfq_group_service_tree_add() is called with Y.
3. cfq_group_service_tree_add() walks up the tree during children_weight
calculation and adds parent X's weight (500) to children_weight of root.
children_weight becomes 500.
4. Set X's weight to 1000.
5. X starts I/O and cfq_group_service_tree_add() is called with X.
6. cfq_group_service_tree_add() applies its new_weight (1000).
7. I/O of Y completes and cfq_group_service_tree_del() is called with Y.
8. I/O of X completes and cfq_group_service_tree_del() is called with X.
9. cfq_group_service_tree_del() subtracts X's weight (1000) from
children_weight of root. children_weight becomes -500.
This triggers WARN_ON_ONCE().
10. Set X's weight to 500.
11. X starts I/O and cfq_group_service_tree_add() is called with X.
12. cfq_group_service_tree_add() applies its new_weight (500) and adds it
to children_weight of root. children_weight becomes 0. Calcularion of
vfr triggers oops by divide error.

weight should be updated right before adding it to children_weight.

Reported-by: Ruki Sekiya <sekiy...@lab.ntt.co.jp>
Signed-off-by: Toshiaki Makita <makita....@lab.ntt.co.jp>
Acked-by: Tejun Heo <t...@kernel.org>
Signed-off-by: Jens Axboe <ax...@fb.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

block/cfq-iosched.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_
static void
cfq_update_group_weight(struct cfq_group *cfqg)
{
- BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
-
if (cfqg->new_weight) {
cfqg->weight = cfqg->new_weight;
cfqg->new_weight = 0;
}
+}
+
+static void
+cfq_update_group_leaf_weight(struct cfq_group *cfqg)
+{
+ BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));

if (cfqg->new_leaf_weight) {
cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb
/* add to the service tree */
BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));

- cfq_update_group_weight(cfqg);
+ cfq_update_group_leaf_weight(cfqg);
__cfq_group_service_tree_add(st, cfqg);

/*
@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb
*/
while ((parent = cfqg_parent(pos))) {
if (propagate) {
+ cfq_update_group_weight(pos);
propagate = !parent->nr_active++;
parent->children_weight += pos->weight;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Brown <bro...@linaro.org>

commit 5844a8b9d98ec11ce1d77610daacf3f0a0e14715 upstream.

A previous over-zealous factorisation of code means that we only treat
registers as volatile if they are readable. For most devices this is fine
since normally most registers can be read and volatility implies
readability but for format_write() devices where there is no readback from
the hardware and we use volatility to mean simply uncacheability this means
that we end up treating all registers as cacheble.

A bigger refactoring of the code to clarify this is in order but as a fix
make a minimal change and only check readability when checking volatility
if there is no format_write() operation defined for the device.

Signed-off-by: Mark Brown <bro...@linaro.org>
Tested-by: Lars-Peter Clausen <la...@metafoo.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/base/regmap/regmap.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -109,7 +109,7 @@ bool regmap_readable(struct regmap *map,

bool regmap_volatile(struct regmap *map, unsigned int reg)
{
- if (!regmap_readable(map, reg))
+ if (!map->format.format_write && !regmap_readable(map, reg))
return false;

if (map->volatile_reg)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Max Filippov <jcmv...@gmail.com>

commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.

Remove restoring a6 on some return paths and instead modify and restore
it in a single place, using symbolic name.
Correctly restore a7 from PT_AREG7 in case of illegal a6 value.

Signed-off-by: Max Filippov <jcmv...@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/xtensa/kernel/entry.S | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)

--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1001,9 +1001,8 @@ ENTRY(fast_syscall_xtensa)
movi a7, 4 # sizeof(unsigned int)
access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp

- addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1
- _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill
- _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp
+ _bgeui a6, SYS_XTENSA_COUNT, .Lill
+ _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp

/* Fall through for ATOMIC_CMP_SWP. */

@@ -1015,27 +1014,26 @@ TRY s32i a5, a3, 0 # different, modify
l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, 1 # and return 1
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe

1: l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, 0 # return 0 (note that we cannot set
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe

.Lnswp: /* Atomic set, add, and exg_add. */

TRY l32i a7, a3, 0 # orig
+ addi a6, a6, -SYS_XTENSA_ATOMIC_SET
add a0, a4, a7 # + arg
moveqz a0, a4, a6 # set
+ addi a6, a6, SYS_XTENSA_ATOMIC_SET
TRY s32i a0, a3, 0 # write new value

mov a0, a2
mov a2, a7
l32i a7, a0, PT_AREG7 # restore a7
l32i a0, a0, PT_AREG0 # restore a0
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe

CATCH
@@ -1044,7 +1042,7 @@ CATCH
movi a2, -EFAULT
rfe

-.Lill: l32i a7, a2, PT_AREG0 # restore a7
+.Lill: l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, -EINVAL
rfe

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Taylor Braun-Jones <taylor.br...@ge.com>

commit 9c491c372d677b6420e0f8c6361fe422791662cc upstream.

Signed-off-by: Taylor Braun-Jones <taylor.br...@ge.com>
Cc: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
2 files changed, 8 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -952,6 +952,8 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
/* Infineon Devices */
{ USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+ /* GE Healthcare devices */
+ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
{ } /* Terminating entry */
};

--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1385,3 +1385,9 @@
* ekey biometric systems GmbH (http://ekey.net/)
*/
#define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
+
+/*
+ * GE Healthcare devices
+ */
+#define GE_HEALTHCARE_VID 0x1901
+#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Bader <stefan...@canonical.com>

commit 0b5a50635fc916cf46e3de0b819a61fc3f17e7ee upstream.

When RANDOMIZE_BASE (KASLR) is enabled; or the sum of all loaded
modules exceeds 512 MiB, then loading modules fails with a warning
(and hence a vmalloc allocation failure) because the PTEs for the
newly-allocated vmalloc address space are not zero.

WARNING: CPU: 0 PID: 494 at linux/mm/vmalloc.c:128
vmap_page_range_noflush+0x2a1/0x360()

This is caused by xen_setup_kernel_pagetables() copying
level2_kernel_pgt into level2_fixmap_pgt, overwriting many non-present
entries.

Without KASLR, the normal kernel image size only covers the first half
of level2_kernel_pgt and module space starts after that.

L4[511]->level3_kernel_pgt[510]->level2_kernel_pgt[ 0..255]->kernel
[256..511]->module
[511]->level2_fixmap_pgt[ 0..505]->module

This allows 512 MiB of of module vmalloc space to be used before
having to use the corrupted level2_fixmap_pgt entries.

With KASLR enabled, the kernel image uses the full PUD range of 1G and
module space starts in the level2_fixmap_pgt. So basically:

L4[511]->level3_kernel_pgt[510]->level2_kernel_pgt[0..511]->kernel
[511]->level2_fixmap_pgt[0..505]->module

And now no module vmalloc space can be used without using the corrupt
level2_fixmap_pgt entries.

Fix this by properly converting the level2_fixmap_pgt entries to MFNs,
and setting level1_fixmap_pgt as read-only.

A number of comments were also using the the wrong L3 offset for
level2_kernel_pgt. These have been corrected.

Signed-off-by: Stefan Bader <stefan...@canonical.com>
Signed-off-by: David Vrabel <david....@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.o...@oracle.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/x86/include/asm/pgtable_64.h | 1 +
arch/x86/xen/mmu.c | 27 ++++++++++++---------------
2 files changed, 13 insertions(+), 15 deletions(-)

--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -19,6 +19,7 @@ extern pud_t level3_ident_pgt[512];
extern pmd_t level2_kernel_pgt[512];
extern pmd_t level2_fixmap_pgt[512];
extern pmd_t level2_ident_pgt[512];
+extern pte_t level1_fixmap_pgt[512];
extern pgd_t init_level4_pgt[];

#define swapper_pg_dir init_level4_pgt
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1866,12 +1866,11 @@ static void __init check_pt_base(unsigne
*
* We can construct this by grafting the Xen provided pagetable into
* head_64.S's preconstructed pagetables. We copy the Xen L2's into
- * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt. This
- * means that only the kernel has a physical mapping to start with -
- * but that's enough to get __va working. We need to fill in the rest
- * of the physical mapping once some sort of allocator has been set
- * up.
- * NOTE: for PVH, the page tables are native.
+ * level2_ident_pgt, and level2_kernel_pgt. This means that only the
+ * kernel has a physical mapping to start with - but that's enough to
+ * get __va working. We need to fill in the rest of the physical
+ * mapping once some sort of allocator has been set up. NOTE: for
+ * PVH, the page tables are native.
*/
void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
{
@@ -1902,8 +1901,11 @@ void __init xen_setup_kernel_pagetable(p
/* L3_i[0] -> level2_ident_pgt */
convert_pfn_mfn(level3_ident_pgt);
/* L3_k[510] -> level2_kernel_pgt
- * L3_i[511] -> level2_fixmap_pgt */
+ * L3_k[511] -> level2_fixmap_pgt */
convert_pfn_mfn(level3_kernel_pgt);
+
+ /* L3_k[511][506] -> level1_fixmap_pgt */
+ convert_pfn_mfn(level2_fixmap_pgt);
}
/* We get [511][511] and have Xen's version of level2_kernel_pgt */
l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
@@ -1913,21 +1915,15 @@ void __init xen_setup_kernel_pagetable(p
addr[1] = (unsigned long)l3;
addr[2] = (unsigned long)l2;
/* Graft it onto L4[272][0]. Note that we creating an aliasing problem:
- * Both L4[272][0] and L4[511][511] have entries that point to the same
+ * Both L4[272][0] and L4[511][510] have entries that point to the same
* L2 (PMD) tables. Meaning that if you modify it in __va space
* it will be also modified in the __ka space! (But if you just
* modify the PMD table to point to other PTE's or none, then you
* are OK - which is what cleanup_highmap does) */
copy_page(level2_ident_pgt, l2);
- /* Graft it onto L4[511][511] */
+ /* Graft it onto L4[511][510] */
copy_page(level2_kernel_pgt, l2);

- /* Get [511][510] and graft that in level2_fixmap_pgt */
- l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd);
- l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud);
- copy_page(level2_fixmap_pgt, l2);
- /* Note that we don't do anything with level1_fixmap_pgt which
- * we don't need. */
if (!xen_feature(XENFEAT_auto_translated_physmap)) {
/* Make pagetable pieces RO */
set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
@@ -1937,6 +1933,7 @@ void __init xen_setup_kernel_pagetable(p
set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+ set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);

/* Pin down new L4 */
pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sudeep Holla <sudeep...@arm.com>

commit a040803a9d6b8c1876d3487a5cb69602ebcbb82c upstream.

Since commit 1dbfa187dad ("ARM: irq migration: force migration off CPU
going down") the ARM interrupt migration code on cpu offline calls
irqchip.irq_set_affinity() with the argument force=true. At the point
of this change the argument had no effect because it was not used by
any interrupt chip driver and there was no semantics defined.

This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu
affinity of interrupts") which made the force argument useful to route
interrupts to not yet online cpus without checking the target cpu
against the cpu online mask. The following commit ffde1de64012
("irqchip: gic: Support forced affinity setting") implemented this for
the GIC interrupt controller.

As a consequence the ARM cpu offline irq migration fails if CPU0 is
offlined, because CPU0 is still set in the affinity mask and the
validataion against cpu online mask is skipped to the force argument
being true. The following first_cpu(mask) selection always selects
CPU0 as the target.

Solve the issue by calling irq_set_affinity() with force=false from
the CPU offline irq migration code so the GIC driver validates the
affinity mask against CPU online mask and therefore removes CPU0 from
the possible target candidates.

Tested on TC2 hotpluging CPU0 in and out. Without this patch the system
locks up as the IRQs are not migrated away from CPU0.

Signed-off-by: Sudeep Holla <sudeep...@arm.com>
Acked-by: Thomas Gleixner <tg...@linutronix.de>
Acked-by: Mark Rutland <mark.r...@arm.com>
Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/kernel/irq.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -175,7 +175,7 @@ static bool migrate_one_irq(struct irq_d
c = irq_data_get_irq_chip(d);
if (!c->irq_set_affinity)
pr_debug("IRQ%u: unable to set affinity\n", d->irq);
- else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
+ else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
cpumask_copy(d->affinity, affinity);

return ret;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Greg KH <gre...@linuxfoundation.org>

commit 91fcb1ce420e0a5f8d92d556d7008a78bc6ce1eb upstream.

This adds a new device id to the pl2303 driver for the ZTEK device.

Reported-by: Mike Chu <Mike...@prolific.com.tw>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Johan Hovold <jo...@kernel.org>

---

drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +

2 files changed, 2 insertions(+)

--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -22,6 +22,7 @@
#define PL2303_PRODUCT_ID_GPRS 0x0609
#define PL2303_PRODUCT_ID_HCR331 0x331a
#define PL2303_PRODUCT_ID_MOTOROLA 0x0307
+#define PL2303_PRODUCT_ID_ZTEK 0xe1f1

#define ATEN_VENDOR_ID 0x0557
#define ATEN_VENDOR_ID2 0x0547

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Max Filippov <jcmv...@gmail.com>

commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.

With SMP and a lot of debug options enabled task_struct::thread gets out
of reach of s32i/l32i instructions with base pointing at task_struct,
breaking build with the following messages:

arch/xtensa/kernel/entry.S: Assembler messages:
arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048'
arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040'
arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'

Change base to point to task_struct::thread in such cases.
Don't use a10 in _switch_to to save/restore prev pointer as a2 is not
clobbered.

Signed-off-by: Max Filippov <jcmv...@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/xtensa/include/asm/uaccess.h | 5 +++++
arch/xtensa/kernel/entry.S | 12 ++++++++----
2 files changed, 13 insertions(+), 4 deletions(-)

--- a/arch/xtensa/include/asm/uaccess.h
+++ b/arch/xtensa/include/asm/uaccess.h
@@ -52,7 +52,12 @@
*/
.macro get_fs ad, sp
GET_CURRENT(\ad,\sp)
+#if THREAD_CURRENT_DS > 1020
+ addi \ad, \ad, TASK_THREAD
+ l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD
+#else
l32i \ad, \ad, THREAD_CURRENT_DS
+#endif
.endm

/*
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1820,7 +1820,6 @@ ENTRY(_switch_to)

entry a1, 16

- mov a10, a2 # preserve 'prev' (a2)
mov a11, a3 # and 'next' (a3)

l32i a4, a2, TASK_THREAD_INFO
@@ -1828,8 +1827,14 @@ ENTRY(_switch_to)

save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER

- s32i a0, a10, THREAD_RA # save return address
- s32i a1, a10, THREAD_SP # save stack pointer
+#if THREAD_RA > 1020 || THREAD_SP > 1020
+ addi a10, a2, TASK_THREAD
+ s32i a0, a10, THREAD_RA - TASK_THREAD # save return address
+ s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer
+#else
+ s32i a0, a2, THREAD_RA # save return address
+ s32i a1, a2, THREAD_SP # save stack pointer
+#endif

/* Disable ints while we manipulate the stack pointer. */

@@ -1870,7 +1875,6 @@ ENTRY(_switch_to)
load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER

wsr a14, ps
- mov a2, a10 # return 'prev'
rsync

retw

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Denis CIOCCA <denis....@st.com>

commit a31d0928999fbf33b3a6042e8bcb7b7f7e07d094 upstream.

This patch fix gains values. The first driver was designed using
engineering samples, in mass production the values are changed.

Signed-off-by: Denis Ciocca <denis....@st.com>
Signed-off-by: Jonathan Cameron <ji...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/iio/magnetometer/st_magn_core.c | 52 ++++++++++++++++++--------------
1 file changed, 30 insertions(+), 22 deletions(-)

--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -42,7 +42,8 @@
#define ST_MAGN_FS_AVL_5600MG 5600
#define ST_MAGN_FS_AVL_8000MG 8000
#define ST_MAGN_FS_AVL_8100MG 8100
-#define ST_MAGN_FS_AVL_10000MG 10000
+#define ST_MAGN_FS_AVL_12000MG 12000
+#define ST_MAGN_FS_AVL_16000MG 16000

/* CUSTOM VALUES FOR SENSOR 1 */
#define ST_MAGN_1_WAI_EXP 0x3c
@@ -69,20 +70,20 @@
#define ST_MAGN_1_FS_AVL_4700_VAL 0x05
#define ST_MAGN_1_FS_AVL_5600_VAL 0x06
#define ST_MAGN_1_FS_AVL_8100_VAL 0x07
-#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 1100
-#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 855
-#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 670
-#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 450
-#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 400
-#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 330
-#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 230
-#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 980
-#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 760
-#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 600
-#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 400
-#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 355
-#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 295
-#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 205
+#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 909
+#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 1169
+#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 1492
+#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 2222
+#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 2500
+#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 3030
+#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 4347
+#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 1020
+#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 1315
+#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 1666
+#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 2500
+#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 2816
+#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 3389
+#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 4878
#define ST_MAGN_1_MULTIREAD_BIT false

/* CUSTOM VALUES FOR SENSOR 2 */
@@ -105,10 +106,12 @@
#define ST_MAGN_2_FS_MASK 0x60
#define ST_MAGN_2_FS_AVL_4000_VAL 0x00
#define ST_MAGN_2_FS_AVL_8000_VAL 0x01
-#define ST_MAGN_2_FS_AVL_10000_VAL 0x02
-#define ST_MAGN_2_FS_AVL_4000_GAIN 430
-#define ST_MAGN_2_FS_AVL_8000_GAIN 230
-#define ST_MAGN_2_FS_AVL_10000_GAIN 230
+#define ST_MAGN_2_FS_AVL_12000_VAL 0x02
+#define ST_MAGN_2_FS_AVL_16000_VAL 0x03
+#define ST_MAGN_2_FS_AVL_4000_GAIN 146
+#define ST_MAGN_2_FS_AVL_8000_GAIN 292
+#define ST_MAGN_2_FS_AVL_12000_GAIN 438
+#define ST_MAGN_2_FS_AVL_16000_GAIN 584
#define ST_MAGN_2_MULTIREAD_BIT false
#define ST_MAGN_2_OUT_X_L_ADDR 0x28
#define ST_MAGN_2_OUT_Y_L_ADDR 0x2a
@@ -266,9 +269,14 @@ static const struct st_sensors st_magn_s
.gain = ST_MAGN_2_FS_AVL_8000_GAIN,
},
[2] = {
- .num = ST_MAGN_FS_AVL_10000MG,
- .value = ST_MAGN_2_FS_AVL_10000_VAL,
- .gain = ST_MAGN_2_FS_AVL_10000_GAIN,
+ .num = ST_MAGN_FS_AVL_12000MG,
+ .value = ST_MAGN_2_FS_AVL_12000_VAL,
+ .gain = ST_MAGN_2_FS_AVL_12000_GAIN,
+ },
+ [3] = {
+ .num = ST_MAGN_FS_AVL_16000MG,
+ .value = ST_MAGN_2_FS_AVL_16000_VAL,
+ .gain = ST_MAGN_2_FS_AVL_16000_GAIN,
},
},
},

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <jo...@kernel.org>

commit 95be5739588c56a9327e477aa0ba3c81c5cf8631 upstream.

Remove dublicate Gobi PID 0x9008 which is already handled by the
qcserial driver since commit f05932c0caf4 ("USB: qcserial: Add extra
device IDs").

Fixes: 799ee9243d89 ("USB: serial: add zte_ev.c driver")
Signed-off-by: Johan Hovold <jo...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/serial/zte_ev.c | 1 -
1 file changed, 1 deletion(-)

--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -275,7 +275,6 @@ static const struct usb_device_id id_tab
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
{ USB_DEVICE(0x05C6, 0x3197) },
- { USB_DEVICE(0x05C6, 0x9008) },
{ },
};
MODULE_DEVICE_TABLE(usb, id_table);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Krause <min...@googlemail.com>

commit bbe1c2740d3a25aa1dbe5d842d2ff09cddcdde0a upstream.

The __init annotations for the DMI callback functions are wrong as this
code can be called even after the module has been initialized, e.g. like
this:

# echo 1 > /sys/bus/pci/devices/0000:00:02.0/remove
# modprobe i915
# echo 1 > /sys/bus/pci/rescan

The first command will remove the PCI device from the kernel's device
list so the second command won't see it right away. But as it registers
a PCI driver it'll see it on the third command. If the system happens to
match one of the DMI table entries we'll try to call a function in long
released memory and generate an Oops, at best.

Fix this by removing the bogus annotation.

Modpost should have caught that one but it ignores section reference
mismatches from the .rodata section. :/

Fixes: 25e341cfc33d ("drm/i915: quirk away broken OpRegion VBT")
Fixes: 8ca4013d702d ("CHROMIUM: i915: Add DMI override to skip CRT...")
Fixes: 425d244c8670 ("drm/i915: ignore LVDS on intel graphics systems...")
Signed-off-by: Mathias Krause <min...@googlemail.com>
Cc: Daniel Vetter <daniel...@ffwll.ch>
Cc: Duncan Laurie <dla...@chromium.org>
Cc: Jarod Wilson <ja...@redhat.com>
Cc: Rusty Russell <ru...@rustcorp.com.au> # Can modpost be fixed?
Signed-off-by: Jani Nikula <jani....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/i915/intel_bios.c | 2 +-
drivers/gpu/drm/i915/intel_crt.c | 2 +-
drivers/gpu/drm/i915/intel_lvds.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1122,7 +1122,7 @@ init_vbt_defaults(struct drm_i915_privat
}
}

-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
{
DRM_DEBUG_KMS("Falling back to manually reading VBT from "
"VBIOS ROM for %s\n",
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -780,7 +780,7 @@ static const struct drm_encoder_funcs in
.destroy = intel_encoder_destroy,
};

-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_crt_dmi_callback(const struct dmi_system_id *id)
{
DRM_INFO("Skipping CRT initialization for %s\n", id->ident);
return 1;
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -531,7 +531,7 @@ static const struct drm_encoder_funcs in
.destroy = intel_encoder_destroy,
};

-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
{
DRM_INFO("Skipping LVDS initialization for %s\n", id->ident);
return 1;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Kosina <jko...@suse.cz>

commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.

The report passed to us from transport driver could potentially be

arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Reported-by: Steven Vittitoe <scv...@google.com>
Signed-off-by: Jiri Kosina <jko...@suse.cz>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/hid/hid-magicmouse.c | 10 ++++++++++
1 file changed, 10 insertions(+)

--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct h
if (size < 4 || ((size - 4) % 9) != 0)
return 0;
npoints = (size - 4) / 9;
+ if (npoints > 15) {
+ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",

+ size);
+ return 0;
+ }

msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct h
if (size < 6 || ((size - 6) % 8) != 0)
return 0;
npoints = (size - 6) / 8;
+ if (npoints > 15) {
+ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",

+ size);
+ return 0;
+ }

msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joe Lawrence <joe.la...@stratus.com>

commit c605f3cdff53a743f6d875b76956b239deca1272 upstream.

During surprise device hotplug removal tests, it was observed that
hub_events may try to call usb_lock_device on a device that has already
been freed. Protect the usb_device by taking out a reference (under the
hub_event_lock) when hub_events pulls it off the list, returning the
reference after hub_events is finished using it.

Signed-off-by: Joe Lawrence <joe.la...@stratus.com>
Suggested-by: David Bulkow <david....@stratus.com> for using kref
Suggested-by: Alan Stern <st...@rowland.harvard.edu> for placement
Acked-by: Alan Stern <st...@rowland.harvard.edu>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/usb/core/hub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5008,9 +5008,10 @@ static void hub_events(void)

hub = list_entry(tmp, struct usb_hub, event_list);
kref_get(&hub->kref);
+ hdev = hub->hdev;
+ usb_get_dev(hdev);
spin_unlock_irq(&hub_event_lock);

- hdev = hub->hdev;
hub_dev = hub->intfdev;
intf = to_usb_interface(hub_dev);
dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
@@ -5123,6 +5124,7 @@ static void hub_events(void)
usb_autopm_put_interface(intf);
loop_disconnected:
usb_unlock_device(hdev);
+ usb_put_dev(hdev);
kref_put(&hub->kref, hub_release);

} /* end while (1) */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Robin Murphy <robin....@arm.com>

commit 5ca918e5e3f9df4634077c06585c42bc6a8d699a upstream.

The alignment fixup incorrectly decodes faulting ARM VLDn/VSTn
instructions (where the optional alignment hint is given but incorrect)
as LDR/STR, leading to register corruption. Detect these and correctly
treat them as unhandled, so that userspace gets the fault it expects.

Reported-by: Simon Hosie <simon...@arm.com>
Signed-off-by: Robin Murphy <robin....@arm.com>
Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/mm/alignment.c | 3 +++

1 file changed, 3 insertions(+)

--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -41,6 +41,7 @@
* This code is not portable to processors with late data abort handling.
*/
#define CODING_BITS(i) (i & 0x0e000000)
+#define COND_BITS(i) (i & 0xf0000000)

#define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */
#define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */
@@ -819,6 +820,8 @@ do_alignment(unsigned long addr, unsigne
break;

case 0x04000000: /* ldr or str immediate */
+ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
+ goto bad;
offset.un = OFFSET_BITS(instr);
handler = do_alignment_ldrstr;
break;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Boyd <sb...@codeaurora.org>

commit 505013bc9065391f09a51d51cd3bf0b06dfb570a upstream.

Rob Clark reports a sleeping while atomic bug when using perf.

BUG: sleeping function called from invalid context at ../kernel/locking/mutex.c:583
in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/0
------------[ cut here ]------------
WARNING: CPU: 2 PID: 4828 at ../kernel/locking/mutex.c:479 mutex_lock_nested+0x3a0/0x3e8()
DEBUG_LOCKS_WARN_ON(in_interrupt())
Modules linked in:
CPU: 2 PID: 4828 Comm: Xorg.bin Tainted: G W 3.17.0-rc3-00234-gd535c45-dirty #819
[<c0216690>] (unwind_backtrace) from [<c0212174>] (show_stack+0x10/0x14)
[<c0212174>] (show_stack) from [<c0867cc0>] (dump_stack+0x98/0xb8)
[<c0867cc0>] (dump_stack) from [<c02492a4>] (warn_slowpath_common+0x70/0x8c)
[<c02492a4>] (warn_slowpath_common) from [<c02492f0>] (warn_slowpath_fmt+0x30/0x40)
[<c02492f0>] (warn_slowpath_fmt) from [<c086a3f8>] (mutex_lock_nested+0x3a0/0x3e8)
[<c086a3f8>] (mutex_lock_nested) from [<c0294d08>] (irq_find_host+0x20/0x9c)
[<c0294d08>] (irq_find_host) from [<c0769d50>] (of_irq_get+0x28/0x48)
[<c0769d50>] (of_irq_get) from [<c057d104>] (platform_get_irq+0x1c/0x8c)
[<c057d104>] (platform_get_irq) from [<c021a06c>] (cpu_pmu_enable_percpu_irq+0x14/0x38)
[<c021a06c>] (cpu_pmu_enable_percpu_irq) from [<c02b1634>] (flush_smp_call_function_queue+0x88/0x178)
[<c02b1634>] (flush_smp_call_function_queue) from [<c0214dc0>] (handle_IPI+0x88/0x160)
[<c0214dc0>] (handle_IPI) from [<c0208930>] (gic_handle_irq+0x64/0x68)
[<c0208930>] (gic_handle_irq) from [<c0212d04>] (__irq_svc+0x44/0x5c)
Exception stack(0xe63ddea0 to 0xe63ddee8)
dea0: 00000001 00000001 00000000 c2f3b200 c16db380 c032d4a0 e63ddf40 60010013
dec0: 00000000 001fbfd4 00000100 00000000 00000001 e63ddee8 c0284770 c02a2e30
dee0: 20010013 ffffffff
[<c0212d04>] (__irq_svc) from [<c02a2e30>] (ktime_get_ts64+0x1c8/0x200)
[<c02a2e30>] (ktime_get_ts64) from [<c032d4a0>] (poll_select_set_timeout+0x60/0xa8)
[<c032d4a0>] (poll_select_set_timeout) from [<c032df64>] (SyS_select+0xa8/0x118)
[<c032df64>] (SyS_select) from [<c020e8e0>] (ret_fast_syscall+0x0/0x48)
---[ end trace 0bb583b46342da6f ]---
INFO: lockdep is turned off.

We don't really need to get the platform irq again when we're
enabling or disabling the per-cpu irq. Furthermore, we don't
really need to set and clear bits in the active_irqs bitmask
because that's only used in the non-percpu irq case to figure out
when the last CPU PMU has been disabled. Just pass the irq
directly to the enable/disable functions to clean all this up.
This should be slightly more efficient and also fix the
scheduling while atomic bug.

Fixes: bbd64559376f "ARM: perf: support percpu irqs for the CPU PMU"

Reported-by: Rob Clark <robd...@gmail.com>
Acked-by: Will Deacon <will....@arm.com>
Signed-off-by: Stephen Boyd <sb...@codeaurora.org>

Signed-off-by: Russell King <rmk+k...@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/kernel/perf_event_cpu.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)

--- a/arch/arm/kernel/perf_event_cpu.c
+++ b/arch/arm/kernel/perf_event_cpu.c
@@ -76,21 +76,15 @@ static struct pmu_hw_events *cpu_pmu_get

static void cpu_pmu_enable_percpu_irq(void *data)
{
- struct arm_pmu *cpu_pmu = data;
- struct platform_device *pmu_device = cpu_pmu->plat_device;
- int irq = platform_get_irq(pmu_device, 0);
+ int irq = *(int *)data;

enable_percpu_irq(irq, IRQ_TYPE_NONE);
- cpumask_set_cpu(smp_processor_id(), &cpu_pmu->active_irqs);
}

static void cpu_pmu_disable_percpu_irq(void *data)
{
- struct arm_pmu *cpu_pmu = data;
- struct platform_device *pmu_device = cpu_pmu->plat_device;
- int irq = platform_get_irq(pmu_device, 0);
+ int irq = *(int *)data;

- cpumask_clear_cpu(smp_processor_id(), &cpu_pmu->active_irqs);
disable_percpu_irq(irq);
}

@@ -103,7 +97,7 @@ static void cpu_pmu_free_irq(struct arm_

irq = platform_get_irq(pmu_device, 0);
if (irq >= 0 && irq_is_percpu(irq)) {
- on_each_cpu(cpu_pmu_disable_percpu_irq, cpu_pmu, 1);
+ on_each_cpu(cpu_pmu_disable_percpu_irq, &irq, 1);
free_percpu_irq(irq, &percpu_pmu);
} else {
for (i = 0; i < irqs; ++i) {
@@ -138,7 +132,7 @@ static int cpu_pmu_request_irq(struct ar
irq);
return err;
}
- on_each_cpu(cpu_pmu_enable_percpu_irq, cpu_pmu, 1);
+ on_each_cpu(cpu_pmu_enable_percpu_irq, &irq, 1);
} else {
for (i = 0; i < irqs; ++i) {
err = 0;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Scot Doyle <lkm...@scotdoyle.com>

commit dfb3d47b2369ad752ab9f7438bbf9949524b46ae upstream.

commit c675949ec58ca50d5a3ae3c757892f1560f6e896
Author: Jani Nikula <jani....@intel.com>
Date: Wed Apr 9 11:31:37 2014 +0300

drm/i915: do not setup backlight if not available according to VBT

prevents backlight setup on the Acer C720 (Core i3 4005U CPU), which has a
misconfigured VBT. Apply quirk to ignore the VBT backlight presence check
during backlight setup.

Signed-off-by: Scot Doyle <lkm...@scotdoyle.com>
Tested-by: Tyler Cleveland <siral...@openmailbox.org>
Cc: Jani Nikula <jani....@intel.com>
Cc: Daniel Vetter <daniel...@ffwll.ch>
Signed-off-by: Jani Nikula <jani....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/gpu/drm/i915/intel_display.c | 3 +++

1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11690,6 +11690,9 @@ static struct intel_quirk intel_quirks[]
/* Acer C720 and C720P Chromebooks (Celeron 2955U) have backlights */
{ 0x0a06, 0x1025, 0x0a11, quirk_backlight_present },

+ /* Acer C720 Chromebook (Core i3 4005U) */
+ { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present },
+
/* Toshiba CB35 Chromebook (Celeron 2955U) */
{ 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lars-Peter Clausen <la...@metafoo.de>

commit 5e0cbe78762b5f02986bf9e59a188dad2f6e0be1 upstream.

Commit 6cfec04bcc05 ("regmap: Separate regmap dev initialization") moved the
regmap debugfs initialization after regcache initialization. This means
that the regmap debugfs directory is not created yet when the cache
initialization runs and so any debugfs files registered by the regcache are
created in the debugfs root directory rather than the debugfs directory of
the regmap instance. Fix this by adding a separate callback for the
regcache debugfs initialization which will be called after the parent
debugfs entry has been created.

Fixes: 6cfec04bcc05 (regmap: Separate regmap dev initialization)
Signed-off-by: Lars-Peter Clausen <la...@metafoo.de>
Signed-off-by: Mark Brown <bro...@linaro.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/base/regmap/internal.h | 3 +++
drivers/base/regmap/regcache-rbtree.c | 9 +++------
drivers/base/regmap/regmap-debugfs.c | 3 +++
3 files changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -146,6 +146,9 @@ struct regcache_ops {
enum regcache_type type;
int (*init)(struct regmap *map);
int (*exit)(struct regmap *map);
+#ifdef CONFIG_DEBUG_FS
+ void (*debugfs_init)(struct regmap *map);
+#endif
int (*read)(struct regmap *map, unsigned int reg, unsigned int *value);
int (*write)(struct regmap *map, unsigned int reg, unsigned int value);
int (*sync)(struct regmap *map, unsigned int min, unsigned int max);
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -194,10 +194,6 @@ static void rbtree_debugfs_init(struct r
{
debugfs_create_file("rbtree", 0400, map->debugfs, map, &rbtree_fops);
}
-#else
-static void rbtree_debugfs_init(struct regmap *map)
-{
-}
#endif

static int regcache_rbtree_init(struct regmap *map)
@@ -222,8 +218,6 @@ static int regcache_rbtree_init(struct r
goto err;
}

- rbtree_debugfs_init(map);
-
return 0;

err:
@@ -532,6 +526,9 @@ struct regcache_ops regcache_rbtree_ops
.name = "rbtree",
.init = regcache_rbtree_init,
.exit = regcache_rbtree_exit,
+#ifdef CONFIG_DEBUG_FS
+ .debugfs_init = rbtree_debugfs_init,
+#endif
.read = regcache_rbtree_read,
.write = regcache_rbtree_write,
.sync = regcache_rbtree_sync,
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -538,6 +538,9 @@ void regmap_debugfs_init(struct regmap *

next = rb_next(&range_node->node);
}
+
+ if (map->cache_ops && map->cache_ops->debugfs_init)
+ map->cache_ops->debugfs_init(map);
}

void regmap_debugfs_exit(struct regmap *map)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Rientjes <rien...@google.com>

commit d4a5fca592b9ab52b90bb261a90af3c8f53be011 upstream.

Since commit 4590685546a3 ("mm/sl[aou]b: Common alignment code"), the
"ralign" automatic variable in __kmem_cache_create() may be used as
uninitialized.

The proper alignment defaults to BYTES_PER_WORD and can be overridden by
SLAB_RED_ZONE or the alignment specified by the caller.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=85031

Signed-off-by: David Rientjes <rien...@google.com>
Reported-by: Andrei Elovikov <a.elo...@gmail.com>
Acked-by: Christoph Lameter <c...@linux.com>
Cc: Pekka Enberg <pen...@kernel.org>
Cc: Joonsoo Kim <iamjoon...@lge.com>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

mm/slab.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)

--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2224,7 +2224,8 @@ static int __init_refok setup_cpu_cache(
int
__kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
{
- size_t left_over, freelist_size, ralign;
+ size_t left_over, freelist_size;
+ size_t ralign = BYTES_PER_WORD;
gfp_t gfp;
int err;
size_t size = cachep->size;
@@ -2257,14 +2258,6 @@ __kmem_cache_create (struct kmem_cache *
size &= ~(BYTES_PER_WORD - 1);
}

- /*
- * Redzoning and user store require word alignment or possibly larger.
- * Note this will be overridden by architecture or caller mandated
- * alignment if either is greater than BYTES_PER_WORD.
- */
- if (flags & SLAB_STORE_USER)
- ralign = BYTES_PER_WORD;
-
if (flags & SLAB_RED_ZONE) {
ralign = REDZONE_ALIGN;
/* If redzoning, ensure that the second redzone is suitably

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <bornt...@de.ibm.com>

commit 3e03d4c46daa849880837d802e41c14132a03ef9 upstream.

Since 3.12 or more precisely commit 0944fe3f4a32 ("s390/mm:
implement software referenced bits") guest storage keys get
corrupted during paging. This commit added another valid->invalid
translation for page tables - namely ptep_test_and_clear_young.
We have to transfer the storage key into the pgste in that case.

Signed-off-by: Christian Borntraeger <bornt...@de.ibm.com>
Acked-by: Martin Schwidefsky <schwi...@de.ibm.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/s390/include/asm/pgtable.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1115,7 +1115,7 @@ static inline int ptep_test_and_clear_yo
unsigned long addr, pte_t *ptep)
{
pgste_t pgste;
- pte_t pte;
+ pte_t pte, oldpte;
int young;

if (mm_has_pgste(vma->vm_mm)) {
@@ -1123,12 +1123,13 @@ static inline int ptep_test_and_clear_yo
pgste = pgste_ipte_notify(vma->vm_mm, ptep, pgste);
}

- pte = *ptep;
+ oldpte = pte = *ptep;
ptep_flush_direct(vma->vm_mm, addr, ptep);
young = pte_young(pte);
pte = pte_mkold(pte);

if (mm_has_pgste(vma->vm_mm)) {
+ pgste = pgste_update_all(&oldpte, pgste, vma->vm_mm);
pgste = pgste_set_pte(ptep, pgste, pte);
pgste_set_unlock(ptep, pgste);
} else

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Stezenbach <j...@sig21.net>

commit d21ccfd0a60ea3dece3e1d142f52694abf87a0b1 upstream.

In v3.15 the driver stopped to accept network packets after successful
authentification, which could be worked around by passing the
nohwcrypt=1 module parameter. This was not reproducible by
everyone, and showed random behaviour in some tests.
It was caused by an uninitialized variable introduced
in 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") and
used in 341b29b9cd2f ("ath9k_htc: use ath9k_cmn_rx_skb_postprocess").

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=78581
Fixes: 341b29b9cd2f ("ath9k_htc: use ath9k_cmn_rx_skb_postprocess")
Signed-off-by: Johannes Stezenbach <j...@sig21.net>
Signed-off-by: John W. Linville <linv...@tuxdriver.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -978,7 +978,7 @@ static bool ath9k_rx_prepare(struct ath9
struct ath_hw *ah = common->ah;
struct ath_htc_rx_status *rxstatus;
struct ath_rx_status rx_stats;
- bool decrypt_error;
+ bool decrypt_error = false;

if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anton Blanchard <an...@samba.org>

commit 85101af13bb854a6572fa540df7c7201958624b9 upstream.

ABIv2 kernels are failing to backtrace through the kernel. An example:

39.30% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
__GI___libc_read

The problem is in valid_next_sp() where we check that the new stack
pointer is at least STACK_FRAME_OVERHEAD below the previous one.

ABIv1 has a minimum stack frame size of 112 bytes consisting of 48 bytes
and 64 bytes of parameter save area. ABIv2 changes that to 32 bytes
with no paramter save area.

STACK_FRAME_OVERHEAD is in theory the minimum stack frame size,
but we over 240 uses of it, some of which assume that it includes
space for the parameter area.

We need to work through all our stack defines and rationalise them
but let's fix perf now by creating STACK_FRAME_MIN_SIZE and using
in valid_next_sp(). This fixes the issue:

30.64% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
pagecache_get_page
generic_file_read_iter
new_sync_read
vfs_read
sys_read
syscall_exit
__GI___libc_read

Reported-by: Aneesh Kumar K.V <aneesh...@linux.vnet.ibm.com>
Signed-off-by: Anton Blanchard <an...@samba.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/powerpc/include/asm/ptrace.h | 7 +++++++
arch/powerpc/perf/callchain.c | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -47,6 +47,12 @@
STACK_FRAME_OVERHEAD + KERNEL_REDZONE_SIZE)
#define STACK_FRAME_MARKER 12

+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define STACK_FRAME_MIN_SIZE 32
+#else
+#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD
+#endif
+
/* Size of dummy stack frame allocated when calling signal handler. */
#define __SIGNAL_FRAMESIZE 128
#define __SIGNAL_FRAMESIZE32 64
@@ -60,6 +66,7 @@
#define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773)
#define STACK_INT_FRAME_SIZE (sizeof(struct pt_regs) + STACK_FRAME_OVERHEAD)
#define STACK_FRAME_MARKER 2
+#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD

/* Size of stack frame allocated when calling signal handler. */
#define __SIGNAL_FRAMESIZE 64
--- a/arch/powerpc/perf/callchain.c
+++ b/arch/powerpc/perf/callchain.c
@@ -35,7 +35,7 @@ static int valid_next_sp(unsigned long s
return 0; /* must be 16-byte aligned */
if (!validate_sp(sp, current, STACK_FRAME_OVERHEAD))
return 0;
- if (sp >= prev_sp + STACK_FRAME_OVERHEAD)
+ if (sp >= prev_sp + STACK_FRAME_MIN_SIZE)
return 1;
/*
* sp could decrease when we jump off an interrupt stack

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <bornt...@de.ibm.com>

commit ab3f285f227fec62868037e9b1b1fd18294a83b8 upstream.

The PFMF instruction handler blindly wrote the storage key even if
the page was mapped R/O in the host. Lets try a COW before continuing
and bail out in case of errors.

Signed-off-by: Christian Borntraeger <bornt...@de.ibm.com>
Reviewed-by: Dominik Dingel <din...@linux.vnet.ibm.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/s390/mm/pgtable.c | 10 ++++++++++

1 file changed, 10 insertions(+)

--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -986,11 +986,21 @@ int set_guest_storage_key(struct mm_stru
pte_t *ptep;

down_read(&mm->mmap_sem);
+retry:
ptep = get_locked_pte(current->mm, addr, &ptl);
if (unlikely(!ptep)) {
up_read(&mm->mmap_sem);
return -EFAULT;
}
+ if (!(pte_val(*ptep) & _PAGE_INVALID) &&
+ (pte_val(*ptep) & _PAGE_PROTECT)) {
+ pte_unmap_unlock(*ptep, ptl);
+ if (fixup_user_fault(current, mm, addr, FAULT_FLAG_WRITE)) {
+ up_read(&mm->mmap_sem);
+ return -EFAULT;
+ }
+ goto retry;
+ }

new = old = pgste_get_lock(ptep);
pgste_val(new) &= ~(PGSTE_GR_BIT | PGSTE_GC_BIT |

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alban Crequy <alban....@collabora.co.uk>

commit 71b1fb5c4473a5b1e601d41b109bdfe001ec82e0 upstream.

/proc/<pid>/cgroup contains one cgroup path on each line. If cgroup names are
allowed to contain "\n", applications cannot parse /proc/<pid>/cgroup safely.

Signed-off-by: Alban Crequy <alban....@collabora.co.uk>
Signed-off-by: Tejun Heo <t...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

kernel/cgroup.c | 5 +++++
1 file changed, 5 insertions(+)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4393,6 +4393,11 @@ static int cgroup_mkdir(struct kernfs_no
struct kernfs_node *kn;
int ssid, ret;

+ /* Do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable.
+ */
+ if (strchr(name, '\n'))
+ return -EINVAL;
+
parent = cgroup_kn_lock_live(parent_kn);
if (!parent)
return -ENODEV;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrey Vagin <ava...@openvz.org>

commit 7e8824816bda16bb11ff5ff1e1212d642e57b0b3 upstream.

Currently we handle only ENOSPC. In case of other errors the file_handle
variable isn't filled properly and we will show a part of stack.

Signed-off-by: Andrey Vagin <ava...@openvz.org>
Acked-by: Cyrill Gorcunov <gorc...@openvz.org>
Cc: Alexander Viro <vi...@zeniv.linux.org.uk>

Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/notify/fdinfo.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_
size = f.handle.handle_bytes >> 2;

ret = exportfs_encode_inode_fh(inode, (struct fid *)f.handle.f_handle, &size, 0);
- if ((ret == FILEID_INVALID) || (ret == -ENOSPC)) {
+ if ((ret == FILEID_INVALID) || (ret < 0)) {
WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
return 0;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Christie <mich...@cs.wisc.edu>

commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.

This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.

This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html

Reported-by: Dan Carpenter <dan.ca...@oracle.com>
Signed-off-by: Mike Christie <mich...@cs.wisc.edu>
Reviewed-by: Sagi Grimberg <sa...@mellanox.com>
Signed-off-by: Christoph Hellwig <h...@lst.de>
Signed-off-by: James Bottomley <JBott...@Parallels.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/scsi/libiscsi.c | 10 ++++++++++

1 file changed, 10 insertions(+)

--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -717,11 +717,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn
return NULL;
}

+ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
+ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
+ return NULL;
+ }
+
task = conn->login_task;
} else {
if (session->state != ISCSI_STATE_LOGGED_IN)
return NULL;

+ if (data_size != 0) {
+ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
+ return NULL;
+ }
+
BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: "J. Bruce Fields" <bfi...@redhat.com>

commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.

Nikita Yuschenko reported that booting a kernel with init=/bin/sh and
then nfs mounting without portmap or rpcbind running using a busybox
mount resulted in:

# mount -t nfs 10.30.130.21:/opt /mnt
svc: failed to register lockdv1 RPC service (errno 111).
lockd_up: makesock failed, error=-111
Unable to handle kernel paging request for data at address 0x00000030
Faulting instruction address: 0xc055e65c
Oops: Kernel access of bad area, sig: 11 [#1]
MPC85xx CDS
Modules linked in:
CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117
task: cf29cea0 ti: cf35c000 task.ti: cf35c000
NIP: c055e65c LR: c0566490 CTR: c055e648
REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge)
MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000
DEAR: 00000030, ESR: 00000000

GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086
00000000
GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000
10090ae8
GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000
bfa46ef0
GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000
cf0ded80
NIP [c055e65c] call_start+0x14/0x34
LR [c0566490] __rpc_execute+0x70/0x250
Call Trace:
[cf35db80] [00000080] 0x80 (unreliable)
[cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4
[cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8
[cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84
[cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c
[cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108
[cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30
[cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0
[cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8
[cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec
[cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4
[cf35dd90] [c0171590] nfs3_create_server+0x10/0x44
[cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4
[cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8
[cf35de70] [c00cd3bc] mount_fs+0x20/0xbc
[cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104
[cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0
[cf35df10] [c00e75ac] SyS_mount+0x90/0xd0
[cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c

The addition of svc_shutdown_net() resulted in two calls to
svc_rpcb_cleanup(); the second is no longer necessary and crashes when
it calls rpcb_register_call with clnt=NULL.

Reported-by: Nikita Yushchenko <nyush...@dev.rtsoft.ru>
Fixes: 679b033df484 "lockd: ensure we tear down any live sockets when socket creation fails during lockd_up"
Acked-by: Jeff Layton <jla...@primarydata.com>
Signed-off-by: J. Bruce Fields <bfi...@redhat.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/lockd/svc.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv

error = make_socks(serv, net);
if (error < 0)
- goto err_socks;
+ goto err_bind;
set_grace_period(net);
dprintk("lockd_up_net: per-net data created; net=%p\n", net);
return 0;

-err_socks:
- svc_rpcb_cleanup(serv, net);
err_bind:
ln->nlmsvc_users--;
return error;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <hdeg...@redhat.com>

commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream.

https://bugzilla.kernel.org/show_bug.cgi?id=69731

Reported-by: Jason Robinson <ma...@jasonrobinson.me>
Signed-off-by: Hans de Goede <hdeg...@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry....@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++
1 file changed, 8 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -608,6 +608,14 @@ static const struct dmi_system_id __init
DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
},
},
+ {
+ /* Fujitsu U574 laptop */
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
+ },
+ },
{ }

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <emmanuel...@intel.com>

commit 86974bff066dd8b98be46d7c7d3aba89034f0833 upstream.

This code was broken on big endian systems. Sparse didn't
catch the bug since the firmware command was not tagged as
little endian.
Fix the bug for big endian systems and tag the field in the
firmware command to prevent such issues in the future.

Fixes: 1f3b0ff8ec ("iwlwifi: mvm: Add Smart FIFO support")
Reviewed-by: Johannes Berg <johann...@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel...@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 ++--
drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -1487,14 +1487,14 @@ enum iwl_sf_scenario {

/**
* Smart Fifo configuration command.
- * @state: smart fifo state, types listed in iwl_sf_sate.
+ * @state: smart fifo state, types listed in enum %iwl_sf_sate.
* @watermark: Minimum allowed availabe free space in RXF for transient state.
* @long_delay_timeouts: aging and idle timer values for each scenario
* in long delay state.
* @full_on_timeouts: timer values for each scenario in full on state.
*/
struct iwl_sf_cfg_cmd {
- enum iwl_sf_state state;
+ __le32 state;
__le32 watermark[SF_TRANSIENT_STATES_NUMBER];
__le32 long_delay_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
__le32 full_on_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
@@ -172,7 +172,7 @@ static int iwl_mvm_sf_config(struct iwl_
enum iwl_sf_state new_state)
{
struct iwl_sf_cfg_cmd sf_cmd = {
- .state = new_state,
+ .state = cpu_to_le32(new_state),
};
struct ieee80211_sta *sta;
int ret = 0;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nishanth Menon <n...@ti.com>

commit e49d519c456f4fb6f4a0473bc04ba30bb805fce5 upstream.

GPIO modules are also interrupt sources. However, they require both the
GPIO number and IRQ type to function properly.

By declaring that GPIO uses interrupt-cells=<1>, we essentially do not
allow users of the nodes to use the interrupt property appropritely.

With this change, the following now works:

interrupt-parent = <&gpio6>;
interrupts = <5 IRQ_TYPE_LEVEL_LOW>;

Fixes: 6e58b8f1daaf ('ARM: dts: DRA7: Add the dts files for dra7 SoC and dra7-evm board')
Signed-off-by: Nishanth Menon <n...@ti.com>
Signed-off-by: Tony Lindgren <to...@atomide.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/arm/boot/dts/dra7.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)

--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -172,7 +172,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio2: gpio@48055000 {
@@ -183,7 +183,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio3: gpio@48057000 {
@@ -194,7 +194,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio4: gpio@48059000 {
@@ -205,7 +205,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio5: gpio@4805b000 {
@@ -216,7 +216,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio6: gpio@4805d000 {
@@ -227,7 +227,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio7: gpio@48051000 {
@@ -238,7 +238,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

gpio8: gpio@48053000 {
@@ -249,7 +249,7 @@
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
- #interrupt-cells = <1>;
+ #interrupt-cells = <2>;
};

uart1: serial@4806a000 {

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Larry Finger <Larry....@lwfinger.net>

commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream.

The Sitecom WLA-2102 adapter uses this driver.

Reported-by: Nico Baggus <nico-...@noci.xs4all.nl>
Signed-off-by: Larry Finger <Larry....@lwfinger.net>
Cc: Nico Baggus <nico-...@noci.xs4all.nl>

Signed-off-by: John W. Linville <linv...@tuxdriver.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -317,6 +317,7 @@ static struct usb_device_id rtl8192c_usb
{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zefan Li <liz...@huawei.com>

commit eb4aec84d6bdf98d00cedb41c18000f7a31e648a upstream.

cgroup_pidlist_start() holds cgrp->pidlist_mutex and then calls
pidlist_array_load(), and cgroup_pidlist_stop() releases the mutex.

It is wrong that we release the mutex in the failure path in
pidlist_array_load(), because cgroup_pidlist_stop() will be called
no matter if cgroup_pidlist_start() returns errno or not.

Fixes: 4bac00d16a8760eae7205e41d2c246477d42a210
Signed-off-by: Zefan Li <liz...@huawei.com>
Signed-off-by: Tejun Heo <t...@kernel.org>
Acked-by: Cong Wang <xiyou.w...@gmail.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

kernel/cgroup.c | 1 -

1 file changed, 1 deletion(-)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -3833,7 +3833,6 @@ static int pidlist_array_load(struct cgr

l = cgroup_pidlist_find_create(cgrp, type);
if (!l) {
- mutex_unlock(&cgrp->pidlist_mutex);
pidlist_free(array);
return -ENOMEM;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Srinivas Pandruvada <srinivas....@linux.intel.com>

commit f153566570fb9e32c2f59182883f4f66048788fb upstream.

Instead of a void function, return the trigger pointer.

Whilst not in of itself a fix, this makes the following set of
7 fixes cleaner than they would otherwise be.

Signed-off-by: Srinivas Pandruvada <srinivas....@linux.intel.com>
Signed-off-by: Jonathan Cameron <ji...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

include/linux/iio/trigger.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -84,10 +84,12 @@ static inline void iio_trigger_put(struc
put_device(&trig->dev);
}

-static inline void iio_trigger_get(struct iio_trigger *trig)
+static inline struct iio_trigger *iio_trigger_get(struct iio_trigger *trig)
{
get_device(&trig->dev);
__module_get(trig->ops->owner);
+
+ return trig;
}

/**

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Rohner <andreas...@gmx.net>

commit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.

This bug leads to reproducible silent data loss, despite the use of
msync(), sync() and a clean unmount of the file system. It is easily
reproducible with the following script:

----------------[BEGIN SCRIPT]--------------------
mkfs.nilfs2 -f /dev/sdb
mount /dev/sdb /mnt

dd if=/dev/zero bs=1M count=30 of=/mnt/testfile

umount /mnt
mount /dev/sdb /mnt
CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"

/root/mmaptest/mmaptest /mnt/testfile 30 10 5

sync
CHECKSUM_AFTER="$(md5sum /mnt/testfile)"
umount /mnt
mount /dev/sdb /mnt
CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)"
umount /mnt

echo "BEFORE MMAP:\t$CHECKSUM_BEFORE"
echo "AFTER MMAP:\t$CHECKSUM_AFTER"
echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT"
----------------[END SCRIPT]--------------------

The mmaptest tool looks something like this (very simplified, with
error checking removed):

----------------[BEGIN mmaptest]--------------------
data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, file_offset);

for (i = 0; i < write_count; ++i) {
memcpy(data + i * 4096, buf, sizeof(buf));
msync(data, file_size - file_offset, MS_SYNC))
}
----------------[END mmaptest]--------------------

The output of the script looks something like this:

BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile
AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile

So it is clear, that the changes done using mmap() do not survive a
remount. This can be reproduced a 100% of the time. The problem was
introduced in commit 136e8770cd5d ("nilfs2: fix issue of
nilfs_set_page_dirty() for page at EOF boundary").

If the page was read with mpage_readpage() or mpage_readpages() for
example, then it has no buffers attached to it. In that case
page_has_buffers(page) in nilfs_set_page_dirty() will be false.
Therefore nilfs_set_file_dirty() is never called and the pages are never
collected and never written to disk.

This patch fixes the problem by also calling nilfs_set_file_dirty() if the
page has no buffers attached to it.

[ak...@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]
Signed-off-by: Andreas Rohner <andreas...@gmx.net>
Tested-by: Andreas Rohner <andreas...@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi...@lab.ntt.co.jp>

Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/nilfs2/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -24,6 +24,7 @@
#include <linux/buffer_head.h>
#include <linux/gfp.h>
#include <linux/mpage.h>
+#include <linux/pagemap.h>
#include <linux/writeback.h>
#include <linux/aio.h>
#include "nilfs.h"
@@ -219,10 +220,10 @@ static int nilfs_writepage(struct page *

static int nilfs_set_page_dirty(struct page *page)
{
+ struct inode *inode = page->mapping->host;
int ret = __set_page_dirty_nobuffers(page);

if (page_has_buffers(page)) {
- struct inode *inode = page->mapping->host;
unsigned nr_dirty = 0;
struct buffer_head *bh, *head;

@@ -245,6 +246,10 @@ static int nilfs_set_page_dirty(struct p

if (nr_dirty)
nilfs_set_file_dirty(inode, nr_dirty);
+ } else if (ret) {
+ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+
+ nilfs_set_file_dirty(inode, nr_dirty);
}
return ret;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Srinivas Pandruvada <srinivas....@linux.intel.com>

commit 0668a4e4d297328ce08b44d91d160537596115e2 upstream.

This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.

Signed-off-by: Srinivas Pandruvada <srinivas....@linux.intel.com>
Signed-off-by: Jonathan Cameron <ji...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/iio/accel/bma180.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -571,7 +571,7 @@ static int bma180_probe(struct i2c_clien
trig->ops = &bma180_trigger_ops;
iio_trigger_set_drvdata(trig, indio_dev);
data->trig = trig;
- indio_dev->trig = trig;
+ indio_dev->trig = iio_trigger_get(trig);

ret = iio_trigger_register(trig);
if (ret)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Richard Genoud <richard...@gmail.com>

commit 35b675b9100fc38f58cb75b30e422ecd342519a8 upstream.

In set_termios(), interrupts where not disabled if UART_ENABLE_MS() was
false.

Tested on at91sam9g35.

Signed-off-by: Richard Genoud <richard...@gmail.com>
Reviewed-by: Peter Hurley <pe...@hurleysoftware.com>
Acked-by: Nicolas Ferre <nicola...@atmel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/tty/serial/atmel_serial.c | 43 +++++++++++++++++++++++++++++++++++++-
1 file changed, 42 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -527,6 +527,45 @@ static void atmel_enable_ms(struct uart_
}

/*
+ * Disable modem status interrupts
+ */
+static void atmel_disable_ms(struct uart_port *port)
+{
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ uint32_t idr = 0;
+
+ /*
+ * Interrupt should not be disabled twice
+ */
+ if (!atmel_port->ms_irq_enabled)
+ return;
+
+ atmel_port->ms_irq_enabled = false;
+
+ if (atmel_port->gpio_irq[UART_GPIO_CTS] >= 0)
+ disable_irq(atmel_port->gpio_irq[UART_GPIO_CTS]);
+ else
+ idr |= ATMEL_US_CTSIC;
+
+ if (atmel_port->gpio_irq[UART_GPIO_DSR] >= 0)
+ disable_irq(atmel_port->gpio_irq[UART_GPIO_DSR]);
+ else
+ idr |= ATMEL_US_DSRIC;
+
+ if (atmel_port->gpio_irq[UART_GPIO_RI] >= 0)
+ disable_irq(atmel_port->gpio_irq[UART_GPIO_RI]);
+ else
+ idr |= ATMEL_US_RIIC;
+
+ if (atmel_port->gpio_irq[UART_GPIO_DCD] >= 0)
+ disable_irq(atmel_port->gpio_irq[UART_GPIO_DCD]);
+ else
+ idr |= ATMEL_US_DCDIC;
+
+ UART_PUT_IDR(port, idr);
+}
+
+/*
* Control the transmission of a break signal
*/
static void atmel_break_ctl(struct uart_port *port, int break_state)
@@ -1993,7 +2032,9 @@ static void atmel_set_termios(struct uar

/* CTS flow-control and modem-status interrupts */
if (UART_ENABLE_MS(port, termios->c_cflag))
- port->ops->enable_ms(port);
+ atmel_enable_ms(port);
+ else
+ atmel_disable_ms(port);

spin_unlock_irqrestore(&port->lock, flags);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <bornt...@de.ibm.com>

commit 614a80e474b227cace52fd6e3c790554db8a396e upstream.

In the early days, we had some special handling for the
KVM_EXIT_S390_SIEIC exit, but this was gone in 2009 with commit
d7b0b5eb3000 (KVM: s390: Make psw available on all exits, not
just a subset).

Now this switch statement is just a sanity check for userspace
not messing with the kvm_run structure. Unfortunately, this
allows userspace to trigger a kernel BUG. Let's just remove
this switch statement.

Signed-off-by: Christian Borntraeger <bornt...@de.ibm.com>
Reviewed-by: Cornelia Huck <cornel...@de.ibm.com>
Reviewed-by: David Hildenbrand <da...@linux.vnet.ibm.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/s390/kvm/kvm-s390.c | 13 -------------
1 file changed, 13 deletions(-)

--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1286,19 +1286,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v

kvm_s390_vcpu_start(vcpu);

- switch (kvm_run->exit_reason) {
- case KVM_EXIT_S390_SIEIC:
- case KVM_EXIT_UNKNOWN:
- case KVM_EXIT_INTR:
- case KVM_EXIT_S390_RESET:
- case KVM_EXIT_S390_UCONTROL:
- case KVM_EXIT_S390_TSCH:
- case KVM_EXIT_DEBUG:
- break;
- default:
- BUG();
- }
-
vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
if (kvm_run->kvm_dirty_regs & KVM_SYNC_PREFIX) {

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <m...@ellerman.id.au>

commit 78e05b1421fa41ae8457701140933baa5e7d9479 upstream.

Similar to the previous commit which described why we need to add a
barrier to arch_spin_is_locked(), we have a similar problem with
spin_unlock_wait().

We need a barrier on entry to ensure any spinlock we have previously
taken is visibly locked prior to the load of lock->slock.

It's also not clear if spin_unlock_wait() is intended to have ACQUIRE
semantics. For now be conservative and add a barrier on exit to give it
ACQUIRE semantics.

Signed-off-by: Michael Ellerman <m...@ellerman.id.au>
Signed-off-by: Benjamin Herrenschmidt <be...@kernel.crashing.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/powerpc/lib/locks.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/arch/powerpc/lib/locks.c
+++ b/arch/powerpc/lib/locks.c
@@ -70,12 +70,16 @@ void __rw_yield(arch_rwlock_t *rw)

void arch_spin_unlock_wait(arch_spinlock_t *lock)
{
+ smp_mb();
+
while (lock->slock) {
HMT_low();
if (SHARED_PROCESSOR)
__spin_yield(lock);
}
HMT_medium();
+
+ smp_mb();
}

EXPORT_SYMBOL(arch_spin_unlock_wait);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrey Vagin <ava...@openvz.org>

commit 1fc98d11cac6dd66342e5580cb2687e5b1e9a613 upstream.

MAX_HANDLE_SZ is equal to 128, but currently the size of pad is only 64
bytes, so exportfs_encode_inode_fh can return an error.

Signed-off-by: Andrey Vagin <ava...@openvz.org>
Acked-by: Cyrill Gorcunov <gorc...@openvz.org>
Cc: Alexander Viro <vi...@zeniv.linux.org.uk>

Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/notify/fdinfo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -42,7 +42,7 @@ static int show_mark_fhandle(struct seq_
{
struct {
struct file_handle handle;
- u8 pad[64];
+ u8 pad[MAX_HANDLE_SZ];
} f;
int size, ret, i;

@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_
size = f.handle.handle_bytes >> 2;

ret = exportfs_encode_inode_fh(inode, (struct fid *)f.handle.f_handle, &size, 0);

- if ((ret == 255) || (ret == -ENOSPC)) {
+ if ((ret == FILEID_INVALID) || (ret == -ENOSPC)) {

WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
return 0;
}

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <m...@ellerman.id.au>

commit 51d7d5205d3389a32859f9939f1093f267409929 upstream.

The kernel defines the function spin_is_locked(), which can be used to
check if a spinlock is currently locked.

Using spin_is_locked() on a lock you don't hold is obviously racy. That
is, even though you may observe that the lock is unlocked, it may become
locked at any time.

There is (at least) one exception to that, which is if two locks are
used as a pair, and the holder of each checks the status of the other
before doing any update.

Assuming *A and *B are two locks, and *COUNTER is a shared non-atomic
value:

The first CPU does:

spin_lock(*A)

if spin_is_locked(*B)
# nothing
else
smp_mb()
LOAD r = *COUNTER
r++
STORE *COUNTER = r

spin_unlock(*A)

And the second CPU does:

spin_lock(*B)

if spin_is_locked(*A)
# nothing
else
smp_mb()
LOAD r = *COUNTER
r++
STORE *COUNTER = r

spin_unlock(*B)

Although this is a strange locking construct, it should work.

It seems to be understood, but not documented, that spin_is_locked() is
not a memory barrier, so in the examples above and below the caller
inserts its own memory barrier before acting on the result of
spin_is_locked().

For now we assume spin_is_locked() is implemented as below, and we break
it out in our examples:

bool spin_is_locked(*LOCK) {
LOAD l = *LOCK
return l.locked
}

Our intuition is that there should be no problem even if the two code
sequences run simultaneously such as:

CPU 0 CPU 1
==================================================
spin_lock(*A) spin_lock(*B)
LOAD b = *B LOAD a = *A
if b.locked # true if a.locked # true
# nothing # nothing
spin_unlock(*A) spin_unlock(*B)

If one CPU gets the lock before the other then it will do the update and
the other CPU will back off:

CPU 0 CPU 1
==================================================
spin_lock(*A)
LOAD b = *B
spin_lock(*B)
if b.locked # false LOAD a = *A
else if a.locked # true
smp_mb() # nothing
LOAD r1 = *COUNTER spin_unlock(*B)
r1++
STORE *COUNTER = r1
spin_unlock(*A)

However in reality spin_lock() itself is not indivisible. On powerpc we
implement it as a load-and-reserve and store-conditional.

Ignoring the retry logic for the lost reservation case, it boils down to:
spin_lock(*LOCK) {
LOAD l = *LOCK
l.locked = true
STORE *LOCK = l
ACQUIRE_BARRIER
}

The ACQUIRE_BARRIER is required to give spin_lock() ACQUIRE semantics as
defined in memory-barriers.txt:

This acts as a one-way permeable barrier. It guarantees that all
memory operations after the ACQUIRE operation will appear to happen
after the ACQUIRE operation with respect to the other components of
the system.

On modern powerpc systems we use lwsync for ACQUIRE_BARRIER. lwsync is
also know as "lightweight sync", or "sync 1".

As described in Power ISA v2.07 section B.2.1.1, in this scenario the
lwsync is not the barrier itself. It instead causes the LOAD of *LOCK to
act as the barrier, preventing any loads or stores in the locked region
from occurring prior to the load of *LOCK.

Whether this behaviour is in accordance with the definition of ACQUIRE
semantics in memory-barriers.txt is open to discussion, we may switch to
a different barrier in future.

What this means in practice is that the following can occur:

CPU 0 CPU 1
==================================================
LOAD a = *A LOAD b = *B
a.locked = true b.locked = true
LOAD b = *B LOAD a = *A
STORE *A = a STORE *B = b
if b.locked # false if a.locked # false
else else
smp_mb() smp_mb()
LOAD r1 = *COUNTER LOAD r2 = *COUNTER
r1++ r2++
STORE *COUNTER = r1
STORE *COUNTER = r2 # Lost update
spin_unlock(*A) spin_unlock(*B)

That is, the load of *B can occur prior to the store that makes *A
visibly locked. And similarly for CPU 1. The result is both CPUs hold
their lock and believe the other lock is unlocked.

The easiest fix for this is to add a full memory barrier to the start of
spin_is_locked(), so adding to our previous definition would give us:

bool spin_is_locked(*LOCK) {
smp_mb()
LOAD l = *LOCK
return l.locked
}

The new barrier orders the store to the lock we are locking vs the load
of the other lock:

CPU 0 CPU 1
==================================================
LOAD a = *A LOAD b = *B
a.locked = true b.locked = true
STORE *A = a STORE *B = b
smp_mb() smp_mb()
LOAD b = *B LOAD a = *A
if b.locked # true if a.locked # true
# nothing # nothing
spin_unlock(*A) spin_unlock(*B)

Although the above example is theoretical, there is code similar to this
example in sem_lock() in ipc/sem.c. This commit in addition to the next
commit appears to be a fix for crashes we are seeing in that code where
we believe this race happens in practice.

Signed-off-by: Michael Ellerman <m...@ellerman.id.au>
Signed-off-by: Benjamin Herrenschmidt <be...@kernel.crashing.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/powerpc/include/asm/spinlock.h | 1 +

1 file changed, 1 insertion(+)

--- a/arch/powerpc/include/asm/spinlock.h
+++ b/arch/powerpc/include/asm/spinlock.h
@@ -61,6 +61,7 @@ static __always_inline int arch_spin_val

static inline int arch_spin_is_locked(arch_spinlock_t *lock)
{
+ smp_mb();
return !arch_spin_value_unlocked(*lock);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Al Viro <vi...@zeniv.linux.org.uk>

commit 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 upstream.

return the value instead, and have path_init() do the assignment. Broken by
"vfs: Fix absolute RCU path walk failures due to uninitialized seq number",
which was Cc-stable with 2.6.38+ as destination. This one should go where
it went.

To avoid dummy value returned in case when root is already set (it would do
no harm, actually, since the only caller that doesn't ignore the return value
is guaranteed to have nd->root *not* set, but it's more obvious that way),
lift the check into callers. And do the same to set_root(), to keep them
in sync.

Signed-off-by: Al Viro <vi...@zeniv.linux.org.uk>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/namei.c | 33 +++++++++++++++++----------------
1 file changed, 17 insertions(+), 16 deletions(-)

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -644,24 +644,22 @@ static int complete_walk(struct nameidat

static __always_inline void set_root(struct nameidata *nd)
{
- if (!nd->root.mnt)
- get_fs_root(current->fs, &nd->root);
+ get_fs_root(current->fs, &nd->root);
}

static int link_path_walk(const char *, struct nameidata *);

-static __always_inline void set_root_rcu(struct nameidata *nd)
+static __always_inline unsigned set_root_rcu(struct nameidata *nd)
{
- if (!nd->root.mnt) {
- struct fs_struct *fs = current->fs;
- unsigned seq;
+ struct fs_struct *fs = current->fs;
+ unsigned seq, res;

- do {
- seq = read_seqcount_begin(&fs->seq);
- nd->root = fs->root;
- nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
- } while (read_seqcount_retry(&fs->seq, seq));
- }
+ do {
+ seq = read_seqcount_begin(&fs->seq);
+ nd->root = fs->root;
+ res = __read_seqcount_begin(&nd->root.dentry->d_seq);
+ } while (read_seqcount_retry(&fs->seq, seq));
+ return res;
}

static void path_put_conditional(struct path *path, struct nameidata *nd)
@@ -861,7 +859,8 @@ follow_link(struct path *link, struct na
return PTR_ERR(s);
}
if (*s == '/') {
- set_root(nd);
+ if (!nd->root.mnt)
+ set_root(nd);
path_put(&nd->path);
nd->path = nd->root;
path_get(&nd->root);
@@ -1136,7 +1135,8 @@ static bool __follow_mount_rcu(struct na

static int follow_dotdot_rcu(struct nameidata *nd)
{
- set_root_rcu(nd);
+ if (!nd->root.mnt)
+ set_root_rcu(nd);

while (1) {
if (nd->path.dentry == nd->root.dentry &&
@@ -1249,7 +1249,8 @@ static void follow_mount(struct path *pa

static void follow_dotdot(struct nameidata *nd)
{
- set_root(nd);
+ if (!nd->root.mnt)
+ set_root(nd);

while(1) {
struct dentry *old = nd->path.dentry;
@@ -1847,7 +1848,7 @@ static int path_init(int dfd, const char
if (*name=='/') {
if (flags & LOOKUP_RCU) {
rcu_read_lock();
- set_root_rcu(nd);
+ nd->seq = set_root_rcu(nd);
} else {
set_root(nd);
path_get(&nd->root);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <dbor...@redhat.com>

commit caa8ad94edf686d02b555c65a6162c0d1b434958 upstream.

There's actually no good reason why we cannot use cgroup id 0,
so lets just remove this artificial barrier.

Reported-by: Alexey Perevalov <a.per...@samsung.com>
Signed-off-by: Daniel Borkmann <dbor...@redhat.com>
Tested-by: Alexey Perevalov <a.per...@samsung.com>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

net/netfilter/xt_cgroup.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -31,7 +31,7 @@ static int cgroup_mt_check(const struct
if (info->invert & ~1)
return -EINVAL;

- return info->id ? 0 : -EINVAL;
+ return 0;
}

static bool

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rasmus Villemoes <li...@rasmusvillemoes.dk>

commit acbbe6fbb240a927ee1f5994f04d31267d422215 upstream.

The C operator <= defines a perfectly fine total ordering on the set of
values representable in a long. However, unlike its namesake in the
integers, it is not translation invariant, meaning that we do not have
"b <= c" iff "a+b <= a+c" for all a,b,c.

This means that it is always wrong to try to boil down the relationship
between two longs to a question about the sign of their difference,
because the resulting relation [a LEQ b iff a-b <= 0] is neither
anti-symmetric or transitive. The former is due to -LONG_MIN==LONG_MIN
(take any two a,b with a-b = LONG_MIN; then a LEQ b and b LEQ a, but a !=
b). The latter can either be seen observing that x LEQ x+1 for all x,
implying x LEQ x+1 LEQ x+2 ... LEQ x-1 LEQ x; or more directly with the
simple example a=LONG_MIN, b=0, c=1, for which a-b < 0, b-c < 0, but a-c >
0.

Note that it makes absolutely no difference that a transmogrying bijection
has been applied before the comparison is done. In fact, had the
obfuscation not been done, one could probably not observe the bug
(assuming all values being compared always lie in one half of the address
space, the mathematical value of a-b is always representable in a long).
As it stands, one can easily obtain three file descriptors exhibiting the
non-transitivity of kcmp().

Side note 1: I can't see that ensuring the MSB of the multiplier is
set serves any purpose other than obfuscating the obfuscating code.

Side note 2:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
#include <sys/syscall.h>

enum kcmp_type {
KCMP_FILE,
KCMP_VM,
KCMP_FILES,
KCMP_FS,
KCMP_SIGHAND,
KCMP_IO,
KCMP_SYSVSEM,
KCMP_TYPES,
};
pid_t pid;

int kcmp(pid_t pid1, pid_t pid2, int type,
unsigned long idx1, unsigned long idx2)
{
return syscall(SYS_kcmp, pid1, pid2, type, idx1, idx2);
}
int cmp_fd(int fd1, int fd2)
{
int c = kcmp(pid, pid, KCMP_FILE, fd1, fd2);
if (c < 0) {
perror("kcmp");
exit(1);
}
assert(0 <= c && c < 3);
return c;
}
int cmp_fdp(const void *a, const void *b)
{
static const int normalize[] = {0, -1, 1};
return normalize[cmp_fd(*(int*)a, *(int*)b)];
}
#define MAX 100 /* This is plenty; I've seen it trigger for MAX==3 */
int main(int argc, char *argv[])
{
int r, s, count = 0;
int REL[3] = {0,0,0};
int fd[MAX];
pid = getpid();
while (count < MAX) {
r = open("/dev/null", O_RDONLY);
if (r < 0)
break;
fd[count++] = r;
}
printf("opened %d file descriptors\n", count);
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
qsort(fd, count, sizeof(fd[0]), cmp_fdp);
memset(REL, 0, sizeof(REL));

for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
return (REL[0] + REL[2] != 0);
}

Signed-off-by: Rasmus Villemoes <li...@rasmusvillemoes.dk>
Reviewed-by: Cyrill Gorcunov <gorc...@openvz.org>
"Eric W. Biederman" <ebie...@xmission.com>

Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

kernel/kcmp.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int t
*/
static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type)
{
- long ret;
+ long t1, t2;

- ret = kptr_obfuscate((long)v1, type) - kptr_obfuscate((long)v2, type);
+ t1 = kptr_obfuscate((long)v1, type);
+ t2 = kptr_obfuscate((long)v2, type);

- return (ret < 0) | ((ret > 0) << 1);
+ return (t1 < t2) | ((t1 > t2) << 1);
}

/* The caller must have pinned the task */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.ca...@oracle.com>

commit d97a86c170b4e432f76db072a827fe30b4d6f659 upstream.

The lvip[] array has "state->limit" elements so the condition here
should be >= instead of >.

Fixes: 6ceea22bbbc8 ('partitions: add aix lvm partition support files')
Signed-off-by: Dan Carpenter <dan.ca...@oracle.com>
Acked-by: Philippe De Muyter <ph...@macqel.be>
Signed-off-by: Jens Axboe <ax...@fb.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

block/partitions/aix.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -253,7 +253,7 @@ int aix_partition(struct parsed_partitio
continue;
}
lv_ix = be16_to_cpu(p->lv_ix) - 1;
- if (lv_ix > state->limit) {
+ if (lv_ix >= state->limit) {
cur_lv_ix = -1;
continue;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.s...@linux.intel.com>

commit e7637c6c0382485f4d2e20715d058dae6f2b6a7c upstream.

We have a duplicate code which starts first descriptor in the queue. Let's make
this as a separate helper that can be used in future as well.

Signed-off-by: Andy Shevchenko <andriy.s...@linux.intel.com>
Signed-off-by: Vinod Koul <vinod...@intel.com>
Cc: "Petallo, MauriceX R" <mauricex....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/dma/dw/core.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)

--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -279,6 +279,15 @@ static void dwc_dostart(struct dw_dma_ch
channel_set_bit(dw, CH_EN, dwc->mask);
}

+static void dwc_dostart_first_queued(struct dw_dma_chan *dwc)
+{
+ if (list_empty(&dwc->queue))
+ return;
+
+ list_move(dwc->queue.next, &dwc->active_list);
+ dwc_dostart(dwc, dwc_first_active(dwc));
+}
+
/*----------------------------------------------------------------------*/

static void
@@ -335,10 +344,7 @@ static void dwc_complete_all(struct dw_d
* the completed ones.
*/
list_splice_init(&dwc->active_list, &list);
- if (!list_empty(&dwc->queue)) {
- list_move(dwc->queue.next, &dwc->active_list);
- dwc_dostart(dwc, dwc_first_active(dwc));
- }
+ dwc_dostart_first_queued(dwc);

spin_unlock_irqrestore(&dwc->lock, flags);

@@ -467,10 +473,7 @@ static void dwc_scan_descriptors(struct
/* Try to continue after resetting the channel... */
dwc_chan_disable(dw, dwc);

- if (!list_empty(&dwc->queue)) {
- list_move(dwc->queue.next, &dwc->active_list);
- dwc_dostart(dwc, dwc_first_active(dwc));
- }
+ dwc_dostart_first_queued(dwc);
spin_unlock_irqrestore(&dwc->lock, flags);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guy Martin <gms...@tuxicoman.be>

commit 89206491201cbd1571009b36292af781cef74c1b upstream.

The current LWS cas only works correctly for 32bit. The new LWS allows
for CAS operations of variable size.

Signed-off-by: Guy Martin <gms...@tuxicoman.be>
Signed-off-by: Helge Deller <del...@gmx.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/parisc/kernel/syscall.S | 233 ++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 229 insertions(+), 4 deletions(-)

--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -74,7 +74,7 @@ ENTRY(linux_gateway_page)
/* ADDRESS 0xb0 to 0xb8, lws uses two insns for entry */
/* Light-weight-syscall entry must always be located at 0xb0 */
/* WARNING: Keep this number updated with table size changes */
-#define __NR_lws_entries (2)
+#define __NR_lws_entries (3)

lws_entry:
gate lws_start, %r0 /* increase privilege */
@@ -502,7 +502,7 @@ lws_exit:


/***************************************************
- Implementing CAS as an atomic operation:
+ Implementing 32bit CAS as an atomic operation:

%r26 - Address to examine
%r25 - Old value to check (old)
@@ -659,6 +659,230 @@ cas_action:
ASM_EXCEPTIONTABLE_ENTRY(2b-linux_gateway_page, 3b-linux_gateway_page)


+ /***************************************************
+ New CAS implementation which uses pointers and variable size
+ information. The value pointed by old and new MUST NOT change
+ while performing CAS. The lock only protect the value at %r26.
+
+ %r26 - Address to examine
+ %r25 - Pointer to the value to check (old)
+ %r24 - Pointer to the value to set (new)
+ %r23 - Size of the variable (0/1/2/3 for 8/16/32/64 bit)
+ %r28 - Return non-zero on failure
+ %r21 - Kernel error code
+
+ %r21 has the following meanings:
+
+ EAGAIN - CAS is busy, ldcw failed, try again.
+ EFAULT - Read or write failed.
+
+ Scratch: r20, r22, r28, r29, r1, fr4 (32bit for 64bit CAS only)
+
+ ****************************************************/
+
+ /* ELF32 Process entry path */
+lws_compare_and_swap_2:
+#ifdef CONFIG_64BIT
+ /* Clip the input registers */
+ depdi 0, 31, 32, %r26
+ depdi 0, 31, 32, %r25
+ depdi 0, 31, 32, %r24
+ depdi 0, 31, 32, %r23
+#endif
+
+ /* Check the validity of the size pointer */
+ subi,>>= 4, %r23, %r0
+ b,n lws_exit_nosys
+
+ /* Jump to the functions which will load the old and new values into
+ registers depending on the their size */
+ shlw %r23, 2, %r29
+ blr %r29, %r0
+ nop
+
+ /* 8bit load */
+4: ldb 0(%sr3,%r25), %r25
+ b cas2_lock_start
+5: ldb 0(%sr3,%r24), %r24
+ nop
+ nop
+ nop
+ nop
+ nop
+
+ /* 16bit load */
+6: ldh 0(%sr3,%r25), %r25
+ b cas2_lock_start
+7: ldh 0(%sr3,%r24), %r24
+ nop
+ nop
+ nop
+ nop
+ nop
+
+ /* 32bit load */
+8: ldw 0(%sr3,%r25), %r25
+ b cas2_lock_start
+9: ldw 0(%sr3,%r24), %r24
+ nop
+ nop
+ nop
+ nop
+ nop
+
+ /* 64bit load */
+#ifdef CONFIG_64BIT
+10: ldd 0(%sr3,%r25), %r25
+11: ldd 0(%sr3,%r24), %r24
+#else
+ /* Load new value into r22/r23 - high/low */
+10: ldw 0(%sr3,%r25), %r22
+11: ldw 4(%sr3,%r25), %r23
+ /* Load new value into fr4 for atomic store later */
+12: flddx 0(%sr3,%r24), %fr4
+#endif
+
+cas2_lock_start:
+ /* Load start of lock table */
+ ldil L%lws_lock_start, %r20
+ ldo R%lws_lock_start(%r20), %r28
+
+ /* Extract four bits from r26 and hash lock (Bits 4-7) */
+ extru %r26, 27, 4, %r20
+
+ /* Find lock to use, the hash is either one of 0 to
+ 15, multiplied by 16 (keep it 16-byte aligned)
+ and add to the lock table offset. */
+ shlw %r20, 4, %r20
+ add %r20, %r28, %r20
+
+ rsm PSW_SM_I, %r0 /* Disable interrupts */
+ /* COW breaks can cause contention on UP systems */
+ LDCW 0(%sr2,%r20), %r28 /* Try to acquire the lock */
+ cmpb,<>,n %r0, %r28, cas2_action /* Did we get it? */
+cas2_wouldblock:
+ ldo 2(%r0), %r28 /* 2nd case */
+ ssm PSW_SM_I, %r0
+ b lws_exit /* Contended... */
+ ldo -EAGAIN(%r0), %r21 /* Spin in userspace */
+
+ /*
+ prev = *addr;
+ if ( prev == old )
+ *addr = new;
+ return prev;
+ */
+
+ /* NOTES:
+ This all works becuse intr_do_signal
+ and schedule both check the return iasq
+ and see that we are on the kernel page
+ so this process is never scheduled off
+ or is ever sent any signal of any sort,
+ thus it is wholly atomic from usrspaces
+ perspective
+ */
+cas2_action:
+ /* Jump to the correct function */
+ blr %r29, %r0
+ /* Set %r28 as non-zero for now */
+ ldo 1(%r0),%r28
+
+ /* 8bit CAS */
+13: ldb,ma 0(%sr3,%r26), %r29
+ sub,= %r29, %r25, %r0
+ b,n cas2_end
+14: stb,ma %r24, 0(%sr3,%r26)
+ b cas2_end
+ copy %r0, %r28
+ nop
+ nop
+
+ /* 16bit CAS */
+15: ldh,ma 0(%sr3,%r26), %r29
+ sub,= %r29, %r25, %r0
+ b,n cas2_end
+16: sth,ma %r24, 0(%sr3,%r26)
+ b cas2_end
+ copy %r0, %r28
+ nop
+ nop
+
+ /* 32bit CAS */
+17: ldw,ma 0(%sr3,%r26), %r29
+ sub,= %r29, %r25, %r0
+ b,n cas2_end
+18: stw,ma %r24, 0(%sr3,%r26)
+ b cas2_end
+ copy %r0, %r28
+ nop
+ nop
+
+ /* 64bit CAS */
+#ifdef CONFIG_64BIT
+19: ldd,ma 0(%sr3,%r26), %r29
+ sub,= %r29, %r25, %r0
+ b,n cas2_end
+20: std,ma %r24, 0(%sr3,%r26)
+ copy %r0, %r28
+#else
+ /* Compare first word */
+19: ldw,ma 0(%sr3,%r26), %r29
+ sub,= %r29, %r22, %r0
+ b,n cas2_end
+ /* Compare second word */
+20: ldw,ma 4(%sr3,%r26), %r29
+ sub,= %r29, %r23, %r0
+ b,n cas2_end
+ /* Perform the store */
+21: fstdx %fr4, 0(%sr3,%r26)
+ copy %r0, %r28
+#endif
+
+cas2_end:
+ /* Free lock */
+ stw,ma %r20, 0(%sr2,%r20)
+ /* Enable interrupts */
+ ssm PSW_SM_I, %r0
+ /* Return to userspace, set no error */
+ b lws_exit
+ copy %r0, %r21
+
+22:
+ /* Error occurred on load or store */
+ /* Free lock */
+ stw %r20, 0(%sr2,%r20)
+ ssm PSW_SM_I, %r0
+ ldo 1(%r0),%r28
+ b lws_exit
+ ldo -EFAULT(%r0),%r21 /* set errno */
+ nop
+ nop
+ nop
+
+ /* Exception table entries, for the load and store, return EFAULT.
+ Each of the entries must be relocated. */
+ ASM_EXCEPTIONTABLE_ENTRY(4b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(5b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(6b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(7b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(8b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(9b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(10b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(11b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(13b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(14b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(15b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(16b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(17b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(18b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(19b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(20b-linux_gateway_page, 22b-linux_gateway_page)
+#ifndef CONFIG_64BIT
+ ASM_EXCEPTIONTABLE_ENTRY(12b-linux_gateway_page, 22b-linux_gateway_page)
+ ASM_EXCEPTIONTABLE_ENTRY(21b-linux_gateway_page, 22b-linux_gateway_page)
+#endif
+
/* Make sure nothing else is placed on this page */
.align PAGE_SIZE
END(linux_gateway_page)
@@ -675,8 +899,9 @@ ENTRY(end_linux_gateway_page)
/* Light-weight-syscall table */
/* Start of lws table. */
ENTRY(lws_table)
- LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic compare and swap */
- LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic compare and swap */
+ LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic 32bit CAS */
+ LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic 32bit CAS */
+ LWS_ENTRY(compare_and_swap_2) /* 2 - ELF32 Atomic 64bit CAS */
END(lws_table)
/* End of lws table */

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Patrick Palka <pat...@parcs.ath.cx>

commit 000a7d66ec30898f46869be01ab8205b056385d0 upstream.

We shouldn't set text_len in the code path that detects printk recursion
because text_len corresponds to the length of the string inside textbuf.
A few lines down from the line

text_len = strlen(recursion_msg);

is the line

text_len += vscnprintf(text + text_len, ...);

So if printk detects recursion, it sets text_len to 29 (the length of
recursion_msg) and logs an error. Then the message supplied by the
caller of printk is stored inside textbuf but offset by 29 bytes. This
means that the output of the recursive call to printk will contain 29
bytes of garbage in front of it.

This defect is caused by commit 458df9fd4815 ("printk: remove separate
printk_sched buffers and use printk buf instead") which turned the line

text_len = vscnprintf(text, ...);

into

text_len += vscnprintf(text + text_len, ...);

To fix this, this patch avoids setting text_len when logging the printk
recursion error. This patch also marks unlikely() the branch leading up
to this code.

Fixes: 458df9fd4815b478 ("printk: remove separate printk_sched buffers and use printk buf instead")
Signed-off-by: Patrick Palka <pat...@parcs.ath.cx>
Reviewed-by: Petr Mladek <pml...@suse.cz>
Reviewed-by: Jan Kara <ja...@suse.cz>
Acked-by: Steven Rostedt <ros...@goodmis.org>

Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

kernel/printk/printk.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1617,15 +1617,15 @@ asmlinkage int vprintk_emit(int facility
raw_spin_lock(&logbuf_lock);
logbuf_cpu = this_cpu;

- if (recursion_bug) {
+ if (unlikely(recursion_bug)) {
static const char recursion_msg[] =
"BUG: recent printk recursion!";

recursion_bug = 0;
- text_len = strlen(recursion_msg);
/* emit KERN_CRIT message */
printed_len += log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
- NULL, 0, recursion_msg, text_len);
+ NULL, 0, recursion_msg,
+ strlen(recursion_msg));
}

/*

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <ros...@goodmis.org>

commit 33b7f99cf003ca6c1d31c42b50e1100ad71aaec0 upstream.

Currently the top level debug file system function tracer shares its
ftrace_ops with the function graph tracer. This was thought to be fine
because the tracers are not used together, as one can only enable
function or function_graph tracer in the current_tracer file.

But that assumption proved to be incorrect. The function profiler
can use the function graph tracer when function tracing is enabled.
Since all function graph users uses the function tracing ftrace_ops
this causes a conflict and when a user enables both function profiling
as well as the function tracer it will crash ftrace and disable it.

The quick solution so far is to move them as separate ftrace_ops like
it was earlier. The problem though is to synchronize the functions that
are traced because both function and function_graph tracer are limited
by the selections made in the set_ftrace_filter and set_ftrace_notrace
files.

To handle this, a new structure is made called ftrace_ops_hash. This
structure will now hold the filter_hash and notrace_hash, and the
ftrace_ops will point to this structure. That will allow two ftrace_ops
to share the same hashes.

Since most ftrace_ops do not share the hashes, and to keep allocation
simple, the ftrace_ops structure will include both a pointer to the
ftrace_ops_hash called func_hash, as well as the structure itself,
called local_hash. When the ops are registered, the func_hash pointer
will be initialized to point to the local_hash within the ftrace_ops
structure. Some of the ftrace internal ftrace_ops will be initialized
statically. This will allow for the function and function_graph tracer
to have separate ops but still share the same hash tables that determine
what functions they trace.

Signed-off-by: Steven Rostedt <ros...@goodmis.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>


---

include/linux/ftrace.h | 13 +++++-
kernel/trace/ftrace.c | 98 +++++++++++++++++++++++++------------------------
2 files changed, 62 insertions(+), 49 deletions(-)

--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -103,6 +103,15 @@ enum {
FTRACE_OPS_FL_DELETED = 1 << 8,
};

+#ifdef CONFIG_DYNAMIC_FTRACE
+/* The hash used to know what functions callbacks trace */
+struct ftrace_ops_hash {
+ struct ftrace_hash *notrace_hash;
+ struct ftrace_hash *filter_hash;
+ struct mutex regex_lock;
+};
+#endif
+
/*
* Note, ftrace_ops can be referenced outside of RCU protection.
* (Although, for perf, the control ops prevent that). If ftrace_ops is
@@ -121,8 +130,8 @@ struct ftrace_ops {
int __percpu *disabled;
void *private;
#ifdef CONFIG_DYNAMIC_FTRACE
- struct ftrace_hash *notrace_hash;
- struct ftrace_hash *filter_hash;
+ struct ftrace_ops_hash local_hash;
+ struct ftrace_ops_hash *func_hash;
struct mutex regex_lock;
#endif
};
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -65,15 +65,17 @@
#define FL_GLOBAL_CONTROL_MASK (FTRACE_OPS_FL_CONTROL)

#ifdef CONFIG_DYNAMIC_FTRACE
-#define INIT_REGEX_LOCK(opsname) \
- .regex_lock = __MUTEX_INITIALIZER(opsname.regex_lock),
+#define INIT_OPS_HASH(opsname) \
+ .func_hash = &opsname.local_hash, \
+ .local_hash.regex_lock = __MUTEX_INITIALIZER(opsname.local_hash.regex_lock),
#else
-#define INIT_REGEX_LOCK(opsname)
+#define INIT_OPS_HASH(opsname)
#endif

static struct ftrace_ops ftrace_list_end __read_mostly = {
.func = ftrace_stub,
.flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_STUB,
+ INIT_OPS_HASH(ftrace_list_end)
};

/* ftrace_enabled is a method to turn ftrace on or off */
@@ -143,7 +145,8 @@ static inline void ftrace_ops_init(struc
{
#ifdef CONFIG_DYNAMIC_FTRACE
if (!(ops->flags & FTRACE_OPS_FL_INITIALIZED)) {
- mutex_init(&ops->regex_lock);
+ mutex_init(&ops->local_hash.regex_lock);
+ ops->func_hash = &ops->local_hash;
ops->flags |= FTRACE_OPS_FL_INITIALIZED;
}
#endif
@@ -902,7 +905,7 @@ static void unregister_ftrace_profiler(v
static struct ftrace_ops ftrace_profile_ops __read_mostly = {
.func = function_profile_call,
.flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
- INIT_REGEX_LOCK(ftrace_profile_ops)
+ INIT_OPS_HASH(ftrace_profile_ops)
};

static int register_ftrace_profiler(void)
@@ -1082,11 +1085,12 @@ static const struct ftrace_hash empty_ha
#define EMPTY_HASH ((struct ftrace_hash *)&empty_hash)

static struct ftrace_ops global_ops = {
- .func = ftrace_stub,
- .notrace_hash = EMPTY_HASH,
- .filter_hash = EMPTY_HASH,
- .flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
- INIT_REGEX_LOCK(global_ops)
+ .func = ftrace_stub,
+ .local_hash.notrace_hash = EMPTY_HASH,
+ .local_hash.filter_hash = EMPTY_HASH,
+ INIT_OPS_HASH(global_ops)
+ .flags = FTRACE_OPS_FL_RECURSION_SAFE |
+ FTRACE_OPS_FL_INITIALIZED,
};

struct ftrace_page {
@@ -1227,8 +1231,8 @@ static void free_ftrace_hash_rcu(struct
void ftrace_free_filter(struct ftrace_ops *ops)
{
ftrace_ops_init(ops);
- free_ftrace_hash(ops->filter_hash);
- free_ftrace_hash(ops->notrace_hash);
+ free_ftrace_hash(ops->func_hash->filter_hash);
+ free_ftrace_hash(ops->func_hash->notrace_hash);
}

static struct ftrace_hash *alloc_ftrace_hash(int size_bits)
@@ -1394,8 +1398,8 @@ ftrace_ops_test(struct ftrace_ops *ops,
return 0;
#endif

- filter_hash = rcu_dereference_raw_notrace(ops->filter_hash);
- notrace_hash = rcu_dereference_raw_notrace(ops->notrace_hash);
+ filter_hash = rcu_dereference_raw_notrace(ops->func_hash->filter_hash);
+ notrace_hash = rcu_dereference_raw_notrace(ops->func_hash->notrace_hash);

if ((ftrace_hash_empty(filter_hash) ||
ftrace_lookup_ip(filter_hash, ip)) &&
@@ -1519,14 +1523,14 @@ static void __ftrace_hash_rec_update(str
* gets inversed.
*/
if (filter_hash) {
- hash = ops->filter_hash;
- other_hash = ops->notrace_hash;
+ hash = ops->func_hash->filter_hash;
+ other_hash = ops->func_hash->notrace_hash;
if (ftrace_hash_empty(hash))
all = 1;
} else {
inc = !inc;
- hash = ops->notrace_hash;
- other_hash = ops->filter_hash;
+ hash = ops->func_hash->notrace_hash;
+ other_hash = ops->func_hash->filter_hash;
/*
* If the notrace hash has no items,
* then there's nothing to do.
@@ -2196,8 +2200,8 @@ static inline int ops_traces_mod(struct
* Filter_hash being empty will default to trace module.
* But notrace hash requires a test of individual module functions.
*/
- return ftrace_hash_empty(ops->filter_hash) &&
- ftrace_hash_empty(ops->notrace_hash);
+ return ftrace_hash_empty(ops->func_hash->filter_hash) &&
+ ftrace_hash_empty(ops->func_hash->notrace_hash);
}

/*
@@ -2219,12 +2223,12 @@ ops_references_rec(struct ftrace_ops *op
return 0;

/* The function must be in the filter */
- if (!ftrace_hash_empty(ops->filter_hash) &&
- !ftrace_lookup_ip(ops->filter_hash, rec->ip))
+ if (!ftrace_hash_empty(ops->func_hash->filter_hash) &&
+ !ftrace_lookup_ip(ops->func_hash->filter_hash, rec->ip))
return 0;

/* If in notrace hash, we ignore it too */
- if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
+ if (ftrace_lookup_ip(ops->func_hash->notrace_hash, rec->ip))
return 0;

return 1;
@@ -2544,10 +2548,10 @@ t_next(struct seq_file *m, void *v, loff
} else {
rec = &iter->pg->records[iter->idx++];
if (((iter->flags & FTRACE_ITER_FILTER) &&
- !(ftrace_lookup_ip(ops->filter_hash, rec->ip))) ||
+ !(ftrace_lookup_ip(ops->func_hash->filter_hash, rec->ip))) ||

((iter->flags & FTRACE_ITER_NOTRACE) &&
- !ftrace_lookup_ip(ops->notrace_hash, rec->ip)) ||
+ !ftrace_lookup_ip(ops->func_hash->notrace_hash, rec->ip)) ||

((iter->flags & FTRACE_ITER_ENABLED) &&
!(rec->flags & FTRACE_FL_ENABLED))) {
@@ -2596,7 +2600,7 @@ static void *t_start(struct seq_file *m,
* functions are enabled.
*/
if (iter->flags & FTRACE_ITER_FILTER &&
- ftrace_hash_empty(ops->filter_hash)) {
+ ftrace_hash_empty(ops->func_hash->filter_hash)) {
if (*pos > 0)
return t_hash_start(m, pos);
iter->flags |= FTRACE_ITER_PRINTALL;
@@ -2750,12 +2754,12 @@ ftrace_regex_open(struct ftrace_ops *ops
iter->ops = ops;
iter->flags = flag;

- mutex_lock(&ops->regex_lock);
+ mutex_lock(&ops->func_hash->regex_lock);

if (flag & FTRACE_ITER_NOTRACE)
- hash = ops->notrace_hash;
+ hash = ops->func_hash->notrace_hash;
else
- hash = ops->filter_hash;
+ hash = ops->func_hash->filter_hash;

if (file->f_mode & FMODE_WRITE) {
iter->hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, hash);
@@ -2788,7 +2792,7 @@ ftrace_regex_open(struct ftrace_ops *ops
file->private_data = iter;

out_unlock:
- mutex_unlock(&ops->regex_lock);
+ mutex_unlock(&ops->func_hash->regex_lock);

return ret;
}
@@ -3026,7 +3030,7 @@ static struct ftrace_ops trace_probe_ops
{
.func = function_trace_probe_call,
.flags = FTRACE_OPS_FL_INITIALIZED,
- INIT_REGEX_LOCK(trace_probe_ops)
+ INIT_OPS_HASH(trace_probe_ops)
};

static int ftrace_probe_registered;
@@ -3089,7 +3093,7 @@ register_ftrace_function_probe(char *glo
void *data)
{
struct ftrace_func_probe *entry;
- struct ftrace_hash **orig_hash = &trace_probe_ops.filter_hash;
+ struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
struct ftrace_hash *hash;
struct ftrace_page *pg;
struct dyn_ftrace *rec;
@@ -3106,7 +3110,7 @@ register_ftrace_function_probe(char *glo
if (WARN_ON(not))
return -EINVAL;

- mutex_lock(&trace_probe_ops.regex_lock);
+ mutex_lock(&trace_probe_ops.func_hash->regex_lock);

hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
if (!hash) {
@@ -3175,7 +3179,7 @@ register_ftrace_function_probe(char *glo
out_unlock:
mutex_unlock(&ftrace_lock);
out:
- mutex_unlock(&trace_probe_ops.regex_lock);
+ mutex_unlock(&trace_probe_ops.func_hash->regex_lock);
free_ftrace_hash(hash);

return count;
@@ -3193,7 +3197,7 @@ __unregister_ftrace_function_probe(char
struct ftrace_func_entry *rec_entry;
struct ftrace_func_probe *entry;
struct ftrace_func_probe *p;
- struct ftrace_hash **orig_hash = &trace_probe_ops.filter_hash;
+ struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
struct list_head free_list;
struct ftrace_hash *hash;
struct hlist_node *tmp;
@@ -3215,7 +3219,7 @@ __unregister_ftrace_function_probe(char
return;
}

- mutex_lock(&trace_probe_ops.regex_lock);
+ mutex_lock(&trace_probe_ops.func_hash->regex_lock);

hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
if (!hash)
@@ -3268,7 +3272,7 @@ __unregister_ftrace_function_probe(char
mutex_unlock(&ftrace_lock);

out_unlock:
- mutex_unlock(&trace_probe_ops.regex_lock);
+ mutex_unlock(&trace_probe_ops.func_hash->regex_lock);
free_ftrace_hash(hash);
}

@@ -3464,12 +3468,12 @@ ftrace_set_hash(struct ftrace_ops *ops,
if (unlikely(ftrace_disabled))
return -ENODEV;

- mutex_lock(&ops->regex_lock);
+ mutex_lock(&ops->func_hash->regex_lock);

if (enable)
- orig_hash = &ops->filter_hash;
+ orig_hash = &ops->func_hash->filter_hash;
else
- orig_hash = &ops->notrace_hash;
+ orig_hash = &ops->func_hash->notrace_hash;

hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
if (!hash) {
@@ -3497,7 +3501,7 @@ ftrace_set_hash(struct ftrace_ops *ops,
mutex_unlock(&ftrace_lock);

out_regex_unlock:
- mutex_unlock(&ops->regex_lock);
+ mutex_unlock(&ops->func_hash->regex_lock);

free_ftrace_hash(hash);
return ret;
@@ -3704,15 +3708,15 @@ int ftrace_regex_release(struct inode *i

trace_parser_put(parser);

- mutex_lock(&iter->ops->regex_lock);
+ mutex_lock(&iter->ops->func_hash->regex_lock);

if (file->f_mode & FMODE_WRITE) {
filter_hash = !!(iter->flags & FTRACE_ITER_FILTER);

if (filter_hash)
- orig_hash = &iter->ops->filter_hash;
+ orig_hash = &iter->ops->func_hash->filter_hash;
else
- orig_hash = &iter->ops->notrace_hash;
+ orig_hash = &iter->ops->func_hash->notrace_hash;

mutex_lock(&ftrace_lock);
ret = ftrace_hash_move(iter->ops, filter_hash,
@@ -3723,7 +3727,7 @@ int ftrace_regex_release(struct inode *i
mutex_unlock(&ftrace_lock);
}

- mutex_unlock(&iter->ops->regex_lock);
+ mutex_unlock(&iter->ops->func_hash->regex_lock);
free_ftrace_hash(iter->hash);
kfree(iter);

@@ -4335,7 +4339,7 @@ void __init ftrace_init(void)
static struct ftrace_ops global_ops = {
.func = ftrace_stub,
.flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
- INIT_REGEX_LOCK(global_ops)
+ INIT_OPS_HASH(global_ops)
};

static int __init ftrace_nodyn_init(void)
@@ -4437,7 +4441,7 @@ ftrace_ops_control_func(unsigned long ip
static struct ftrace_ops control_ops = {
.func = ftrace_ops_control_func,
.flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
- INIT_REGEX_LOCK(control_ops)
+ INIT_OPS_HASH(control_ops)
};

static inline void

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.s...@linux.intel.com>

commit dd8ecfcac66b4485416b2d1df0ec4798b198d7d6 upstream.

Accordingly to discussion [1] and followed up documentation the DMA controller
driver shouldn't start any DMA operations when dmaengine_submit() is called.

This patch fixes the workflow in dw_dmac driver to follow the documentation.

[1] http://www.spinics.net/lists/arm-kernel/msg125987.html

Signed-off-by: Andy Shevchenko <andriy.s...@linux.intel.com>
Signed-off-by: Vinod Koul <vinod...@intel.com>
Cc: "Petallo, MauriceX R" <mauricex....@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/dma/TODO | 1 -
drivers/dma/dw/core.c | 19 +++++++------------
2 files changed, 7 insertions(+), 13 deletions(-)

--- a/drivers/dma/TODO
+++ b/drivers/dma/TODO
@@ -7,7 +7,6 @@ TODO for slave dma
- imx-dma
- imx-sdma
- mxs-dma.c
- - dw_dmac
- intel_mid_dma
4. Check other subsystems for dma drivers and merge/move to dmaengine
5. Remove dma_slave_config's dma direction.
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -680,17 +680,9 @@ static dma_cookie_t dwc_tx_submit(struct
* possible, perhaps even appending to those already submitted
* for DMA. But this is hard to do in a race-free manner.
*/
- if (list_empty(&dwc->active_list)) {
- dev_vdbg(chan2dev(tx->chan), "%s: started %u\n", __func__,
- desc->txd.cookie);
- list_add_tail(&desc->desc_node, &dwc->active_list);
- dwc_dostart(dwc, dwc_first_active(dwc));
- } else {
- dev_vdbg(chan2dev(tx->chan), "%s: queued %u\n", __func__,
- desc->txd.cookie);

- list_add_tail(&desc->desc_node, &dwc->queue);
- }
+ dev_vdbg(chan2dev(tx->chan), "%s: queued %u\n", __func__, desc->txd.cookie);
+ list_add_tail(&desc->desc_node, &dwc->queue);

spin_unlock_irqrestore(&dwc->lock, flags);

@@ -1095,9 +1087,12 @@ dwc_tx_status(struct dma_chan *chan,
static void dwc_issue_pending(struct dma_chan *chan)
{
struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+ unsigned long flags;

- if (!list_empty(&dwc->queue))
- dwc_scan_descriptors(to_dw_dma(chan->device), dwc);
+ spin_lock_irqsave(&dwc->lock, flags);
+ if (list_empty(&dwc->active_list))
+ dwc_dostart_first_queued(dwc);
+ spin_unlock_irqrestore(&dwc->lock, flags);
}

static int dwc_alloc_chan_resources(struct dma_chan *chan)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Axel Lin <axel...@ingics.com>

commit d9f26748128c73ec6bed2846ca52fb1c2edc3ced upstream.

device_add() expects that any memory allocated via devm_* API is only
done in the device's probe function.

Fix below boot warning:
[ 3.092348] WARNING: at drivers/base/dd.c:286
[ 3.096637] Modules linked in:
[ 3.099697] CPU: 0 PID: 25 Comm: kworker/u2:1 Tainted: G W 3.16.1-s3k-drv-999-svn5771_knld-999 #158
[ 3.109610] Workqueue: deferwq deferred_probe_work_func
[ 3.114736] task: c787f020 ti: c790c000 task.ti: c790c000
[ 3.120062] NIP: c01df158 LR: c01df144 CTR: 00000000
[ 3.124983] REGS: c790db30 TRAP: 0700 Tainted: G W (3.16.1-s3k-drv-999-svn5771_knld-999)
[ 3.134162] MSR: 00029032 <EE,ME,IR,DR,RI> CR: 22002082 XER: 20000000
[ 3.140703]
[ 3.140703] GPR00: 00000001 c790dbe0 c787f020 00000044 00000054 00000308 c056da0e 20737069
[ 3.140703] GPR08: 33323736 000ebfe0 00000308 000ebfdf 22002082 00000000 c046c5a0 c046c608
[ 3.140703] GPR16: c046c614 c046c620 c046c62c c046c638 c046c648 c046c654 c046c68c c046c6c4
[ 3.140703] GPR24: 00000000 00000000 00000003 c0401aa0 c0596638 c059662c c054e7a8 c7996800
[ 3.170102] NIP [c01df158] driver_probe_device+0xf8/0x334
[ 3.175431] LR [c01df144] driver_probe_device+0xe4/0x334
[ 3.180633] Call Trace:
[ 3.183093] [c790dbe0] [c01df144] driver_probe_device+0xe4/0x334 (unreliable)
[ 3.190147] [c790dc10] [c01dd15c] bus_for_each_drv+0x7c/0xc0
[ 3.195741] [c790dc40] [c01df5fc] device_attach+0xcc/0xf8
[ 3.201076] [c790dc60] [c01dd6d4] bus_probe_device+0xb4/0xc4
[ 3.206666] [c790dc80] [c01db9f8] device_add+0x270/0x564
[ 3.211923] [c790dcc0] [c0219e84] spi_add_device+0xc0/0x190
[ 3.217427] [c790dce0] [c021a79c] spi_register_master+0x720/0x834
[ 3.223455] [c790dd40] [c021cb48] of_fsl_spi_probe+0x55c/0x614
[ 3.229234] [c790dda0] [c01e0d2c] platform_drv_probe+0x30/0x74
[ 3.234987] [c790ddb0] [c01df18c] driver_probe_device+0x12c/0x334
[ 3.241008] [c790dde0] [c01dd15c] bus_for_each_drv+0x7c/0xc0
[ 3.246602] [c790de10] [c01df5fc] device_attach+0xcc/0xf8
[ 3.251937] [c790de30] [c01dd6d4] bus_probe_device+0xb4/0xc4
[ 3.257536] [c790de50] [c01de9d8] deferred_probe_work_func+0x98/0xe0
[ 3.263816] [c790de70] [c00305b8] process_one_work+0x18c/0x440
[ 3.269577] [c790dea0] [c0030a00] worker_thread+0x194/0x67c
[ 3.275105] [c790def0] [c0039198] kthread+0xd0/0xe4
[ 3.279911] [c790df40] [c000c6d0] ret_from_kernel_thread+0x5c/0x64
[ 3.285970] Instruction dump:
[ 3.288900] 80de0000 419e01d0 3b7b0038 3c60c046 7f65db78 38635264 48211b99 813f00a0
[ 3.296559] 381f00a0 7d290278 3169ffff 7c0b4910 <0f000000> 93df0044 7fe3fb78 4bfffd4d

Reported-by: leroy christophe <christop...@c-s.fr>
Signed-off-by: Axel Lin <axel...@ingics.com>
Tested-by: Christophe Leroy <christop...@c-s.fr>
Signed-off-by: Mark Brown <bro...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/spi/spi-fsl-espi.c | 15 ++++++++++++---
drivers/spi/spi-fsl-spi.c | 10 +++++++---
2 files changed, 19 insertions(+), 6 deletions(-)

--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -452,16 +452,16 @@ static int fsl_espi_setup(struct spi_dev
int retval;
u32 hw_mode;
u32 loop_mode;
- struct spi_mpc8xxx_cs *cs = spi->controller_state;
+ struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi);

if (!spi->max_speed_hz)
return -EINVAL;

if (!cs) {
- cs = devm_kzalloc(&spi->dev, sizeof(*cs), GFP_KERNEL);
+ cs = kzalloc(sizeof(*cs), GFP_KERNEL);
if (!cs)
return -ENOMEM;
- spi->controller_state = cs;
+ spi_set_ctldata(spi, cs);
}

mpc8xxx_spi = spi_master_get_devdata(spi->master);
@@ -496,6 +496,14 @@ static int fsl_espi_setup(struct spi_dev
return 0;
}

+static void fsl_espi_cleanup(struct spi_device *spi)
+{
+ struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi);
+
+ kfree(cs);
+ spi_set_ctldata(spi, NULL);
+}
+
void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
{
struct fsl_espi_reg *reg_base = mspi->reg_base;
@@ -605,6 +613,7 @@ static struct spi_master * fsl_espi_prob

master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 16);
master->setup = fsl_espi_setup;
+ master->cleanup = fsl_espi_cleanup;

mpc8xxx_spi = spi_master_get_devdata(master);
mpc8xxx_spi->spi_do_one_msg = fsl_espi_do_one_msg;
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -425,16 +425,16 @@ static int fsl_spi_setup(struct spi_devi
struct fsl_spi_reg *reg_base;
int retval;
u32 hw_mode;
- struct spi_mpc8xxx_cs *cs = spi->controller_state;
+ struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi);

if (!spi->max_speed_hz)
return -EINVAL;

if (!cs) {
- cs = devm_kzalloc(&spi->dev, sizeof(*cs), GFP_KERNEL);
+ cs = kzalloc(sizeof(*cs), GFP_KERNEL);
if (!cs)
return -ENOMEM;
- spi->controller_state = cs;
+ spi_set_ctldata(spi, cs);
}
mpc8xxx_spi = spi_master_get_devdata(spi->master);

@@ -496,9 +496,13 @@ static int fsl_spi_setup(struct spi_devi
static void fsl_spi_cleanup(struct spi_device *spi)
{
struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+ struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi);

if (mpc8xxx_spi->type == TYPE_GRLIB && gpio_is_valid(spi->cs_gpio))
gpio_free(spi->cs_gpio);
+
+ kfree(cs);
+ spi_set_ctldata(spi, NULL);
}

static void fsl_spi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <ne...@suse.de>

commit 669cc7ba77864e7b1ac39c9f2b2afb8730f341f4 upstream.

If there are outstanding writes when close_sync is called,
the change to ->start_next_window might cause them to
decrement the wrong counter when they complete. Fix this
by merging the two counters into the one that will be decremented.

Having an incorrect value in a counter can cause raise_barrier()
to hangs, so this is suitable for -stable.

Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
Signed-off-by: NeilBrown <ne...@suse.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/md/raid1.c | 5 +++++
1 file changed, 5 insertions(+)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1548,8 +1548,13 @@ static void close_sync(struct r1conf *co
mempool_destroy(conf->r1buf_pool);
conf->r1buf_pool = NULL;

+ spin_lock_irq(&conf->resync_lock);
conf->next_resync = 0;
conf->start_next_window = MaxSector;
+ conf->current_window_requests +=
+ conf->next_window_requests;
+ conf->next_window_requests = 0;
+ spin_unlock_irq(&conf->resync_lock);
}

static int raid1_spare_active(struct mddev *mddev)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <viresh...@linaro.org>

commit b1b12babe3b72cfb08b875245e5a5d7c2747c772 upstream.

Commit 8e30444e1530 ("cpufreq: fix cpufreq suspend/resume for intel_pstate")
introduced a bug where the governors wouldn't be stopped anymore for
->target{_index}() drivers during suspend. This happens because
'cpufreq_suspended' is updated before stopping the governors during suspend
and due to this __cpufreq_governor() would return early due to this check:

/* Don't start any governor operations if we are entering suspend */
if (cpufreq_suspended)
return 0;

Fixes: 8e30444e1530 ("cpufreq: fix cpufreq suspend/resume for intel_pstate")
Signed-off-by: Viresh Kumar <viresh...@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j...@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/cpufreq/cpufreq.c | 7 ++++---

1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1666,10 +1666,8 @@ void cpufreq_suspend(void)
if (!cpufreq_driver)
return;

- cpufreq_suspended = true;
-
if (!has_target())
- return;
+ goto suspend;

pr_debug("%s: Suspending Governors\n", __func__);

@@ -1682,6 +1680,9 @@ void cpufreq_suspend(void)
pr_err("%s: Failed to suspend driver: %p\n", __func__,
policy);
}
+
+suspend:
+ cpufreq_suspended = true;
}

/**

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <t...@kernel.org>

commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream.

If pcpu_map_pages() fails midway, it unmaps the already mapped pages.
Currently, it doesn't flush tlb after the partial unmapping. This may
be okay in most cases as the established mapping hasn't been used at
that point but it can go wrong and when it goes wrong it'd be
extremely difficult to track down.

Flush tlb after the partial unmapping.

Signed-off-by: Tejun Heo <t...@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

mm/percpu-vm.c | 1 +

1 file changed, 1 insertion(+)

--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -272,6 +272,7 @@ err:
__pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
page_end - page_start);
}
+ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
return err;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ulf Hansson <ulf.h...@linaro.org>

commit 7878289b269d41c8e611aa6d4519feae706e49f3 upstream.

Commit "mmc: mmci: Handle CMD irq before DATA irq", caused an issue
when using the ARM model of the PL181 and running QEMU.

The bug was reported for the following QEMU version:
$ qemu-system-arm -version
QEMU emulator version 2.0.0 (Debian 2.0.0+dfsg-2ubuntu1.1), Copyright
(c) 2003-2008 Fabrice Bellard

To resolve the problem, let's restore the old behavior were the DATA
irq is handled prior the CMD irq, but only for the arm_variant, which
the problem was reported for.

Reported-by: John Stultz <john....@linaro.org>
Cc: Peter Maydell <peter....@linaro.org>
Cc: Russell King <li...@arm.linux.org.uk>
Tested-by: Kees Cook <kees...@chromium.org>
Tested-by: John Stultz <john....@linaro.org>
Cc: <sta...@vger.kernel.org> # v3.15+
Signed-off-by: Ulf Hansson <ulf.h...@linaro.org>
[kees: backported to 3.16]
Signed-off-by: Kees Cook <kees...@chromium.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/mmc/host/mmci.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -65,6 +65,7 @@ static unsigned int fmax = 515633;
* @pwrreg_clkgate: MMCIPOWER register must be used to gate the clock
* @busy_detect: true if busy detection on dat0 is supported
* @pwrreg_nopower: bits in MMCIPOWER don't controls ext. power supply
+ * @reversed_irq_handling: handle data irq before cmd irq.
*/
struct variant_data {
unsigned int clkreg;
@@ -80,6 +81,7 @@ struct variant_data {
bool pwrreg_clkgate;
bool busy_detect;
bool pwrreg_nopower;
+ bool reversed_irq_handling;
};

static struct variant_data variant_arm = {
@@ -87,6 +89,7 @@ static struct variant_data variant_arm =
.fifohalfsize = 8 * 4,
.datalength_bits = 16,
.pwrreg_powerup = MCI_PWR_UP,
+ .reversed_irq_handling = true,
};

static struct variant_data variant_arm_extended_fifo = {
@@ -1163,8 +1166,13 @@ static irqreturn_t mmci_irq(int irq, voi

dev_dbg(mmc_dev(host->mmc), "irq0 (data+cmd) %08x\n", status);

- mmci_cmd_irq(host, host->cmd, status);
- mmci_data_irq(host, host->data, status);
+ if (host->variant->reversed_irq_handling) {
+ mmci_data_irq(host, host->data, status);
+ mmci_cmd_irq(host, host->cmd, status);
+ } else {
+ mmci_cmd_irq(host, host->cmd, status);
+ mmci_data_irq(host, host->data, status);
+ }

/* Don't poll for busy completion in irq context. */
if (host->busy_status)

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eliad Peller <el...@wizery.com>

commit a5fe8e7695dc3f547e955ad2b662e3e72969e506 upstream.

alpha2 is defined as 2-chars array, but is used in multiple
places as string (e.g. with nla_put_string calls), which
might leak kernel data.

Solve it by simply adding an extra char for the NULL
terminator, making such operations safe.

Signed-off-by: Eliad Peller <eliadx...@intel.com>
Signed-off-by: Johannes Berg <johann...@intel.com>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

include/net/regulatory.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -167,7 +167,7 @@ struct ieee80211_reg_rule {
struct ieee80211_regdomain {
struct rcu_head rcu_head;
u32 n_reg_rules;
- char alpha2[2];
+ char alpha2[3];
enum nl80211_dfs_regions dfs_region;
struct ieee80211_reg_rule reg_rules[];
};

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pablo Neira Ayuso <pa...@netfilter.org>

commit b88825de8545ad252c31543fef13cadf4de7a2bc upstream.

Fix possible replacement of the per-cpu chain counters by null
pointer when updating an existing chain in the commit path.

Reported-by: Matteo Croce <techn...@gmail.com>

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

net/netfilter/nf_tables_api.c | 3 +++
1 file changed, 3 insertions(+)

--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -899,6 +899,9 @@ static struct nft_stats __percpu *nft_st
static void nft_chain_stats_replace(struct nft_base_chain *chain,
struct nft_stats __percpu *newstats)
{
+ if (newstats == NULL)
+ return;
+
if (chain->stats) {
struct nft_stats __percpu *oldstats =
nft_dereference(chain->stats);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <ne...@suse.de>

commit c6d119cf1b5a778e9ed60a006e2a434fcc4471a2 upstream.

commit 79ef3a8aa1cb1523cc231c9a90a278333c21f761 made
it possible for reads to happen concurrently with resync.
This means that we need to be more careful where read_balancing
is allowed during resync - we can no longer be sure that any
resync that has already started will definitely finish.

So keep read_balancing to before recovery_cp, which is conservative
but safe.

This bug makes it possible to read from a device that doesn't
have up-to-date data, so it can cause data corruption.
So it is suitable for any kernel since 3.11.

Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
Signed-off-by: NeilBrown <ne...@suse.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/md/raid1.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -540,11 +540,7 @@ static int read_balance(struct r1conf *c
has_nonrot_disk = 0;
choose_next_idle = 0;

- if (conf->mddev->recovery_cp < MaxSector &&
- (this_sector + sectors >= conf->next_resync))
- choose_first = 1;
- else
- choose_first = 0;
+ choose_first = (conf->mddev->recovery_cp < this_sector + sectors);

for (disk = 0 ; disk < conf->raid_disks * 2 ; disk++) {
sector_t dist;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <ty...@mit.edu>

commit a9cfcd63e8d206ce4235c355d857c4fbdf0f4587 upstream.

Thanks to Dan Carpenter for extending smatch to find bugs like this.
(This was found using a development version of smatch.)

Fixes: 36de928641ee48b2078d3fe9514242aaa2f92013
Reported-by: Dan Carpenter <dan.ca...@oracle.com
Signed-off-by: Theodore Ts'o <ty...@mit.edu>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

fs/ext4/namei.c | 2 ++
fs/ext4/resize.c | 2 ++
2 files changed, 4 insertions(+)

--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3240,6 +3240,7 @@ static int ext4_rename(struct inode *old
&new.de, &new.inlined);
if (IS_ERR(new.bh)) {
retval = PTR_ERR(new.bh);
+ new.bh = NULL;
goto end_rename;
}
if (new.bh) {
@@ -3386,6 +3387,7 @@ static int ext4_cross_rename(struct inod
&new.de, &new.inlined);
if (IS_ERR(new.bh)) {
retval = PTR_ERR(new.bh);
+ new.bh = NULL;
goto end_rename;
}

--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -575,6 +575,7 @@ handle_bb:
bh = bclean(handle, sb, block);
if (IS_ERR(bh)) {
err = PTR_ERR(bh);
+ bh = NULL;
goto out;
}
overhead = ext4_group_overhead_blocks(sb, group);
@@ -603,6 +604,7 @@ handle_ib:
bh = bclean(handle, sb, block);
if (IS_ERR(bh)) {
err = PTR_ERR(bh);
+ bh = NULL;
goto out;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edum...@google.com>

commit 7bd8490eef9776ced7632345df5133384b6be0fe upstream.

xt_hashlimit cannot be used with large hash tables, because garbage
collector is run from a timer. If table is really big, its possible
to hold cpu for more than 500 msec, which is unacceptable.

Switch to a work queue, and use proper scheduling points to remove
latencies spikes.

Later, we also could switch to a smoother garbage collection done
at lookup time, one bucket at a time...

Signed-off-by: Eric Dumazet <edum...@google.com>
Cc: Florian Westphal <f...@strlen.de>
Cc: Patrick McHardy <ka...@trash.net>
Reviewed-by: Florian Westphal <f...@strlen.de>

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

net/netfilter/xt_hashlimit.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)

--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -104,7 +104,7 @@ struct xt_hashlimit_htable {
spinlock_t lock; /* lock for list_head */
u_int32_t rnd; /* random seed for hash */
unsigned int count; /* number entries in table */
- struct timer_list timer; /* timer for gc */
+ struct delayed_work gc_work;

/* seq_file stuff */
struct proc_dir_entry *pde;
@@ -213,7 +213,7 @@ dsthash_free(struct xt_hashlimit_htable
call_rcu_bh(&ent->rcu, dsthash_free_rcu);
ht->count--;
}
-static void htable_gc(unsigned long htlong);
+static void htable_gc(struct work_struct *work);

static int htable_create(struct net *net, struct xt_hashlimit_mtinfo1 *minfo,
u_int8_t family)
@@ -273,9 +273,9 @@ static int htable_create(struct net *net
}
hinfo->net = net;

- setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo);
- hinfo->timer.expires = jiffies + msecs_to_jiffies(hinfo->cfg.gc_interval);
- add_timer(&hinfo->timer);
+ INIT_DEFERRABLE_WORK(&hinfo->gc_work, htable_gc);
+ queue_delayed_work(system_power_efficient_wq, &hinfo->gc_work,
+ msecs_to_jiffies(hinfo->cfg.gc_interval));

hlist_add_head(&hinfo->node, &hashlimit_net->htables);

@@ -300,29 +300,30 @@ static void htable_selective_cleanup(str
{
unsigned int i;

- /* lock hash table and iterate over it */
- spin_lock_bh(&ht->lock);
for (i = 0; i < ht->cfg.size; i++) {
struct dsthash_ent *dh;
struct hlist_node *n;
+
+ spin_lock_bh(&ht->lock);
hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) {
if ((*select)(ht, dh))
dsthash_free(ht, dh);
}
+ spin_unlock_bh(&ht->lock);
+ cond_resched();
}
- spin_unlock_bh(&ht->lock);
}

-/* hash table garbage collector, run by timer */
-static void htable_gc(unsigned long htlong)
+static void htable_gc(struct work_struct *work)
{
- struct xt_hashlimit_htable *ht = (struct xt_hashlimit_htable *)htlong;
+ struct xt_hashlimit_htable *ht;
+
+ ht = container_of(work, struct xt_hashlimit_htable, gc_work.work);

htable_selective_cleanup(ht, select_gc);

- /* re-add the timer accordingly */
- ht->timer.expires = jiffies + msecs_to_jiffies(ht->cfg.gc_interval);
- add_timer(&ht->timer);
+ queue_delayed_work(system_power_efficient_wq,
+ &ht->gc_work, msecs_to_jiffies(ht->cfg.gc_interval));
}

static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
@@ -341,7 +342,7 @@ static void htable_remove_proc_entry(str

static void htable_destroy(struct xt_hashlimit_htable *hinfo)
{
- del_timer_sync(&hinfo->timer);
+ cancel_delayed_work_sync(&hinfo->gc_work);
htable_remove_proc_entry(hinfo);
htable_selective_cleanup(hinfo, select_all);
kfree(hinfo->name);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gu Zheng <guz....@cn.fujitsu.com>

commit 6098b45b32e6baeacc04790773ced9340601d511 upstream.

It seems that exit_aio() also needs to wait for all iocbs to complete (like
io_destroy), but we missed the wait step in current implemention, so fix
it in the same way as we did in io_destroy.

Signed-off-by: Gu Zheng <guz....@cn.fujitsu.com>
Signed-off-by: Benjamin LaHaise <bc...@kvack.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>

---
fs/aio.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

--- a/fs/aio.c
+++ b/fs/aio.c
@@ -797,6 +797,9 @@ void exit_aio(struct mm_struct *mm)
unsigned i = 0;

while (1) {
+ struct completion requests_done =
+ COMPLETION_INITIALIZER_ONSTACK(requests_done);
+
rcu_read_lock();
table = rcu_dereference(mm->ioctx_table);

@@ -824,7 +827,10 @@ void exit_aio(struct mm_struct *mm)
*/
ctx->mmap_size = 0;

- kill_ioctx(mm, ctx, NULL);
+ kill_ioctx(mm, ctx, &requests_done);
+
+ /* Wait until all IO for the context are done. */
+ wait_for_completion(&requests_done);

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Julian Anastasov <j...@ssi.bg>

commit eb90b0c734ad793d5f5bf230a9e9a4dcc48df8aa upstream.

commit fc604767613b6d2036cdc35b660bc39451040a47
("ipvs: changes for local real server") from 2.6.37
introduced DNAT support to local real server but the
IPv6 LOCAL_OUT handler ip_vs_local_reply6() is
registered incorrectly as IPv4 hook causing any outgoing
IPv4 traffic to be dropped depending on the IP header values.

Chris tracked down the problem to CONFIG_IP_VS_IPV6=y
Bug report: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1349768

Reported-by: Chris J Arges <chris....@canonical.com>
Tested-by: Chris J Arges <chris....@canonical.com>
Signed-off-by: Julian Anastasov <j...@ssi.bg>
Signed-off-by: Simon Horman <ho...@verge.net.au>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1906,7 +1906,7 @@ static struct nf_hook_ops ip_vs_ops[] __
{
.hook = ip_vs_local_reply6,
.owner = THIS_MODULE,
- .pf = NFPROTO_IPV4,
+ .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_NAT_DST + 1,
},

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <ne...@suse.de>

commit 2f73d3c55d09ce60647b96ad2a9b539c95a530ee upstream.

The resync/recovery process for raid1 was recently changed
so that writes could happen in parallel with resync providing
they were in different regions of the device.

There is a problem though: While a write request will always
wait for conflicting resync to complete, a resync request
will *not* always wait for conflicting writes to complete.

Two changes are needed to fix this:

1/ raise_barrier (which waits until it is safe to do resync)
must wait until current_window_requests is zero
2/ wait_battier (which waits at the start of a new write request)
must update current_window_requests if the request could
possible conflict with a concurrent resync.

As concurrent writes and resync can lead to data loss,
this patch is suitable for -stable.

Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
Cc: majianpeng <majia...@gmail.com>
Signed-off-by: NeilBrown <ne...@suse.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

drivers/md/raid1.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -845,10 +845,12 @@ static void raise_barrier(struct r1conf
* C: next_resync + RESYNC_SECTORS > start_next_window, meaning
* next resync will reach to the window which normal bios are
* handling.
+ * D: while there are any active requests in the current window.
*/
wait_event_lock_irq(conf->wait_barrier,
!conf->array_frozen &&
conf->barrier < RESYNC_DEPTH &&
+ conf->current_window_requests == 0 &&
(conf->start_next_window >=
conf->next_resync + RESYNC_SECTORS),
conf->resync_lock);
@@ -915,8 +917,8 @@ static sector_t wait_barrier(struct r1co
}

if (bio && bio_data_dir(bio) == WRITE) {
- if (conf->next_resync + NEXT_NORMALIO_DISTANCE
- <= bio->bi_iter.bi_sector) {
+ if (bio->bi_iter.bi_sector >=
+ conf->next_resync) {
if (conf->start_next_window == MaxSector)
conf->start_next_window =
conf->next_resync +

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Gartrell <agar...@fb.com>

commit 76f084bc10004b3050b2cff9cfac29148f1f6088 upstream.

Previously, only the four high bits of the tclass were maintained in the
ipv6 case. This matches the behavior of ipv4, though whether or not we
should reflect ECN bits may be up for debate.

Signed-off-by: Alex Gartrell <agar...@fb.com>
Acked-by: Julian Anastasov <j...@ssi.bg>
Signed-off-by: Simon Horman <ho...@verge.net.au>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

net/netfilter/ipvs/ip_vs_xmit.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -967,8 +967,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb
iph->nexthdr = IPPROTO_IPV6;
iph->payload_len = old_iph->payload_len;
be16_add_cpu(&iph->payload_len, sizeof(*old_iph));
- iph->priority = old_iph->priority;
memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
+ ipv6_change_dsfield(iph, 0, ipv6_get_dsfield(old_iph));
iph->daddr = cp->daddr.in6;
iph->saddr = saddr;
iph->hop_limit = old_iph->hop_limit;

[Greg Kroah-Hartman]

3.16-stable review patch. If anyone has any objections, please let me know.

------------------

From: John David Anglin <dave....@bell.net>

commit d26a7730b5874a5fa6779c62f4ad7c5065a94723 upstream.

In spite of what the GCC manual says, the -mfast-indirect-calls has
never been supported in the 64-bit parisc compiler. Indirect calls have
always been done using function descriptors irrespective of the
-mfast-indirect-calls option.

Recently, it was noticed that a function descriptor was always requested
when the -mfast-indirect-calls option was specified. This caused
problems when the option was used in application code and doesn't make
any sense because the whole point of the option is to avoid using a
function descriptor for indirect calls.

Fixing this broke 64-bit kernel builds.

I will fix GCC but for now we need the attached change. This results in
the same kernel code as before.

Signed-off-by: John David Anglin <dave....@bell.net>
Signed-off-by: Helge Deller <del...@gmx.de>

Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---

arch/parisc/Makefile | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -48,7 +48,12 @@ cflags-y := -pipe

# These flags should be implied by an hppa-linux configuration, but they
# are not in gcc 3.2.
-cflags-y += -mno-space-regs -mfast-indirect-calls
+cflags-y += -mno-space-regs
+
+# -mfast-indirect-calls is only relevant for 32-bit kernels.
+ifndef CONFIG_64BIT
+cflags-y += -mfast-indirect-calls
+endif

# Currently we save and restore fpregs on all kernel entry/interruption paths.
# If that gets optimized, we might need to disable the use of fpregs in the