[PATCH 3.16 159/217] drm/dp: move hw_mutex up the call stack

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Rob Clark 

commit 7779c5e23c5132c22a219f1f5554ef81dd15ee91 upstream.

1) don't let other threads trying to bang on aux channel interrupt the
defer timeout/logic
2) don't let other threads interrupt the i2c over aux logic

Technically, according to people who actually have the DP spec, this
should not be required.  In practice, it makes some troublesome Dell
monitor (and perhaps others) work, so probably a case of "It's compliant
if it works with windows" on the hw vendor's part..

v2: rebased to come before DPCD/AUX logging patch for easier backport
to stable branches.

Reported-by: Dave Wysochanski 
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1274157
Signed-off-by: Rob Clark 
Reviewed-by: Ville Syrjälä 
Reviewed-by: Daniel Vetter 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/drm_dp_helper.c | 27 +--
 1 file changed, 17 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -368,7 +368,7 @@ static int drm_dp_dpcd_access(struct drm
 {
struct drm_dp_aux_msg msg;
unsigned int retry;
-   int err;
+   int err = 0;
 
memset(, 0, sizeof(msg));
msg.address = offset;
@@ -376,6 +376,8 @@ static int drm_dp_dpcd_access(struct drm
msg.buffer = buffer;
msg.size = size;
 
+   mutex_lock(>hw_mutex);
+
/*
 * The specification doesn't give any recommendation on how often to
 * retry native transactions. We used to retry 7 times like for
@@ -384,25 +386,24 @@ static int drm_dp_dpcd_access(struct drm
 */
for (retry = 0; retry < 32; retry++) {
 
-   mutex_lock(>hw_mutex);
err = aux->transfer(aux, );
-   mutex_unlock(>hw_mutex);
if (err < 0) {
if (err == -EBUSY)
continue;
 
-   return err;
+   goto unlock;
}
 
 
switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) {
case DP_AUX_NATIVE_REPLY_ACK:
if (err < size)
-   return -EPROTO;
-   return err;
+   err = -EPROTO;
+   goto unlock;
 
case DP_AUX_NATIVE_REPLY_NACK:
-   return -EIO;
+   err = -EIO;
+   goto unlock;
 
case DP_AUX_NATIVE_REPLY_DEFER:
usleep_range(400, 500);
@@ -411,7 +412,11 @@ static int drm_dp_dpcd_access(struct drm
}
 
DRM_DEBUG_KMS("too many retries, giving up\n");
-   return -EIO;
+   err = -EIO;
+
+unlock:
+   mutex_unlock(>hw_mutex);
+   return err;
 }
 
 /**
@@ -600,9 +605,7 @@ static int drm_dp_i2c_do_msg(struct drm_
 * before giving up the AUX transaction.
 */
for (retry = 0; retry < 7; retry++) {
-   mutex_lock(>hw_mutex);
err = aux->transfer(aux, msg);
-   mutex_unlock(>hw_mutex);
if (err < 0) {
if (err == -EBUSY)
continue;
@@ -682,6 +685,8 @@ static int drm_dp_i2c_xfer(struct i2c_ad
 
memset(, 0, sizeof(msg));
 
+   mutex_lock(>hw_mutex);
+
for (i = 0; i < num; i++) {
msg.address = msgs[i].addr;
msg.request = (msgs[i].flags & I2C_M_RD) ?
@@ -726,6 +731,8 @@ static int drm_dp_i2c_xfer(struct i2c_ad
msg.size = 0;
(void)drm_dp_i2c_do_msg(aux, );
 
+   mutex_unlock(>hw_mutex);
+
return err;
 }
 

[PATCH 3.16 140/217] ALSA: hda - Apply fix for white noise on Asus N550JV, too

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bobi Mihalca 

commit 83a9efb5b8170b7cffef4f62656656e1d8ad2ccd upstream.

Apply the new fixup that is used for ASUS N750JV to another similar
model, N500JV, too, for reducing the headphone noise.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6070,7 +6070,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1028, 0x0696, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0698, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
-   SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
+   SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", 
ALC662_FIXUP_BASS_MODE4_CHMAP),

[PATCH 3.16 159/217] drm/dp: move hw_mutex up the call stack

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Rob Clark 

commit 7779c5e23c5132c22a219f1f5554ef81dd15ee91 upstream.

1) don't let other threads trying to bang on aux channel interrupt the
defer timeout/logic
2) don't let other threads interrupt the i2c over aux logic

Technically, according to people who actually have the DP spec, this
should not be required.  In practice, it makes some troublesome Dell
monitor (and perhaps others) work, so probably a case of "It's compliant
if it works with windows" on the hw vendor's part..

v2: rebased to come before DPCD/AUX logging patch for easier backport
to stable branches.

Reported-by: Dave Wysochanski 
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1274157
Signed-off-by: Rob Clark 
Reviewed-by: Ville Syrjälä 
Reviewed-by: Daniel Vetter 
Signed-off-by: Dave Airlie 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/drm_dp_helper.c | 27 +--
 1 file changed, 17 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -368,7 +368,7 @@ static int drm_dp_dpcd_access(struct drm
 {
struct drm_dp_aux_msg msg;
unsigned int retry;
-   int err;
+   int err = 0;
 
memset(, 0, sizeof(msg));
msg.address = offset;
@@ -376,6 +376,8 @@ static int drm_dp_dpcd_access(struct drm
msg.buffer = buffer;
msg.size = size;
 
+   mutex_lock(>hw_mutex);
+
/*
 * The specification doesn't give any recommendation on how often to
 * retry native transactions. We used to retry 7 times like for
@@ -384,25 +386,24 @@ static int drm_dp_dpcd_access(struct drm
 */
for (retry = 0; retry < 32; retry++) {
 
-   mutex_lock(>hw_mutex);
err = aux->transfer(aux, );
-   mutex_unlock(>hw_mutex);
if (err < 0) {
if (err == -EBUSY)
continue;
 
-   return err;
+   goto unlock;
}
 
 
switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) {
case DP_AUX_NATIVE_REPLY_ACK:
if (err < size)
-   return -EPROTO;
-   return err;
+   err = -EPROTO;
+   goto unlock;
 
case DP_AUX_NATIVE_REPLY_NACK:
-   return -EIO;
+   err = -EIO;
+   goto unlock;
 
case DP_AUX_NATIVE_REPLY_DEFER:
usleep_range(400, 500);
@@ -411,7 +412,11 @@ static int drm_dp_dpcd_access(struct drm
}
 
DRM_DEBUG_KMS("too many retries, giving up\n");
-   return -EIO;
+   err = -EIO;
+
+unlock:
+   mutex_unlock(>hw_mutex);
+   return err;
 }
 
 /**
@@ -600,9 +605,7 @@ static int drm_dp_i2c_do_msg(struct drm_
 * before giving up the AUX transaction.
 */
for (retry = 0; retry < 7; retry++) {
-   mutex_lock(>hw_mutex);
err = aux->transfer(aux, msg);
-   mutex_unlock(>hw_mutex);
if (err < 0) {
if (err == -EBUSY)
continue;
@@ -682,6 +685,8 @@ static int drm_dp_i2c_xfer(struct i2c_ad
 
memset(, 0, sizeof(msg));
 
+   mutex_lock(>hw_mutex);
+
for (i = 0; i < num; i++) {
msg.address = msgs[i].addr;
msg.request = (msgs[i].flags & I2C_M_RD) ?
@@ -726,6 +731,8 @@ static int drm_dp_i2c_xfer(struct i2c_ad
msg.size = 0;
(void)drm_dp_i2c_do_msg(aux, );
 
+   mutex_unlock(>hw_mutex);
+
return err;
 }
 

[PATCH 3.16 146/217] ocfs2/dlm: fix race between convert and recovery

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Joseph Qi 

commit ac7cf246dfdbec3d8fed296c7bf30e16f5099dac upstream.

There is a race window between dlmconvert_remote and
dlm_move_lockres_to_recovery_list, which will cause a lock with
OCFS2_LOCK_BUSY in grant list, thus system hangs.

dlmconvert_remote
{
spin_lock(>spinlock);
list_move_tail(>list, >converting);
lock->convert_pending = 1;
spin_unlock(>spinlock);

status = dlm_send_remote_convert_request();
>> race window, master has queued ast and return DLM_NORMAL,
   and then down before sending ast.
   this node detects master down and calls
   dlm_move_lockres_to_recovery_list, which will revert the
   lock to grant list.
   Then OCFS2_LOCK_BUSY won't be cleared as new master won't
   send ast any more because it thinks already be authorized.

spin_lock(>spinlock);
lock->convert_pending = 0;
if (status != DLM_NORMAL)
dlm_revert_pending_convert(res, lock);
spin_unlock(>spinlock);
}

In this case, check if res->state has DLM_LOCK_RES_RECOVERING bit set
(res is still in recovering) or res master changed (new master has
finished recovery), reset the status to DLM_RECOVERING, then it will
retry convert.

Signed-off-by: Joseph Qi 
Reported-by: Yiwen Jiang 
Reviewed-by: Junxiao Bi 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Tariq Saeed 
Cc: Junxiao Bi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 fs/ocfs2/dlm/dlmconvert.c | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct
  struct dlm_lock *lock, int flags, int type)
 {
enum dlm_status status;
+   u8 old_owner = res->owner;
 
mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
 lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -316,11 +317,19 @@ enum dlm_status dlmconvert_remote(struct
spin_lock(>spinlock);
res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
lock->convert_pending = 0;
-   /* if it failed, move it back to granted queue */
+   /* if it failed, move it back to granted queue.
+* if master returns DLM_NORMAL and then down before sending ast,
+* it may have already been moved to granted queue, reset to
+* DLM_RECOVERING and retry convert */
if (status != DLM_NORMAL) {
if (status != DLM_NOTQUEUED)
dlm_error(status);
dlm_revert_pending_convert(res, lock);
+   } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
+   (old_owner != res->owner)) {
+   mlog(0, "res %.*s is in recovering or has been recovered.\n",
+   res->lockname.len, res->lockname.name);
+   status = DLM_RECOVERING;
}
 bail:
spin_unlock(>spinlock);

[PATCH 3.16 165/217] mm: fix invalid node in alloc_migrate_target()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Xishi Qiu 

commit 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 upstream.

It is incorrect to use next_node to find a target node, it will return
MAX_NUMNODES or invalid node.  This will lead to crash in buddy system
allocation.

Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle 
hugepage")
Signed-off-by: Xishi Qiu 
Acked-by: Vlastimil Babka 
Acked-by: Naoya Horiguchi 
Cc: Joonsoo Kim 
Cc: David Rientjes 
Cc: "Laura Abbott" 
Cc: Hui Zhu 
Cc: Wang Xiaoqiang 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 mm/page_isolation.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -259,11 +259,11 @@ struct page *alloc_migrate_target(struct
 * now as a simple work-around, we use the next node for destination.
 */
if (PageHuge(page)) {
-   nodemask_t src = nodemask_of_node(page_to_nid(page));
-   nodemask_t dst;
-   nodes_complement(dst, src);
+   int node = next_online_node(page_to_nid(page));
+   if (node == MAX_NUMNODES)
+   node = first_online_node;
return alloc_huge_page_node(page_hstate(compound_head(page)),
-   next_node(page_to_nid(page), dst));
+   node);
}
 
if (PageHighMem(page))

[PATCH 3.16 165/217] mm: fix invalid node in alloc_migrate_target()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Xishi Qiu 

commit 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 upstream.

It is incorrect to use next_node to find a target node, it will return
MAX_NUMNODES or invalid node.  This will lead to crash in buddy system
allocation.

Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle 
hugepage")
Signed-off-by: Xishi Qiu 
Acked-by: Vlastimil Babka 
Acked-by: Naoya Horiguchi 
Cc: Joonsoo Kim 
Cc: David Rientjes 
Cc: "Laura Abbott" 
Cc: Hui Zhu 
Cc: Wang Xiaoqiang 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 mm/page_isolation.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -259,11 +259,11 @@ struct page *alloc_migrate_target(struct
 * now as a simple work-around, we use the next node for destination.
 */
if (PageHuge(page)) {
-   nodemask_t src = nodemask_of_node(page_to_nid(page));
-   nodemask_t dst;
-   nodes_complement(dst, src);
+   int node = next_online_node(page_to_nid(page));
+   if (node == MAX_NUMNODES)
+   node = first_online_node;
return alloc_huge_page_node(page_hstate(compound_head(page)),
-   next_node(page_to_nid(page), dst));
+   node);
}
 
if (PageHighMem(page))

[PATCH 3.16 148/217] hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

commit 3c2e2266a5bd2d1cef258e6e54dca1d99946379f upstream.

arm:pxa_defconfig can result in the following crash if the max driver
is not instantiated.

Unhandled fault: page domain fault (0x01b) at 0x
pgd = c0004000
[] *pgd=
Internal error: : 1b [#1] PREEMPT ARM
Modules linked in:
CPU: 0 PID: 300 Comm: kworker/0:1 Not tainted 4.5.0-01301-g1701f680407c #10
Hardware name: SHARP Akita
Workqueue: events sharpsl_charge_toggle
task: c390a000 ti: c391e000 task.ti: c391e000
PC is at max_read_channel+0x20/0x30
LR is at sharpsl_pm_pxa_read_max+0x2c/0x3c
pc : []lr : []psr: 2013
...
[] (max_read_channel) from []
(sharpsl_pm_pxa_read_max+0x2c/0x3c)
[] (sharpsl_pm_pxa_read_max) from []
(spitzpm_read_devdata+0x5c/0xc4)
[] (spitzpm_read_devdata) from []
(sharpsl_check_battery_temp+0x78/0x110)
[] (sharpsl_check_battery_temp) from []
(sharpsl_charge_toggle+0x48/0x110)
[] (sharpsl_charge_toggle) from []
(process_one_work+0x14c/0x48c)
[] (process_one_work) from [] (worker_thread+0x3c/0x5d4)
[] (worker_thread) from [] (kthread+0xd0/0xec)
[] (kthread) from [] (ret_from_fork+0x14/0x24)

This can occur because the SPI controller driver (SPI_PXA2XX) is built as
module and thus not necessarily loaded. While building SPI_PXA2XX into the
kernel would make the problem disappear, it appears prudent to ensure that
the driver is instantiated before accessing its data structures.

Cc: Arnd Bergmann 
Signed-off-by: Guenter Roeck 
Signed-off-by: Ben Hutchings 
---
 drivers/hwmon/max.c | 6 ++
 1 file changed, 6 insertions(+)

--- a/drivers/hwmon/max.c
+++ b/drivers/hwmon/max.c
@@ -85,6 +85,9 @@ static struct max_data *the_max;
 
 int max_read_channel(int channel)
 {
+   if (!the_max || !the_max->spi)
+   return -ENODEV;
+
return max_read(_max->spi->dev, channel);
 }
 EXPORT_SYMBOL(max_read_channel);
@@ -258,6 +261,9 @@ static int max_remove(struct spi_dev
 {
struct max_data *data = spi_get_drvdata(spi);
 
+#ifdef CONFIG_SHARPSL_PM
+   the_max = NULL;
+#endif
hwmon_device_unregister(data->hwmon_dev);
sysfs_remove_group(>dev.kobj, _attr_group);
sysfs_remove_group(>dev.kobj, _attr_group);

[PATCH 3.16 148/217] hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

commit 3c2e2266a5bd2d1cef258e6e54dca1d99946379f upstream.

arm:pxa_defconfig can result in the following crash if the max driver
is not instantiated.

Unhandled fault: page domain fault (0x01b) at 0x
pgd = c0004000
[] *pgd=
Internal error: : 1b [#1] PREEMPT ARM
Modules linked in:
CPU: 0 PID: 300 Comm: kworker/0:1 Not tainted 4.5.0-01301-g1701f680407c #10
Hardware name: SHARP Akita
Workqueue: events sharpsl_charge_toggle
task: c390a000 ti: c391e000 task.ti: c391e000
PC is at max_read_channel+0x20/0x30
LR is at sharpsl_pm_pxa_read_max+0x2c/0x3c
pc : []lr : []psr: 2013
...
[] (max_read_channel) from []
(sharpsl_pm_pxa_read_max+0x2c/0x3c)
[] (sharpsl_pm_pxa_read_max) from []
(spitzpm_read_devdata+0x5c/0xc4)
[] (spitzpm_read_devdata) from []
(sharpsl_check_battery_temp+0x78/0x110)
[] (sharpsl_check_battery_temp) from []
(sharpsl_charge_toggle+0x48/0x110)
[] (sharpsl_charge_toggle) from []
(process_one_work+0x14c/0x48c)
[] (process_one_work) from [] (worker_thread+0x3c/0x5d4)
[] (worker_thread) from [] (kthread+0xd0/0xec)
[] (kthread) from [] (ret_from_fork+0x14/0x24)

This can occur because the SPI controller driver (SPI_PXA2XX) is built as
module and thus not necessarily loaded. While building SPI_PXA2XX into the
kernel would make the problem disappear, it appears prudent to ensure that
the driver is instantiated before accessing its data structures.

Cc: Arnd Bergmann 
Signed-off-by: Guenter Roeck 
Signed-off-by: Ben Hutchings 
---
 drivers/hwmon/max.c | 6 ++
 1 file changed, 6 insertions(+)

--- a/drivers/hwmon/max.c
+++ b/drivers/hwmon/max.c
@@ -85,6 +85,9 @@ static struct max_data *the_max;
 
 int max_read_channel(int channel)
 {
+   if (!the_max || !the_max->spi)
+   return -ENODEV;
+
return max_read(_max->spi->dev, channel);
 }
 EXPORT_SYMBOL(max_read_channel);
@@ -258,6 +261,9 @@ static int max_remove(struct spi_dev
 {
struct max_data *data = spi_get_drvdata(spi);
 
+#ifdef CONFIG_SHARPSL_PM
+   the_max = NULL;
+#endif
hwmon_device_unregister(data->hwmon_dev);
sysfs_remove_group(>dev.kobj, _attr_group);
sysfs_remove_group(>dev.kobj, _attr_group);

[PATCH 3.16 153/217] ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream.

Just a minor code cleanup: unify the error paths.

Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/quirks.c | 22 +++---
 1 file changed, 11 insertions(+), 11 deletions(-)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -155,23 +155,18 @@ static int create_fixed_stream_quirk(str
stream = (fp->endpoint & USB_DIR_IN)
? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
err = snd_usb_add_audio_stream(chip, stream, fp);
-   if (err < 0) {
-   kfree(fp);
-   kfree(rate_table);
-   return err;
-   }
+   if (err < 0)
+   goto error;
if (fp->iface != 
get_iface_desc(>altsetting[0])->bInterfaceNumber ||
fp->altset_idx >= iface->num_altsetting) {
-   kfree(fp);
-   kfree(rate_table);
-   return -EINVAL;
+   err = -EINVAL;
+   goto error;
}
alts = >altsetting[fp->altset_idx];
altsd = get_iface_desc(alts);
if (altsd->bNumEndpoints < 1) {
-   kfree(fp);
-   kfree(rate_table);
-   return -EINVAL;
+   err = -EINVAL;
+   goto error;
}
 
fp->protocol = altsd->bInterfaceProtocol;
@@ -184,6 +179,11 @@ static int create_fixed_stream_quirk(str
snd_usb_init_pitch(chip, fp->iface, alts, fp);
snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
return 0;
+
+ error:
+   kfree(fp);
+   kfree(rate_table);
+   return err;
 }
 
 static int create_auto_pcm_quirk(struct snd_usb_audio *chip,

Re: [PATCH v2] Documentation: fix common spelling mistakes

[Randy Dunlap]

On 04/26/16 16:41, Kees Cook wrote:
> This fixes several spelling mistakes in the Documentation/ tree, which
> are caught by checkpatch.pl's spell checking.
> 
> Signed-off-by: Kees Cook 

Acked-by: Randy Dunlap 

Thanks.

> ---
>  Documentation/ABI/obsolete/sysfs-driver-hid-roccat-savu   | 11 
> ++-
>  .../ABI/testing/sysfs-bus-event_source-devices-hv_24x7|  2 +-
>  Documentation/ABI/testing/sysfs-driver-hid-picolcd|  2 +-
>  Documentation/ABI/testing/sysfs-firmware-acpi |  2 +-
>  Documentation/DocBook/media/v4l/controls.xml  |  2 +-
>  Documentation/DocBook/media/v4l/dev-raw-vbi.xml   |  2 +-
>  Documentation/DocBook/media/v4l/vidioc-g-selection.xml|  2 +-
>  Documentation/RCU/RTFP.txt|  6 +++---
>  Documentation/arm/SA1100/Assabet  |  2 +-
>  Documentation/devicetree/bindings/mfd/arizona.txt |  2 +-
>  Documentation/filesystems/cifs/README |  2 +-
>  Documentation/filesystems/pohmelfs/design_notes.txt   |  2 +-
>  Documentation/filesystems/qnx6.txt|  2 +-
>  Documentation/firmware_class/README   |  2 +-
>  Documentation/hwmon/abituguru |  2 +-
>  Documentation/infiniband/ipoib.txt|  2 +-
>  Documentation/networking/altera_tse.txt   |  2 +-
>  Documentation/networking/can.txt  |  2 +-
>  Documentation/scsi/bfa.txt|  2 +-
>  Documentation/timers/hrtimers.txt |  2 +-
>  Documentation/video4linux/README.cx88 |  2 +-
>  Documentation/video4linux/bttv/Sound-FAQ  |  2 +-
>  Documentation/vm/hugetlbpage.txt  |  2 +-
>  23 files changed, 30 insertions(+), 29 deletions(-)



-- 
~Randy

[PATCH 3.16 150/217] drm/radeon: add a dpm quirk for all R7 370 parts

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit 0e5585dc870af947fab2af96a88c2d8b4270247c upstream.

Higher mclk values are not stable due to a bug somewhere.
Limit them for now.

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/si_dpm.c | 4 
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3017,6 +3017,10 @@ static void si_apply_state_adjust_rules(
ps->performance_levels[i].sclk = max_sclk;
}
}
+   /* limit mclk on all R7 370 parts for stability */
+   if (rdev->pdev->device == 0x6811 &&
+   rdev->pdev->revision == 0x81)
+   max_mclk = 12;
 
/* XXX validate the min clocks required for display */
 

[PATCH 3.16 153/217] ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream.

Just a minor code cleanup: unify the error paths.

Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/quirks.c | 22 +++---
 1 file changed, 11 insertions(+), 11 deletions(-)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -155,23 +155,18 @@ static int create_fixed_stream_quirk(str
stream = (fp->endpoint & USB_DIR_IN)
? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
err = snd_usb_add_audio_stream(chip, stream, fp);
-   if (err < 0) {
-   kfree(fp);
-   kfree(rate_table);
-   return err;
-   }
+   if (err < 0)
+   goto error;
if (fp->iface != 
get_iface_desc(>altsetting[0])->bInterfaceNumber ||
fp->altset_idx >= iface->num_altsetting) {
-   kfree(fp);
-   kfree(rate_table);
-   return -EINVAL;
+   err = -EINVAL;
+   goto error;
}
alts = >altsetting[fp->altset_idx];
altsd = get_iface_desc(alts);
if (altsd->bNumEndpoints < 1) {
-   kfree(fp);
-   kfree(rate_table);
-   return -EINVAL;
+   err = -EINVAL;
+   goto error;
}
 
fp->protocol = altsd->bInterfaceProtocol;
@@ -184,6 +179,11 @@ static int create_fixed_stream_quirk(str
snd_usb_init_pitch(chip, fp->iface, alts, fp);
snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
return 0;
+
+ error:
+   kfree(fp);
+   kfree(rate_table);
+   return err;
 }
 
 static int create_auto_pcm_quirk(struct snd_usb_audio *chip,

Re: [PATCH v2] Documentation: fix common spelling mistakes

[Randy Dunlap]

On 04/26/16 16:41, Kees Cook wrote:
> This fixes several spelling mistakes in the Documentation/ tree, which
> are caught by checkpatch.pl's spell checking.
> 
> Signed-off-by: Kees Cook 

Acked-by: Randy Dunlap 

Thanks.

> ---
>  Documentation/ABI/obsolete/sysfs-driver-hid-roccat-savu   | 11 
> ++-
>  .../ABI/testing/sysfs-bus-event_source-devices-hv_24x7|  2 +-
>  Documentation/ABI/testing/sysfs-driver-hid-picolcd|  2 +-
>  Documentation/ABI/testing/sysfs-firmware-acpi |  2 +-
>  Documentation/DocBook/media/v4l/controls.xml  |  2 +-
>  Documentation/DocBook/media/v4l/dev-raw-vbi.xml   |  2 +-
>  Documentation/DocBook/media/v4l/vidioc-g-selection.xml|  2 +-
>  Documentation/RCU/RTFP.txt|  6 +++---
>  Documentation/arm/SA1100/Assabet  |  2 +-
>  Documentation/devicetree/bindings/mfd/arizona.txt |  2 +-
>  Documentation/filesystems/cifs/README |  2 +-
>  Documentation/filesystems/pohmelfs/design_notes.txt   |  2 +-
>  Documentation/filesystems/qnx6.txt|  2 +-
>  Documentation/firmware_class/README   |  2 +-
>  Documentation/hwmon/abituguru |  2 +-
>  Documentation/infiniband/ipoib.txt|  2 +-
>  Documentation/networking/altera_tse.txt   |  2 +-
>  Documentation/networking/can.txt  |  2 +-
>  Documentation/scsi/bfa.txt|  2 +-
>  Documentation/timers/hrtimers.txt |  2 +-
>  Documentation/video4linux/README.cx88 |  2 +-
>  Documentation/video4linux/bttv/Sound-FAQ  |  2 +-
>  Documentation/vm/hugetlbpage.txt  |  2 +-
>  23 files changed, 30 insertions(+), 29 deletions(-)



-- 
~Randy

[PATCH 3.16 150/217] drm/radeon: add a dpm quirk for all R7 370 parts

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit 0e5585dc870af947fab2af96a88c2d8b4270247c upstream.

Higher mclk values are not stable due to a bug somewhere.
Limit them for now.

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/si_dpm.c | 4 
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3017,6 +3017,10 @@ static void si_apply_state_adjust_rules(
ps->performance_levels[i].sclk = max_sclk;
}
}
+   /* limit mclk on all R7 370 parts for stability */
+   if (rdev->pdev->device == 0x6811 &&
+   rdev->pdev->revision == 0x81)
+   max_mclk = 12;
 
/* XXX validate the min clocks required for display */
 

[PATCH 3.16 209/217] qmi_wwan: add "D-Link DWM-221 B1" device id

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bjørn Mork 

[ Upstream commit e84810c7b85a2d7897797b3ad3e879168a8e032a ]

Thomas reports:
"Windows:

00 diagnostics
01 modem
02 at-port
03 nmea
04 nic

Linux:

T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2001 ProdID=7e19 Rev=02.32
S:  Manufacturer=Mobile Connect
S:  Product=Mobile Connect
S:  SerialNumber=0123456789ABCDEF
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage"

Reported-by: Thomas Schäfer 
Signed-off-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8677c6a..8153e97 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -749,6 +749,7 @@ static const struct usb_device_id products[] = {
{QMI_FIXED_INTF(0x19d2, 0x1426, 2)},/* ZTE MF91 */
{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},/* Telewell TW-LTE 4G v2 */
{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},/* ZTE (Vodafone) K3765-Z */
+   {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},/* D-Link DWM-221 B1 */
{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},/* Sierra Wireless MC7700 */
{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},/* Sierra Wireless MC7750 */
{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},/* Sierra Wireless MC7710 in 
QMI mode */

[PATCH 3.16 209/217] qmi_wwan: add "D-Link DWM-221 B1" device id

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bjørn Mork 

[ Upstream commit e84810c7b85a2d7897797b3ad3e879168a8e032a ]

Thomas reports:
"Windows:

00 diagnostics
01 modem
02 at-port
03 nmea
04 nic

Linux:

T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2001 ProdID=7e19 Rev=02.32
S:  Manufacturer=Mobile Connect
S:  Product=Mobile Connect
S:  SerialNumber=0123456789ABCDEF
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage"

Reported-by: Thomas Schäfer 
Signed-off-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8677c6a..8153e97 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -749,6 +749,7 @@ static const struct usb_device_id products[] = {
{QMI_FIXED_INTF(0x19d2, 0x1426, 2)},/* ZTE MF91 */
{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},/* Telewell TW-LTE 4G v2 */
{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},/* ZTE (Vodafone) K3765-Z */
+   {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},/* D-Link DWM-221 B1 */
{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},/* Sierra Wireless MC7700 */
{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},/* Sierra Wireless MC7750 */
{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},/* Sierra Wireless MC7710 in 
QMI mode */

[PATCH 3.16 175/217] gpio: pca953x: Use correct u16 value for register word write

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Yong Li 

commit 9b8e3ec34318663affced3c14d960e78d760dd9a upstream.

The current implementation only uses the first byte in val,
the second byte is always 0. Change it to use cpu_to_le16
to write the two bytes into the register

Signed-off-by: Yong Li 
Reviewed-by: Phil Reid 
Signed-off-by: Linus Walleij 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpio/gpio-pca953x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -18,6 +18,7 @@
 #include 
 #include 
 #include 
+#include 
 #ifdef CONFIG_OF_GPIO
 #include 
 #endif
@@ -154,7 +155,7 @@ static int pca953x_write_regs(struct pca
switch (chip->chip_type) {
case PCA953X_TYPE:
ret = i2c_smbus_write_word_data(chip->client,
-   reg << 1, (u16) *val);
+   reg << 1, cpu_to_le16(get_unaligned((u16 *)val)));
break;
case PCA957X_TYPE:
ret = i2c_smbus_write_byte_data(chip->client, reg << 1,

[PATCH 3.16 145/217] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit f971f2263deaa4a441e377b385c11aee0f3b3f9a upstream.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=94692

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/si_dpm.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2921,6 +2921,7 @@ static struct si_dpm_quirk si_dpm_quirk_
/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 12 },
+   { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 9 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 12 },

[PATCH 3.16 143/217] net: bcmgenet: fix skb_len in bcmgenet_xmit_single()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Petri Gynther 

commit 7dd399130efb5a454daf24075b7563d197114e39 upstream.

skb_len needs to be skb_headlen(skb) in bcmgenet_xmit_single().

Fragmented skbs can have only Ethernet + IP + TCP headers (14+20+20=54 bytes)
in the linear buffer, followed by the rest in fragments. Bumping skb_len to
ETH_ZLEN would be incorrect for this case, as it would introduce garbage
between TCP header and the fragment data.

This also works with regular/non-fragmented small packets < ETH_ZLEN bytes.
Successfully tested this on GENETv3 with 42-byte ARP frames.

For testing, I used:
ethtool -K eth0 tx-checksum-ipv4 off
ethtool -K eth0 tx-checksum-ipv6 off
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Petri Gynther 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -979,7 +979,7 @@ static int bcmgenet_xmit_single(struct n
 
tx_cb_ptr->skb = skb;
 
-   skb_len = skb_headlen(skb) < ETH_ZLEN ? ETH_ZLEN : skb_headlen(skb);
+   skb_len = skb_headlen(skb);
 
mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
ret = dma_mapping_error(kdev, mapping);

[PATCH 3.16 175/217] gpio: pca953x: Use correct u16 value for register word write

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Yong Li 

commit 9b8e3ec34318663affced3c14d960e78d760dd9a upstream.

The current implementation only uses the first byte in val,
the second byte is always 0. Change it to use cpu_to_le16
to write the two bytes into the register

Signed-off-by: Yong Li 
Reviewed-by: Phil Reid 
Signed-off-by: Linus Walleij 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/gpio/gpio-pca953x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -18,6 +18,7 @@
 #include 
 #include 
 #include 
+#include 
 #ifdef CONFIG_OF_GPIO
 #include 
 #endif
@@ -154,7 +155,7 @@ static int pca953x_write_regs(struct pca
switch (chip->chip_type) {
case PCA953X_TYPE:
ret = i2c_smbus_write_word_data(chip->client,
-   reg << 1, (u16) *val);
+   reg << 1, cpu_to_le16(get_unaligned((u16 *)val)));
break;
case PCA957X_TYPE:
ret = i2c_smbus_write_byte_data(chip->client, reg << 1,

[PATCH 3.16 145/217] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit f971f2263deaa4a441e377b385c11aee0f3b3f9a upstream.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=94692

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/si_dpm.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2921,6 +2921,7 @@ static struct si_dpm_quirk si_dpm_quirk_
/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 12 },
+   { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 9 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 12 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 12 },

[PATCH 3.16 143/217] net: bcmgenet: fix skb_len in bcmgenet_xmit_single()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Petri Gynther 

commit 7dd399130efb5a454daf24075b7563d197114e39 upstream.

skb_len needs to be skb_headlen(skb) in bcmgenet_xmit_single().

Fragmented skbs can have only Ethernet + IP + TCP headers (14+20+20=54 bytes)
in the linear buffer, followed by the rest in fragments. Bumping skb_len to
ETH_ZLEN would be incorrect for this case, as it would introduce garbage
between TCP header and the fragment data.

This also works with regular/non-fragmented small packets < ETH_ZLEN bytes.
Successfully tested this on GENETv3 with 42-byte ARP frames.

For testing, I used:
ethtool -K eth0 tx-checksum-ipv4 off
ethtool -K eth0 tx-checksum-ipv6 off
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Petri Gynther 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -979,7 +979,7 @@ static int bcmgenet_xmit_single(struct n
 
tx_cb_ptr->skb = skb;
 
-   skb_len = skb_headlen(skb) < ETH_ZLEN ? ETH_ZLEN : skb_headlen(skb);
+   skb_len = skb_headlen(skb);
 
mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
ret = dma_mapping_error(kdev, mapping);

[PATCH 3.16 171/217] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Josh Boyer 

commit ea6db90e750328068837bed34cb1302b7a177339 upstream.

A Fedora user reports that the ftdi_sio driver works properly for the
ICP DAS I-7561U device.  Further, the user manual for these devices
instructs users to load the driver and add the ids using the sysfs
interface.

Add support for these in the driver directly so that the devices work
out of the box instead of needing manual configuration.

Reported-by: 
Signed-off-by: Josh Boyer 
Signed-off-by: Johan Hovold 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ftdi_sio.c | 4 
 drivers/usb/serial/ftdi_sio_ids.h | 8 
 2 files changed, 12 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1017,6 +1017,10 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
+   /* ICP DAS I-756xU devices */
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
{ } /* Terminating entry */
 };
 
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -872,6 +872,14 @@
 #define NOVITUS_BONO_E_PID 0x6010
 
 /*
+ * ICPDAS I-756*U devices
+ */
+#define ICPDAS_VID 0x1b5c
+#define ICPDAS_I7560U_PID  0x0103
+#define ICPDAS_I7561U_PID  0x0104
+#define ICPDAS_I7563U_PID  0x0105
+
+/*
  * RT Systems programming cables for various ham radios
  */
 #define RTSYSTEMS_VID  0x2100  /* Vendor ID */

[PATCH 3.16 164/217] ALSA: timer: Use mod_timer() for rearming the system timer

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  
  [] snd_timer_s_start+0x13e/0x1a0
  [] snd_timer_interrupt+0x504/0xec0
  [] ? debug_check_no_locks_freed+0x290/0x290
  [] snd_timer_s_function+0xb4/0x120
  [] call_timer_fn+0x162/0x520
  [] ? call_timer_fn+0xcd/0x520
  [] ? snd_timer_interrupt+0xec0/0xec0
  

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/core/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1053,8 +1053,8 @@ static int snd_timer_s_start(struct snd_
njiff += timer->sticks - priv->correction;
priv->correction = 0;
}
-   priv->last_expires = priv->tlist.expires = njiff;
-   add_timer(>tlist);
+   priv->last_expires = njiff;
+   mod_timer(>tlist, njiff);
return 0;
 }
 

[PATCH 3.16 121/217] USB: usb_driver_claim_interface: add sanity checking

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/core/driver.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -515,11 +515,15 @@ static int usb_unbind_interface(struct d
 int usb_driver_claim_interface(struct usb_driver *driver,
struct usb_interface *iface, void *priv)
 {
-   struct device *dev = >dev;
+   struct device *dev;
struct usb_device *udev;
int retval = 0;
int lpm_disable_error;
 
+   if (!iface)
+   return -ENODEV;
+
+   dev = >dev;
if (dev->driver)
return -EBUSY;
 

[PATCH 3.16 171/217] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Josh Boyer 

commit ea6db90e750328068837bed34cb1302b7a177339 upstream.

A Fedora user reports that the ftdi_sio driver works properly for the
ICP DAS I-7561U device.  Further, the user manual for these devices
instructs users to load the driver and add the ids using the sysfs
interface.

Add support for these in the driver directly so that the devices work
out of the box instead of needing manual configuration.

Reported-by: 
Signed-off-by: Josh Boyer 
Signed-off-by: Johan Hovold 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ftdi_sio.c | 4 
 drivers/usb/serial/ftdi_sio_ids.h | 8 
 2 files changed, 12 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1017,6 +1017,10 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
+   /* ICP DAS I-756xU devices */
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+   { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
{ } /* Terminating entry */
 };
 
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -872,6 +872,14 @@
 #define NOVITUS_BONO_E_PID 0x6010
 
 /*
+ * ICPDAS I-756*U devices
+ */
+#define ICPDAS_VID 0x1b5c
+#define ICPDAS_I7560U_PID  0x0103
+#define ICPDAS_I7561U_PID  0x0104
+#define ICPDAS_I7563U_PID  0x0105
+
+/*
  * RT Systems programming cables for various ham radios
  */
 #define RTSYSTEMS_VID  0x2100  /* Vendor ID */

[PATCH 3.16 164/217] ALSA: timer: Use mod_timer() for rearming the system timer

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  
  [] snd_timer_s_start+0x13e/0x1a0
  [] snd_timer_interrupt+0x504/0xec0
  [] ? debug_check_no_locks_freed+0x290/0x290
  [] snd_timer_s_function+0xb4/0x120
  [] call_timer_fn+0x162/0x520
  [] ? call_timer_fn+0xcd/0x520
  [] ? snd_timer_interrupt+0xec0/0xec0
  

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/core/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1053,8 +1053,8 @@ static int snd_timer_s_start(struct snd_
njiff += timer->sticks - priv->correction;
priv->correction = 0;
}
-   priv->last_expires = priv->tlist.expires = njiff;
-   add_timer(>tlist);
+   priv->last_expires = njiff;
+   mod_timer(>tlist, njiff);
return 0;
 }
 

[PATCH 3.16 121/217] USB: usb_driver_claim_interface: add sanity checking

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/core/driver.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -515,11 +515,15 @@ static int usb_unbind_interface(struct d
 int usb_driver_claim_interface(struct usb_driver *driver,
struct usb_interface *iface, void *priv)
 {
-   struct device *dev = >dev;
+   struct device *dev;
struct usb_device *udev;
int retval = 0;
int lpm_disable_error;
 
+   if (!iface)
+   return -ENODEV;
+
+   dev = >dev;
if (dev->driver)
return -EBUSY;
 

[PATCH 3.16 132/217] target: Fix target_release_cmd_kref shutdown comp leak

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Himanshu Madhani 

commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream.

This patch fixes an active I/O shutdown bug for fabric
drivers using target_wait_for_sess_cmds(), where se_cmd
descriptor shutdown would result in hung tasks waiting
indefinitely for se_cmd->cmd_wait_comp to complete().

To address this bug, drop the incorrect list_del_init()
usage in target_wait_for_sess_cmds() and always complete()
during se_cmd target_release_cmd_kref() put, in order to
let caller invoke the final fabric release callback
into se_cmd->se_tfo->release_cmd() code.

Reported-by: Himanshu Madhani 
Tested-by: Himanshu Madhani 
Signed-off-by: Himanshu Madhani 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings 
---
 drivers/target/target_core_transport.c | 2 --
 1 file changed, 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2540,8 +2540,6 @@ void target_wait_for_sess_cmds(struct se
 
list_for_each_entry_safe(se_cmd, tmp_cmd,
_sess->sess_wait_list, se_cmd_list) {
-   list_del_init(_cmd->se_cmd_list);
-
pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
" %d\n", se_cmd, se_cmd->t_state,
se_cmd->se_tfo->get_cmd_state(se_cmd));

[PATCH 3.16 144/217] MAINTAINERS: Update mailing list and web page for hwmon subsystem

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

commit 968ce1b1f45a7d76b5471b19bd035dbecc72f32d upstream.

The old web page for the hwmon subsystem is no longer operational,
and the mailing list has become unreliable. Move both to kernel.org.

Reviewed-by: Jean Delvare 
Signed-off-by: Guenter Roeck 
[bwh: Backported to 3.16: the set of hwmon drivers is different, so do a
 search-and-replace for the same addresses]
Signed-off-by: Ben Hutchings 
---
 MAINTAINERS | 96 ++---
 1 file changed, 48 insertions(+), 48 deletions(-)

--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -218,13 +218,13 @@ F:kernel/sys_ni.c
 
 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
 M: Hans de Goede 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/abituguru.c
 
 ABIT UGURU 3 HARDWARE MONITOR DRIVER
 M: Alistair John Strachan 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/abituguru3.c
 
@@ -355,14 +355,14 @@ S:Maintained
 
 ADM1025 HARDWARE MONITOR DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/adm1025
 F: drivers/hwmon/adm1025.c
 
 ADM1029 HARDWARE MONITOR DRIVER
 M: Corentin Labbe 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/adm1029.c
 
@@ -407,7 +407,7 @@ F:  drivers/video/backlight/adp8860_bl.c
 
 ADS1015 HARDWARE MONITOR DRIVER
 M: Dirk Eibach 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/ads1015
 F: drivers/hwmon/ads1015.c
@@ -420,7 +420,7 @@ F:  drivers/macintosh/therm_adt746x.c
 
 ADT7475 HARDWARE MONITOR DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/adt7475
 F: drivers/hwmon/adt7475.c
@@ -568,7 +568,7 @@ F:  include/linux/ccp.h
 
 AMD FAM15H PROCESSOR POWER MONITORING DRIVER
 M: Andreas Herrmann 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/fam15h_power
 F: drivers/hwmon/fam15h_power.c
@@ -689,7 +689,7 @@ F:  drivers/input/mouse/bcm5974.c
 
 APPLE SMC DRIVER
 M: Henrik Rydberg 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/applesmc.c
 
@@ -1504,7 +1504,7 @@ F:include/media/as3645a.h
 
 ASC7621 HARDWARE MONITOR DRIVER
 M: George Joseph 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/asc7621
 F: drivers/hwmon/asc7621.c
@@ -1583,7 +1583,7 @@ F:drivers/net/wireless/ath/carl9170/
 
 ATK0110 HWMON DRIVER
 M: Luca Tettamanti 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/asus_atk0110.c
 
@@ -2459,7 +2459,7 @@ F:mm/page_cgroup.c
 
 CORETEMP HARDWARE MONITORING DRIVER
 M: Fenghua Yu 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/coretemp
 F: drivers/hwmon/coretemp.c
@@ -2931,7 +2931,7 @@ T:git git://git.infradead.org/users/vko
 
 DME1737 HARDWARE MONITOR DRIVER
 M: Juerg Haefliger 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/dme1737
 F: drivers/hwmon/dme1737.c
@@ -3559,7 +3559,7 @@ F:include/video/exynos_mipi*
 
 F71805F HARDWARE MONITORING DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/f71805f
 F: drivers/hwmon/f71805f.c
@@ -3632,7 +3632,7 @@ F:fs/*
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M: Riku Voipio 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/f75375s.c
 F: include/linux/f75375s.h
@@ -4093,8 +4093,8 @@ F:drivers/tty/hvc/
 HARDWARE MONITORING
 M: Jean Delvare 
 M: Guenter Roeck 
-L: lm-sens...@lm-sensors.org
-W: http://www.lm-sensors.org/
+L: linux-hw...@vger.kernel.org
+W: http://hwmon.wiki.kernel.org/
 T: quilt 

[PATCH 3.16 132/217] target: Fix target_release_cmd_kref shutdown comp leak

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Himanshu Madhani 

commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream.

This patch fixes an active I/O shutdown bug for fabric
drivers using target_wait_for_sess_cmds(), where se_cmd
descriptor shutdown would result in hung tasks waiting
indefinitely for se_cmd->cmd_wait_comp to complete().

To address this bug, drop the incorrect list_del_init()
usage in target_wait_for_sess_cmds() and always complete()
during se_cmd target_release_cmd_kref() put, in order to
let caller invoke the final fabric release callback
into se_cmd->se_tfo->release_cmd() code.

Reported-by: Himanshu Madhani 
Tested-by: Himanshu Madhani 
Signed-off-by: Himanshu Madhani 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings 
---
 drivers/target/target_core_transport.c | 2 --
 1 file changed, 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2540,8 +2540,6 @@ void target_wait_for_sess_cmds(struct se
 
list_for_each_entry_safe(se_cmd, tmp_cmd,
_sess->sess_wait_list, se_cmd_list) {
-   list_del_init(_cmd->se_cmd_list);
-
pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
" %d\n", se_cmd, se_cmd->t_state,
se_cmd->se_tfo->get_cmd_state(se_cmd));

[PATCH 3.16 144/217] MAINTAINERS: Update mailing list and web page for hwmon subsystem

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

commit 968ce1b1f45a7d76b5471b19bd035dbecc72f32d upstream.

The old web page for the hwmon subsystem is no longer operational,
and the mailing list has become unreliable. Move both to kernel.org.

Reviewed-by: Jean Delvare 
Signed-off-by: Guenter Roeck 
[bwh: Backported to 3.16: the set of hwmon drivers is different, so do a
 search-and-replace for the same addresses]
Signed-off-by: Ben Hutchings 
---
 MAINTAINERS | 96 ++---
 1 file changed, 48 insertions(+), 48 deletions(-)

--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -218,13 +218,13 @@ F:kernel/sys_ni.c
 
 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
 M: Hans de Goede 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/abituguru.c
 
 ABIT UGURU 3 HARDWARE MONITOR DRIVER
 M: Alistair John Strachan 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/abituguru3.c
 
@@ -355,14 +355,14 @@ S:Maintained
 
 ADM1025 HARDWARE MONITOR DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/adm1025
 F: drivers/hwmon/adm1025.c
 
 ADM1029 HARDWARE MONITOR DRIVER
 M: Corentin Labbe 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/adm1029.c
 
@@ -407,7 +407,7 @@ F:  drivers/video/backlight/adp8860_bl.c
 
 ADS1015 HARDWARE MONITOR DRIVER
 M: Dirk Eibach 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/ads1015
 F: drivers/hwmon/ads1015.c
@@ -420,7 +420,7 @@ F:  drivers/macintosh/therm_adt746x.c
 
 ADT7475 HARDWARE MONITOR DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/adt7475
 F: drivers/hwmon/adt7475.c
@@ -568,7 +568,7 @@ F:  include/linux/ccp.h
 
 AMD FAM15H PROCESSOR POWER MONITORING DRIVER
 M: Andreas Herrmann 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/fam15h_power
 F: drivers/hwmon/fam15h_power.c
@@ -689,7 +689,7 @@ F:  drivers/input/mouse/bcm5974.c
 
 APPLE SMC DRIVER
 M: Henrik Rydberg 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/applesmc.c
 
@@ -1504,7 +1504,7 @@ F:include/media/as3645a.h
 
 ASC7621 HARDWARE MONITOR DRIVER
 M: George Joseph 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/asc7621
 F: drivers/hwmon/asc7621.c
@@ -1583,7 +1583,7 @@ F:drivers/net/wireless/ath/carl9170/
 
 ATK0110 HWMON DRIVER
 M: Luca Tettamanti 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/asus_atk0110.c
 
@@ -2459,7 +2459,7 @@ F:mm/page_cgroup.c
 
 CORETEMP HARDWARE MONITORING DRIVER
 M: Fenghua Yu 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/coretemp
 F: drivers/hwmon/coretemp.c
@@ -2931,7 +2931,7 @@ T:git git://git.infradead.org/users/vko
 
 DME1737 HARDWARE MONITOR DRIVER
 M: Juerg Haefliger 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/dme1737
 F: drivers/hwmon/dme1737.c
@@ -3559,7 +3559,7 @@ F:include/video/exynos_mipi*
 
 F71805F HARDWARE MONITORING DRIVER
 M: Jean Delvare 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/f71805f
 F: drivers/hwmon/f71805f.c
@@ -3632,7 +3632,7 @@ F:fs/*
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M: Riku Voipio 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: drivers/hwmon/f75375s.c
 F: include/linux/f75375s.h
@@ -4093,8 +4093,8 @@ F:drivers/tty/hvc/
 HARDWARE MONITORING
 M: Jean Delvare 
 M: Guenter Roeck 
-L: lm-sens...@lm-sensors.org
-W: http://www.lm-sensors.org/
+L: linux-hw...@vger.kernel.org
+W: http://hwmon.wiki.kernel.org/
 T: quilt 
kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-hwmon/
 T: git 
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git
 S: Maintained
@@ -4540,7 +4540,7 @@ F:drivers/usb/atm/ueagle-atm.c
 
 INA209 HARDWARE MONITOR DRIVER
 M: Guenter Roeck 
-L: lm-sens...@lm-sensors.org
+L: linux-hw...@vger.kernel.org
 S: Maintained
 F: Documentation/hwmon/ina209
 F: Documentation/devicetree/bindings/i2c/ina209.txt
@@ -4548,7 +4548,7 

[PATCH 3.16 138/217] ALSA: hda - Asus N750JV external subwoofer fixup

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bobi Mihalca 

commit 70cf2cbd685e218c3ffd105d9fb6cf0f8d767481 upstream.

ASUS N750JV needs the same fixup as N550 for enabling its subwoofer.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6065,6 +6065,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", 
ALC662_FIXUP_BASS_MODE4_CHMAP),
SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),

[PATCH 3.16 142/217] ppp: take reference on channels netns

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guillaume Nault 

commit 1f461dcdd296eecedac6bae2bfa90bd7eb89 upstream.

Let channels hold a reference on their network namespace.
Some channel types, like ppp_async and ppp_synctty, can have their
userspace controller running in a different namespace. Therefore they
can't rely on them to preclude their netns from being removed from
under them.

==
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at
addr 880064e217e0
Read of size 8 by task syz-executor/11581
=
BUG net_namespace (Not tainted): kasan: bad access detected
-

Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[<  none  >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440
[<  none  >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469
[< inline >] slab_alloc_node kernel/mm/slub.c:2532
[< inline >] slab_alloc kernel/mm/slub.c:2574
[<  none  >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579
[< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597
[< inline >] net_alloc kernel/net/core/net_namespace.c:325
[<  none  >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360
[<  none  >] create_new_namespaces+0x2f6/0x610 
kernel/kernel/nsproxy.c:95
[<  none  >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150
[<  none  >] copy_process.part.35+0x1bf4/0x5760 
kernel/kernel/fork.c:1451
[< inline >] copy_process kernel/kernel/fork.c:1274
[<  none  >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723
[< inline >] SYSC_clone kernel/kernel/fork.c:1832
[<  none  >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826
[<  none  >] entry_SYSCALL_64_fastpath+0x16/0x7a 
kernel/arch/x86/entry/entry_64.S:185

INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[<  none  >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650
[< inline >] slab_free kernel/mm/slub.c:2805
[<  none  >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814
[< inline >] net_free kernel/net/core/net_namespace.c:341
[<  none  >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348
[<  none  >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448
[<  none  >] process_one_work+0x794/0x1440 
kernel/kernel/workqueue.c:2036
[<  none  >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170
[<  none  >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303
[<  none  >] ret_from_fork+0x3f/0x70 
kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xea0001938800 objects=3 used=0 fp=0x880064e2
flags=0x5fffc004080
INFO: Object 0x880064e2 @offset=0 fp=0x880064e24200

CPU: 1 PID: 11581 Comm: syz-executor Tainted: GB   4.4.0+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
  8800662c7790 8292049d 88003e36a300
 880064e2 880064e2 8800662c77c0 816f2054
 88003e36a300 ea0001938800 880064e2 
Call Trace:
 [< inline >] __dump_stack kernel/lib/dump_stack.c:15
 [] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
 [] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
 [] object_err+0x2f/0x40 kernel/mm/slub.c:661
 [< inline >] print_address_description kernel/mm/kasan/report.c:138
 [] kasan_report_error+0x215/0x530 
kernel/mm/kasan/report.c:236
 [< inline >] kasan_report kernel/mm/kasan/report.c:259
 [] __asan_report_load8_noabort+0x3e/0x40 
kernel/mm/kasan/report.c:280
 [< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218
 [] ? ppp_unregister_channel+0x372/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [< inline >] ppp_pernet kernel/include/linux/compiler.h:218
 [] ppp_unregister_channel+0x372/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
 [] ? ppp_unregister_channel+0xe6/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [] ppp_asynctty_close+0xa3/0x130 
kernel/drivers/net/ppp/ppp_async.c:241
 [] ? async_lcp_peek+0x5b0/0x5b0 
kernel/drivers/net/ppp/ppp_async.c:1000
 [] tty_ldisc_close.isra.1+0x99/0xe0 
kernel/drivers/tty/tty_ldisc.c:478
 [] tty_ldisc_kill+0x40/0x170 
kernel/drivers/tty/tty_ldisc.c:744
 [] tty_ldisc_release+0x1b3/0x260 
kernel/drivers/tty/tty_ldisc.c:772
 [] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
 [] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
 [] __fput+0x236/0x780 kernel/fs/file_table.c:208
 [] 

[PATCH 3.16 138/217] ALSA: hda - Asus N750JV external subwoofer fixup

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bobi Mihalca 

commit 70cf2cbd685e218c3ffd105d9fb6cf0f8d767481 upstream.

ASUS N750JV needs the same fixup as N550 for enabling its subwoofer.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6065,6 +6065,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", 
ALC662_FIXUP_BASS_MODE4_CHMAP),
SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),

[PATCH 3.16 142/217] ppp: take reference on channels netns

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Guillaume Nault 

commit 1f461dcdd296eecedac6bae2bfa90bd7eb89 upstream.

Let channels hold a reference on their network namespace.
Some channel types, like ppp_async and ppp_synctty, can have their
userspace controller running in a different namespace. Therefore they
can't rely on them to preclude their netns from being removed from
under them.

==
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at
addr 880064e217e0
Read of size 8 by task syz-executor/11581
=
BUG net_namespace (Not tainted): kasan: bad access detected
-

Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[<  none  >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440
[<  none  >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469
[< inline >] slab_alloc_node kernel/mm/slub.c:2532
[< inline >] slab_alloc kernel/mm/slub.c:2574
[<  none  >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579
[< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597
[< inline >] net_alloc kernel/net/core/net_namespace.c:325
[<  none  >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360
[<  none  >] create_new_namespaces+0x2f6/0x610 
kernel/kernel/nsproxy.c:95
[<  none  >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150
[<  none  >] copy_process.part.35+0x1bf4/0x5760 
kernel/kernel/fork.c:1451
[< inline >] copy_process kernel/kernel/fork.c:1274
[<  none  >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723
[< inline >] SYSC_clone kernel/kernel/fork.c:1832
[<  none  >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826
[<  none  >] entry_SYSCALL_64_fastpath+0x16/0x7a 
kernel/arch/x86/entry/entry_64.S:185

INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[<  none  >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650
[< inline >] slab_free kernel/mm/slub.c:2805
[<  none  >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814
[< inline >] net_free kernel/net/core/net_namespace.c:341
[<  none  >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348
[<  none  >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448
[<  none  >] process_one_work+0x794/0x1440 
kernel/kernel/workqueue.c:2036
[<  none  >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170
[<  none  >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303
[<  none  >] ret_from_fork+0x3f/0x70 
kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xea0001938800 objects=3 used=0 fp=0x880064e2
flags=0x5fffc004080
INFO: Object 0x880064e2 @offset=0 fp=0x880064e24200

CPU: 1 PID: 11581 Comm: syz-executor Tainted: GB   4.4.0+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
  8800662c7790 8292049d 88003e36a300
 880064e2 880064e2 8800662c77c0 816f2054
 88003e36a300 ea0001938800 880064e2 
Call Trace:
 [< inline >] __dump_stack kernel/lib/dump_stack.c:15
 [] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
 [] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
 [] object_err+0x2f/0x40 kernel/mm/slub.c:661
 [< inline >] print_address_description kernel/mm/kasan/report.c:138
 [] kasan_report_error+0x215/0x530 
kernel/mm/kasan/report.c:236
 [< inline >] kasan_report kernel/mm/kasan/report.c:259
 [] __asan_report_load8_noabort+0x3e/0x40 
kernel/mm/kasan/report.c:280
 [< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218
 [] ? ppp_unregister_channel+0x372/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [< inline >] ppp_pernet kernel/include/linux/compiler.h:218
 [] ppp_unregister_channel+0x372/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
 [] ? ppp_unregister_channel+0xe6/0x3a0 
kernel/drivers/net/ppp/ppp_generic.c:2392
 [] ppp_asynctty_close+0xa3/0x130 
kernel/drivers/net/ppp/ppp_async.c:241
 [] ? async_lcp_peek+0x5b0/0x5b0 
kernel/drivers/net/ppp/ppp_async.c:1000
 [] tty_ldisc_close.isra.1+0x99/0xe0 
kernel/drivers/tty/tty_ldisc.c:478
 [] tty_ldisc_kill+0x40/0x170 
kernel/drivers/tty/tty_ldisc.c:744
 [] tty_ldisc_release+0x1b3/0x260 
kernel/drivers/tty/tty_ldisc.c:772
 [] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
 [] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
 [] __fput+0x236/0x780 kernel/fs/file_table.c:208
 [] fput+0x15/0x20 

[PATCH 3.16 135/217] tracing: Fix trace_printk() to print when not using bprintk()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit 3debb0a9ddb16526de8b456491b7db60114f7b5e upstream.

The trace_printk() code will allocate extra buffers if the compile detects
that a trace_printk() is used. To do this, the format of the trace_printk()
is saved to the __trace_printk_fmt section, and if that section is bigger
than zero, the buffers are allocated (along with a message that this has
happened).

If trace_printk() uses a format that is not a constant, and thus something
not guaranteed to be around when the print happens, the compiler optimizes
the fmt out, as it is not used, and the __trace_printk_fmt section is not
filled. This means the kernel will not allocate the special buffers needed
for the trace_printk() and the trace_printk() will not write anything to the
tracing buffer.

Adding a "__used" to the variable in the __trace_printk_fmt section will
keep it around, even though it is set to NULL. This will keep the string
from being printed in the debugfs/tracing/printk_formats section as it is
not needed.

Reported-by: Vlastimil Babka 
Fixes: 07d777fe8c398 "tracing: Add percpu buffers for trace_printk()"
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 include/linux/kernel.h  | 6 +++---
 kernel/trace/trace_printk.c | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -596,7 +596,7 @@ do {
\
 
 #define do_trace_printk(fmt, args...)  \
 do {   \
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
__attribute__((section("__trace_printk_fmt"))) =\
__builtin_constant_p(fmt) ? fmt : NULL; \
\
@@ -640,7 +640,7 @@ int __trace_printk(unsigned long ip, con
  */
 
 #define trace_puts(str) ({ \
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
__attribute__((section("__trace_printk_fmt"))) =\
__builtin_constant_p(str) ? str : NULL; \
\
@@ -662,7 +662,7 @@ extern void trace_dump_stack(int skip);
 #define ftrace_vprintk(fmt, vargs) \
 do {   \
if (__builtin_constant_p(fmt)) {\
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
  __attribute__((section("__trace_printk_fmt"))) =  \
__builtin_constant_p(fmt) ? fmt : NULL; \
\
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -292,6 +292,9 @@ static int t_show(struct seq_file *m, vo
const char *str = *fmt;
int i;
 
+   if (!*fmt)
+   return 0;
+
seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
 
/*

[PATCH 3.16 135/217] tracing: Fix trace_printk() to print when not using bprintk()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit 3debb0a9ddb16526de8b456491b7db60114f7b5e upstream.

The trace_printk() code will allocate extra buffers if the compile detects
that a trace_printk() is used. To do this, the format of the trace_printk()
is saved to the __trace_printk_fmt section, and if that section is bigger
than zero, the buffers are allocated (along with a message that this has
happened).

If trace_printk() uses a format that is not a constant, and thus something
not guaranteed to be around when the print happens, the compiler optimizes
the fmt out, as it is not used, and the __trace_printk_fmt section is not
filled. This means the kernel will not allocate the special buffers needed
for the trace_printk() and the trace_printk() will not write anything to the
tracing buffer.

Adding a "__used" to the variable in the __trace_printk_fmt section will
keep it around, even though it is set to NULL. This will keep the string
from being printed in the debugfs/tracing/printk_formats section as it is
not needed.

Reported-by: Vlastimil Babka 
Fixes: 07d777fe8c398 "tracing: Add percpu buffers for trace_printk()"
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 include/linux/kernel.h  | 6 +++---
 kernel/trace/trace_printk.c | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -596,7 +596,7 @@ do {
\
 
 #define do_trace_printk(fmt, args...)  \
 do {   \
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
__attribute__((section("__trace_printk_fmt"))) =\
__builtin_constant_p(fmt) ? fmt : NULL; \
\
@@ -640,7 +640,7 @@ int __trace_printk(unsigned long ip, con
  */
 
 #define trace_puts(str) ({ \
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
__attribute__((section("__trace_printk_fmt"))) =\
__builtin_constant_p(str) ? str : NULL; \
\
@@ -662,7 +662,7 @@ extern void trace_dump_stack(int skip);
 #define ftrace_vprintk(fmt, vargs) \
 do {   \
if (__builtin_constant_p(fmt)) {\
-   static const char *trace_printk_fmt \
+   static const char *trace_printk_fmt __used  \
  __attribute__((section("__trace_printk_fmt"))) =  \
__builtin_constant_p(fmt) ? fmt : NULL; \
\
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -292,6 +292,9 @@ static int t_show(struct seq_file *m, vo
const char *str = *fmt;
int i;
 
+   if (!*fmt)
+   return 0;
+
seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
 
/*

[PATCH 3.16 131/217] mdio-sun4i: oops in error handling in probe

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 227f33beab746aeec4ef3305bd17b1d374df09e7 upstream.

We could end up dereferencing an error pointer when we call
regulator_disable().

Fixes: 4bdcb1dd9feb ('net: Add MDIO bus driver for the Allwinner EMAC')
Signed-off-by: Dan Carpenter 
Acked-by: Chen-Yu Tsai 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/phy/mdio-sun4i.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -132,6 +132,7 @@ static int sun4i_mdio_probe(struct platf
return -EPROBE_DEFER;
 
dev_info(>dev, "no regulator found\n");
+   data->regulator = NULL;
} else {
ret = regulator_enable(data->regulator);
if (ret)
@@ -147,7 +148,8 @@ static int sun4i_mdio_probe(struct platf
return 0;
 
 err_out_disable_regulator:
-   regulator_disable(data->regulator);
+   if (data->regulator)
+   regulator_disable(data->regulator);
 err_out_free_mdiobus:
mdiobus_free(bus);
return ret;

[PATCH 3.16 139/217] ALSA: hda - Fix white noise on Asus N750JV headphone

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bobi Mihalca 

commit 9d4dc5840f93bcb002fa311693349deae7702bc5 upstream.

For reducing the noise from the headphone output on ASUS N750JV,
call the existing fixup, alc_fixup_auto_mute_via_amp(), additionally.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5818,6 +5818,7 @@ enum {
ALC668_FIXUP_AUTO_MUTE,
ALC668_FIXUP_DELL_DISABLE_AAMIX,
ALC668_FIXUP_DELL_XPS13,
+   ALC662_FIXUP_ASUS_Nx50,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -6044,6 +6045,12 @@ static const struct hda_fixup alc662_fix
.type = HDA_FIXUP_FUNC,
.v.func = alc_fixup_bass_chmap,
},
+   [ALC662_FIXUP_ASUS_Nx50] = {
+   .type = HDA_FIXUP_FUNC,
+   .v.func = alc_fixup_auto_mute_via_amp,
+   .chained = true,
+   .chain_id = ALC662_FIXUP_BASS_1A
+   },
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6065,7 +6072,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
-   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
+   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", 
ALC662_FIXUP_BASS_MODE4_CHMAP),
SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),

[PATCH 3.16 131/217] mdio-sun4i: oops in error handling in probe

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 227f33beab746aeec4ef3305bd17b1d374df09e7 upstream.

We could end up dereferencing an error pointer when we call
regulator_disable().

Fixes: 4bdcb1dd9feb ('net: Add MDIO bus driver for the Allwinner EMAC')
Signed-off-by: Dan Carpenter 
Acked-by: Chen-Yu Tsai 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/phy/mdio-sun4i.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -132,6 +132,7 @@ static int sun4i_mdio_probe(struct platf
return -EPROBE_DEFER;
 
dev_info(>dev, "no regulator found\n");
+   data->regulator = NULL;
} else {
ret = regulator_enable(data->regulator);
if (ret)
@@ -147,7 +148,8 @@ static int sun4i_mdio_probe(struct platf
return 0;
 
 err_out_disable_regulator:
-   regulator_disable(data->regulator);
+   if (data->regulator)
+   regulator_disable(data->regulator);
 err_out_free_mdiobus:
mdiobus_free(bus);
return ret;

[PATCH 3.16 139/217] ALSA: hda - Fix white noise on Asus N750JV headphone

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Bobi Mihalca 

commit 9d4dc5840f93bcb002fa311693349deae7702bc5 upstream.

For reducing the noise from the headphone output on ASUS N750JV,
call the existing fixup, alc_fixup_auto_mute_via_amp(), additionally.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5818,6 +5818,7 @@ enum {
ALC668_FIXUP_AUTO_MUTE,
ALC668_FIXUP_DELL_DISABLE_AAMIX,
ALC668_FIXUP_DELL_XPS13,
+   ALC662_FIXUP_ASUS_Nx50,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -6044,6 +6045,12 @@ static const struct hda_fixup alc662_fix
.type = HDA_FIXUP_FUNC,
.v.func = alc_fixup_bass_chmap,
},
+   [ALC662_FIXUP_ASUS_Nx50] = {
+   .type = HDA_FIXUP_FUNC,
+   .v.func = alc_fixup_auto_mute_via_amp,
+   .chained = true,
+   .chain_id = ALC662_FIXUP_BASS_1A
+   },
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6065,7 +6072,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
-   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
+   SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", 
ALC662_FIXUP_BASS_MODE4_CHMAP),
SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),

[PATCH 3.16 160/217] drm/udl: Use unlocked gem unreferencing

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Daniel Vetter 

commit 72b9ff0612ad8fc969b910cd00ac16b57a1a9ba4 upstream.

For drm_gem_object_unreference callers are required to hold
dev->struct_mutex, which these paths don't. Enforcing this requirement
has become a bit more strict with

commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663
Author: Daniel Vetter 
Date:   Thu Oct 15 09:36:25 2015 +0200

drm/gem: Check locking in drm_gem_object_unreference

Signed-off-by: Daniel Vetter 
Signed-off-by: Dave Airlie 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/udl/udl_fb.c  | 2 +-
 drivers/gpu/drm/udl/udl_gem.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -545,7 +545,7 @@ static int udlfb_create(struct drm_fb_he
 
return ret;
 out_gfree:
-   drm_gem_object_unreference(>ufb.obj->base);
+   drm_gem_object_unreference_unlocked(>ufb.obj->base);
 out:
return ret;
 }
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -51,7 +51,7 @@ udl_gem_create(struct drm_file *file,
return ret;
}
 
-   drm_gem_object_unreference(>base);
+   drm_gem_object_unreference_unlocked(>base);
*handle_p = handle;
return 0;
 }

[PATCH 3.16 123/217] tracing: Have preempt(irqs)off trace preempt disabled functions

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit cb86e05390debcc084cfdb0a71ed4c5dbbec517d upstream.

Joel Fernandes reported that the function tracing of preempt disabled
sections was not being reported when running either the preemptirqsoff or
preemptoff tracers. This was due to the fact that the function tracer
callback for those tracers checked if irqs were disabled before tracing. But
this fails when we want to trace preempt off locations as well.

Joel explained that he wanted to see funcitons where interrupts are enabled
but preemption was disabled. The expected output he wanted:

   <...>-22651d.h1 3419us : preempt_count_sub <-irq_exit
   <...>-22651d..1 3419us : __do_softirq <-irq_exit
   <...>-22651d..1 3419us : msecs_to_jiffies <-__do_softirq
   <...>-22651d..1 3420us : irqtime_account_irq <-__do_softirq
   <...>-22651d..1 3420us : __local_bh_disable_ip <-__do_softirq
   <...>-22651..s1 3421us : run_timer_softirq <-__do_softirq
   <...>-22651..s1 3421us : hrtimer_run_pending <-run_timer_softirq
   <...>-22651..s1 3421us : _raw_spin_lock_irq <-run_timer_softirq
   <...>-22651d.s1 3422us : preempt_count_add <-_raw_spin_lock_irq
   <...>-22651d.s2 3422us : _raw_spin_unlock_irq <-run_timer_softirq
   <...>-22651..s2 3422us : preempt_count_sub <-_raw_spin_unlock_irq
   <...>-22651..s1 3423us : rcu_bh_qs <-__do_softirq
   <...>-22651d.s1 3423us : irqtime_account_irq <-__do_softirq
   <...>-22651d.s1 3423us : __local_bh_enable <-__do_softirq

There's a comment saying that the irq disabled check is because there's a
possible race that tracing_cpu may be set when the function is executed. But
I don't remember that race. For now, I added a check for preemption being
enabled too to not record the function, as there would be no race if that
was the case. I need to re-investigate this, as I'm now thinking that the
tracing_cpu will always be correct. But no harm in keeping the check for
now, except for the slight performance hit.

Link: 
http://lkml.kernel.org/r/1457770386-88717-1-git-send-email-agnel.j...@gmail.com

Fixes: 5e6d2b9cfa3a "tracing: Use one prologue for the preempt irqs off tracer 
function tracers"
Cc: sta...@vget.kernel.org # 2.6.37+
Reported-by: Joel Fernandes 
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 kernel/trace/trace_irqsoff.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -118,8 +118,12 @@ static int func_prolog_dec(struct trace_
return 0;
 
local_save_flags(*flags);
-   /* slight chance to get a false positive on tracing_cpu */
-   if (!irqs_disabled_flags(*flags))
+   /*
+* Slight chance to get a false positive on tracing_cpu,
+* although I'm starting to think there isn't a chance.
+* Leave this for now just to be paranoid.
+*/
+   if (!irqs_disabled_flags(*flags) && !preempt_count())
return 0;
 
*data = per_cpu_ptr(tr->trace_buffer.data, cpu);

[PATCH 3.16 160/217] drm/udl: Use unlocked gem unreferencing

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Daniel Vetter 

commit 72b9ff0612ad8fc969b910cd00ac16b57a1a9ba4 upstream.

For drm_gem_object_unreference callers are required to hold
dev->struct_mutex, which these paths don't. Enforcing this requirement
has become a bit more strict with

commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663
Author: Daniel Vetter 
Date:   Thu Oct 15 09:36:25 2015 +0200

drm/gem: Check locking in drm_gem_object_unreference

Signed-off-by: Daniel Vetter 
Signed-off-by: Dave Airlie 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/udl/udl_fb.c  | 2 +-
 drivers/gpu/drm/udl/udl_gem.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -545,7 +545,7 @@ static int udlfb_create(struct drm_fb_he
 
return ret;
 out_gfree:
-   drm_gem_object_unreference(>ufb.obj->base);
+   drm_gem_object_unreference_unlocked(>ufb.obj->base);
 out:
return ret;
 }
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -51,7 +51,7 @@ udl_gem_create(struct drm_file *file,
return ret;
}
 
-   drm_gem_object_unreference(>base);
+   drm_gem_object_unreference_unlocked(>base);
*handle_p = handle;
return 0;
 }

[PATCH 3.16 123/217] tracing: Have preempt(irqs)off trace preempt disabled functions

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit cb86e05390debcc084cfdb0a71ed4c5dbbec517d upstream.

Joel Fernandes reported that the function tracing of preempt disabled
sections was not being reported when running either the preemptirqsoff or
preemptoff tracers. This was due to the fact that the function tracer
callback for those tracers checked if irqs were disabled before tracing. But
this fails when we want to trace preempt off locations as well.

Joel explained that he wanted to see funcitons where interrupts are enabled
but preemption was disabled. The expected output he wanted:

   <...>-22651d.h1 3419us : preempt_count_sub <-irq_exit
   <...>-22651d..1 3419us : __do_softirq <-irq_exit
   <...>-22651d..1 3419us : msecs_to_jiffies <-__do_softirq
   <...>-22651d..1 3420us : irqtime_account_irq <-__do_softirq
   <...>-22651d..1 3420us : __local_bh_disable_ip <-__do_softirq
   <...>-22651..s1 3421us : run_timer_softirq <-__do_softirq
   <...>-22651..s1 3421us : hrtimer_run_pending <-run_timer_softirq
   <...>-22651..s1 3421us : _raw_spin_lock_irq <-run_timer_softirq
   <...>-22651d.s1 3422us : preempt_count_add <-_raw_spin_lock_irq
   <...>-22651d.s2 3422us : _raw_spin_unlock_irq <-run_timer_softirq
   <...>-22651..s2 3422us : preempt_count_sub <-_raw_spin_unlock_irq
   <...>-22651..s1 3423us : rcu_bh_qs <-__do_softirq
   <...>-22651d.s1 3423us : irqtime_account_irq <-__do_softirq
   <...>-22651d.s1 3423us : __local_bh_enable <-__do_softirq

There's a comment saying that the irq disabled check is because there's a
possible race that tracing_cpu may be set when the function is executed. But
I don't remember that race. For now, I added a check for preemption being
enabled too to not record the function, as there would be no race if that
was the case. I need to re-investigate this, as I'm now thinking that the
tracing_cpu will always be correct. But no harm in keeping the check for
now, except for the slight performance hit.

Link: 
http://lkml.kernel.org/r/1457770386-88717-1-git-send-email-agnel.j...@gmail.com

Fixes: 5e6d2b9cfa3a "tracing: Use one prologue for the preempt irqs off tracer 
function tracers"
Cc: sta...@vget.kernel.org # 2.6.37+
Reported-by: Joel Fernandes 
Signed-off-by: Steven Rostedt 
Signed-off-by: Ben Hutchings 
---
 kernel/trace/trace_irqsoff.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -118,8 +118,12 @@ static int func_prolog_dec(struct trace_
return 0;
 
local_save_flags(*flags);
-   /* slight chance to get a false positive on tracing_cpu */
-   if (!irqs_disabled_flags(*flags))
+   /*
+* Slight chance to get a false positive on tracing_cpu,
+* although I'm starting to think there isn't a chance.
+* Leave this for now just to be paranoid.
+*/
+   if (!irqs_disabled_flags(*flags) && !preempt_count())
return 0;
 
*data = per_cpu_ptr(tr->trace_buffer.data, cpu);

Re: [PATCH V3 1/4] acpi,pci,irq: reduce resource requirements

[Bjorn Helgaas]

On Tue, Apr 26, 2016 at 01:36:11PM -0500, Bjorn Helgaas wrote:
> On Sun, Apr 17, 2016 at 01:36:53PM -0400, Sinan Kaya wrote:
> > Code has been redesigned to calculate penalty requirements on the fly. This
> > significantly simplifies the implementation and removes some of the init
> > calls from x86 architecture.
> > 
> > Signed-off-by: Sinan Kaya 
> 
> For all four patches:
> 
> Acked-by: Bjorn Helgaas 

Rafael, I should have mentioned that I'm assuming you'll take these
because they're in drivers/acpi and you merged the previous ones,
e.g.,

  0971686954f9 ACPI / PCI: Simplify acpi_penalize_isa_irq()
  37c5939136d7 ACPI, PCI, irq: remove interrupt number restriction
  b5bd02695471 ACPI, PCI, irq: remove interrupt count restriction

Just let me know if you'd rather have me take them.

Bjorn

Re: [PATCH V3 1/4] acpi,pci,irq: reduce resource requirements

[Bjorn Helgaas]

On Tue, Apr 26, 2016 at 01:36:11PM -0500, Bjorn Helgaas wrote:
> On Sun, Apr 17, 2016 at 01:36:53PM -0400, Sinan Kaya wrote:
> > Code has been redesigned to calculate penalty requirements on the fly. This
> > significantly simplifies the implementation and removes some of the init
> > calls from x86 architecture.
> > 
> > Signed-off-by: Sinan Kaya 
> 
> For all four patches:
> 
> Acked-by: Bjorn Helgaas 

Rafael, I should have mentioned that I'm assuming you'll take these
because they're in drivers/acpi and you merged the previous ones,
e.g.,

  0971686954f9 ACPI / PCI: Simplify acpi_penalize_isa_irq()
  37c5939136d7 ACPI, PCI, irq: remove interrupt number restriction
  b5bd02695471 ACPI, PCI, irq: remove interrupt count restriction

Just let me know if you'd rather have me take them.

Bjorn

[PATCH 3.16 151/217] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Yoshihiro Shimoda 

commit 894f2fc44f2f3f48c36c973b1123f6ab298be160 upstream.

When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:

Unable to handle kernel NULL pointer dereference at virtual address 
pgd = c0004000
[] *pgd=
Internal error: Oops: 8007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [<>]lr : []psr: 6193
sp : c0725db8  ip :   fp : c0725df4
r10: 0001  r9 : 0193  r8 : ef3ccab4
r7 : ef3cca10  r6 : eea4586c  r5 :   r4 : ef19ceb4
r3 :   r2 : 009c  r1 : c0725dc4  r0 : ef19ceb4

This patch adds a condition to avoid the dereference.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Signed-off-by: Yoshihiro Shimoda 
Signed-off-by: Felipe Balbi 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/renesas_usbhs/fifo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usb
goto __usbhs_pkt_handler_end;
}
 
-   ret = func(pkt, _done);
+   if (likely(func))
+   ret = func(pkt, _done);
 
if (is_done)
__usbhsf_pkt_del(pkt);

[PATCH 3.16 151/217] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Yoshihiro Shimoda 

commit 894f2fc44f2f3f48c36c973b1123f6ab298be160 upstream.

When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:

Unable to handle kernel NULL pointer dereference at virtual address 
pgd = c0004000
[] *pgd=
Internal error: Oops: 8007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [<>]lr : []psr: 6193
sp : c0725db8  ip :   fp : c0725df4
r10: 0001  r9 : 0193  r8 : ef3ccab4
r7 : ef3cca10  r6 : eea4586c  r5 :   r4 : ef19ceb4
r3 :   r2 : 009c  r1 : c0725dc4  r0 : ef19ceb4

This patch adds a condition to avoid the dereference.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Signed-off-by: Yoshihiro Shimoda 
Signed-off-by: Felipe Balbi 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/renesas_usbhs/fifo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usb
goto __usbhs_pkt_handler_end;
}
 
-   ret = func(pkt, _done);
+   if (likely(func))
+   ret = func(pkt, _done);
 
if (is_done)
__usbhsf_pkt_del(pkt);

[PATCH 3.16 154/217] ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Vladis Dronov 

commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream.

create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
create_uaxx_quirk() functions allocate the audioformat object by themselves
and free it upon error before returning. However, once the object is linked
to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
double-freed, eventually resulting in a memory corruption.

This patch fixes these failures in the error paths by unlinking the audioformat
object before freeing it.

Based on a patch by Takashi Iwai 

[Note for stable backports:
 this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
 code cleanup in create_fixed_stream_quirk()')]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/quirks.c | 4 
 sound/usb/stream.c | 6 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -138,6 +138,7 @@ static int create_fixed_stream_quirk(str
usb_audio_err(chip, "cannot memdup\n");
return -ENOMEM;
}
+   INIT_LIST_HEAD(>list);
if (fp->nr_rates > MAX_NR_RATES) {
kfree(fp);
return -EINVAL;
@@ -181,6 +182,7 @@ static int create_fixed_stream_quirk(str
return 0;
 
  error:
+   list_del(>list); /* unlink for avoiding double-free */
kfree(fp);
kfree(rate_table);
return err;
@@ -456,6 +458,7 @@ static int create_uaxx_quirk(struct snd_
fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
fp->datainterval = 0;
fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
+   INIT_LIST_HEAD(>list);
 
switch (fp->maxpacksize) {
case 0x120:
@@ -479,6 +482,7 @@ static int create_uaxx_quirk(struct snd_
? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
err = snd_usb_add_audio_stream(chip, stream, fp);
if (err < 0) {
+   list_del(>list); /* unlink for avoiding double-free */
kfree(fp);
return err;
}
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -315,7 +315,9 @@ static struct snd_pcm_chmap_elem *conver
 /*
  * add this endpoint to the chip instance.
  * if a stream with the same endpoint already exists, append to it.
- * if not, create a new pcm stream.
+ * if not, create a new pcm stream. note, fp is added to the substream
+ * fmt_list and will be freed on the chip instance release. do not free
+ * fp or do remove it from the substream fmt_list to avoid double-free.
  */
 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
 int stream,
@@ -668,6 +670,7 @@ int snd_usb_parse_audio_interface(struct
* (fp->maxpacksize & 0x7ff);
fp->attributes = parse_uac_endpoint_attributes(chip, alts, 
protocol, iface_no);
fp->clock = clock;
+   INIT_LIST_HEAD(>list);
 
/* some quirks for attributes here */
 
@@ -716,6 +719,7 @@ int snd_usb_parse_audio_interface(struct
dev_dbg(>dev, "%u:%d: add audio endpoint %#x\n", iface_no, 
altno, fp->endpoint);
err = snd_usb_add_audio_stream(chip, stream, fp);
if (err < 0) {
+   list_del(>list); /* unlink for avoiding double-free 
*/
kfree(fp->rate_table);
kfree(fp->chmap);
kfree(fp);

[PATCH 3.16 154/217] ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Vladis Dronov 

commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream.

create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
create_uaxx_quirk() functions allocate the audioformat object by themselves
and free it upon error before returning. However, once the object is linked
to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
double-freed, eventually resulting in a memory corruption.

This patch fixes these failures in the error paths by unlinking the audioformat
object before freeing it.

Based on a patch by Takashi Iwai 

[Note for stable backports:
 this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
 code cleanup in create_fixed_stream_quirk()')]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/quirks.c | 4 
 sound/usb/stream.c | 6 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -138,6 +138,7 @@ static int create_fixed_stream_quirk(str
usb_audio_err(chip, "cannot memdup\n");
return -ENOMEM;
}
+   INIT_LIST_HEAD(>list);
if (fp->nr_rates > MAX_NR_RATES) {
kfree(fp);
return -EINVAL;
@@ -181,6 +182,7 @@ static int create_fixed_stream_quirk(str
return 0;
 
  error:
+   list_del(>list); /* unlink for avoiding double-free */
kfree(fp);
kfree(rate_table);
return err;
@@ -456,6 +458,7 @@ static int create_uaxx_quirk(struct snd_
fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
fp->datainterval = 0;
fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
+   INIT_LIST_HEAD(>list);
 
switch (fp->maxpacksize) {
case 0x120:
@@ -479,6 +482,7 @@ static int create_uaxx_quirk(struct snd_
? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
err = snd_usb_add_audio_stream(chip, stream, fp);
if (err < 0) {
+   list_del(>list); /* unlink for avoiding double-free */
kfree(fp);
return err;
}
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -315,7 +315,9 @@ static struct snd_pcm_chmap_elem *conver
 /*
  * add this endpoint to the chip instance.
  * if a stream with the same endpoint already exists, append to it.
- * if not, create a new pcm stream.
+ * if not, create a new pcm stream. note, fp is added to the substream
+ * fmt_list and will be freed on the chip instance release. do not free
+ * fp or do remove it from the substream fmt_list to avoid double-free.
  */
 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
 int stream,
@@ -668,6 +670,7 @@ int snd_usb_parse_audio_interface(struct
* (fp->maxpacksize & 0x7ff);
fp->attributes = parse_uac_endpoint_attributes(chip, alts, 
protocol, iface_no);
fp->clock = clock;
+   INIT_LIST_HEAD(>list);
 
/* some quirks for attributes here */
 
@@ -716,6 +719,7 @@ int snd_usb_parse_audio_interface(struct
dev_dbg(>dev, "%u:%d: add audio endpoint %#x\n", iface_no, 
altno, fp->endpoint);
err = snd_usb_add_audio_stream(chip, stream, fp);
if (err < 0) {
+   list_del(>list); /* unlink for avoiding double-free 
*/
kfree(fp->rate_table);
kfree(fp->chmap);
kfree(fp);

[PATCH 3.16 202/217] ax25: add link layer header validation function

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Willem de Bruijn 

commit ea47781c26510e5d97f80f9aceafe9065bd5e3aa upstream.

As variable length protocol, AX25 fails link layer header validation
tests based on a minimum length. header_ops.validate allows protocols
to validate headers that are shorter than hard_header_len. Implement
this callback for AX25.

See also http://comments.gmane.org/gmane.linux.network/401064

Signed-off-by: Willem de Bruijn 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 net/ax25/ax25_ip.c | 15 +++
 1 file changed, 15 insertions(+)

--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -231,9 +231,24 @@ int ax25_rebuild_header(struct sk_buff *
 
 #endif
 
+static bool ax25_validate_header(const char *header, unsigned int len)
+{
+   ax25_digi digi;
+
+   if (!len)
+   return false;
+
+   if (header[0])
+   return true;
+
+   return ax25_addr_parse(header + 1, len - 1, NULL, NULL, , NULL,
+  NULL);
+}
+
 const struct header_ops ax25_header_ops = {
.create = ax25_hard_header,
.rebuild = ax25_rebuild_header,
+   .validate = ax25_validate_header,
 };
 
 EXPORT_SYMBOL(ax25_hard_header);

[PATCH 3.16 075/217] perf/x86/pebs: Add workaround for broken OVFL status on HSW+

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Eranian 

commit 8077eca079a212f26419c57226f28696b7100683 upstream.

This patch fixes an issue with the GLOBAL_OVERFLOW_STATUS bits on
Haswell, Broadwell and Skylake processors when using PEBS.

The SDM stipulates that when the PEBS iterrupt threshold is crossed,
an interrupt is posted and the kernel is interrupted. The kernel will
find GLOBAL_OVF_SATUS bit 62 set indicating there are PEBS records to
drain. But the bits corresponding to the actual counters should NOT be
set. The kernel follows the SDM and assumes that all PEBS events are
processed in the drain_pebs() callback. The kernel then checks for
remaining overflows on any other (non-PEBS) events and processes these
in the for_each_bit_set() loop.

As it turns out, under certain conditions on HSW and later processors,
on PEBS buffer interrupt, bit 62 is set but the counter bits may be
set as well. In that case, the kernel drains PEBS and generates
SAMPLES with the EXACT tag, then it processes the counter bits, and
generates normal (non-EXACT) SAMPLES.

I ran into this problem by trying to understand why on HSW sampling on
a PEBS event was sometimes returning SAMPLES without the EXACT tag.
This should not happen on user level code because HSW has the
eventing_ip which always point to the instruction that caused the
event.

The workaround in this patch simply ensures that the bits for the
counters used for PEBS events are cleared after the PEBS buffer has
been drained. With this fix 100% of the PEBS samples on my user code
report the EXACT tag.

Before:
  $ perf record -e cpu/event=0xd0,umask=0x81/upp ./multichase
  $ perf report -D | fgrep SAMPLES
  PERF_RECORD_SAMPLE(IP, 0x2): 11775/11775: 0x406de5 period: 73469 addr: 0 
exact=Y
   \--- EXACT tag is missing

After:
  $ perf record -e cpu/event=0xd0,umask=0x81/upp ./multichase
  $ perf report -D | fgrep SAMPLES
  PERF_RECORD_SAMPLE(IP, 0x4002): 11775/11775: 0x406de5 period: 73469 addr: 0 
exact=Y
   \--- EXACT tag is set

The problem tends to appear more often when multiple PEBS events are used.

Signed-off-by: Stephane Eranian 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Alexander Shishkin 
Cc: Arnaldo Carvalho de Melo 
Cc: Jiri Olsa 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Vince Weaver 
Cc: adrian.hun...@intel.com
Cc: kan.li...@intel.com
Cc: namhy...@kernel.org
Link: 
http://lkml.kernel.org/r/1457034642-21837-3-git-send-email-eran...@google.com
Signed-off-by: Ingo Molnar 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings 
---
 arch/x86/events/intel/core.c | 10 ++
 1 file changed, 10 insertions(+)

--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1407,6 +1407,16 @@ again:
if (__test_and_clear_bit(62, (unsigned long *))) {
handled++;
x86_pmu.drain_pebs(regs);
+   /*
+* There are cases where, even though, the PEBS ovfl bit is set
+* in GLOBAL_OVF_STATUS, the PEBS events may also have their
+* overflow bits set for their counters. We must clear them
+* here because they have been processed as exact samples in
+* the drain_pebs() routine. They must not be processed again
+* in the for_each_bit_set() loop for regular samples below.
+*/
+   status &= ~cpuc->pebs_enabled;
+   status &= x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI;
}
 
/*

[PATCH 3.16 202/217] ax25: add link layer header validation function

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Willem de Bruijn 

commit ea47781c26510e5d97f80f9aceafe9065bd5e3aa upstream.

As variable length protocol, AX25 fails link layer header validation
tests based on a minimum length. header_ops.validate allows protocols
to validate headers that are shorter than hard_header_len. Implement
this callback for AX25.

See also http://comments.gmane.org/gmane.linux.network/401064

Signed-off-by: Willem de Bruijn 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
 net/ax25/ax25_ip.c | 15 +++
 1 file changed, 15 insertions(+)

--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -231,9 +231,24 @@ int ax25_rebuild_header(struct sk_buff *
 
 #endif
 
+static bool ax25_validate_header(const char *header, unsigned int len)
+{
+   ax25_digi digi;
+
+   if (!len)
+   return false;
+
+   if (header[0])
+   return true;
+
+   return ax25_addr_parse(header + 1, len - 1, NULL, NULL, , NULL,
+  NULL);
+}
+
 const struct header_ops ax25_header_ops = {
.create = ax25_hard_header,
.rebuild = ax25_rebuild_header,
+   .validate = ax25_validate_header,
 };
 
 EXPORT_SYMBOL(ax25_hard_header);

[PATCH 3.16 075/217] perf/x86/pebs: Add workaround for broken OVFL status on HSW+

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Eranian 

commit 8077eca079a212f26419c57226f28696b7100683 upstream.

This patch fixes an issue with the GLOBAL_OVERFLOW_STATUS bits on
Haswell, Broadwell and Skylake processors when using PEBS.

The SDM stipulates that when the PEBS iterrupt threshold is crossed,
an interrupt is posted and the kernel is interrupted. The kernel will
find GLOBAL_OVF_SATUS bit 62 set indicating there are PEBS records to
drain. But the bits corresponding to the actual counters should NOT be
set. The kernel follows the SDM and assumes that all PEBS events are
processed in the drain_pebs() callback. The kernel then checks for
remaining overflows on any other (non-PEBS) events and processes these
in the for_each_bit_set() loop.

As it turns out, under certain conditions on HSW and later processors,
on PEBS buffer interrupt, bit 62 is set but the counter bits may be
set as well. In that case, the kernel drains PEBS and generates
SAMPLES with the EXACT tag, then it processes the counter bits, and
generates normal (non-EXACT) SAMPLES.

I ran into this problem by trying to understand why on HSW sampling on
a PEBS event was sometimes returning SAMPLES without the EXACT tag.
This should not happen on user level code because HSW has the
eventing_ip which always point to the instruction that caused the
event.

The workaround in this patch simply ensures that the bits for the
counters used for PEBS events are cleared after the PEBS buffer has
been drained. With this fix 100% of the PEBS samples on my user code
report the EXACT tag.

Before:
  $ perf record -e cpu/event=0xd0,umask=0x81/upp ./multichase
  $ perf report -D | fgrep SAMPLES
  PERF_RECORD_SAMPLE(IP, 0x2): 11775/11775: 0x406de5 period: 73469 addr: 0 
exact=Y
   \--- EXACT tag is missing

After:
  $ perf record -e cpu/event=0xd0,umask=0x81/upp ./multichase
  $ perf report -D | fgrep SAMPLES
  PERF_RECORD_SAMPLE(IP, 0x4002): 11775/11775: 0x406de5 period: 73469 addr: 0 
exact=Y
   \--- EXACT tag is set

The problem tends to appear more often when multiple PEBS events are used.

Signed-off-by: Stephane Eranian 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Alexander Shishkin 
Cc: Arnaldo Carvalho de Melo 
Cc: Jiri Olsa 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Vince Weaver 
Cc: adrian.hun...@intel.com
Cc: kan.li...@intel.com
Cc: namhy...@kernel.org
Link: 
http://lkml.kernel.org/r/1457034642-21837-3-git-send-email-eran...@google.com
Signed-off-by: Ingo Molnar 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings 
---
 arch/x86/events/intel/core.c | 10 ++
 1 file changed, 10 insertions(+)

--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1407,6 +1407,16 @@ again:
if (__test_and_clear_bit(62, (unsigned long *))) {
handled++;
x86_pmu.drain_pebs(regs);
+   /*
+* There are cases where, even though, the PEBS ovfl bit is set
+* in GLOBAL_OVF_STATUS, the PEBS events may also have their
+* overflow bits set for their counters. We must clear them
+* here because they have been processed as exact samples in
+* the drain_pebs() routine. They must not be processed again
+* in the for_each_bit_set() loop for regular samples below.
+*/
+   status &= ~cpuc->pebs_enabled;
+   status &= x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI;
}
 
/*

[PATCH 3.16 106/217] sd: disable discard_zeroes_data for UNMAP

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Martin K. Petersen" 

commit 7985090aa0201fa7760583f9f8e6ba41a8d4c392 upstream.

The T10 SBC UNMAP command does not provide any hard guarantees that
blocks will return zeroes on a subsequent READ. This is due to the fact
that the device server is free to silently ignore all or parts of the
request.

The only way to ensure that a block consistently returns zeroes after
being unmapped is to use WRITE SAME with the UNMAP bit set. Should the
device be unable to unmap one or more blocks described by the command it
is required to manually write zeroes to them.

Until now we have preferred UNMAP over the WRITE SAME variants to
accommodate thinly provisioned devices that predated the final SBC-3
spec. This patch changes the heuristic so that we favor WRITE SAME(16)
or (10) over UNMAP if these commands are marked as supported in the
Logical Block Provisioning VPD page.

The patch also disables discard_zeroes_data for devices operating in
UNMAP mode.

Signed-off-by: Martin K. Petersen 
Reviewed-by: Paolo Bonzini 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/sd.c | 10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -627,7 +627,7 @@ static void sd_config_discard(struct scs
unsigned int logical_block_size = sdkp->device->sector_size;
unsigned int max_blocks = 0;
 
-   q->limits.discard_zeroes_data = sdkp->lbprz;
+   q->limits.discard_zeroes_data = 0;
q->limits.discard_alignment = sdkp->unmap_alignment *
logical_block_size;
q->limits.discard_granularity =
@@ -651,11 +651,13 @@ static void sd_config_discard(struct scs
case SD_LBP_WS16:
max_blocks = min_not_zero(sdkp->max_ws_blocks,
  (u32)SD_MAX_WS16_BLOCKS);
+   q->limits.discard_zeroes_data = sdkp->lbprz;
break;
 
case SD_LBP_WS10:
max_blocks = min_not_zero(sdkp->max_ws_blocks,
  (u32)SD_MAX_WS10_BLOCKS);
+   q->limits.discard_zeroes_data = sdkp->lbprz;
break;
 
case SD_LBP_ZERO:
@@ -2572,12 +2574,12 @@ static void sd_read_block_limits(struct
 
} else {/* LBP VPD page tells us what to use */
 
-   if (sdkp->lbpu && sdkp->max_unmap_blocks)
-   sd_config_discard(sdkp, SD_LBP_UNMAP);
-   else if (sdkp->lbpws)
+   if (sdkp->lbpws)
sd_config_discard(sdkp, SD_LBP_WS16);
else if (sdkp->lbpws10)
sd_config_discard(sdkp, SD_LBP_WS10);
+   else if (sdkp->lbpu && sdkp->max_unmap_blocks)
+   sd_config_discard(sdkp, SD_LBP_UNMAP);
else
sd_config_discard(sdkp, SD_LBP_DISABLE);
}

[PATCH 3.16 162/217] ALSA: hda - fix front mic problem for a HP desktop

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Hui Wang 

commit e549d190f7b5f94e9ab36bd965028112914d010d upstream.

The front mic jack (pink color) can't detect any plug or unplug. After
applying this fix, both detecting function and recording function
work well.

BugLink: https://bugs.launchpad.net/bugs/1564712
Signed-off-by: Hui Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 9 +
 1 file changed, 9 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4343,6 +4343,7 @@ enum {
ALC293_FIXUP_LENOVO_SPK_NOISE,
ALC255_FIXUP_DELL_SPK_NOISE,
ALC280_FIXUP_HP_HEADSET_MIC,
+   ALC221_FIXUP_HP_FRONT_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4841,6 +4842,13 @@ static const struct hda_fixup alc269_fix
.chained = true,
.chain_id = ALC269_FIXUP_HEADSET_MIC,
},
+   [ALC221_FIXUP_HP_FRONT_MIC] = {
+   .type = HDA_FIXUP_PINS,
+   .v.pins = (const struct hda_pintbl[]) {
+   { 0x19, 0x02a19020 }, /* Front Mic */
+   { }
+   },
+   },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4960,6 +4968,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", 
ALC280_FIXUP_HP_HEADSET_MIC),
+   SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),

[PATCH 3.16 106/217] sd: disable discard_zeroes_data for UNMAP

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Martin K. Petersen" 

commit 7985090aa0201fa7760583f9f8e6ba41a8d4c392 upstream.

The T10 SBC UNMAP command does not provide any hard guarantees that
blocks will return zeroes on a subsequent READ. This is due to the fact
that the device server is free to silently ignore all or parts of the
request.

The only way to ensure that a block consistently returns zeroes after
being unmapped is to use WRITE SAME with the UNMAP bit set. Should the
device be unable to unmap one or more blocks described by the command it
is required to manually write zeroes to them.

Until now we have preferred UNMAP over the WRITE SAME variants to
accommodate thinly provisioned devices that predated the final SBC-3
spec. This patch changes the heuristic so that we favor WRITE SAME(16)
or (10) over UNMAP if these commands are marked as supported in the
Logical Block Provisioning VPD page.

The patch also disables discard_zeroes_data for devices operating in
UNMAP mode.

Signed-off-by: Martin K. Petersen 
Reviewed-by: Paolo Bonzini 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/sd.c | 10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -627,7 +627,7 @@ static void sd_config_discard(struct scs
unsigned int logical_block_size = sdkp->device->sector_size;
unsigned int max_blocks = 0;
 
-   q->limits.discard_zeroes_data = sdkp->lbprz;
+   q->limits.discard_zeroes_data = 0;
q->limits.discard_alignment = sdkp->unmap_alignment *
logical_block_size;
q->limits.discard_granularity =
@@ -651,11 +651,13 @@ static void sd_config_discard(struct scs
case SD_LBP_WS16:
max_blocks = min_not_zero(sdkp->max_ws_blocks,
  (u32)SD_MAX_WS16_BLOCKS);
+   q->limits.discard_zeroes_data = sdkp->lbprz;
break;
 
case SD_LBP_WS10:
max_blocks = min_not_zero(sdkp->max_ws_blocks,
  (u32)SD_MAX_WS10_BLOCKS);
+   q->limits.discard_zeroes_data = sdkp->lbprz;
break;
 
case SD_LBP_ZERO:
@@ -2572,12 +2574,12 @@ static void sd_read_block_limits(struct
 
} else {/* LBP VPD page tells us what to use */
 
-   if (sdkp->lbpu && sdkp->max_unmap_blocks)
-   sd_config_discard(sdkp, SD_LBP_UNMAP);
-   else if (sdkp->lbpws)
+   if (sdkp->lbpws)
sd_config_discard(sdkp, SD_LBP_WS16);
else if (sdkp->lbpws10)
sd_config_discard(sdkp, SD_LBP_WS10);
+   else if (sdkp->lbpu && sdkp->max_unmap_blocks)
+   sd_config_discard(sdkp, SD_LBP_UNMAP);
else
sd_config_discard(sdkp, SD_LBP_DISABLE);
}

[PATCH 3.16 162/217] ALSA: hda - fix front mic problem for a HP desktop

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Hui Wang 

commit e549d190f7b5f94e9ab36bd965028112914d010d upstream.

The front mic jack (pink color) can't detect any plug or unplug. After
applying this fix, both detecting function and recording function
work well.

BugLink: https://bugs.launchpad.net/bugs/1564712
Signed-off-by: Hui Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_realtek.c | 9 +
 1 file changed, 9 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4343,6 +4343,7 @@ enum {
ALC293_FIXUP_LENOVO_SPK_NOISE,
ALC255_FIXUP_DELL_SPK_NOISE,
ALC280_FIXUP_HP_HEADSET_MIC,
+   ALC221_FIXUP_HP_FRONT_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4841,6 +4842,13 @@ static const struct hda_fixup alc269_fix
.chained = true,
.chain_id = ALC269_FIXUP_HEADSET_MIC,
},
+   [ALC221_FIXUP_HP_FRONT_MIC] = {
+   .type = HDA_FIXUP_PINS,
+   .v.pins = (const struct hda_pintbl[]) {
+   { 0x19, 0x02a19020 }, /* Front Mic */
+   { }
+   },
+   },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4960,6 +4968,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", 
ALC280_FIXUP_HP_HEADSET_MIC),
+   SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),

[PATCH 3.16 111/217] paride: make 'verbose' parameter an 'int' again

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

commit dec63a4dec2d6d01346fd5d96062e67c0636852b upstream.

gcc-6.0 found an ancient bug in the paride driver, which had a
"module_param(verbose, bool, 0);" since before 2.6.12, but actually uses
it to accept '0', '1' or '2' as arguments:

  drivers/block/paride/pd.c: In function 'pd_init_dev_parms':
  drivers/block/paride/pd.c:298:29: warning: comparison of constant '1' with 
boolean expression is always false [-Wbool-compare]
   #define DBMSG(msg) ((verbose>1)?(msg):NULL)

In 2012, Rusty did a cleanup patch that also changed the type of the
variable to 'bool', which introduced what is now a gcc warning.

This changes the type back to 'int' and adapts the module_param() line
instead, so it should work as documented in case anyone ever cares about
running the ancient driver with debugging.

Fixes: 90ab5ee94171 ("module_param: make bool parameters really bool (drivers & 
misc)")
Signed-off-by: Arnd Bergmann 
Rusty Russell 
Cc: Tim Waugh 
Cc: Sudip Mukherjee 
Cc: Jens Axboe 
Cc: Greg Kroah-Hartman 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/block/paride/pd.c | 4 ++--
 drivers/block/paride/pt.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -126,7 +126,7 @@
 */
 #include 
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PD_MAJOR;
 static char *name = PD_NAME;
 static int cluster = 64;
@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO,
 static DEFINE_MUTEX(pd_mutex);
 static DEFINE_SPINLOCK(pd_lock);
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param(cluster, int, 0);
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -117,7 +117,7 @@
 
 */
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PT_MAJOR;
 static char *name = PT_NAME;
 static int disable = 0;
@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {, &
 
 #include 
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param_array(drive0, int, NULL, 0);

[PATCH 3.16 111/217] paride: make 'verbose' parameter an 'int' again

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

commit dec63a4dec2d6d01346fd5d96062e67c0636852b upstream.

gcc-6.0 found an ancient bug in the paride driver, which had a
"module_param(verbose, bool, 0);" since before 2.6.12, but actually uses
it to accept '0', '1' or '2' as arguments:

  drivers/block/paride/pd.c: In function 'pd_init_dev_parms':
  drivers/block/paride/pd.c:298:29: warning: comparison of constant '1' with 
boolean expression is always false [-Wbool-compare]
   #define DBMSG(msg) ((verbose>1)?(msg):NULL)

In 2012, Rusty did a cleanup patch that also changed the type of the
variable to 'bool', which introduced what is now a gcc warning.

This changes the type back to 'int' and adapts the module_param() line
instead, so it should work as documented in case anyone ever cares about
running the ancient driver with debugging.

Fixes: 90ab5ee94171 ("module_param: make bool parameters really bool (drivers & 
misc)")
Signed-off-by: Arnd Bergmann 
Rusty Russell 
Cc: Tim Waugh 
Cc: Sudip Mukherjee 
Cc: Jens Axboe 
Cc: Greg Kroah-Hartman 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/block/paride/pd.c | 4 ++--
 drivers/block/paride/pt.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -126,7 +126,7 @@
 */
 #include 
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PD_MAJOR;
 static char *name = PD_NAME;
 static int cluster = 64;
@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO,
 static DEFINE_MUTEX(pd_mutex);
 static DEFINE_SPINLOCK(pd_lock);
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param(cluster, int, 0);
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -117,7 +117,7 @@
 
 */
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PT_MAJOR;
 static char *name = PT_NAME;
 static int disable = 0;
@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {, &
 
 #include 
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param_array(drive0, int, NULL, 0);

[PATCH 3.16 101/217] net: Fix use after free in the recvmmsg exit path

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit 34b88a68f26a75e4fded796f1a49c40f82234b7d upstream.

The syzkaller fuzzer hit the following use-after-free:

  Call Trace:
   [] __asan_report_load8_noabort+0x3e/0x40 
mm/kasan/report.c:295
   [] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261
   [< inline >] SYSC_recvmmsg net/socket.c:2281
   [] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270
   [] entry_SYSCALL_64_fastpath+0x16/0x7a
  arch/x86/entry/entry_64.S:185

And, as Dmitry rightly assessed, that is because we can drop the
reference and then touch it when the underlying recvmsg calls return
some packets and then hit an error, which will make recvmmsg to set
sock->sk->sk_err, oops, fix it.

Reported-and-Tested-by: Dmitry Vyukov 
Cc: Alexander Potapenko 
Cc: Eric Dumazet 
Cc: Kostya Serebryany 
Cc: Sasha Levin 
Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
http://lkml.kernel.org/r/20160122211644.gc2...@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/socket.c | 38 +++---
 1 file changed, 19 insertions(+), 19 deletions(-)

--- a/net/socket.c
+++ b/net/socket.c
@@ -2404,31 +2404,31 @@ int __sys_recvmmsg(int fd, struct mmsghd
break;
}
 
-out_put:
-   fput_light(sock->file, fput_needed);
-
if (err == 0)
-   return datagrams;
+   goto out_put;
+
+   if (datagrams == 0) {
+   datagrams = err;
+   goto out_put;
+   }
 
-   if (datagrams != 0) {
+   /*
+* We may return less entries than requested (vlen) if the
+* sock is non block and there aren't enough datagrams...
+*/
+   if (err != -EAGAIN) {
/*
-* We may return less entries than requested (vlen) if the
-* sock is non block and there aren't enough datagrams...
+* ... or  if recvmsg returns an error after we
+* received some datagrams, where we record the
+* error to return on the next call or if the
+* app asks about it using getsockopt(SO_ERROR).
 */
-   if (err != -EAGAIN) {
-   /*
-* ... or  if recvmsg returns an error after we
-* received some datagrams, where we record the
-* error to return on the next call or if the
-* app asks about it using getsockopt(SO_ERROR).
-*/
-   sock->sk->sk_err = -err;
-   }
-
-   return datagrams;
+   sock->sk->sk_err = -err;
}
+out_put:
+   fput_light(sock->file, fput_needed);
 
-   return err;
+   return datagrams;
 }
 
 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,

[PATCH 3.16 101/217] net: Fix use after free in the recvmmsg exit path

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit 34b88a68f26a75e4fded796f1a49c40f82234b7d upstream.

The syzkaller fuzzer hit the following use-after-free:

  Call Trace:
   [] __asan_report_load8_noabort+0x3e/0x40 
mm/kasan/report.c:295
   [] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261
   [< inline >] SYSC_recvmmsg net/socket.c:2281
   [] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270
   [] entry_SYSCALL_64_fastpath+0x16/0x7a
  arch/x86/entry/entry_64.S:185

And, as Dmitry rightly assessed, that is because we can drop the
reference and then touch it when the underlying recvmsg calls return
some packets and then hit an error, which will make recvmmsg to set
sock->sk->sk_err, oops, fix it.

Reported-and-Tested-by: Dmitry Vyukov 
Cc: Alexander Potapenko 
Cc: Eric Dumazet 
Cc: Kostya Serebryany 
Cc: Sasha Levin 
Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
http://lkml.kernel.org/r/20160122211644.gc2...@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/socket.c | 38 +++---
 1 file changed, 19 insertions(+), 19 deletions(-)

--- a/net/socket.c
+++ b/net/socket.c
@@ -2404,31 +2404,31 @@ int __sys_recvmmsg(int fd, struct mmsghd
break;
}
 
-out_put:
-   fput_light(sock->file, fput_needed);
-
if (err == 0)
-   return datagrams;
+   goto out_put;
+
+   if (datagrams == 0) {
+   datagrams = err;
+   goto out_put;
+   }
 
-   if (datagrams != 0) {
+   /*
+* We may return less entries than requested (vlen) if the
+* sock is non block and there aren't enough datagrams...
+*/
+   if (err != -EAGAIN) {
/*
-* We may return less entries than requested (vlen) if the
-* sock is non block and there aren't enough datagrams...
+* ... or  if recvmsg returns an error after we
+* received some datagrams, where we record the
+* error to return on the next call or if the
+* app asks about it using getsockopt(SO_ERROR).
 */
-   if (err != -EAGAIN) {
-   /*
-* ... or  if recvmsg returns an error after we
-* received some datagrams, where we record the
-* error to return on the next call or if the
-* app asks about it using getsockopt(SO_ERROR).
-*/
-   sock->sk->sk_err = -err;
-   }
-
-   return datagrams;
+   sock->sk->sk_err = -err;
}
+out_put:
+   fput_light(sock->file, fput_needed);
 
-   return err;
+   return datagrams;
 }
 
 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,

[PATCH 3.16 110/217] ALSA: hda - Fix unconditional GPIO toggle via automute

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.

Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically
depending on the jack plug state.  This works fine for the auto-mute
mode where the speaker gets muted upon the HP jack plug.   OTOH, when
the auto-mute mode is off, this turns off the EAPD unexpectedly
depending on the jack state, which results in the silent speaker
output.

This patch fixes the silent speaker output issue by setting GPIO bits
constantly when the auto-mute mode is off.

Reported-and-tested-by: moos...@gmail.com
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_cirrus.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -176,8 +176,12 @@ static void cs_automute(struct hda_codec
snd_hda_gen_update_outputs(codec);
 
if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
-   spec->gpio_data = spec->gen.hp_jack_present ?
-   spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+   if (spec->gen.automute_speaker)
+   spec->gpio_data = spec->gen.hp_jack_present ?
+   spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+   else
+   spec->gpio_data =
+   spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
snd_hda_codec_write(codec, 0x01, 0,
AC_VERB_SET_GPIO_DATA, spec->gpio_data);
}

[PATCH 3.16 110/217] ALSA: hda - Fix unconditional GPIO toggle via automute

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.

Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically
depending on the jack plug state.  This works fine for the auto-mute
mode where the speaker gets muted upon the HP jack plug.   OTOH, when
the auto-mute mode is off, this turns off the EAPD unexpectedly
depending on the jack state, which results in the silent speaker
output.

This patch fixes the silent speaker output issue by setting GPIO bits
constantly when the auto-mute mode is off.

Reported-and-tested-by: moos...@gmail.com
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_cirrus.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -176,8 +176,12 @@ static void cs_automute(struct hda_codec
snd_hda_gen_update_outputs(codec);
 
if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
-   spec->gpio_data = spec->gen.hp_jack_present ?
-   spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+   if (spec->gen.automute_speaker)
+   spec->gpio_data = spec->gen.hp_jack_present ?
+   spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+   else
+   spec->gpio_data =
+   spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
snd_hda_codec_write(codec, 0x01, 0,
AC_VERB_SET_GPIO_DATA, spec->gpio_data);
}

[PATCH 3.16 084/217] drm/radeon: add PX quirk for asus K53TK

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit ff1b129403aad9a5c7cc9a6eaaffe4bd5fc0c67f upstream.

Seems to have problems turning the dGPU on/off.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=51381

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/radeon_device.c | 4 
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -123,6 +123,10 @@ static struct radeon_px_quirk radeon_px_
 * https://bugzilla.kernel.org/show_bug.cgi?id=51381
 */
{ PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x108c, RADEON_PX_QUIRK_DISABLE_PX 
},
+   /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
+* https://bugzilla.kernel.org/show_bug.cgi?id=51381
+*/
+   { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX 
},
/* macbook pro 8.2 */
{ PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, 
RADEON_PX_QUIRK_LONG_WAKEUP },
{ 0, 0, 0, 0, 0 },

[PATCH 3.16 074/217] perf/x86/intel: Add definition for PT PMI bit

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Eranian 

commit 5690ae28e472d25e330ad0c637a5cea3fc39fb32 upstream.

This patch adds a definition for GLOBAL_OVFL_STATUS bit 55
which is used with the Processor Trace (PT) feature.

Signed-off-by: Stephane Eranian 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Alexander Shishkin 
Cc: Arnaldo Carvalho de Melo 
Cc: Jiri Olsa 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Vince Weaver 
Cc: adrian.hun...@intel.com
Cc: kan.li...@intel.com
Cc: namhy...@kernel.org
Link: 
http://lkml.kernel.org/r/1457034642-21837-2-git-send-email-eran...@google.com
Signed-off-by: Ingo Molnar 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -151,6 +151,8 @@ struct x86_pmu_capability {
  */
 #define INTEL_PMC_IDX_FIXED_BTS
(INTEL_PMC_IDX_FIXED + 16)
 
+#define GLOBAL_STATUS_TRACE_TOPAPMIBIT_ULL(55)
+
 /*
  * IBS cpuid feature detection
  */

[PATCH 3.16 107/217] sd: Make discard granularity match logical block size when LBPRZ=1

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Martin K. Petersen" 

commit 397737223c59e89dca7305feb6528caef8fbef84 upstream.

A device may report an OPTIMAL UNMAP GRANULARITY and UNMAP GRANULARITY
ALIGNMENT in the Block Limits VPD. These parameters describe the
device's internal provisioning allocation units. By default the block
layer will round and align any discard requests based on these limits.

If a device reports LBPRZ=1 to guarantee zeroes after discard, however,
it is imperative that the block layer does not leave out any parts of
the requested block range. Otherwise the device can not do the required
zeroing of any partial allocation units and this can lead to data
corruption.

Since the dm thinp personality relies on the block layer's current
behavior and is unable to deal with partial discard blocks we work
around the problem by setting the granularity to match the logical block
size when LBPRZ is enabled.

Signed-off-by: Martin K. Petersen 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/sd.c | 23 ++-
 1 file changed, 18 insertions(+), 5 deletions(-)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -628,11 +628,24 @@ static void sd_config_discard(struct scs
unsigned int max_blocks = 0;
 
q->limits.discard_zeroes_data = 0;
-   q->limits.discard_alignment = sdkp->unmap_alignment *
-   logical_block_size;
-   q->limits.discard_granularity =
-   max(sdkp->physical_block_size,
-   sdkp->unmap_granularity * logical_block_size);
+
+   /*
+* When LBPRZ is reported, discard alignment and granularity
+* must be fixed to the logical block size. Otherwise the block
+* layer will drop misaligned portions of the request which can
+* lead to data corruption. If LBPRZ is not set, we honor the
+* device preference.
+*/
+   if (sdkp->lbprz) {
+   q->limits.discard_alignment = 0;
+   q->limits.discard_granularity = 1;
+   } else {
+   q->limits.discard_alignment = sdkp->unmap_alignment *
+   logical_block_size;
+   q->limits.discard_granularity =
+   max(sdkp->physical_block_size,
+   sdkp->unmap_granularity * logical_block_size);
+   }
 
sdkp->provisioning_mode = mode;
 

[PATCH 3.16 084/217] drm/radeon: add PX quirk for asus K53TK

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit ff1b129403aad9a5c7cc9a6eaaffe4bd5fc0c67f upstream.

Seems to have problems turning the dGPU on/off.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=51381

Signed-off-by: Alex Deucher 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/radeon/radeon_device.c | 4 
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -123,6 +123,10 @@ static struct radeon_px_quirk radeon_px_
 * https://bugzilla.kernel.org/show_bug.cgi?id=51381
 */
{ PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x108c, RADEON_PX_QUIRK_DISABLE_PX 
},
+   /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
+* https://bugzilla.kernel.org/show_bug.cgi?id=51381
+*/
+   { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX 
},
/* macbook pro 8.2 */
{ PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, 
RADEON_PX_QUIRK_LONG_WAKEUP },
{ 0, 0, 0, 0, 0 },

[PATCH 3.16 074/217] perf/x86/intel: Add definition for PT PMI bit

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Stephane Eranian 

commit 5690ae28e472d25e330ad0c637a5cea3fc39fb32 upstream.

This patch adds a definition for GLOBAL_OVFL_STATUS bit 55
which is used with the Processor Trace (PT) feature.

Signed-off-by: Stephane Eranian 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Alexander Shishkin 
Cc: Arnaldo Carvalho de Melo 
Cc: Jiri Olsa 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Vince Weaver 
Cc: adrian.hun...@intel.com
Cc: kan.li...@intel.com
Cc: namhy...@kernel.org
Link: 
http://lkml.kernel.org/r/1457034642-21837-2-git-send-email-eran...@google.com
Signed-off-by: Ingo Molnar 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings 
---
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -151,6 +151,8 @@ struct x86_pmu_capability {
  */
 #define INTEL_PMC_IDX_FIXED_BTS
(INTEL_PMC_IDX_FIXED + 16)
 
+#define GLOBAL_STATUS_TRACE_TOPAPMIBIT_ULL(55)
+
 /*
  * IBS cpuid feature detection
  */

[PATCH 3.16 107/217] sd: Make discard granularity match logical block size when LBPRZ=1

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: "Martin K. Petersen" 

commit 397737223c59e89dca7305feb6528caef8fbef84 upstream.

A device may report an OPTIMAL UNMAP GRANULARITY and UNMAP GRANULARITY
ALIGNMENT in the Block Limits VPD. These parameters describe the
device's internal provisioning allocation units. By default the block
layer will round and align any discard requests based on these limits.

If a device reports LBPRZ=1 to guarantee zeroes after discard, however,
it is imperative that the block layer does not leave out any parts of
the requested block range. Otherwise the device can not do the required
zeroing of any partial allocation units and this can lead to data
corruption.

Since the dm thinp personality relies on the block layer's current
behavior and is unable to deal with partial discard blocks we work
around the problem by setting the granularity to match the logical block
size when LBPRZ is enabled.

Signed-off-by: Martin K. Petersen 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/sd.c | 23 ++-
 1 file changed, 18 insertions(+), 5 deletions(-)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -628,11 +628,24 @@ static void sd_config_discard(struct scs
unsigned int max_blocks = 0;
 
q->limits.discard_zeroes_data = 0;
-   q->limits.discard_alignment = sdkp->unmap_alignment *
-   logical_block_size;
-   q->limits.discard_granularity =
-   max(sdkp->physical_block_size,
-   sdkp->unmap_granularity * logical_block_size);
+
+   /*
+* When LBPRZ is reported, discard alignment and granularity
+* must be fixed to the logical block size. Otherwise the block
+* layer will drop misaligned portions of the request which can
+* lead to data corruption. If LBPRZ is not set, we honor the
+* device preference.
+*/
+   if (sdkp->lbprz) {
+   q->limits.discard_alignment = 0;
+   q->limits.discard_granularity = 1;
+   } else {
+   q->limits.discard_alignment = sdkp->unmap_alignment *
+   logical_block_size;
+   q->limits.discard_granularity =
+   max(sdkp->physical_block_size,
+   sdkp->unmap_granularity * logical_block_size);
+   }
 
sdkp->provisioning_mode = mode;
 

[PATCH 3.16 105/217] net: mvneta: enable change MAC address when interface is up

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dmitri Epshtein 

commit 928b6519afeb2a5e2dc61154380b545ed66c476a upstream.

Function eth_prepare_mac_addr_change() is called as part of MAC
address change. This function check if interface is running.
To enable change MAC address when interface is running:
IFF_LIVE_ADDR_CHANGE flag must be set to dev->priv_flags field

Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP
network unit")
Signed-off-by: Dmitri Epshtein 
Signed-off-by: Gregory CLEMENT 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/ethernet/marvell/mvneta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3078,7 +3078,7 @@ static int mvneta_probe(struct platform_
dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
dev->hw_features |= dev->features;
dev->vlan_features |= dev->features;
-   dev->priv_flags |= IFF_UNICAST_FLT;
+   dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
 
err = register_netdev(dev);

[PATCH 3.16 155/217] USB: mct_u232: add sanity checking in probe

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream.

An attack using the lack of sanity checking in probe is known. This
patch checks for the existence of a second port.

CVE-2016-3136

Signed-off-by: Oliver Neukum 
[johan: add error message ]
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/mct_u232.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct
 
 static int mct_u232_port_probe(struct usb_serial_port *port)
 {
+   struct usb_serial *serial = port->serial;
struct mct_u232_private *priv;
 
+   /* check first to simplify error handling */
+   if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) {
+   dev_err(>dev, "expected endpoint missing\n");
+   return -ENODEV;
+   }
+
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
 
/* Use second interrupt-in endpoint for reading. */
-   priv->read_urb = port->serial->port[1]->interrupt_in_urb;
+   priv->read_urb = serial->port[1]->interrupt_in_urb;
priv->read_urb->context = port;
 
spin_lock_init(>lock);

[PATCH 3.16 105/217] net: mvneta: enable change MAC address when interface is up

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dmitri Epshtein 

commit 928b6519afeb2a5e2dc61154380b545ed66c476a upstream.

Function eth_prepare_mac_addr_change() is called as part of MAC
address change. This function check if interface is running.
To enable change MAC address when interface is running:
IFF_LIVE_ADDR_CHANGE flag must be set to dev->priv_flags field

Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP
network unit")
Signed-off-by: Dmitri Epshtein 
Signed-off-by: Gregory CLEMENT 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/ethernet/marvell/mvneta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3078,7 +3078,7 @@ static int mvneta_probe(struct platform_
dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
dev->hw_features |= dev->features;
dev->vlan_features |= dev->features;
-   dev->priv_flags |= IFF_UNICAST_FLT;
+   dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
 
err = register_netdev(dev);

[PATCH 3.16 155/217] USB: mct_u232: add sanity checking in probe

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream.

An attack using the lack of sanity checking in probe is known. This
patch checks for the existence of a second port.

CVE-2016-3136

Signed-off-by: Oliver Neukum 
[johan: add error message ]
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/mct_u232.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct
 
 static int mct_u232_port_probe(struct usb_serial_port *port)
 {
+   struct usb_serial *serial = port->serial;
struct mct_u232_private *priv;
 
+   /* check first to simplify error handling */
+   if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) {
+   dev_err(>dev, "expected endpoint missing\n");
+   return -ENODEV;
+   }
+
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
 
/* Use second interrupt-in endpoint for reading. */
-   priv->read_urb = port->serial->port[1]->interrupt_in_urb;
+   priv->read_urb = serial->port[1]->interrupt_in_urb;
priv->read_urb->context = port;
 
spin_lock_init(>lock);

[PATCH 3.16 095/217] ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Aaron Plattner 

commit 2d369c748c2ecc2a012ee85412a04007e67913ec upstream.

Vendor ID 0x10de0082 is used by a yet-to-be-named GPU chip.

This chip also has the 2-ch audio swapping bug, so patch_nvhdmi is
appropriate here.

Signed-off-by: Aaron Plattner 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16: don't use HDA_CODEC_ENTRY()]
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_hdmi.c | 1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3345,6 +3345,7 @@ static const struct hda_codec_preset snd
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de007d, .name = "GPU 7d HDMI/DP",  .patch = patch_nvhdmi },
+{ .id = 0x10de0082, .name = "GPU 82 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de0083, .name = "GPU 83 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",  .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",   .patch = patch_via_hdmi },

[PATCH 3.16 088/217] Bluetooth: btusb: Add a new AR3012 ID 13d3:3472

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Tunin 

commit 75c6aca4765dbe3d0c1507ab5052f2e373dc2331 upstream.

T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3472 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

BugLink: https://bugs.launchpad.net/bugs/1552925

Signed-off-by: Dmitry Tunin 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Ben Hutchings 
---
 drivers/bluetooth/ath3k.c | 2 ++
 drivers/bluetooth/btusb.c | 1 +
 2 files changed, 3 insertions(+)

--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -120,6 +120,7 @@ static const struct usb_device_id ath3k_
{ USB_DEVICE(0x13d3, 0x3408) },
{ USB_DEVICE(0x13d3, 0x3423) },
{ USB_DEVICE(0x13d3, 0x3432) },
+   { USB_DEVICE(0x13d3, 0x3472) },
{ USB_DEVICE(0x13d3, 0x3474) },
 
/* Atheros AR5BBU12 with sflash firmware */
@@ -185,6 +186,7 @@ static const struct usb_device_id ath3k_
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
/* Atheros AR5BBU22 with sflash firmware */
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -214,6 +214,7 @@ static const struct usb_device_id blackl
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
/* Atheros AR5BBU12 with sflash firmware */

[PATCH 3.16 095/217] ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Aaron Plattner 

commit 2d369c748c2ecc2a012ee85412a04007e67913ec upstream.

Vendor ID 0x10de0082 is used by a yet-to-be-named GPU chip.

This chip also has the 2-ch audio swapping bug, so patch_nvhdmi is
appropriate here.

Signed-off-by: Aaron Plattner 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16: don't use HDA_CODEC_ENTRY()]
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/patch_hdmi.c | 1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3345,6 +3345,7 @@ static const struct hda_codec_preset snd
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de007d, .name = "GPU 7d HDMI/DP",  .patch = patch_nvhdmi },
+{ .id = 0x10de0082, .name = "GPU 82 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de0083, .name = "GPU 83 HDMI/DP",  .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",  .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",   .patch = patch_via_hdmi },

[PATCH 3.16 088/217] Bluetooth: btusb: Add a new AR3012 ID 13d3:3472

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Tunin 

commit 75c6aca4765dbe3d0c1507ab5052f2e373dc2331 upstream.

T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3472 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

BugLink: https://bugs.launchpad.net/bugs/1552925

Signed-off-by: Dmitry Tunin 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Ben Hutchings 
---
 drivers/bluetooth/ath3k.c | 2 ++
 drivers/bluetooth/btusb.c | 1 +
 2 files changed, 3 insertions(+)

--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -120,6 +120,7 @@ static const struct usb_device_id ath3k_
{ USB_DEVICE(0x13d3, 0x3408) },
{ USB_DEVICE(0x13d3, 0x3423) },
{ USB_DEVICE(0x13d3, 0x3432) },
+   { USB_DEVICE(0x13d3, 0x3472) },
{ USB_DEVICE(0x13d3, 0x3474) },
 
/* Atheros AR5BBU12 with sflash firmware */
@@ -185,6 +186,7 @@ static const struct usb_device_id ath3k_
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
/* Atheros AR5BBU22 with sflash firmware */
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -214,6 +214,7 @@ static const struct usb_device_id blackl
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+   { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
/* Atheros AR5BBU12 with sflash firmware */

[PATCH 3.16 147/217] ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Joseph Qi 

commit be12b299a83fc807bbaccd2bcb8ec50cbb0cb55c upstream.

When master handles convert request, it queues ast first and then
returns status.  This may happen that the ast is sent before the request
status because the above two messages are sent by two threads.  And
right after the ast is sent, if master down, it may trigger BUG in
dlm_move_lockres_to_recovery_list in the requested node because ast
handler moves it to grant list without clear lock->convert_pending.  So
remove BUG_ON statement and check if the ast is processed in
dlmconvert_remote.

Signed-off-by: Joseph Qi 
Reported-by: Yiwen Jiang 
Cc: Junxiao Bi 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Tariq Saeed 
Cc: Junxiao Bi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 fs/ocfs2/dlm/dlmconvert.c  | 13 +
 fs/ocfs2/dlm/dlmrecovery.c |  1 -
 2 files changed, 13 insertions(+), 1 deletion(-)

--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -288,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct
status = DLM_DENIED;
goto bail;
}
+
+   if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) {
+   mlog(0, "last convert request returned DLM_RECOVERING, but "
+"owner has already queued and sent ast to me. res %.*s, "
+"(cookie=%u:%llu, type=%d, conv=%d)\n",
+res->lockname.len, res->lockname.name,
+dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
+dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
+lock->ml.type, lock->ml.convert_type);
+   status = DLM_NORMAL;
+   goto bail;
+   }
+
res->state |= DLM_LOCK_RES_IN_PROGRESS;
/* move lock to local convert queue */
/* do not alter lock refcount.  switching lists. */
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2053,7 +2053,6 @@ void dlm_move_lockres_to_recovery_list(s
dlm_lock_get(lock);
if (lock->convert_pending) {
/* move converting lock back to granted */
-   BUG_ON(i != DLM_CONVERTING_LIST);
mlog(0, "node died with convert pending "
 "on %.*s. move back to granted list.\n",
 res->lockname.len, res->lockname.name);

[PATCH 3.16 130/217] bitops: Do not default to __clear_bit() for __clear_bit_unlock()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Peter Zijlstra 

commit f75d48644c56a31731d17fa693c8175328957e1d upstream.

__clear_bit_unlock() is a special little snowflake. While it carries the
non-atomic '__' prefix, it is specifically documented to pair with
test_and_set_bit() and therefore should be 'somewhat' atomic.

Therefore the generic implementation of __clear_bit_unlock() cannot use
the fully non-atomic __clear_bit() as a default.

If an arch is able to do better; is must provide an implementation of
__clear_bit_unlock() itself.

Specifically, this came up as a result of hackbench livelock'ing in
slab_lock() on ARC with SMP + SLUB + !LLSC.

The issue was incorrect pairing of atomic ops.

 slab_lock() -> bit_spin_lock() -> test_and_set_bit()
 slab_unlock() -> __bit_spin_unlock() -> __clear_bit()

The non serializing __clear_bit() was getting "lost"

 80543b8e:  ld_s   r2,[r13,0] <--- (A) Finds PG_locked is set
 80543b90:  or r3,r2,1<--- (B) other core unlocks right here
 80543b94:  st_s   r3,[r13,0] <--- (C) sets PG_locked (overwrites 
unlock)

Fixes ARC STAR 9000817404 (and probably more).

Reported-by: Vineet Gupta 
Tested-by: Vineet Gupta 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Andrew Morton 
Cc: Christoph Lameter 
Cc: David Rientjes 
Cc: Helge Deller 
Cc: James E.J. Bottomley 
Cc: Joonsoo Kim 
Cc: Linus Torvalds 
Cc: Noam Camus 
Cc: Paul E. McKenney 
Cc: Pekka Enberg 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: 
http://lkml.kernel.org/r/20160309114054.gj6...@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 include/asm-generic/bitops/lock.h | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -29,16 +29,16 @@ do {\
  * @nr: the bit to set
  * @addr: the address to start counting from
  *
- * This operation is like clear_bit_unlock, however it is not atomic.
- * It does provide release barrier semantics so it can be used to unlock
- * a bit lock, however it would only be used if no other CPU can modify
- * any bits in the memory until the lock is released (a good example is
- * if the bit lock itself protects access to the other bits in the word).
+ * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all
+ * the bits in the word are protected by this lock some archs can use weaker
+ * ops to safely unlock.
+ *
+ * See for example x86's implementation.
  */
 #define __clear_bit_unlock(nr, addr)   \
 do {   \
-   smp_mb();   \
-   __clear_bit(nr, addr);  \
+   smp_mb__before_atomic();\
+   clear_bit(nr, addr);\
 } while (0)
 
 #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */

[PATCH 3.16 147/217] ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Joseph Qi 

commit be12b299a83fc807bbaccd2bcb8ec50cbb0cb55c upstream.

When master handles convert request, it queues ast first and then
returns status.  This may happen that the ast is sent before the request
status because the above two messages are sent by two threads.  And
right after the ast is sent, if master down, it may trigger BUG in
dlm_move_lockres_to_recovery_list in the requested node because ast
handler moves it to grant list without clear lock->convert_pending.  So
remove BUG_ON statement and check if the ast is processed in
dlmconvert_remote.

Signed-off-by: Joseph Qi 
Reported-by: Yiwen Jiang 
Cc: Junxiao Bi 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Tariq Saeed 
Cc: Junxiao Bi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 fs/ocfs2/dlm/dlmconvert.c  | 13 +
 fs/ocfs2/dlm/dlmrecovery.c |  1 -
 2 files changed, 13 insertions(+), 1 deletion(-)

--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -288,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct
status = DLM_DENIED;
goto bail;
}
+
+   if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) {
+   mlog(0, "last convert request returned DLM_RECOVERING, but "
+"owner has already queued and sent ast to me. res %.*s, "
+"(cookie=%u:%llu, type=%d, conv=%d)\n",
+res->lockname.len, res->lockname.name,
+dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
+dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
+lock->ml.type, lock->ml.convert_type);
+   status = DLM_NORMAL;
+   goto bail;
+   }
+
res->state |= DLM_LOCK_RES_IN_PROGRESS;
/* move lock to local convert queue */
/* do not alter lock refcount.  switching lists. */
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2053,7 +2053,6 @@ void dlm_move_lockres_to_recovery_list(s
dlm_lock_get(lock);
if (lock->convert_pending) {
/* move converting lock back to granted */
-   BUG_ON(i != DLM_CONVERTING_LIST);
mlog(0, "node died with convert pending "
 "on %.*s. move back to granted list.\n",
 res->lockname.len, res->lockname.name);

[PATCH 3.16 130/217] bitops: Do not default to __clear_bit() for __clear_bit_unlock()

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Peter Zijlstra 

commit f75d48644c56a31731d17fa693c8175328957e1d upstream.

__clear_bit_unlock() is a special little snowflake. While it carries the
non-atomic '__' prefix, it is specifically documented to pair with
test_and_set_bit() and therefore should be 'somewhat' atomic.

Therefore the generic implementation of __clear_bit_unlock() cannot use
the fully non-atomic __clear_bit() as a default.

If an arch is able to do better; is must provide an implementation of
__clear_bit_unlock() itself.

Specifically, this came up as a result of hackbench livelock'ing in
slab_lock() on ARC with SMP + SLUB + !LLSC.

The issue was incorrect pairing of atomic ops.

 slab_lock() -> bit_spin_lock() -> test_and_set_bit()
 slab_unlock() -> __bit_spin_unlock() -> __clear_bit()

The non serializing __clear_bit() was getting "lost"

 80543b8e:  ld_s   r2,[r13,0] <--- (A) Finds PG_locked is set
 80543b90:  or r3,r2,1<--- (B) other core unlocks right here
 80543b94:  st_s   r3,[r13,0] <--- (C) sets PG_locked (overwrites 
unlock)

Fixes ARC STAR 9000817404 (and probably more).

Reported-by: Vineet Gupta 
Tested-by: Vineet Gupta 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Andrew Morton 
Cc: Christoph Lameter 
Cc: David Rientjes 
Cc: Helge Deller 
Cc: James E.J. Bottomley 
Cc: Joonsoo Kim 
Cc: Linus Torvalds 
Cc: Noam Camus 
Cc: Paul E. McKenney 
Cc: Pekka Enberg 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: 
http://lkml.kernel.org/r/20160309114054.gj6...@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 include/asm-generic/bitops/lock.h | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -29,16 +29,16 @@ do {\
  * @nr: the bit to set
  * @addr: the address to start counting from
  *
- * This operation is like clear_bit_unlock, however it is not atomic.
- * It does provide release barrier semantics so it can be used to unlock
- * a bit lock, however it would only be used if no other CPU can modify
- * any bits in the memory until the lock is released (a good example is
- * if the bit lock itself protects access to the other bits in the word).
+ * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all
+ * the bits in the word are protected by this lock some archs can use weaker
+ * ops to safely unlock.
+ *
+ * See for example x86's implementation.
  */
 #define __clear_bit_unlock(nr, addr)   \
 do {   \
-   smp_mb();   \
-   __clear_bit(nr, addr);  \
+   smp_mb__before_atomic();\
+   clear_bit(nr, addr);\
 } while (0)
 
 #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */

[PATCH 3.16 196/217] Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card (rev3) to qmi_wwan

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Patrik Halfar 

commit fb5eb24cdd5cdb83be77d3e4b2f16e92e06bd9e9 upstream.

New revison of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new 
idProduct

Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp.
Device Descriptor:
  bLength18
  bDescriptorType 1
  bcdUSB   2.00
  bDeviceClass0
  bDeviceSubClass 0
  bDeviceProtocol 0
  bMaxPacketSize064
  idVendor   0x413c Dell Computer Corp.
  idProduct  0x81b3
  bcdDevice0.06
  iManufacturer   1 Sierra Wireless, Incorporated
  iProduct2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband 
Card
  iSerial 3
  bNumConfigurations  2

Signed-off-by: Patrik Halfar 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -792,6 +792,7 @@ static const struct usb_device_id produc
{QMI_FIXED_INTF(0x413c, 0x81a8, 8)},/* Dell Wireless 5808 Gobi(TM) 
4G LTE Mobile Broadband Card */
{QMI_FIXED_INTF(0x413c, 0x81a9, 8)},/* Dell Wireless 5808e Gobi(TM) 
4G LTE Mobile Broadband Card */
{QMI_FIXED_INTF(0x413c, 0x81b1, 8)},/* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card */
+   {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},/* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card (rev3) */
{QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},/* HP lt4111 LTE/EV-DO/HSPA+ 
Gobi 4G Module */
{QMI_FIXED_INTF(0x22de, 0x9061, 3)},/* WeTelecom WPD-600N */
{QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},/* SIMCom 7230E */

[PATCH 3.16 196/217] Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card (rev3) to qmi_wwan

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Patrik Halfar 

commit fb5eb24cdd5cdb83be77d3e4b2f16e92e06bd9e9 upstream.

New revison of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new 
idProduct

Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp.
Device Descriptor:
  bLength18
  bDescriptorType 1
  bcdUSB   2.00
  bDeviceClass0
  bDeviceSubClass 0
  bDeviceProtocol 0
  bMaxPacketSize064
  idVendor   0x413c Dell Computer Corp.
  idProduct  0x81b3
  bcdDevice0.06
  iManufacturer   1 Sierra Wireless, Incorporated
  iProduct2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband 
Card
  iSerial 3
  bNumConfigurations  2

Signed-off-by: Patrik Halfar 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -792,6 +792,7 @@ static const struct usb_device_id produc
{QMI_FIXED_INTF(0x413c, 0x81a8, 8)},/* Dell Wireless 5808 Gobi(TM) 
4G LTE Mobile Broadband Card */
{QMI_FIXED_INTF(0x413c, 0x81a9, 8)},/* Dell Wireless 5808e Gobi(TM) 
4G LTE Mobile Broadband Card */
{QMI_FIXED_INTF(0x413c, 0x81b1, 8)},/* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card */
+   {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},/* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card (rev3) */
{QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},/* HP lt4111 LTE/EV-DO/HSPA+ 
Gobi 4G Module */
{QMI_FIXED_INTF(0x22de, 0x9061, 3)},/* WeTelecom WPD-600N */
{QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},/* SIMCom 7230E */

[PATCH 3.16 092/217] bus: imx-weim: Take the 'status' property value into account

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Fabio Estevam 

commit 33b96d2c9579213cf3f36d7b29841b1e464750c4 upstream.

Currently we have an incorrect behaviour when multiple devices
are present under the weim node. For example:

 {
...
status = "okay";

sram@0,0 {
...
status = "okay";
};

mram@0,0 {
...
status = "disabled";
};
};

In this case only the 'sram' device should be probed and not 'mram'.

However what happens currently is that the status variable is ignored,
causing the 'sram' device to be disabled and 'mram' to be enabled.

Change the weim_parse_dt() function to use
for_each_available_child_of_node()so that the devices marked with
'status = disabled' are not probed.

Suggested-by: Wolfgang Netbal 
Signed-off-by: Fabio Estevam 
Reviewed-by: Sascha Hauer 
Acked-by: Shawn Guo 
Signed-off-by: Olof Johansson 
Signed-off-by: Ben Hutchings 
---
 drivers/bus/imx-weim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -150,7 +150,7 @@ static int __init weim_parse_dt(struct p
return ret;
}
 
-   for_each_child_of_node(pdev->dev.of_node, child) {
+   for_each_available_child_of_node(pdev->dev.of_node, child) {
if (!child->name)
continue;
 

[PATCH 3.16 133/217] KVM: VMX: avoid guest hang on invalid invept instruction

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Paolo Bonzini 

commit 2849eb4f99d54925c543db12917127f88b3c38ff upstream.

A guest executing an invalid invept instruction would hang
because the instruction pointer was not updated.

Fixes: bfd0a56b90005f8c8a004baf407ad90045c2b11e
Reviewed-by: David Matlack 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings 
---
 arch/x86/kvm/vmx.c | 1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6601,6 +6601,7 @@ static int handle_invept(struct kvm_vcpu
if (!(types & (1UL << type))) {
nested_vmx_failValid(vcpu,
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+   skip_emulated_instruction(vcpu);
return 1;
}
 

[PATCH 3.16 090/217] xtensa: clear all DBREAKC registers on start

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Max Filippov 

commit 7de7ac785ae18a2cdc78d7560f48e3213d9ea0ab upstream.

There are XCHAL_NUM_DBREAK registers, clear them all.
This also fixes cryptic assembler error message with binutils 2.25 when
XCHAL_NUM_DBREAK is 0:

  as: out of memory allocating 18446744073709551575 bytes after a total
  of 495616 bytes

Signed-off-by: Max Filippov 
Signed-off-by: Ben Hutchings 
---
 arch/xtensa/kernel/head.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -123,7 +123,7 @@ ENTRY(_startup)
wsr a0, icountlevel
 
.set_index, 0
-   .rept   XCHAL_NUM_DBREAK - 1
+   .rept   XCHAL_NUM_DBREAK
wsr a0, SREG_DBREAKC + _index
.set_index, _index + 1
.endr

[PATCH 3.16 133/217] KVM: VMX: avoid guest hang on invalid invept instruction

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Paolo Bonzini 

commit 2849eb4f99d54925c543db12917127f88b3c38ff upstream.

A guest executing an invalid invept instruction would hang
because the instruction pointer was not updated.

Fixes: bfd0a56b90005f8c8a004baf407ad90045c2b11e
Reviewed-by: David Matlack 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Ben Hutchings 
---
 arch/x86/kvm/vmx.c | 1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6601,6 +6601,7 @@ static int handle_invept(struct kvm_vcpu
if (!(types & (1UL << type))) {
nested_vmx_failValid(vcpu,
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+   skip_emulated_instruction(vcpu);
return 1;
}
 

[PATCH 3.16 090/217] xtensa: clear all DBREAKC registers on start

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Max Filippov 

commit 7de7ac785ae18a2cdc78d7560f48e3213d9ea0ab upstream.

There are XCHAL_NUM_DBREAK registers, clear them all.
This also fixes cryptic assembler error message with binutils 2.25 when
XCHAL_NUM_DBREAK is 0:

  as: out of memory allocating 18446744073709551575 bytes after a total
  of 495616 bytes

Signed-off-by: Max Filippov 
Signed-off-by: Ben Hutchings 
---
 arch/xtensa/kernel/head.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -123,7 +123,7 @@ ENTRY(_startup)
wsr a0, icountlevel
 
.set_index, 0
-   .rept   XCHAL_NUM_DBREAK - 1
+   .rept   XCHAL_NUM_DBREAK
wsr a0, SREG_DBREAKC + _index
.set_index, _index + 1
.endr

[PATCH 3.16 092/217] bus: imx-weim: Take the 'status' property value into account

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Fabio Estevam 

commit 33b96d2c9579213cf3f36d7b29841b1e464750c4 upstream.

Currently we have an incorrect behaviour when multiple devices
are present under the weim node. For example:

 {
...
status = "okay";

sram@0,0 {
...
status = "okay";
};

mram@0,0 {
...
status = "disabled";
};
};

In this case only the 'sram' device should be probed and not 'mram'.

However what happens currently is that the status variable is ignored,
causing the 'sram' device to be disabled and 'mram' to be enabled.

Change the weim_parse_dt() function to use
for_each_available_child_of_node()so that the devices marked with
'status = disabled' are not probed.

Suggested-by: Wolfgang Netbal 
Signed-off-by: Fabio Estevam 
Reviewed-by: Sascha Hauer 
Acked-by: Shawn Guo 
Signed-off-by: Olof Johansson 
Signed-off-by: Ben Hutchings 
---
 drivers/bus/imx-weim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -150,7 +150,7 @@ static int __init weim_parse_dt(struct p
return ret;
}
 
-   for_each_child_of_node(pdev->dev.of_node, child) {
+   for_each_available_child_of_node(pdev->dev.of_node, child) {
if (!child->name)
continue;
 

[PATCH 3.16 070/217] perf stat: Document --detailed option

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Borislav Petkov 

commit f594bae08183fb6b57db55387794ece3e1edf6f6 upstream.

I'm surprised this remained undocumented since at least 2011. And it is
actually a very useful switch, as Steve and I came to realize recently.

Add the text from

  2cba3ffb9a9d ("perf stat: Add -d -d and -d -d -d options to show more CPU 
events")

which added the incrementing aspect to -d.

Tested-by: Arnaldo Carvalho de Melo 
Signed-off-by: Borislav Petkov 
Signed-off-by: Arnaldo Carvalho de Melo 
Cc: Alexander Shishkin 
Cc: David Ahern 
Cc: Davidlohr Bueso 
Cc: Jiri Olsa 
Cc: Mel Gorman 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Peter Zijlstra 
Cc: Steven Rostedt 
Cc: Thomas Gleixner 
Fixes: 2cba3ffb9a9d ("perf stat: Add -d -d and -d -d -d options to show more 
CPU events")
Link: http://lkml.kernel.org/r/1457347294-32546-1-git-send-email...@alien8.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 tools/perf/Documentation/perf-stat.txt | 8 
 1 file changed, 8 insertions(+)

--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -50,6 +50,14 @@ OPTIONS
 --scale::
scale/normalize counter values
 
+-d::
+--detailed::
+   print more detailed statistics, can be specified up to 3 times
+
+  -d:  detailed events, L1 and LLC data cache
+-d -d: more detailed events, dTLB and iTLB events
+ -d -d -d: very detailed events, adding prefetch events
+
 -r::
 --repeat=::
repeat command and print average + stddev (max: 100). 0 means forever.

[PATCH 3.16 070/217] perf stat: Document --detailed option

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Borislav Petkov 

commit f594bae08183fb6b57db55387794ece3e1edf6f6 upstream.

I'm surprised this remained undocumented since at least 2011. And it is
actually a very useful switch, as Steve and I came to realize recently.

Add the text from

  2cba3ffb9a9d ("perf stat: Add -d -d and -d -d -d options to show more CPU 
events")

which added the incrementing aspect to -d.

Tested-by: Arnaldo Carvalho de Melo 
Signed-off-by: Borislav Petkov 
Signed-off-by: Arnaldo Carvalho de Melo 
Cc: Alexander Shishkin 
Cc: David Ahern 
Cc: Davidlohr Bueso 
Cc: Jiri Olsa 
Cc: Mel Gorman 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Peter Zijlstra 
Cc: Steven Rostedt 
Cc: Thomas Gleixner 
Fixes: 2cba3ffb9a9d ("perf stat: Add -d -d and -d -d -d options to show more 
CPU events")
Link: http://lkml.kernel.org/r/1457347294-32546-1-git-send-email...@alien8.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 tools/perf/Documentation/perf-stat.txt | 8 
 1 file changed, 8 insertions(+)

--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -50,6 +50,14 @@ OPTIONS
 --scale::
scale/normalize counter values
 
+-d::
+--detailed::
+   print more detailed statistics, can be specified up to 3 times
+
+  -d:  detailed events, L1 and LLC data cache
+-d -d: more detailed events, dTLB and iTLB events
+ -d -d -d: very detailed events, adding prefetch events
+
 -r::
 --repeat=::
repeat command and print average + stddev (max: 100). 0 means forever.

[PATCH 3.16 137/217] rapidio/rionet: fix deadlock on SMP

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Aurelien Jacquiot 

commit 36915976eca58f2eefa040ba8f9939672564df61 upstream.

Fix deadlocking during concurrent receive and transmit operations on SMP
platforms caused by the use of incorrect lock: on transmit 'tx_lock'
spinlock should be used instead of 'lock' which is used for receive
operation.

This fix is applicable to kernel versions starting from v2.15.

Signed-off-by: Aurelien Jacquiot 
Signed-off-by: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andre van Herk 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/net/rionet.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct
struct net_device *ndev = dev_id;
struct rionet_private *rnet = netdev_priv(ndev);
 
-   spin_lock(>lock);
+   spin_lock(>tx_lock);
 
if (netif_msg_intr(rnet))
printk(KERN_INFO
@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct
if (rnet->tx_cnt < RIONET_TX_RING_SIZE)
netif_wake_queue(ndev);
 
-   spin_unlock(>lock);
+   spin_unlock(>tx_lock);
 }
 
 static int rionet_open(struct net_device *ndev)

[PATCH 3.16 137/217] rapidio/rionet: fix deadlock on SMP

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Aurelien Jacquiot 

commit 36915976eca58f2eefa040ba8f9939672564df61 upstream.

Fix deadlocking during concurrent receive and transmit operations on SMP
platforms caused by the use of incorrect lock: on transmit 'tx_lock'
spinlock should be used instead of 'lock' which is used for receive
operation.

This fix is applicable to kernel versions starting from v2.15.

Signed-off-by: Aurelien Jacquiot 
Signed-off-by: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andre van Herk 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/net/rionet.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct
struct net_device *ndev = dev_id;
struct rionet_private *rnet = netdev_priv(ndev);
 
-   spin_lock(>lock);
+   spin_lock(>tx_lock);
 
if (netif_msg_intr(rnet))
printk(KERN_INFO
@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct
if (rnet->tx_cnt < RIONET_TX_RING_SIZE)
netif_wake_queue(ndev);
 
-   spin_unlock(>lock);
+   spin_unlock(>tx_lock);
 }
 
 static int rionet_open(struct net_device *ndev)

[PATCH 3.16 077/217] sched/cputime: Fix steal_account_process_tick() to always return jiffies

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Chris Friesen 

commit f9c904b7613b8b4c85b10cd6b33ad41b2843fa9d upstream.

The callers of steal_account_process_tick() expect it to return
whether a jiffy should be considered stolen or not.

Currently the return value of steal_account_process_tick() is in
units of cputime, which vary between either jiffies or nsecs
depending on CONFIG_VIRT_CPU_ACCOUNTING_GEN.

If cputime has nsecs granularity and there is a tiny amount of
stolen time (a few nsecs, say) then we will consider the entire
tick stolen and will not account the tick on user/system/idle,
causing /proc/stats to show invalid data.

The fix is to change steal_account_process_tick() to accumulate
the stolen time and only account it once it's worth a jiffy.

(Thanks to Frederic Weisbecker for suggestions to fix a bug in my
first version of the patch.)

Signed-off-by: Chris Friesen 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Thomas Gleixner 
Cc: Frederic Weisbecker 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Link: http://lkml.kernel.org/r/56dbbdb8.40...@mail.usask.ca
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 kernel/sched/cputime.c | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -259,21 +259,21 @@ static __always_inline bool steal_accoun
 #ifdef CONFIG_PARAVIRT
if (static_key_false(_steal_enabled)) {
u64 steal;
-   cputime_t steal_ct;
+   unsigned long steal_jiffies;
 
steal = paravirt_steal_clock(smp_processor_id());
steal -= this_rq()->prev_steal_time;
 
/*
-* cputime_t may be less precise than nsecs (eg: if it's
-* based on jiffies). Lets cast the result to cputime
+* steal is in nsecs but our caller is expecting steal
+* time in jiffies. Lets cast the result to jiffies
 * granularity and account the rest on the next rounds.
 */
-   steal_ct = nsecs_to_cputime(steal);
-   this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
+   steal_jiffies = nsecs_to_jiffies(steal);
+   this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies);
 
-   account_steal_time(steal_ct);
-   return steal_ct;
+   account_steal_time(jiffies_to_cputime(steal_jiffies));
+   return steal_jiffies;
}
 #endif
return false;

[PATCH 3.16 086/217] sg: fix dxferp in from_to case

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Douglas Gilbert 

commit 5ecee0a3ee8d74b6950cb41e8989b0c2174568d4 upstream.

One of the strange things that the original sg driver did was let the
user provide both a data-out buffer (it followed the sg_header+cdb)
_and_ specify a reply length greater than zero. What happened was that
the user data-out buffer was copied into some kernel buffers and then
the mid level was told a read type operation would take place with the
data from the device overwriting the same kernel buffers. The user would
then read those kernel buffers back into the user space.

=46romwhat I can tell, the above action was broken by commit fad7f01e61bf
("sg: set dxferp to NULL for READ with the older SG interface") in 2008
and syzkaller found that out recently.

Make sure that a user space pointer is passed through when data follows
the sg_header structure and command.  Fix the abnormal case when a
non-zero reply_len is also given.

Fixes: fad7f01e61bf737fe8a3740d803f000db57ecac6
Signed-off-by: Douglas Gilbert 
Reviewed-by: Ewan Milne 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings 
---
 drivers/scsi/sg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -633,7 +633,8 @@ sg_write(struct file *filp, const char _
else
hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : 
SG_DXFER_NONE;
hp->dxfer_len = mxsize;
-   if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+   if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
+   (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
hp->dxferp = (char __user *)buf + cmd_size;
else
hp->dxferp = NULL;

[PATCH 3.16 089/217] xtensa: ISS: don't hang if stdin EOF is reached

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Max Filippov 

commit 362014c8d9d51d504c167c44ac280169457732be upstream.

Simulator stdin may be connected to a file, when its end is reached
kernel hangs in infinite loop inside rs_poll, because simc_poll always
signals that descriptor 0 is readable and simc_read always returns 0.
Check simc_read return value and exit loop if it's not positive. Also
don't rewind polling timer if it's zero.

Signed-off-by: Max Filippov 
Signed-off-by: Ben Hutchings 
---
 arch/xtensa/platforms/iss/console.c | 10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv)
 {
struct tty_port *port = (struct tty_port *)priv;
int i = 0;
+   int rd = 1;
unsigned char c;
 
spin_lock(_lock);
 
while (simc_poll(0)) {
-   simc_read(0, , 1);
+   rd = simc_read(0, , 1);
+   if (rd <= 0)
+   break;
tty_insert_flip_char(port, c, TTY_NORMAL);
i++;
}
 
if (i)
tty_flip_buffer_push(port);
-
-
-   mod_timer(_timer, jiffies + SERIAL_TIMER_VALUE);
+   if (rd)
+   mod_timer(_timer, jiffies + SERIAL_TIMER_VALUE);
spin_unlock(_lock);
 }
 

[PATCH 3.16 077/217] sched/cputime: Fix steal_account_process_tick() to always return jiffies

[Ben Hutchings]

3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Chris Friesen 

commit f9c904b7613b8b4c85b10cd6b33ad41b2843fa9d upstream.

The callers of steal_account_process_tick() expect it to return
whether a jiffy should be considered stolen or not.

Currently the return value of steal_account_process_tick() is in
units of cputime, which vary between either jiffies or nsecs
depending on CONFIG_VIRT_CPU_ACCOUNTING_GEN.

If cputime has nsecs granularity and there is a tiny amount of
stolen time (a few nsecs, say) then we will consider the entire
tick stolen and will not account the tick on user/system/idle,
causing /proc/stats to show invalid data.

The fix is to change steal_account_process_tick() to accumulate
the stolen time and only account it once it's worth a jiffy.

(Thanks to Frederic Weisbecker for suggestions to fix a bug in my
first version of the patch.)

Signed-off-by: Chris Friesen 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Thomas Gleixner 
Cc: Frederic Weisbecker 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Link: http://lkml.kernel.org/r/56dbbdb8.40...@mail.usask.ca
Signed-off-by: Ingo Molnar 
Signed-off-by: Ben Hutchings 
---
 kernel/sched/cputime.c | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -259,21 +259,21 @@ static __always_inline bool steal_accoun
 #ifdef CONFIG_PARAVIRT
if (static_key_false(_steal_enabled)) {
u64 steal;
-   cputime_t steal_ct;
+   unsigned long steal_jiffies;
 
steal = paravirt_steal_clock(smp_processor_id());
steal -= this_rq()->prev_steal_time;
 
/*
-* cputime_t may be less precise than nsecs (eg: if it's
-* based on jiffies). Lets cast the result to cputime
+* steal is in nsecs but our caller is expecting steal
+* time in jiffies. Lets cast the result to jiffies
 * granularity and account the rest on the next rounds.
 */
-   steal_ct = nsecs_to_cputime(steal);
-   this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct);
+   steal_jiffies = nsecs_to_jiffies(steal);
+   this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies);
 
-   account_steal_time(steal_ct);
-   return steal_ct;
+   account_steal_time(jiffies_to_cputime(steal_jiffies));
+   return steal_jiffies;
}
 #endif
return false;