3.14.3-stable review

This is the start of the stable review cycle for the 3.14.3 release. There are 158 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Tue May 6 15:38:47 UTC 2014. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.14.3-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 3.14.3-rc1

Aaron Sanders <[email protected]>
USB: pl2303: add ids for Hewlett-Packard HP POS pole displays

Stephen Warren <[email protected]>
USB: EHCI: tegra: set txfill_tuning

Stephen Warren <[email protected]>
dt: tegra: remove non-existent clock IDs

Stephen Warren <[email protected]>
clk: tegra: remove non-existent clocks

Stephen Warren <[email protected]>
ARM: tegra: remove UART5/UARTE from tegra124.dtsi

Julius Werner <[email protected]>
usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb

Theodore Ts'o <[email protected]>
ext4: use i_size_read in ext4_unaligned_aio()

Theodore Ts'o <[email protected]>
ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent()

Jan Kara <[email protected]>
ext4: fix jbd2 warning under heavy xattr load

Matthew Wilcox <[email protected]>
ext4: note the error in ext4_end_bio()

Kazuya Mio <[email protected]>
ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS

Martin K. Petersen <[email protected]>
block: Fix for_each_bvec()

Al Viro <[email protected]>
smarter propagate_mnt()

Krzysztof Kozlowski <[email protected]>
clk: s2mps11: Fix possible NULL pointer dereference

Tetsuo Handa <[email protected]>

    ocfs2: fix panic on kfree(xattr->name)

alex chen <[email protected]>
ocfs2: do not put bh when buffer_uptodate failed

Junxiao Bi <[email protected]>
ocfs2: dlm: fix recovery hung

Junxiao Bi <[email protected]>
ocfs2: dlm: fix lock migration crash

Serge Hallyn <[email protected]>
xattr: guard against simultaneous glibc header inclusion

Liu Hua <[email protected]>
hung_task: check the value of "sysctl_hung_task_timeout_sec"

Mizuma, Masayoshi <[email protected]>
mm: hugetlb: fix softlockup when a large number of hugepages are freed.

Vlastimil Babka <[email protected]>
mm: try_to_unmap_cluster() should lock_page() before mlocking

Johannes Weiner <[email protected]>
mm: page_alloc: spill to remote nodes before waking kswapd

Matt Fleming <[email protected]>
sh: fix format string bug in stack tracer

Nicholas Bellinger <[email protected]>
iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err

Nicholas Bellinger <[email protected]>
iser-target: Match FRMR descriptors to available session tags

Sam Bradshaw <[email protected]>
mtip32xx: mtip_async_complete() bug fixes

Felipe Franciosi <[email protected]>
mtip32xx: Unmap the DMA segments before completing the IO request

Felipe Franciosi <[email protected]>
mtip32xx: Set queue bounce limit

Alan Stern <[email protected]>
USB: unbind all interfaces before rebinding any

Daniel Mack <[email protected]>
usb: phy: am335x-control: wait 1ms after power-up transitions

Michal Simek <[email protected]>
usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210

Paul Gortmaker <[email protected]>
hvc: ensure hvc_init is only ever called once in hvc_console.c

Felipe Balbi <[email protected]>
usb: musb: fix PHY power on/off

Felipe Balbi <[email protected]>
usb: musb: avoid NULL pointer dereference

Felipe Balbi <[email protected]>
usb: dwc3: fix randconfig build errors

Huang Rui <[email protected]>
usb: dwc3: fix wrong bit mask in dwc3_event_devt

Wolfram Sang <[email protected]>

    media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2

Florian Vaussard <[email protected]>
media: omap3isp: preview: Fix the crop margins

Hans Verkuil <[email protected]>
media: saa7134: fix WARN_ON during resume

Antti Palosaari <[email protected]>
media: em28xx: fix PCTV 290e LNA oops

Malcolm Priestley <[email protected]>
media: m88rs2000: add caps FE_CAN_INVERSION_AUTO

Frank Schaefer <[email protected]>
media: em28xx-audio: fix user counting in snd_em28xx_capture_open()

Malcolm Priestley <[email protected]>
media: m88rs2000: prevent frontend crash on continuous transponder scans

Hans Verkuil <[email protected]>
media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support

Hans Verkuil <[email protected]>
media: v4l2-dv-timings: add module name, description, license

Antoine Ténart <[email protected]>
video: atmel_lcdfb: ensure the hardware is initialized with the correct mode

Hans Verkuil <[email protected]>
media: videodev2.h: add parenthesis around macro arguments

Oleksij Rempel <[email protected]>
media: uvcvideo: Do not use usb_set_interface on bulk EP

David Cohen <[email protected]>

    usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM

Igor Gnatenko <[email protected]>
xhci: extend quirk for Renesas cards

Denis Turischev <[email protected]>
xhci: Switch Intel Lynx Point ports to EHCI on shutdown.

Mathias Nyman <[email protected]>
xhci: Prevent runtime pm from autosuspending during initialization

Roger Quadros <[email protected]>
usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1

Gregory CLEMENT <[email protected]>
usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled

Kees Cook <[email protected]>
usb: gadget: tcm_usb_gadget: stop format strings

Jeff Mahoney <[email protected]>
reiserfs: fix race in readdir

Russell King <[email protected]>
DRM: armada: fix corruption while loading cursors

Miklos Szeredi <[email protected]>
arm64: __NR_compat_syscalls fix

Will Deacon <[email protected]>
word-at-a-time: avoid undefined behaviour in zero_bytemask macro

Matt Fleming <[email protected]>

    efi: Pass correct file handle to efi_file_{read,close}

Matt Fleming <[email protected]>
x86/efi: Correct EFI boot stub use of code32_start

K. Y. Srinivasan <[email protected]>
Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts

Andy Grover <[email protected]>
target/tcm_fc: Fix use-after-free of ft_tpg

Nicholas Bellinger <[email protected]>
target/iblock: Fix double bioset_integrity_free bug

Martin Svec <[email protected]>
Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist

Quinn Tran <[email protected]>
target/rd: T10-Dif: RAM disk is allocating more space than required.

Nicholas Bellinger <[email protected]>
iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug

Dan Carpenter <[email protected]>
SCSI: arcmsr: upper 32 of dma address lost

Dan Carpenter <[email protected]>
SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc()

Mike Marciniszyn <[email protected]>
ib_srpt: Use correct ib_sg_dma primitives

Moni Shoua <[email protected]>
IB/core: Don't resolve passive side RoCE L2 address in CMA REQ handler

Yann Droneaud <[email protected]>
IB/qib: add missing braces in do_qib_user_sdma_queue_create()

Mike Marciniszyn <[email protected]>
IB/qib: Fix debugfs ordering issue with multiple HCAs

Yann Droneaud <[email protected]>
IB/ehca: Returns an error on ib_copy_to_udata() failure

Yann Droneaud <[email protected]>
IB/mthca: Return an error on ib_copy_to_udata() failure

Yann Droneaud <[email protected]>
IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL

Dennis Dalessandro <[email protected]>
IB/ipath: Fix potential buffer overrun in sending diag packet routine

Jeff Layton <[email protected]>
nfsd: set timeparms.to_maxval in setup_callback_client

Kinglong Mee <[email protected]>
NFSD: Traverse unconfirmed client through hash-table

J. Bruce Fields <[email protected]>
nfsd4: fix setclientid encode size

Yan, Zheng <[email protected]>
nfsd4: fix memory leak in nfsd4_encode_fattr()

Stanislav Kinsbursky <[email protected]>
nfsd: check passed socket's net matches NFSd superblock's one

J. Bruce Fields <[email protected]>
nfsd: notify_change needs elevated write count

J. Bruce Fields <[email protected]>
nfsd4: leave reply buffer space for failed setattr

J. Bruce Fields <[email protected]>
nfsd4: fix test_stateid error reply encoding

J. Bruce Fields <[email protected]>
nfsd4: buffer-length check for SUPPATTR_EXCLCREAT

J. Bruce Fields <[email protected]>
nfsd4: session needs room for following op to error out

J. Bruce Fields <[email protected]>
nfsd: revert v2 half of "nfsd: don't return high mode bits"

Trond Myklebust <[email protected]>
NFSv4: Fix a use-after-free problem in open()

Krzysztof Kozlowski <[email protected]>
iio: cm36651: Fix i2c client leak and possible NULL pointer dereference

Beomho Seo <[email protected]>
iio: cm32181: Fix read integration time function

Alexandre Belloni <[email protected]>
iio: adc: at91_adc: Repair broken platform_data support

Alec Berg <[email protected]>
iio: querying buffer scan_mask should return 0/1

Alan Stern <[email protected]>
USB: fix crash during hotplug of PCI USB controller card

Jean-Jacques Hiblot <[email protected]>
PCI: mvebu: Fix potential issue in range parsing

Marek Vasut <[email protected]>
PCI: imx6: Wait for retraining

Charles Keepax <[email protected]>
regulator: arizona-ldo1: Correct default regulator init_data

H. Peter Anvin <[email protected]>
x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

Petr Mladek <[email protected]>
ftrace/x86: One more missing sync after fixup of function modification failure

Fenghua Yu <[email protected]>
x86, AVX-512: Enable AVX-512 States Context Switch

Fenghua Yu <[email protected]>

    x86, AVX-512: AVX-512 Feature Detection

Jan Beulich <[email protected]>
x86, hash: Fix build failure with older binutils

Larry Finger <[email protected]>
staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL

H Hartley Sweeten <[email protected]>
staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data

Larry Finger <[email protected]>
staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0

Himangi Saraogi <[email protected]>
staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer

David Fries <[email protected]>
w1: fix w1_send_slave dropping a slave id

Tomas Novotny <[email protected]>
mfd: twl-core: Fix accessibility of some twl4030 audio registers

Guenter Roeck <[email protected]>
mfd: kempld-core: Fix potential hang-up during boot

Krzysztof Kozlowski <[email protected]>
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail

Krzysztof Kozlowski <[email protected]>
mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: 88pm800: Fix I2C device resource leak if probe fails

Krzysztof Kozlowski <[email protected]>

    mfd: 88pm860x: Fix I2C device resource leak on regmap init fail

Krzysztof Kozlowski <[email protected]>

    mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error

Krzysztof Kozlowski <[email protected]>
mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error

Alexander Usyskin <[email protected]>
mei: ignore client writing state during cb completion

Tomas Winkler <[email protected]>
mei: me: do not load the driver if the FW doesn't support MEI interface

Tomas Winkler <[email protected]>
mei: fix memory leak of pending write cb objects

Martin Schwidefsky <[email protected]>
s390: fix control register update

Heiko Carstens <[email protected]>
s390/bitops,atomic: add missing memory barriers

Christian Borntraeger <[email protected]>
KVM: s390: Optimize ucontrol path

Sebastian Ott <[email protected]>
s390/cio: fix driver callback initialization for ccw consoles

Axel Lin <[email protected]>
spi: dw: Don't call kfree for memory allocated by devm_kzalloc

Uwe Kleine-König <[email protected]>
spi: efm32: use $vendor,$device scheme for compatible string

Lv Zheng <[email protected]>
ACPICA: Restore code that repairs NULL package elements in return values.

Kailang Yang <[email protected]>
ALSA: hda/realtek - Add headset Mic support for Dell machine

Kailang Yang <[email protected]>
ALSA: hda/realtek - Add support of ALC288 codec

Takashi Iwai <[email protected]>
ALSA: hda - Fix silent speaker output due to mute LED fixup

Takashi Iwai <[email protected]>
ALSA: ice1712: Fix boundary checks in PCM pointer ops

W. Trevor King <[email protected]>
ALSA: hda - Enable beep for ASUS 1015E

Hui Wang <[email protected]>
ALSA: hda - add headset mic detect quirks for three Dell laptops

Kailang Yang <[email protected]>
ALSA: hda/realtek - Restore default value for ALC283

Andrea Adami <[email protected]>
ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO

Thomas Petazzoni <[email protected]>
ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP

Liu Hua <[email protected]>
ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo

Xiangyu Lu <[email protected]>
ARM: 8027/1: fix do_div() bug in big-endian systems

Christopher Covington <[email protected]>
ARM: 8007/1: Remove extraneous kcmp syscall ignore

Andrew Lunn <[email protected]>
ARM: Fix default CPU selection for ARCH_MULTI_V5

Will Deacon <[email protected]>
ARM: 7954/1: mm: remove remaining domain support from ARMv6

Tomasz Figa <[email protected]>
ARM: dts: Keep G3D regulator always on for exynos5250-arndale

Florian Vaussard <[email protected]>
ARM: dts: omap4/5: Use l3_ick for the gpmc node

Mugunthan V N <[email protected]>
ARM: dts: am33xx: correcting dt node unit address for usb

Roger Quadros <[email protected]>
ARM: OMAP3: hwmod data: Correct clock domains for USB modules

Nishanth Menon <[email protected]>
ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM

Florian Vaussard <[email protected]>
CLK: TI: OMAP4/5/DRA7: Remove gpmc_fck from dummy clocks

Suman Anna <[email protected]>
ARM: OMAP2+: hwmod: fix missing braces in _init()

Stefan Sørensen <[email protected]>
ARM: OMAP2+: INTC: Acknowledge stuck active interrupts

Brian Austin <[email protected]>
ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE

Brian Austin <[email protected]>
ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE

Brian Austin <[email protected]>
ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols

Mark Brown <[email protected]>
ASoC: pcm: Drop incorrect double/extra frees

Catalin Marinas <[email protected]>
arm64: Make DMA coherent and strongly ordered mappings not executable

Catalin Marinas <[email protected]>
arm64: Do not synchronise I and D caches for special ptes

-------------

Diffstat:

 .../devicetree/bindings/spi/efm32-spi.txt          |   4 +-
 Documentation/sysctl/kernel.txt                    |   1 +
 Documentation/video4linux/gspca.txt                |   1 +
 Makefile                                           |   4 +-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm/boot/dts/am33xx.dtsi                      |   4 +-
 arch/arm/boot/dts/armada-370-xp.dtsi               |   1 +
 arch/arm/boot/dts/exynos5250-arndale.dts           |   1 +
 arch/arm/boot/dts/omap4.dtsi                       |   2 +
 arch/arm/boot/dts/omap5.dtsi                       |   2 +
 arch/arm/boot/dts/tegra124.dtsi                    |  13 --
 arch/arm/include/asm/div64.h                       |   2 +-
 arch/arm/include/asm/futex.h                       |   6 -
 arch/arm/include/asm/pgtable-2level.h              |   1 +
 arch/arm/include/asm/unistd.h                      |   1 -
 arch/arm/kernel/machine_kexec.c                    |   7 +
 arch/arm/mach-omap2/irq.c                          |   8 +
 arch/arm/mach-omap2/omap_hwmod.c                   |   3 +-
 arch/arm/mach-omap2/omap_hwmod_3xxx_data.c         |   4 +-
 arch/arm/mach-omap2/pm.h                           |   2 +-
 arch/arm/mach-pxa/include/mach/hx4700.h            |   1 +
 arch/arm/mm/Kconfig                                |   3 +-
 arch/arm/mm/mmu.c                                  |  10 ++
 arch/arm/mm/proc-macros.S                          |  19 +-
 arch/arm/mm/proc-v7-2level.S                       |   7 -
 arch/arm64/include/asm/pgtable.h                   |   8 +-
 arch/arm64/include/asm/unistd32.h                  |   2 +-
 arch/s390/include/asm/atomic.h                     |  70 +++++---
 arch/s390/include/asm/bitops.h                     |  41 +++--
 arch/s390/include/asm/ccwdev.h                     |   2 +-
 arch/s390/kernel/ptrace.c                          |   2 +-
 arch/s390/kvm/kvm-s390.c                           |   3 +-
 arch/sh/kernel/dumpstack.c                         |   2 +-
 arch/x86/Makefile                                  |   1 +
 arch/x86/boot/compressed/eboot.c                   |   5 +-
 arch/x86/boot/compressed/head_32.S                 |  14 +-
 arch/x86/boot/compressed/head_64.S                 |   9 +-
 arch/x86/include/asm/cpufeature.h                  |   4 +
 arch/x86/include/asm/xsave.h                       |  16 +-
 arch/x86/kernel/ftrace.c                           |   2 +-
 arch/x86/kernel/ldt.c                              |  11 ++
 arch/x86/lib/hash.c                                |   4 +
 drivers/acpi/acpica/nsrepair.c                     |  25 ++-
 drivers/block/mtip32xx/mtip32xx.c                  |  88 +++++----
 drivers/block/mtip32xx/mtip32xx.h                  |   2 +-
 drivers/clk/clk-s2mps11.c                          |   2 +-
 drivers/clk/tegra/clk-tegra124.c                   |   3 -
 drivers/clk/ti/clk-44xx.c                          |   1 -
 drivers/clk/ti/clk-54xx.c                          |   1 -
 drivers/clk/ti/clk-7xx.c                           |   1 -
 drivers/firmware/efi/efi-stub-helper.c             |   6 +-
 drivers/gpu/drm/armada/armada_crtc.c               |   1 +
 drivers/hv/connection.c                            |   5 +-
 drivers/iio/adc/at91_adc.c                         |  26 ++-
 drivers/iio/industrialio-buffer.c                  |   6 +-
 drivers/iio/light/cm32181.c                        |   1 +
 drivers/iio/light/cm36651.c                        |  22 ++-
 drivers/infiniband/core/cm.c                       |  17 --
 drivers/infiniband/core/cma.c                      |  26 ---
 drivers/infiniband/hw/ehca/ehca_cq.c               |   1 +
 drivers/infiniband/hw/ipath/ipath_diag.c           |  66 +++----
 drivers/infiniband/hw/mthca/mthca_provider.c       |   1 +
 drivers/infiniband/hw/nes/nes_verbs.c              |   2 +-
 drivers/infiniband/hw/qib/qib_file_ops.c           |   3 +-
 drivers/infiniband/hw/qib/qib_init.c               |  25 ++-
 drivers/infiniband/ulp/isert/ib_isert.c            |  70 +++++---
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  16 +-
 drivers/media/dvb-frontends/m88rs2000.c            |  19 +-
 drivers/media/pci/saa7134/saa7134-cards.c          |   4 +-
 drivers/media/platform/omap3isp/isppreview.c       |   9 +
 drivers/media/usb/em28xx/em28xx-audio.c            |  22 +--
 drivers/media/usb/em28xx/em28xx-dvb.c              |   3 +-
 drivers/media/usb/gspca/sn9c20x.c                  |   1 +
 drivers/media/usb/uvc/uvc_video.c                  |  20 ++-
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c      |   4 +-
 drivers/media/v4l2-core/v4l2-dv-timings.c          |   4 +
 drivers/mfd/88pm800.c                              |   3 +-
 drivers/mfd/88pm860x-core.c                        |   6 +
 drivers/mfd/kempld-core.c                          |   7 +-
 drivers/mfd/max77686.c                             |   4 +
 drivers/mfd/max77693.c                             |  12 +-
 drivers/mfd/max8925-i2c.c                          |   9 +
 drivers/mfd/max8997.c                              |  18 ++
 drivers/mfd/max8998.c                              |   4 +
 drivers/mfd/sec-core.c                             |   4 +
 drivers/mfd/tps65910.c                             |   4 +-
 drivers/mfd/twl-core.c                             |  10 +-
 drivers/misc/mei/client.c                          |  76 +++++---
 drivers/misc/mei/client.h                          |  18 --
 drivers/misc/mei/hw-me-regs.h                      |   5 +
 drivers/misc/mei/interrupt.c                       |   3 +-
 drivers/misc/mei/main.c                            |   3 +-
 drivers/misc/mei/pci-me.c                          |  30 +++-
 drivers/pci/host/pci-imx6.c                        |  47 +++--
 drivers/pci/host/pci-mvebu.c                       |   2 +-
 drivers/regulator/arizona-ldo1.c                   |   7 +-
 drivers/s390/char/con3215.c                        |   2 +-
 drivers/s390/char/con3270.c                        |   6 +-
 drivers/s390/char/raw3270.c                        |  10 +-
 drivers/s390/char/raw3270.h                        |   2 +-
 drivers/s390/cio/device.c                          |   3 +-
 drivers/scsi/arcmsr/arcmsr_hba.c                   |   7 +-
 drivers/scsi/qla2xxx/qla_os.c                      |   6 +-
 drivers/spi/spi-dw.c                               |   7 -
 drivers/spi/spi-efm32.c                            |   3 +
 drivers/staging/comedi/drivers/usbdux.c            |   9 +-
 drivers/staging/rtl8188eu/core/rtw_recv.c          |   4 +-
 drivers/staging/rtl8712/rtl871x_recv.c             |  13 +-
 drivers/staging/serqt_usb2/serqt_usb2.c            |   2 +-
 drivers/target/iscsi/iscsi_target.c                |   4 +-
 drivers/target/target_core_iblock.c                |   5 +-
 drivers/target/target_core_rd.c                    |  14 +-
 drivers/target/target_core_sbc.c                   |   3 +-
 drivers/target/tcm_fc/tfc_sess.c                   |   1 +
 drivers/tty/hvc/hvc_console.c                      |   6 +-
 drivers/usb/core/driver.c                          |  94 ++++++----
 drivers/usb/core/hcd-pci.c                         |   2 +-
 drivers/usb/core/hub.c                             |   5 +-
 drivers/usb/core/usb.h                             |   2 +-
 drivers/usb/dwc3/core.h                            |  39 +++-
 drivers/usb/dwc3/gadget.h                          |  12 --
 drivers/usb/gadget/atmel_usba_udc.c                |   6 +-
 drivers/usb/gadget/tcm_usb_gadget.c                |   2 +-
 drivers/usb/gadget/zero.c                          |   2 +-
 drivers/usb/host/ehci-tegra.c                      |  23 +++
 drivers/usb/host/xhci-pci.c                        |  17 +-
 drivers/usb/host/xhci-ring.c                       |  67 ++++---
 drivers/usb/host/xhci.c                            |   7 +-
 drivers/usb/host/xhci.h                            |   2 -
 drivers/usb/musb/musb_core.c                       |   5 +-
 drivers/usb/musb/omap2430.c                        |   2 +
 drivers/usb/phy/phy-am335x-control.c               |   9 +
 drivers/usb/phy/phy-ulpi.c                         |   2 +
 drivers/usb/serial/pl2303.c                        |   3 +
 drivers/usb/serial/pl2303.h                        |   5 +-
 drivers/video/atmel_lcdfb.c                        |   6 +
 drivers/w1/w1_netlink.c                            |  25 +--
 fs/ext4/ext4.h                                     |  17 --
 fs/ext4/file.c                                     |   2 +-
 fs/ext4/inode.c                                    |  20 ++-
 fs/ext4/page-io.c                                  |   5 +-
 fs/ext4/xattr.c                                    |  23 ++-
 fs/namespace.c                                     |  11 +-
 fs/nfs/nfs4proc.c                                  |  19 +-
 fs/nfsd/nfs4callback.c                             |   4 +-
 fs/nfsd/nfs4proc.c                                 |   9 +-
 fs/nfsd/nfs4state.c                                |  13 +-
 fs/nfsd/nfs4xdr.c                                  |   9 +-
 fs/nfsd/nfsctl.c                                   |   5 +
 fs/nfsd/nfsd.h                                     |   2 +-
 fs/nfsd/nfsxdr.c                                   |   2 +-
 fs/nfsd/vfs.c                                      |   9 +
 fs/ocfs2/buffer_head_io.c                          |   2 -
 fs/ocfs2/dlm/dlmrecovery.c                         |  29 ++-
 fs/ocfs2/namei.c                                   |   2 -
 fs/pnode.c                                         | 198 +++++++++++++--------
 fs/pnode.h                                         |   3 +
 fs/reiserfs/dir.c                                  |   6 +-
 include/asm-generic/word-at-a-time.h               |   8 +-
 include/dt-bindings/clock/tegra124-car.h           |   6 +-
 include/linux/bio.h                                |   6 +-
 include/linux/hyperv.h                             |   4 +-
 include/linux/mount.h                              |   3 +
 include/linux/sunrpc/svcsock.h                     |   1 +
 include/rdma/ib_cm.h                               |   1 -
 include/uapi/linux/libc-compat.h                   |   9 +
 include/uapi/linux/videodev2.h                     |  10 +-
 include/uapi/linux/xattr.h                         |   7 +
 kernel/sysctl.c                                    |   6 +
 mm/hugetlb.c                                       |   1 +
 mm/internal.h                                      |   1 +
 mm/mlock.c                                         |   2 +
 mm/page_alloc.c                                    |  89 ++++-----
 mm/rmap.c                                          |  14 +-
 net/sunrpc/svcsock.c                               |  16 ++
 sound/pci/hda/patch_realtek.c                      |  98 +++++++++-
 sound/pci/ice1712/ice1712.c                        |  15 +-
 sound/soc/codecs/cs42l51.c                         |   9 +-
 sound/soc/codecs/cs42l52.c                         |   8 +-
 sound/soc/codecs/cs42l73.c                         |   6 +-
 sound/soc/soc-pcm.c                                |   3 -
 181 files changed, 1411 insertions(+), 826 deletions(-)

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Catalin Marinas <[email protected]>

commit 71fdb6bf61bf0692f004f9daf5650392c0cfe300 upstream.

Special pte mappings are not intended to be executable and do not even have an associated struct page. This patch ensures that we do not call __sync_icache_dcache() on such ptes.

---
 arch/arm64/include/asm/pgtable.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -199,7 +199,7 @@ static inline void set_pte_at(struct mm_
 			      pte_t *ptep, pte_t pte)
 {
 	if (pte_valid_user(pte)) {
-		if (pte_exec(pte))
+		if (!pte_special(pte) && pte_exec(pte))
 			__sync_icache_dcache(pte, addr);
 		if (pte_dirty(pte) && pte_write(pte))
 			pte_val(pte) &= ~PTE_RDONLY;

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Catalin Marinas <[email protected]>

commit de2db7432917a82b62d55bb59635586eeca6d1bd upstream.

pgprot_{dmacoherent,writecombine,noncached} don't need to generate executable mappings with side-effects like __sync_icache_dcache() being called when the mapping is in user space.

---
 arch/arm64/include/asm/pgtable.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -286,11 +286,11 @@ static inline int has_transparent_hugepa
  * Mark the prot value as uncacheable and unbufferable.
  */
 #define pgprot_noncached(prot) \
-	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))
+	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE) | PTE_PXN | PTE_UXN)
 #define pgprot_writecombine(prot) \
-	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
 #define pgprot_dmacoherent(prot) \
-	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
 #define __HAVE_PHYS_MEM_ACCESS_PROT
 struct file;
 extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Brown <[email protected]>

commit 017d9491ce203c620ad1377f46a3ce78d554b2de upstream.

The changes in "ASoC: pcm: free path list before exiting from error conditions" actually introduced both double frees (in case where the path list was allocated but empty) and frees of unallocated memory (in cases where the error being handled was -ENOMEM. Drop the commit for now.

---
 sound/soc/soc-pcm.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -1989,7 +1989,6 @@ int soc_dpcm_runtime_update(struct snd_s
 
 		paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
 		if (paths < 0) {
-			dpcm_path_put(&list);
 			dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
 					fe->dai_link->name,  "playback");
 			mutex_unlock(&card->mutex);

@@ -2019,7 +2018,6 @@ capture:
 
 		paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
 		if (paths < 0) {
-			dpcm_path_put(&list);
 			dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
 					fe->dai_link->name,  "capture");
 			mutex_unlock(&card->mutex);

@@ -2084,7 +2082,6 @@ static int dpcm_fe_dai_open(struct snd_p
 	fe->dpcm[stream].runtime = fe_substream->runtime;
 
 	if (dpcm_path_get(fe, stream, &list) <= 0) {
-		dpcm_path_put(&list);
 		dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
 			fe->dai_link->name, stream ? "capture" : "playback");
 	}

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Austin <[email protected]>

commit 7272e051157ccd5871b5d939548d0ba5a94a2965 upstream.

The shift values for the ADC,PCM, and Analog kcontrols were wrong causing wrong values for the SOC_DOUBLE_R_SX_TLV macros Fixed the TLV for aout_tlv to show -102dB correctly

---
 sound/soc/codecs/cs42l51.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

@@ -124,9 +124,8 @@ static int cs42l51_set_chan_mix(struct s
 
 static const DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -5150, 50, 0);
 static const DECLARE_TLV_DB_SCALE(tone_tlv, -1050, 150, 0);
-/* This is a lie. after -102 db, it stays at -102 */
-/* maybe a range would be better */
-static const DECLARE_TLV_DB_SCALE(aout_tlv, -11550, 50, 0);
+
+static const DECLARE_TLV_DB_SCALE(aout_tlv, -10200, 50, 0);
 
 static const DECLARE_TLV_DB_SCALE(boost_tlv, 1600, 1600, 0);
 static const char *chan_mix[] = {

@@ -141,7 +140,7 @@ static const struct soc_enum cs42l51_cha
 static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
 	SOC_DOUBLE_R_SX_TLV("PCM Playback Volume",
 			CS42L51_PCMA_VOL, CS42L51_PCMB_VOL,
-			6, 0x19, 0x7F, adc_pcm_tlv),
+			0, 0x19, 0x7F, adc_pcm_tlv),
 	SOC_DOUBLE_R("PCM Playback Switch",
 			CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, 7, 1, 1),
 	SOC_DOUBLE_R_SX_TLV("Analog Playback Volume",

@@ -149,7 +148,7 @@ static const struct snd_kcontrol_new cs4
 			0, 0x34, 0xE4, aout_tlv),
 	SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
 			CS42L51_ADCA_VOL, CS42L51_ADCB_VOL,
-			6, 0x19, 0x7F, adc_pcm_tlv),
+			0, 0x19, 0x7F, adc_pcm_tlv),
 	SOC_DOUBLE_R("ADC Mixer Switch",
 			CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, 7, 1, 1),
 	SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0),

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Austin <[email protected]>

commit d31a33dd7792c7d6c11fda226a3b9e4fb7f86f95 upstream.

The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the PCM/ADC Swap controls

---
 sound/soc/codecs/cs42l52.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -347,7 +347,7 @@ static const char * const right_swap_tex
 static const unsigned int swap_values[] = { 0, 1, 3 };
 
 static const struct soc_enum adca_swap_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 1,
+	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 3,
 			      ARRAY_SIZE(left_swap_text),
 			      left_swap_text,
 			      swap_values);

@@ -356,7 +356,7 @@ static const struct snd_kcontrol_new adc
 	SOC_DAPM_ENUM("Route", adca_swap_enum);
 
 static const struct soc_enum pcma_swap_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 1,
+	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 3,
 			      ARRAY_SIZE(left_swap_text),
 			      left_swap_text,
 			      swap_values);

@@ -365,7 +365,7 @@ static const struct snd_kcontrol_new pcm
 	SOC_DAPM_ENUM("Route", pcma_swap_enum);
 
 static const struct soc_enum adcb_swap_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 1,
+	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 3,
 			      ARRAY_SIZE(right_swap_text),
 			      right_swap_text,
 			      swap_values);

@@ -374,7 +374,7 @@ static const struct snd_kcontrol_new adc
 	SOC_DAPM_ENUM("Route", adcb_swap_enum);
 
 static const struct soc_enum pcmb_swap_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 1,
+	SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 3,
 			      ARRAY_SIZE(right_swap_text),
 			      right_swap_text,
 			      swap_values);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Austin <[email protected]>

commit 1555b652970e541fa1cb80c61ffc696bbfb92bb7 upstream.

The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the mono mix controls.

---
 sound/soc/codecs/cs42l73.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -319,7 +319,7 @@ static const char * const cs42l73_mono_m
 static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 };
 
 static const struct soc_enum spk_asp_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1,
+	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3,
 			      ARRAY_SIZE(cs42l73_mono_mix_texts),
 			      cs42l73_mono_mix_texts,
 			      cs42l73_mono_mix_values);

@@ -337,7 +337,7 @@ static const struct snd_kcontrol_new spk
 	SOC_DAPM_ENUM("Route", spk_xsp_enum);
 
 static const struct soc_enum esl_asp_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5,
+	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3,
 			      ARRAY_SIZE(cs42l73_mono_mix_texts),
 			      cs42l73_mono_mix_texts,
 			      cs42l73_mono_mix_values);

@@ -346,7 +346,7 @@ static const struct snd_kcontrol_new esl
 	SOC_DAPM_ENUM("Route", esl_asp_enum);
 
 static const struct soc_enum esl_xsp_enum =
-	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7,
+	SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3,
 			      ARRAY_SIZE(cs42l73_mono_mix_texts),
 			      cs42l73_mono_mix_texts,
 			      cs42l73_mono_mix_values);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Sørensen <[email protected]>

commit 698b48532539484b012fb7c4176b959d32a17d00 upstream.

When an interrupt has become active on the INTC it will stay active until it is acked, even if masked or de-asserted. The INTC_PENDING_IRQn registers are however updated and since these are used by omap_intc_handle_irq to determine which interrupt to handle, it will never see the active interrupt. This will result in a storm of useless interrupts that is only stopped when another higher priority interrupt is asserted.

Fix by sending the INTC an acknowledge if we find no interrupts to handle.

---
 arch/arm/mach-omap2/irq.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -222,6 +222,7 @@ void __init ti81xx_init_irq(void)
 static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs *regs)
 {
 	u32 irqnr;
+	int handled_irq = 0;
 
 	do {
 		irqnr = readl_relaxed(base_addr + 0x98);

@@ -249,8 +250,15 @@ out:
 		if (irqnr) {
 			irqnr = irq_find_mapping(domain, irqnr);
 			handle_IRQ(irqnr, regs);
+			handled_irq = 1;
 		}
 	} while (irqnr);
+
+	/* If an irq is masked or deasserted while active, we will
+	 * keep ending up here with no irq handled. So remove it from
+	 * the INTC with an ack.*/
+	if (!handled_irq)
+		omap_ack_irq(NULL);
 }
 
 asmlinkage void __exception_irq_entry omap2_intc_handle_irq(struct pt_regs *regs)

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Suman Anna <[email protected]>

commit 3d36ad7e7a9be0d130c862727a052ed279046437 upstream.

Bug was introduced by commit 'f92d959: ARM: OMAP2+: hwmod:
Extract no-idle and no-reset info from DT'

There were 2 versions of the patch posted which resulted in the above commit. While v1 [1] had the bug, v2 [2] had it fixed. However v1 apparently seemed to have been pulled in by mistake introducing the bug.

Given of_find_property() does return NULL when the node passed is NULL, it did not introduce any functional issues as such, just the fact that the second if check was executed unnecessarily.

[1] https://www.mail-archive.com/[email protected]/msg94220.html
[2] http://www.spinics.net/lists/linux-omap/msg98490.html

---
 arch/arm/mach-omap2/omap_hwmod.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2546,11 +2546,12 @@ static int __init _init(struct omap_hwmo
 		return -EINVAL;
 	}
 
-	if (np)
+	if (np) {
 		if (of_find_property(np, "ti,no-reset-on-init", NULL))
 			oh->flags |= HWMOD_INIT_NO_RESET;
 		if (of_find_property(np, "ti,no-idle-on-init", NULL))
 			oh->flags |= HWMOD_INIT_NO_IDLE;
+	}
 
 	oh->_state = _HWMOD_STATE_INITIALIZED;
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Vaussard <[email protected]>

commit 8559087f0e9722a95df43fa5968bd1ee42bcf540 upstream.

When arch/arm/mach-omap2/gpmc.c calls clk_get(..., "fck"), it will get a dummy clock and try to use it. As the rate is configured to zero, this will result in several divisions by zero, and misconfigured timings, with devices on the bus being lost in the La La Land.

It is better to remove gpmc_fck from the dummy clocks, so that gpmc.c can fail gracefully.

---
 drivers/clk/ti/clk-44xx.c |    1 -
 drivers/clk/ti/clk-54xx.c |    1 -
 drivers/clk/ti/clk-7xx.c  |    1 -
 3 files changed, 3 deletions(-)

@@ -222,7 +222,6 @@ static struct ti_dt_clk omap44xx_clks[]
 	DT_CLK(NULL, "auxclk5_src_ck", "auxclk5_src_ck"),
 	DT_CLK(NULL, "auxclk5_ck", "auxclk5_ck"),
 	DT_CLK(NULL, "auxclkreq5_ck", "auxclkreq5_ck"),
-	DT_CLK("50000000.gpmc", "fck", "dummy_ck"),
 	DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.3", "ick", "dummy_ck"),

@@ -182,7 +182,6 @@ static struct ti_dt_clk omap54xx_clks[]
 	DT_CLK(NULL, "auxclk3_src_ck", "auxclk3_src_ck"),
 	DT_CLK(NULL, "auxclk3_ck", "auxclk3_ck"),
 	DT_CLK(NULL, "auxclkreq3_ck", "auxclkreq3_ck"),
-	DT_CLK(NULL, "gpmc_ck", "dummy_ck"),
 	DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.3", "ick", "dummy_ck"),

@@ -262,7 +262,6 @@ static struct ti_dt_clk dra7xx_clks[] =
 	DT_CLK(NULL, "vip1_gclk_mux", "vip1_gclk_mux"),
 	DT_CLK(NULL, "vip2_gclk_mux", "vip2_gclk_mux"),
 	DT_CLK(NULL, "vip3_gclk_mux", "vip3_gclk_mux"),
-	DT_CLK(NULL, "gpmc_ck", "dummy_ck"),
 	DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
 	DT_CLK("omap_i2c.3", "ick", "dummy_ck"),

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nishanth Menon <[email protected]>

commit 07484ca33ef83900f5cfbde075c1a19e5a237aa1 upstream.

Just like IS_PM34XX_ERRATUM, IS_PM44XX_ERRATUM is valid only if CONFIG_PM is enabled, else, disabling CONFIG_PM results in build failure complaining about the following:
arch/arm/mach-omap2/built-in.o: In function `omap4_boot_secondary':
:(.text+0x8a70): undefined reference to `pm44xx_errata'

---
 arch/arm/mach-omap2/pm.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -103,7 +103,7 @@ static inline void enable_omap3630_toggl
 
 #define PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD	(1 << 0)
 
-#if defined(CONFIG_ARCH_OMAP4)
+#if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP4)
 extern u16 pm44xx_errata;
 #define IS_PM44XX_ERRATUM(id)		(pm44xx_errata & (id))
 #else

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit c6c56697ae4bf1226263c19e8353343d7083f40e upstream.

OMAP3 doesn't contain "l3_init_clkdm" clock domain. Use the proper clock domains for USB Host and USB TLL modules.

Gets rid of the following warnings during boot
omap_hwmod: usb_host_hs: could not associate to clkdm l3_init_clkdm
omap_hwmod: usb_tll_hs: could not associate to clkdm l3_init_clkdm

---
 arch/arm/mach-omap2/omap_hwmod_3xxx_data.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1968,7 +1968,7 @@ static struct omap_hwmod_irq_info omap3x
 static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = {
 	.name		= "usb_host_hs",
 	.class		= &omap3xxx_usb_host_hs_hwmod_class,
-	.clkdm_name	= "l3_init_clkdm",
+	.clkdm_name	= "usbhost_clkdm",
 	.mpu_irqs	= omap3xxx_usb_host_hs_irqs,
 	.main_clk	= "usbhost_48m_fck",
 	.prcm = {

@@ -2053,7 +2053,7 @@ static struct omap_hwmod_irq_info omap3x
 static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = {
 	.name		= "usb_tll_hs",
 	.class		= &omap3xxx_usb_tll_hs_hwmod_class,
-	.clkdm_name	= "l3_init_clkdm",
+	.clkdm_name	= "core_l4_clkdm",
 	.mpu_irqs	= omap3xxx_usb_tll_hs_irqs,
 	.main_clk	= "usbtll_fck",
 	.prcm = {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mugunthan V N <[email protected]>

commit 8abcdd680d543fb582371e146e62ba9f2af8a816 upstream.

DT node's unit address should be its own register offset address to make it a unique across the system. This patch corrects the incorrect USB entries with correct register offset for unit address.

---
 arch/arm/boot/dts/am33xx.dtsi |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -448,7 +448,7 @@
 			ti,hwmods = "usb_otg_hs";
 			status = "disabled";
 
-			usb_ctrl_mod: control@44e10000 {
+			usb_ctrl_mod: control@44e10620 {
 				compatible = "ti,am335x-usb-ctrl-module";
 				reg = <0x44e10620 0x10
 					0x44e10648 0x4>;

@@ -551,7 +551,7 @@
 					"tx14", "tx15";
 			};
 
-			cppi41dma: dma-controller@07402000 {
+			cppi41dma: dma-controller@47402000 {
 				compatible = "ti,am3359-cppi41";
 				reg =  <0x47400000 0x1000
 					0x47402000 0x1000

This one should not be backported without commit

	a2f8d6b30321 ("ARM: dts: am335x: update USB DT references")

which is in Linus' tree but is not marked for stable (or USB will be disabled for the boards relying on the old node addresses).

Thanks,
Johan

Thanks for letting me know, I've now applied that patch as well.

greg k-h

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Vaussard <[email protected]>

commit 7b8b6af169a069454936053631d151a50af7b69a upstream.

The GPMC clock is derived from l3_ick. The simplest solution is to reference directly l3_ick to provide the GPMC fck in order to get correct timings. The real management of the clock is left to hwmod.

---
 arch/arm/boot/dts/omap4.dtsi |    2 ++
 arch/arm/boot/dts/omap5.dtsi |    2 ++
 2 files changed, 4 insertions(+)

@@ -275,6 +275,8 @@
 			gpmc,num-waitpins = <4>;
 			ti,hwmods = "gpmc";
 			ti,no-idle-on-init;
+			clocks = <&l3_div_ck>;
+			clock-names = "fck";
 		};
 
 		uart1: serial@4806a000 {

@@ -302,6 +302,8 @@
 			gpmc,num-cs = <8>;
 			gpmc,num-waitpins = <4>;
 			ti,hwmods = "gpmc";
+			clocks = <&l3_iclk_div>;
+			clock-names = "fck";
 		};
 
 		i2c1: i2c@48070000 {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomasz Figa <[email protected]>

commit bfeda827278f09f4db35877e5f1ca9c149ca2890 upstream.

Apparently, if G3D regulator is powered off, the SoC cannot enter low power modes and just hangs. This patch fixes this by keeping the regulator always on when the system is running, as suggested by Exynos 4 User's Manual in case of Exynos4210/4x12 SoCs (Exynos5250 UM does not have such note, but observed behavior seems to confirm that it is true for this SoC as well).

This fixes an issue preventing Arndale board from entering sleep mode observed since commit

346f372f7b72a0 clk: exynos5250: Add CLK_IGNORE_UNUSED flag for pmu clock

that landed in kernel 3.10, which has fixed the clock driver to make the SoC actually try to enter the sleep mode.

---
 arch/arm/boot/dts/exynos5250-arndale.dts |    1 +
 1 file changed, 1 insertion(+)

@@ -287,6 +287,7 @@
 					regulator-name = "vdd_g3d";
 					regulator-min-microvolt = <1000000>;
 					regulator-max-microvolt = <1000000>;
+					regulator-always-on;
 					regulator-boot-on;
 					op_mode = <1>;
 				};

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit b6ccb9803e90c16b212cf4ed62913a7591e79a39 upstream.

CPU_32v6 currently selects CPU_USE_DOMAINS if CPU_V6 and MMU. This is because ARM 1136 r0pX CPUs lack the v6k extensions, and therefore do not have hardware thread registers. The lack of these registers requires the kernel to update the vectors page at each context switch in order to write a new TLS pointer. This write must be done via the userspace mapping, since aliasing caches can lead to expensive flushing when using kmap. Finally, this requires the vectors page to be mapped r/w for kernel and r/o for user, which has implications for things like put_user which must trigger CoW appropriately when targetting user pages.

The upshot of all this is that a v6/v7 kernel makes use of domains to segregate kernel and user memory accesses. This has the nasty side-effect of making device mappings executable, which has been observed to cause subtle bugs on recent cores (e.g. Cortex-A15 performing a speculative instruction fetch from the GIC and acking an interrupt in the process).

This patch solves this problem by removing the remaining domain support from ARMv6. A new memory type is added specifically for the vectors page which allows that page (and only that page) to be mapped as user r/o, kernel r/w. All other user r/o pages are mapped also as kernel r/o. Patch co-developed with Russell King.

---
 arch/arm/include/asm/futex.h          |    6 ------
 arch/arm/include/asm/pgtable-2level.h |    1 +
 arch/arm/mm/Kconfig                   |    3 +--
 arch/arm/mm/mmu.c                     |   10 ++++++++++
 arch/arm/mm/proc-macros.S             |   19 ++++++-------------
 arch/arm/mm/proc-v7-2level.S          |    7 -------
 6 files changed, 18 insertions(+), 28 deletions(-)

@@ -3,11 +3,6 @@
 
 #ifdef __KERNEL__
 
-#if defined(CONFIG_CPU_USE_DOMAINS) && defined(CONFIG_SMP)
-/* ARM doesn't provide unprivileged exclusive memory accessors */
-#include <asm-generic/futex.h>
-#else
-
 #include <linux/futex.h>
 #include <linux/uaccess.h>
 #include <asm/errno.h>

@@ -164,6 +159,5 @@ futex_atomic_op_inuser (int encoded_op,
 	return ret;
 }
 
-#endif /* !(CPU_USE_DOMAINS && SMP) */
 #endif /* __KERNEL__ */
 #endif /* _ASM_ARM_FUTEX_H */

@@ -140,6 +140,7 @@
 #define L_PTE_MT_DEV_NONSHARED	(_AT(pteval_t, 0x0c) << 2)	/* 1100 */
 #define L_PTE_MT_DEV_WC		(_AT(pteval_t, 0x09) << 2)	/* 1001 */
 #define L_PTE_MT_DEV_CACHED	(_AT(pteval_t, 0x0b) << 2)	/* 1011 */
+#define L_PTE_MT_VECTORS	(_AT(pteval_t, 0x0f) << 2)	/* 1111 */
 #define L_PTE_MT_MASK		(_AT(pteval_t, 0x0f) << 2)
 
 #ifndef __ASSEMBLY__

@@ -446,7 +446,6 @@ config CPU_32v5
 
 config CPU_32v6
 	bool
-	select CPU_USE_DOMAINS if CPU_V6 && MMU
 	select TLS_REG_EMUL if !CPU_32v6K && !MMU
 
 config CPU_32v6K

@@ -671,7 +670,7 @@ config ARM_VIRT_EXT
 
 config SWP_EMULATE
 	bool "Emulate SWP/SWPB instructions"
-	depends on !CPU_USE_DOMAINS && CPU_V7
+	depends on CPU_V7
 	default y if SMP
 	select HAVE_PROC_CPU if PROC_FS
 	help

@@ -516,6 +516,16 @@ static void __init build_mem_type_table(
 	s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
 
 	/*
+	 * We don't use domains on ARMv6 (since this causes problems with
+	 * v6/v7 kernels), so we must use a separate memory type for user
+	 * r/o, kernel r/w to map the vectors page.
+	 */
+#ifndef CONFIG_ARM_LPAE
+	if (cpu_arch == CPU_ARCH_ARMv6)
+		vecs_pgprot |= L_PTE_MT_VECTORS;
+#endif
+
+	/*
 	 * ARMv6 and above have extended page tables.
 	 */
 	if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {

@@ -112,13 +112,9 @@
  *  100x   1   0   1	r/o	no acc
  *  10x0   1   0   1	r/o	no acc
  *  1011   0   0   1	r/w	no acc
- *  110x   0   1   0	r/w	r/o
- *  11x0   0   1   0	r/w	r/o
- *  1111   0   1   1	r/w	r/w
- *
- * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed:
  *  110x   1   1   1	r/o	r/o
  *  11x0   1   1   1	r/o	r/o
+ *  1111   0   1   1	r/w	r/w
  */
 	.macro	armv6_mt_table pfx
 \pfx\()_mt_table:

@@ -137,7 +133,7 @@
 	.long	PTE_EXT_TEX(2)					@ L_PTE_MT_DEV_NONSHARED
 	.long	0x00						@ unused
 	.long	0x00						@ unused
-	.long	0x00						@ unused
+	.long	PTE_CACHEABLE | PTE_BUFFERABLE | PTE_EXT_APX	@ L_PTE_MT_VECTORS
 	.endm
 
 	.macro	armv6_set_pte_ext pfx

@@ -158,24 +154,21 @@
 
 	tst	r1, #L_PTE_USER
 	orrne	r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
-	@ allow kernel read/write access to read-only user pages
 	tstne	r3, #PTE_EXT_APX
-	bicne	r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
+
+	@ user read-only -> kernel read-only
+	bicne	r3, r3, #PTE_EXT_AP0
 
 	tst	r1, #L_PTE_XN
 	orrne	r3, r3, #PTE_EXT_XN
 
-	orr	r3, r3, r2
+	eor	r3, r3, r2
 
 	tst	r1, #L_PTE_YOUNG
 	tstne	r1, #L_PTE_PRESENT
 	moveq	r3, #0
-#ifndef CONFIG_CPU_USE_DOMAINS
 	tstne	r1, #L_PTE_NONE
 	movne	r3, #0
-#endif
 
 	str	r3, [r0]
 	mcr	p15, 0, r0, c7, c10, 1		@ flush_pte

@@ -90,21 +90,14 @@ ENTRY(cpu_v7_set_pte_ext)
 
 	tst	r1, #L_PTE_USER
 	orrne	r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
-	@ allow kernel read/write access to read-only user pages
-	tstne	r3, #PTE_EXT_APX
-	bicne	r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
 
 	tst	r1, #L_PTE_XN
 	orrne	r3, r3, #PTE_EXT_XN
 
 	tst	r1, #L_PTE_YOUNG
 	tstne	r1, #L_PTE_VALID
-#ifndef CONFIG_CPU_USE_DOMAINS
 	eorne	r1, r1, #L_PTE_NONE
 	tstne	r1, #L_PTE_NONE
-#endif
 	moveq	r3, #0
 
  ARM(	str	r3, [r0, #2048]! )

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrew Lunn <[email protected]>

commit 12567bbdee7ea553237085a2bbc0ffa5240f5248 upstream.

CPU_ARM926T should be selected if no other CPU is. Put the ! in the right place so this works.

---
 arch/arm/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -898,7 +898,7 @@ config ARCH_MULTI_V5
 	bool "ARMv5 based platforms (ARM926T, XSCALE, PJ1, ...)"
 	depends on !ARCH_MULTI_V6_V7
 	select ARCH_MULTI_V4_V5
-	select CPU_ARM926T if (!CPU_ARM946E || CPU_ARM1020 || \
+	select CPU_ARM926T if !(CPU_ARM946E || CPU_ARM1020 || \
 		CPU_ARM1020E || CPU_ARM1022 || CPU_ARM1026 || \
 		CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_FEROCEON)
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christopher Covington <[email protected]>

commit 95c52fe063351192e0f4ffb70ef9bac1aa26f5a4 upstream.

The kcmp system call was ported to ARM in
commit 3f7d1fe108dbaefd0c57a41753fc2c90b395f458 "ARM: 7665/1: Wire up kcmp syscall".

---
 arch/arm/include/asm/unistd.h |    1 -
 1 file changed, 1 deletion(-)

@@ -48,6 +48,5 @@
  */
 #define __IGNORE_fadvise64_64
 #define __IGNORE_migrate_pages
-#define __IGNORE_kcmp
 
 #endif /* __ASM_ARM_UNISTD_H */

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiangyu Lu <[email protected]>

commit 80bb3ef109ff40a7593d9481c17de9bbc4d7c0e2 upstream.

In big-endian systems, "%1" get the most significant part of the value, cause the instruction to get the wrong result.

When viewing ftrace record in big-endian ARM systems, we found that the timestamp errors:

swapper-0   [001] 1325.970000:   0:120:R ==> [001]    16:120:R events/1
events/1-16 [001] 1325.970000:   16:120:S ==> [001]    0:120:R swapper
swapper-0   [000] 1325.1000000:  0:120:R   + [000]    15:120:R events/0
swapper-0   [000] 1325.1000000:  0:120:R ==> [000]    15:120:R events/0
swapper-0   [000] 1326.030000:   0:120:R   + [000]  1150:120:R sshd
swapper-0   [000] 1326.030000:   0:120:R ==> [000]  1150:120:R sshd

When viewed ftrace records, it will call the do_div(n, base) function, which achieved arch/arm/include/asm/div64.h in. When n = 10000000, base = 1000000, in do_div(n, base) will execute "umull %Q0, %R0, %1, %Q2".

---
 arch/arm/include/asm/div64.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -156,7 +156,7 @@
 		/* Select the best insn combination to perform the   */	\
 		/* actual __m * __n / (__p << 64) operation.         */	\
 		if (!__c) {						\
-			asm (	"umull	%Q0, %R0, %1, %Q2\n\t"		\
+			asm (	"umull	%Q0, %R0, %Q1, %Q2\n\t"		\
 				"mov	%Q0, #0"			\
 				: "=&r" (__res)				\
 				: "r" (__m), "r" (__n)			\

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Liu Hua <[email protected]>

commit 56b700fd6f1e49149880fb1b6ffee0dca5be45fb upstream.

For vmcore generated by LPAE enabled kernel, user space utility such as crash needs additional infomation to parse.

So this patch add arch_crash_save_vmcoreinfo as what PAE enabled i386 linux does.

---
 arch/arm/kernel/machine_kexec.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -184,3 +184,10 @@ void machine_kexec(struct kimage *image)
 
 	soft_restart(reboot_entry_phys);
 }
+
+void arch_crash_save_vmcoreinfo(void)
+{
+#ifdef CONFIG_ARM_LPAE
+	VMCOREINFO_CONFIG(ARM_LPAE);
+#endif
+}

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <[email protected]>

commit a6e03dd451c724f785277d8ecca5d1a0b886d892 upstream.

The mvmdio driver accesses some register of the Ethernet unit. It therefore takes a reference and enables a clock. However, on Armada 370/XP, no clock specification was given in the Device Tree, which leads the mvmdio driver to fail when being used as a module and loaded before the mvneta driver: it tries to access a register from a hardware unit that isn't clocked.

---
 arch/arm/boot/dts/armada-370-xp.dtsi |    1 +
 1 file changed, 1 insertion(+)

@@ -226,6 +226,7 @@
 				#size-cells = <0>;
 				compatible = "marvell,orion-mdio";
 				reg = <0x72004 0x4>;
+				clocks = <&gateclk 4>;
 			};
 
 			eth1: ethernet@74000 {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrea Adami <[email protected]>

commit c02b50e90be9f41d6802049a1a08246e9eb1a22c upstream.

hx4700 needs the same fix as in 9705e74671f0e4f994d86b00cecf441917c64a66
"ARM: pxa: fix various compilation problems"

Fix build errors. Initial one is:
/linux/arch/arm/mach-pxa/include/mach/hx4700.h:18:32: error:
'PXA_NR_BUILTIN_GPIO' undeclared here (not in a function)
| #define HX4700_ASIC3_GPIO_BASE PXA_NR_BUILTIN_GPIO

---
 arch/arm/mach-pxa/include/mach/hx4700.h |    1 +
 1 file changed, 1 insertion(+)

@@ -14,6 +14,7 @@
 
 #include <linux/gpio.h>
 #include <linux/mfd/asic3.h>
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
 
 #define HX4700_ASIC3_GPIO_BASE	PXA_NR_BUILTIN_GPIO
 #define HX4700_EGPIO_BASE	(HX4700_ASIC3_GPIO_BASE + ASIC3_NUM_GPIOS)

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kailang Yang <[email protected]>

commit 6bd55b04fe05cb26094b0fe494c7a207e6c0c36e upstream.

Restore the registers to prevent the abnormal digital power supply rising ratio/sequence to the codec and causing the incorrect default codec register restoration during initialization.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71861

---
 sound/pci/hda/patch_realtek.c |   85 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

@@ -2786,6 +2786,89 @@ static void alc269_shutup(struct hda_cod
 	snd_hda_shutup_pins(codec);
 }
 
+static void alc283_restore_default_value(struct hda_codec *codec)
+{
+	int val;
+
+	/* Power Down Control */
+	alc_write_coef_idx(codec, 0x03, 0x0002);
+	/* FIFO and filter clock */
+	alc_write_coef_idx(codec, 0x05, 0x0700);
+	/* DMIC control */
+	alc_write_coef_idx(codec, 0x07, 0x0200);
+	/* Analog clock */
+	val = alc_read_coef_idx(codec, 0x06);
+	alc_write_coef_idx(codec, 0x06, (val & ~0x00f0) | 0x0);
+	/* JD */
+	val = alc_read_coef_idx(codec, 0x08);
+	alc_write_coef_idx(codec, 0x08, (val & ~0xfffc) | 0x0c2c);
+	/* JD offset1 */
+	alc_write_coef_idx(codec, 0x0a, 0xcccc);
+	/* JD offset2 */
+	alc_write_coef_idx(codec, 0x0b, 0xcccc);
+	/* LDO1/2/3, DAC/ADC */
+	alc_write_coef_idx(codec, 0x0e, 0x6fc0);
+	/* JD */
+	val = alc_read_coef_idx(codec, 0x0f);
+	alc_write_coef_idx(codec, 0x0f, (val & ~0xf800) | 0x1000);
+	/* Capless */
+	val = alc_read_coef_idx(codec, 0x10);
+	alc_write_coef_idx(codec, 0x10, (val & ~0xfc00) | 0x0c00);
+	/* Class D test 4 */
+	alc_write_coef_idx(codec, 0x3a, 0x0);
+	/* IO power down directly */
+	val = alc_read_coef_idx(codec, 0x0c);
+	alc_write_coef_idx(codec, 0x0c, (val & ~0xfe00) | 0x0);
+	/* ANC */
+	alc_write_coef_idx(codec, 0x22, 0xa0c0);
+	/* AGC MUX */
+	val = alc_read_coefex_idx(codec, 0x53, 0x01);
+	alc_write_coefex_idx(codec, 0x53, 0x01, (val & ~0x000f) | 0x0008);
+	/* DAC simple content protection */
+	val = alc_read_coef_idx(codec, 0x1d);
+	alc_write_coef_idx(codec, 0x1d, (val & ~0x00e0) | 0x0);
+	/* ADC simple content protection */
+	val = alc_read_coef_idx(codec, 0x1f);
+	alc_write_coef_idx(codec, 0x1f, (val & ~0x00e0) | 0x0);
+	/* DAC ADC Zero Detection */
+	alc_write_coef_idx(codec, 0x21, 0x8804);
+	/* PLL */
+	alc_write_coef_idx(codec, 0x2e, 0x2902);
+	/* capless control 2 */
+	alc_write_coef_idx(codec, 0x33, 0xa080);
+	/* capless control 3 */
+	alc_write_coef_idx(codec, 0x34, 0x3400);
+	/* capless control 4 */
+	alc_write_coef_idx(codec, 0x35, 0x2f3e);
+	/* capless control 5 */
+	alc_write_coef_idx(codec, 0x36, 0x0);
+	/* class D test 2 */
+	val = alc_read_coef_idx(codec, 0x38);
+	alc_write_coef_idx(codec, 0x38, (val & ~0x0fff) | 0x0900);
+	/* class D test 3 */
+	alc_write_coef_idx(codec, 0x39, 0x110a);
+	/* class D test 5 */
+	val = alc_read_coef_idx(codec, 0x3b);
+	alc_write_coef_idx(codec, 0x3b, (val & ~0x00f8) | 0x00d8);
+	/* class D test 6 */
+	alc_write_coef_idx(codec, 0x3c, 0x0014);
+	/* classD OCP */
+	alc_write_coef_idx(codec, 0x3d, 0xc2ba);
+	/* classD pure DC test */
+	val = alc_read_coef_idx(codec, 0x42);
+	alc_write_coef_idx(codec, 0x42, (val & ~0x0f80) | 0x0);
+	/* test mode */
+	alc_write_coef_idx(codec, 0x49, 0x0);
+	/* Class D DC enable */
+	val = alc_read_coef_idx(codec, 0x40);
+	alc_write_coef_idx(codec, 0x40, (val & ~0xf800) | 0x9800);
+	/* DC offset */
+	val = alc_read_coef_idx(codec, 0x42);
+	alc_write_coef_idx(codec, 0x42, (val & ~0xf000) | 0x2000);
+	/* Class D amp control */
+	alc_write_coef_idx(codec, 0x37, 0xfc06);
+}
+
 static void alc283_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;

@@ -2793,6 +2876,8 @@ static void alc283_init(struct hda_codec
 	bool hp_pin_sense;
 	int val;
 
+	alc283_restore_default_value(codec);
+
 	if (!hp_pin)
 		return;
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hui Wang <[email protected]>

commit a870593bab179ca402ead455f45af6e4404a2a7f upstream.

When we plug a 3-ring headset on the Dell machines (VID: 0x10ec0255,
SID: 0x10280632; VID: 0x10ec0293, SID: 0x1028062c; VID: 0x10ec0293,
SID: 0x1028062e), the headset mic can't be detected, after apply this patch, the headset mic can work well.

---
 sound/pci/hda/patch_realtek.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -4404,6 +4404,9 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
 	SND_PCI_QUIRK(0x1028, 0x061f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0629, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x062c, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x062e, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x0632, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
 	SND_PCI_QUIRK(0x1028, 0x063e, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x063f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "W. Trevor King" <[email protected]>

commit a4b7f21d7b42b33609df3f86992a8deff80abfaf upstream.

The lspci -nnvv output contains (wrapped for line length):

00:1b.0 Audio device [0403]:
Intel Corporation 7 Series/C210 Series Chipset Family High Definition Audio Controller [8086:1e20] (rev 04)
Subsystem: ASUSTeK Computer Inc. Device [1043:115d]

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

@@ -993,6 +993,7 @@ static int alc_codec_rename_from_preset(
 
 static const struct snd_pci_quirk beep_white_list[] = {
 	SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1),
+	SND_PCI_QUIRK(0x1043, 0x115d, "ASUS", 1),
 	SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
 	SND_PCI_QUIRK(0x1043, 0x8376, "EeePC", 1),
 	SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 4f8e940095536bc002a81666a4107a581c84e9b9 upstream.

PCM pointer callbacks in ice1712 driver check the buffer size boundary wrongly between bytes and frames. This leads to PCM core warnings
like:
snd_pcm_update_hw_ptr0: 105 callbacks suppressed
ALSA pcm_lib.c:352 BUG: pcmC3D0c:0, pos = 5461, buffer size = 5461, period size = 2730

This patch fixes these checks to be placed after the proper unit conversions.

---
 sound/pci/ice1712/ice1712.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

@@ -685,9 +685,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
 	if (!(snd_ice1712_read(ice, ICE1712_IREG_PBK_CTRL) & 1))
 		return 0;
 	ptr = runtime->buffer_size - inw(ice->ddma_port + 4);
+	ptr = bytes_to_frames(substream->runtime, ptr);
 	if (ptr == runtime->buffer_size)
 		ptr = 0;
-	return bytes_to_frames(substream->runtime, ptr);
+	return ptr;
 }
 
 static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substream *substream)

@@ -704,9 +705,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
 		addr = ICE1712_DSC_ADDR0;
 	ptr = snd_ice1712_ds_read(ice, substream->number * 2, addr) -
 		ice->playback_con_virt_addr[substream->number];
+	ptr = bytes_to_frames(substream->runtime, ptr);
 	if (ptr == substream->runtime->buffer_size)
 		ptr = 0;
-	return bytes_to_frames(substream->runtime, ptr);
+	return ptr;
 }
 
 static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *substream)

@@ -717,9 +719,10 @@ static snd_pcm_uframes_t snd_ice1712_cap
 	if (!(snd_ice1712_read(ice, ICE1712_IREG_CAP_CTRL) & 1))
 		return 0;
 	ptr = inl(ICEREG(ice, CONCAP_ADDR)) - ice->capture_con_virt_addr;
+	ptr = bytes_to_frames(substream->runtime, ptr);
 	if (ptr == substream->runtime->buffer_size)
 		ptr = 0;
-	return bytes_to_frames(substream->runtime, ptr);
+	return ptr;
 }
 
 static const struct snd_pcm_hardware snd_ice1712_playback = {

@@ -1113,9 +1116,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
 	if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_PLAYBACK_START))
 		return 0;
 	ptr = ice->playback_pro_size - (inw(ICEMT(ice, PLAYBACK_SIZE)) << 2);
+	ptr = bytes_to_frames(substream->runtime, ptr);
 	if (ptr == substream->runtime->buffer_size)
 		ptr = 0;
-	return bytes_to_frames(substream->runtime, ptr);
+	return ptr;
 }
 
 static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substream *substream)

@@ -1126,9 +1130,10 @@ static snd_pcm_uframes_t snd_ice1712_cap
 	if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_CAPTURE_START_SHADOW))
 		return 0;
 	ptr = ice->capture_pro_size - (inw(ICEMT(ice, CAPTURE_SIZE)) << 2);
+	ptr = bytes_to_frames(substream->runtime, ptr);
 	if (ptr == substream->runtime->buffer_size)
 		ptr = 0;
-	return bytes_to_frames(substream->runtime, ptr);
+	return ptr;
 }
 
 static const struct snd_pcm_hardware snd_ice1712_playback_pro = {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 415d555e6b398b00fc1733f0113065a54df9106a upstream.

The recent fixups for HP laptops to support the mute LED made the speaker output silent on some machines. It turned out that they use the NID 0x18 for the speaker while it's also used for controlling the LED via VREF bits although the current driver code blindly assumes that such a node is a mic pin (where 0x18 is usually so).

This patch fixes the problem by only changing the VREF bits and keeping the other pin ctl bits.

---
 sound/pci/hda/patch_realtek.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -3212,8 +3212,9 @@ static void alc269_fixup_mic_mute_hook(v
 
 	if (spec->mute_led_polarity)
 		enabled = !enabled;
-	pinval = AC_PINCTL_IN_EN |
-		(enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80);
+	pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
+	pinval &= ~AC_PINCTL_VREFEN;
+	pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
 	if (spec->mute_led_nid)
 		snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
 }

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kailang Yang <[email protected]>

commit 7c66593286bcd153e4868383e675673a27071bd5 upstream.

---
 sound/pci/hda/patch_realtek.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -4708,6 +4708,7 @@ static int patch_alc269(struct hda_codec
 		spec->codec_variant = ALC269_TYPE_ALC285;
 		break;
 	case 0x10ec0286:
+	case 0x10ec0288:
 		spec->codec_variant = ALC269_TYPE_ALC286;
 		break;
 	case 0x10ec0255:

@@ -5514,6 +5515,7 @@ static const struct hda_codec_preset snd
 	{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
 	{ .id = 0x10ec0285, .name = "ALC285", .patch = patch_alc269 },
 	{ .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
+	{ .id = 0x10ec0288, .name = "ALC288", .patch = patch_alc269 },
 	{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
 	{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
 	{ .id = 0x10ec0293, .name = "ALC293", .patch = patch_alc269 },

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kailang Yang <[email protected]>

commit 8dc9abb93dde94e7f2bc719032fe16f5713df05c upstream.

---
 sound/pci/hda/patch_realtek.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -5275,6 +5275,8 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
 	SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_AUTO_MUTE),
+	SND_PCI_QUIRK(0x1028, 0x0696, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
 	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
 	SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lv Zheng <[email protected]>

commit 61db45ca21630f5ab7f678d54c5d969c21647854 upstream.

The original code was lost accidently, it was not generated along with the following commit of mechanism improvements and thus not get merged:

Commit: d5a36100f62fa6db5541344e08b361b34e9114c5
Subject: ACPICA: Add mechanism for early object repairs on a per-name basis

Adds the framework to allow object repairs very early in the return object analysis. Enables repairs like string->unicode, etc.

This patch restores the implementation of the NULL element repair code for ACPI_RTYPE_NONE. In the original design, ACPI_RTYPE_NONE is defined to collect simple NULL object repairs.
Lv Zheng.

---
 drivers/acpi/acpica/nsrepair.c |   25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

@@ -207,13 +207,30 @@ acpi_ns_simple_repair(struct acpi_evalua
 	 * this predefined name. Either one return value is expected, or none,
 	 * for both methods and other objects.
 	 *
-	 * Exit now if there is no return object. Warning if one was expected.
+	 * Try to fix if there was no return object. Warning if failed to fix.
 	 */
 	if (!return_object) {
 		if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
-			ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
-					      ACPI_WARN_ALWAYS,
-					      "Missing expected return value"));
+			if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+				ACPI_WARN_PREDEFINED((AE_INFO,
+						      info->full_pathname,
+						      ACPI_WARN_ALWAYS,
+						      "Found unexpected NULL package element"));
+
+				status =
+				    acpi_ns_repair_null_element(info,
+								expected_btypes,
+								package_index,
+								return_object_ptr);
+				if (ACPI_SUCCESS(status)) {
+					return (AE_OK);	/* Repair was successful */
+				}
+			} else {
+				ACPI_WARN_PREDEFINED((AE_INFO,
+						      info->full_pathname,
+						      ACPI_WARN_ALWAYS,
+						      "Missing expected return value"));
+			}
 
 			return (AE_AML_NO_RETURN_VALUE);
 		}

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email protected]>

commit 12f6dd860cf8bf036c0bec38c00a53da71bcd43a upstream.

Wolfram Sang pointed out that "efm32,$device" is non-standard. So use the common scheme and prefix device with "efm32-". The old compatible string is left in place until arch/arm/boot/dts/efm32* is fixed.

---
 Documentation/devicetree/bindings/spi/efm32-spi.txt |    4 ++--
 drivers/spi/spi-efm32.c                             |    3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

@@ -3,7 +3,7 @@
 Required properties:
 - #address-cells: see spi-bus.txt
 - #size-cells: see spi-bus.txt
-- compatible: should be "efm32,spi"
+- compatible: should be "energymicro,efm32-spi"
 - reg: Offset and length of the register set for the controller
 - interrupts: pair specifying rx and tx irq
 - clocks: phandle to the spi clock

@@ -15,7 +15,7 @@ Example:
 spi1: spi@0x4000c400 { /* USART1 */
 	#address-cells = <1>;
 	#size-cells = <0>;
-	compatible = "efm32,spi";
+	compatible = "energymicro,efm32-spi";
 	reg = <0x4000c400 0x400>;
 	interrupts = <15 16>;
 	clocks = <&cmu 20>;

@@ -487,6 +487,9 @@ static int efm32_spi_remove(struct platf
 
 static const struct of_device_id efm32_spi_dt_ids[] = {
 	{
+		.compatible = "energymicro,efm32-spi",
+	}, {
+		/* doesn't follow the "vendor,device" scheme, don't use */
 		.compatible = "efm32,spi",
 	}, {
 		/* sentinel */

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Axel Lin <[email protected]>

commit c63f5da00845143de621e991ea186be0829647ee upstream.

With devm_kzalloc, the memory is automatically freed when spi_device detach from the bus.

---
 drivers/spi/spi-dw.c |    7 -------
 1 file changed, 7 deletions(-)

@@ -671,12 +671,6 @@ static int dw_spi_setup(struct spi_devic
 	return 0;
 }
 
-static void dw_spi_cleanup(struct spi_device *spi)
-{
-	struct chip_data *chip = spi_get_ctldata(spi);
-	kfree(chip);
-}
-
 static int init_queue(struct dw_spi *dws)
 {
 	INIT_LIST_HEAD(&dws->queue);

@@ -806,7 +800,6 @@ int dw_spi_add_host(struct device *dev,
 	master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
 	master->bus_num = dws->bus_num;
 	master->num_chipselect = dws->num_cs;
-	master->cleanup = dw_spi_cleanup;
 	master->setup = dw_spi_setup;
 	master->transfer = dw_spi_transfer;
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Ott <[email protected]>

commit 2253e8d79237c69086ded391e6767afe16972527 upstream.

ccw consoles are in use before they can be properly registered with the driver core. For devices which are in use by a device driver we rely on the ccw_device's pointer to the driver callbacks to be valid. For ccw consoles this pointer is NULL until they are registered later during boot and we dereferenced this pointer. This worked by chance on 64 bit builds (cdev->drv was NULL but the optional callback cdev->drv->path_event was also NULL by coincidence) and was unnoticed until we received reports about boot failures on 31 bit systems. Fix it by initializing the driver pointer for ccw consoles.

---
 arch/s390/include/asm/ccwdev.h |    2 +-
 drivers/s390/char/con3215.c    |    2 +-
 drivers/s390/char/con3270.c    |    6 +-----
 drivers/s390/char/raw3270.c    |   10 +++++++++-
 drivers/s390/char/raw3270.h    |    2 +-
 drivers/s390/cio/device.c      |    3 ++-
 6 files changed, 15 insertions(+), 10 deletions(-)

@@ -219,7 +219,7 @@ extern void ccw_device_get_id(struct ccw
 #define to_ccwdev(n) container_of(n, struct ccw_device, dev)
 #define to_ccwdrv(n) container_of(n, struct ccw_driver, driver)
 
-extern struct ccw_device *ccw_device_probe_console(void);
+extern struct ccw_device *ccw_device_probe_console(struct ccw_driver *);
 extern void ccw_device_wait_idle(struct ccw_device *);
 extern int ccw_device_force_console(struct ccw_device *);
 

@@ -922,7 +922,7 @@ static int __init con3215_init(void)
 		raw3215_freelist = req;
 	}
 
-	cdev = ccw_device_probe_console();
+	cdev = ccw_device_probe_console(&raw3215_ccw_driver);
 	if (IS_ERR(cdev))
 		return -ENODEV;
 

@@ -576,7 +576,6 @@ static struct console con3270 = {
 static int __init
 con3270_init(void)
 {
-	struct ccw_device *cdev;
 	struct raw3270 *rp;
 	void *cbuf;
 	int i;

@@ -591,10 +590,7 @@ con3270_init(void)
 		cpcmd("TERM AUTOCR OFF", NULL, 0, NULL);
 	}
 
-	cdev = ccw_device_probe_console();
-	if (IS_ERR(cdev))
-		return -ENODEV;
-	rp = raw3270_setup_console(cdev);
+	rp = raw3270_setup_console();
 	if (IS_ERR(rp))
 		return PTR_ERR(rp);
 

@@ -776,16 +776,24 @@ raw3270_setup_device(struct ccw_device *
 }
 
 #ifdef CONFIG_TN3270_CONSOLE
+/* Tentative definition - see below for actual definition. */
+static struct ccw_driver raw3270_ccw_driver;
+
 /*
  * Setup 3270 device configured as console.
  */
-struct raw3270 __init *raw3270_setup_console(struct ccw_device *cdev)
+struct raw3270 __init *raw3270_setup_console(void)
 {
+	struct ccw_device *cdev;
 	unsigned long flags;
 	struct raw3270 *rp;
 	char *ascebc;
 	int rc;
 
+	cdev = ccw_device_probe_console(&raw3270_ccw_driver);
+	if (IS_ERR(cdev))
+		return ERR_CAST(cdev);
+
 	rp = kzalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA);
 	ascebc = kzalloc(256, GFP_KERNEL);
 	rc = raw3270_setup_device(cdev, rp, ascebc);

@@ -190,7 +190,7 @@ raw3270_put_view(struct raw3270_view *vi
 		wake_up(&raw3270_wait_queue);
 }
 
-struct raw3270 *raw3270_setup_console(struct ccw_device *cdev);
+struct raw3270 *raw3270_setup_console(void);
 void raw3270_wait_cons_dev(struct raw3270 *);
 
 /* Notifier for device addition/removal */

@@ -1609,7 +1609,7 @@ out_unlock:
 	return rc;
 }
 
-struct ccw_device *ccw_device_probe_console(void)
+struct ccw_device *ccw_device_probe_console(struct ccw_driver *drv)
 {
 	struct io_subchannel_private *io_priv;
 	struct ccw_device *cdev;

@@ -1631,6 +1631,7 @@ struct ccw_device *ccw_device_probe_cons
 		kfree(io_priv);
 		return cdev;
 	}
+	cdev->drv = drv;
 	set_io_private(sch, io_priv);
 	ret = ccw_device_console_enable(cdev, sch);
 	if (ret) {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <[email protected]>

commit 2955c83f72801245afd0fe5c560cc75b82bea9aa upstream.

Since commit 7c470539c95630c1f2a10f109e96f249730b75eb (s390/kvm: avoid automatic sie reentry) we will run through the C code of KVM on host interrupts instead of just reentering the guest. This will result in additional ucontrol exits (at least HZ per second). Let handle a 0 intercept in the kernel and dont return to userspace, even if in ucontrol mode.

---
 arch/s390/kvm/kvm-s390.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -753,7 +753,8 @@ static int vcpu_post_run(struct kvm_vcpu
 
 	if (rc == 0) {
 		if (kvm_is_ucontrol(vcpu->kvm))
-			rc = -EOPNOTSUPP;
+			/* Don't exit for host interrupts. */
+			rc = vcpu->arch.sie_block->icptcode ? -EOPNOTSUPP : 0;
 		else
 			rc = kvm_handle_sie_intercept(vcpu);
 	}

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit 0ccc8b7ac86053388e793bad20bd26bd777752eb upstream.

When reworking the bitops and atomic ops I missed that those instructions that got atomic behaviour only perform a "specific-operand-serialization" instead of a full "serialization".
The compare-and-swap instruction used before performs a full serialization before and after the instruction is executed, which means it has full memory barrier semantics.
In order to give the new bitops and atomic ops functions also full memory barrier semantics add a "bcr 14,0" before and after each of those new instructions which performs full serialization as well.

This restores memory barrier semantics for bitops and atomic ops functions which return values, like e.g. atomic_add_return(), but not for functions which do not return a value, like e.g. atomic_add().
This is consistent to other architectures and what common code requires.

---
 arch/s390/include/asm/atomic.h |   70 ++++++++++++++++++++++++-----------------
 arch/s390/include/asm/bitops.h |   41 +++++++++++++-----------
 2 files changed, 65 insertions(+), 46 deletions(-)

@@ -15,23 +15,29 @@
 
 #include <linux/compiler.h>
 #include <linux/types.h>
+#include <asm/barrier.h>
 #include <asm/cmpxchg.h>
 
 #define ATOMIC_INIT(i)  { (i) }
 
+#define __ATOMIC_NO_BARRIER	"\n"
+
 #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
 
 #define __ATOMIC_OR	"lao"
 #define __ATOMIC_AND	"lan"
 #define __ATOMIC_ADD	"laa"
+#define __ATOMIC_BARRIER "bcr	14,0\n"
 
-#define __ATOMIC_LOOP(ptr, op_val, op_string)				\
+#define __ATOMIC_LOOP(ptr, op_val, op_string, __barrier)		\
 ({									\
 	int old_val;							\
 									\
 	typecheck(atomic_t *, ptr);					\
 	asm volatile(							\
+		__barrier						\
 		op_string "	%0,%2,%1\n"				\
+		__barrier						\
 		: "=d" (old_val), "+Q" ((ptr)->counter)			\
 		: "d" (op_val)						\
 		: "cc", "memory");					\

@@ -43,8 +49,9 @@
 #define __ATOMIC_OR	"or"
 #define __ATOMIC_AND	"nr"
 #define __ATOMIC_ADD	"ar"
+#define __ATOMIC_BARRIER "\n"
 
-#define __ATOMIC_LOOP(ptr, op_val, op_string)				\
+#define __ATOMIC_LOOP(ptr, op_val, op_string, __barrier)		\
 ({									\
 	int old_val, new_val;						\
 									\

@@ -82,7 +89,7 @@ static inline void atomic_set(atomic_t *
 
 static inline int atomic_add_return(int i, atomic_t *v)
 {
-	return __ATOMIC_LOOP(v, i, __ATOMIC_ADD) + i;
+	return __ATOMIC_LOOP(v, i, __ATOMIC_ADD, __ATOMIC_BARRIER) + i;
 }
 
 static inline void atomic_add(int i, atomic_t *v)

@@ -94,12 +101,10 @@ static inline void atomic_add(int i, ato
 			: "+Q" (v->counter)
 			: "i" (i)
 			: "cc", "memory");
-	} else {
-		atomic_add_return(i, v);
+		return;
 	}
-#else
-	atomic_add_return(i, v);
 #endif
+	__ATOMIC_LOOP(v, i, __ATOMIC_ADD, __ATOMIC_NO_BARRIER);
 }
 
 #define atomic_add_negative(_i, _v)	(atomic_add_return(_i, _v) < 0)

@@ -115,12 +120,12 @@ static inline void atomic_add(int i, ato
 
 static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
 {
-	__ATOMIC_LOOP(v, ~mask, __ATOMIC_AND);
+	__ATOMIC_LOOP(v, ~mask, __ATOMIC_AND, __ATOMIC_NO_BARRIER);
 }
 
 static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
 {
-	__ATOMIC_LOOP(v, mask, __ATOMIC_OR);
+	__ATOMIC_LOOP(v, mask, __ATOMIC_OR, __ATOMIC_NO_BARRIER);
 }
 
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))

@@ -157,19 +162,24 @@ static inline int __atomic_add_unless(at
 
 #ifdef CONFIG_64BIT
 
+#define __ATOMIC64_NO_BARRIER	"\n"
+
 #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
 
 #define __ATOMIC64_OR	"laog"
 #define __ATOMIC64_AND	"lang"
 #define __ATOMIC64_ADD	"laag"
+#define __ATOMIC64_BARRIER "bcr	14,0\n"
 
-#define __ATOMIC64_LOOP(ptr, op_val, op_string)				\
+#define __ATOMIC64_LOOP(ptr, op_val, op_string, __barrier)		\
 ({									\
 	long long old_val;						\
 									\
 	typecheck(atomic64_t *, ptr);					\
 	asm volatile(							\
+		__barrier						\
 		op_string "	%0,%2,%1\n"				\
+		__barrier						\
 		: "=d" (old_val), "+Q" ((ptr)->counter)			\
 		: "d" (op_val)						\
 		: "cc", "memory");					\

@@ -181,8 +191,9 @@ static inline int __atomic_add_unless(at
 #define __ATOMIC64_OR	"ogr"
 #define __ATOMIC64_AND	"ngr"
 #define __ATOMIC64_ADD	"agr"
+#define __ATOMIC64_BARRIER "\n"
 
-#define __ATOMIC64_LOOP(ptr, op_val, op_string)				\
+#define __ATOMIC64_LOOP(ptr, op_val, op_string, __barrier)		\
 ({									\
 	long long old_val, new_val;					\
 									\

@@ -220,17 +231,32 @@ static inline void atomic64_set(atomic64
 
 static inline long long atomic64_add_return(long long i, atomic64_t *v)
 {
-	return __ATOMIC64_LOOP(v, i, __ATOMIC64_ADD) + i;
+	return __ATOMIC64_LOOP(v, i, __ATOMIC64_ADD, __ATOMIC64_BARRIER) + i;
+}
+
+static inline void atomic64_add(long long i, atomic64_t *v)
+{
+#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+	if (__builtin_constant_p(i) && (i > -129) && (i < 128)) {
+		asm volatile(
+			"agsi	%0,%1\n"
+			: "+Q" (v->counter)
+			: "i" (i)
+			: "cc", "memory");
+		return;
+	}
+#endif
+	__ATOMIC64_LOOP(v, i, __ATOMIC64_ADD, __ATOMIC64_NO_BARRIER);
 }
 
 static inline void atomic64_clear_mask(unsigned long mask, atomic64_t *v)
 {
-	__ATOMIC64_LOOP(v, ~mask, __ATOMIC64_AND);
+	__ATOMIC64_LOOP(v, ~mask, __ATOMIC64_AND, __ATOMIC64_NO_BARRIER);
 }
 
 static inline void atomic64_set_mask(unsigned long mask, atomic64_t *v)
 {
-	__ATOMIC64_LOOP(v, mask, __ATOMIC64_OR);
+	__ATOMIC64_LOOP(v, mask, __ATOMIC64_OR, __ATOMIC64_NO_BARRIER);
 }
 
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))

@@ -334,25 +360,13 @@ static inline void atomic64_clear_mask(u
 	} while (atomic64_cmpxchg(v, old, new) != old);
 }
 
-#endif /* CONFIG_64BIT */
-
 static inline void atomic64_add(long long i, atomic64_t *v)
 {
-#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
-	if (__builtin_constant_p(i) && (i > -129) && (i < 128)) {
-		asm volatile(
-			"agsi	%0,%1\n"
-			: "+Q" (v->counter)
-			: "i" (i)
-			: "cc", "memory");
-	} else {
-		atomic64_add_return(i, v);
-	}
-#else
 	atomic64_add_return(i, v);
-#endif
 }
 
+#endif /* CONFIG_64BIT */
+
 static inline int atomic64_add_unless(atomic64_t *v, long long i, long long u)
 {
 	long long c, old;

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <[email protected]>

commit a8a934e44f2bd0ed613e1aa0471e3478c6a9228a upstream.

The git commit c63badebfebacdba827ab1cc1d420fc81bd8d818 "s390: optimize control register update" broke the update for control register 0. After the update do the lctlg from the correct value.

---
 arch/s390/kernel/ptrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -64,7 +64,7 @@ void update_cr_regs(struct task_struct *
 		if (task->thread.per_flags & PER_FLAG_NO_TE)
 			cr_new &= ~(1UL << 55);
 		if (cr_new != cr)
-			__ctl_load(cr, 0, 0);
+			__ctl_load(cr_new, 0, 0);
 		/* Set or clear transaction execution TDC bits 62 and 63. */
 		__ctl_store(cr, 2, 2);
 		cr_new = cr & ~3UL;

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomas Winkler <[email protected]>

commit cc99ecfdac01215594c73907726b12f251c21e20 upstream.

Write callbacks are released on the write completed path but when file handler is closed before the writes are completed those are left dangling on write and write_waiting queues.

We add mei_io_list_free function to perform this task

Also move static functions to client.c form client.h

---
 drivers/misc/mei/client.c |   76 +++++++++++++++++++++++++++++++++-------------
 drivers/misc/mei/client.h |   18 ----------
 2 files changed, 55 insertions(+), 39 deletions(-)

@@ -74,23 +74,69 @@ int mei_me_cl_by_id(struct mei_device *d
 
 
 /**
- * mei_io_list_flush - removes list entry belonging to cl.
+ * mei_cl_cmp_id - tells if the clients are the same
  *
- * @list:  An instance of our list structure
- * @cl: host client
+ * @cl1: host client 1
+ * @cl2: host client 2
+ *
+ * returns true  - if the clients has same host and me ids
+ *         false - otherwise
+ */
+static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
+				const struct mei_cl *cl2)
+{
+	return cl1 && cl2 &&
+		(cl1->host_client_id == cl2->host_client_id) &&
+		(cl1->me_client_id == cl2->me_client_id);
+}
+
+/**
+ * mei_io_list_flush - removes cbs belonging to cl.
+ *
+ * @list:  an instance of our list structure
+ * @cl:    host client, can be NULL for flushing the whole list
+ * @free:  whether to free the cbs
  */
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+static void __mei_io_list_flush(struct mei_cl_cb *list,
+				struct mei_cl *cl, bool free)
 {
 	struct mei_cl_cb *cb;
 	struct mei_cl_cb *next;
 
+	/* enable removing everything if no cl is specified */
 	list_for_each_entry_safe(cb, next, &list->list, list) {
-		if (cb->cl && mei_cl_cmp_id(cl, cb->cl))
+		if (!cl || (cb->cl && mei_cl_cmp_id(cl, cb->cl))) {
 			list_del(&cb->list);
+			if (free)
+				mei_io_cb_free(cb);
+		}
 	}
 }
 
 /**
+ * mei_io_list_flush - removes list entry belonging to cl.
+ *
+ * @list:  An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+	__mei_io_list_flush(list, cl, false);
+}
+
+
+/**
+ * mei_io_list_free - removes cb belonging to cl and free them
+ *
+ * @list:  An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_free(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+	__mei_io_list_flush(list, cl, true);
+}
+
+/**
  * mei_io_cb_free - free mei_cb_private related memory
  *
  * @cb: mei callback struct

@@ -196,8 +242,8 @@ int mei_cl_flush_queues(struct mei_cl *c
 
 	cl_dbg(dev, cl, "remove list entry belonging to cl\n");
 	mei_io_list_flush(&cl->dev->read_list, cl);
-	mei_io_list_flush(&cl->dev->write_list, cl);
-	mei_io_list_flush(&cl->dev->write_waiting_list, cl);
+	mei_io_list_free(&cl->dev->write_list, cl);
+	mei_io_list_free(&cl->dev->write_waiting_list, cl);
 	mei_io_list_flush(&cl->dev->ctrl_wr_list, cl);
 	mei_io_list_flush(&cl->dev->ctrl_rd_list, cl);
 	mei_io_list_flush(&cl->dev->amthif_cmd_list, cl);

@@ -942,20 +988,8 @@ void mei_cl_all_wakeup(struct mei_device
  */
 void mei_cl_all_write_clear(struct mei_device *dev)
 {
-	struct mei_cl_cb *cb, *next;
-	struct list_head *list;
-
-	list = &dev->write_list.list;
-	list_for_each_entry_safe(cb, next, list, list) {
-		list_del(&cb->list);
-		mei_io_cb_free(cb);
-	}
-
-	list = &dev->write_waiting_list.list;
-	list_for_each_entry_safe(cb, next, list, list) {
-		list_del(&cb->list);
-		mei_io_cb_free(cb);
-	}
+	mei_io_list_free(&dev->write_list, NULL);
+	mei_io_list_free(&dev->write_waiting_list, NULL);
 }
 
 

@@ -45,8 +45,6 @@ static inline void mei_io_list_init(stru
 {
 	INIT_LIST_HEAD(&list->list);
 }
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl);
-
 /*
  * MEI Host Client Functions
  */

@@ -61,22 +59,6 @@ int mei_cl_unlink(struct mei_cl *cl);
 int mei_cl_flush_queues(struct mei_cl *cl);
 struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl);
 
-/**
- * mei_cl_cmp_id - tells if file private data have same id
- *
- * @fe1: private data of 1. file object
- * @fe2: private data of 2. file object
- *
- * returns true  - if ids are the same and not NULL
- */
-static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
-				const struct mei_cl *cl2)
-{
-	return cl1 && cl2 &&
-		(cl1->host_client_id == cl2->host_client_id) &&
-		(cl1->me_client_id == cl2->me_client_id);
-}
-
 
 int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomas Winkler <[email protected]>

commit 5e6533a6f52f1a8283b2f818f5828be99a417dd6 upstream.

NM and SPS FW types that may run on ME device on server platforms do not have valid MEI/HECI interface and driver should not be bound to it as this might lead to system hung.
In practice not all BIOSes effectively hide such devices from the OS and in some cases it is not possible.

We determine FW type by examining Host FW status registers in order to unbind the driver.
In this patch we are adding check for ME on Cougar Point, Lynx Point Devices

---
 drivers/misc/mei/hw-me-regs.h |    5 +++++
 drivers/misc/mei/pci-me.c     |   30 +++++++++++++++++++++++-------
 2 files changed, 28 insertions(+), 7 deletions(-)

@@ -115,6 +115,11 @@
 #define MEI_DEV_ID_LPT_HR     0x8CBA  /* Lynx Point H Refresh */
 
 #define MEI_DEV_ID_WPT_LP     0x9CBA  /* Wildcat Point LP */
+
+/* Host Firmware Status Registers in PCI Config Space */
+#define PCI_CFG_HFS_1         0x40
+#define PCI_CFG_HFS_2         0x48
+
 /*
  * MEI HW Section
  */

@@ -100,15 +100,31 @@ static bool mei_me_quirk_probe(struct pc
 				const struct pci_device_id *ent)
 {
 	u32 reg;
-	if (ent->device == MEI_DEV_ID_PBG_1) {
-		pci_read_config_dword(pdev, 0x48, &reg);
-		/* make sure that bit 9 is up and bit 10 is down */
-		if ((reg & 0x600) == 0x200) {
-			dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
-			return false;
-		}
+	/* Cougar Point || Patsburg */
+	if (ent->device == MEI_DEV_ID_CPT_1 ||
+	    ent->device == MEI_DEV_ID_PBG_1) {
+		pci_read_config_dword(pdev, PCI_CFG_HFS_2, &reg);
+		/* make sure that bit 9 (NM) is up and bit 10 (DM) is down */
+		if ((reg & 0x600) == 0x200)
+			goto no_mei;
 	}
+
+	/* Lynx Point */
+	if (ent->device == MEI_DEV_ID_LPT_H  ||
+	    ent->device == MEI_DEV_ID_LPT_W  ||
+	    ent->device == MEI_DEV_ID_LPT_HR) {
+		/* Read ME FW Status check for SPS Firmware */
+		pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+		/* if bits [19:16] = 15, running SPS Firmware */
+		if ((reg & 0xf0000) == 0xf0000)
+			goto no_mei;
+	}
+
 	return true;
+
+no_mei:
+	dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+	return false;
 }
 /**
  * mei_probe - Device Initialization Routine

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Usyskin <[email protected]>

commit 34ec43661fe8f1977dd0f05353302ae2ed10aabb upstream.

Ignore client writing state during cb completion to fix a memory leak.

When moving cbs to the completion list we should not look at writing_state as this state can be already overwritten by next write, the fact that a cb is on the write waiting list means that it was already written to the HW and we can safely complete it.

Same pays for wait in poll handler, we do not have to check the state wake is done after completion list processing.

---
 drivers/misc/mei/interrupt.c |    3 +--
 drivers/misc/mei/main.c      |    3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

@@ -428,8 +428,7 @@ int mei_irq_write_handler(struct mei_dev
 
 		cl->status = 0;
 		list_del(&cb->list);
-		if (MEI_WRITING == cl->writing_state &&
-		    cb->fop_type == MEI_FOP_WRITE &&
+		if (cb->fop_type == MEI_FOP_WRITE &&
 		    cl != &dev->iamthif_cl) {
 			cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
 			cl->writing_state = MEI_WRITE_COMPLETE;

@@ -653,8 +653,7 @@ static unsigned int mei_poll(struct file
 		goto out;
 	}
 
-	if (MEI_WRITE_COMPLETE == cl->writing_state)
-		mask |= (POLLIN | POLLRDNORM);
+	mask |= (POLLIN | POLLRDNORM);
 
 out:
 	mutex_unlock(&dev->device_lock);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 65aba1e04916d72b30c028730a1e31860c225412 upstream.

During probe the sec-core driver allocates dummy I2C device for RTC with i2c_new_dummy() but return value is not checked. In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by devm_regmap_init_i2c() or i2c_unregister_device().

If i2c_new_dummy() fails for RTC device, fail also the probe for main MFD driver.

---
 drivers/mfd/sec-core.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -252,6 +252,10 @@ static int sec_pmic_probe(struct i2c_cli
 	}
 
 	sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+	if (!sec_pmic->rtc) {
+		dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
 
 	sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc,

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream.

During probe the driver allocates dummy I2C device for companion chip with i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by regmap_init_i2c().

If i2c_new_dummy() fails for companion device, fail also the probe for main MFD driver.

---
 drivers/mfd/88pm860x-core.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_clien
 		chip->companion_addr = pdata->companion_addr;
 		chip->companion = i2c_new_dummy(chip->client->adapter,
 						chip->companion_addr);
+		if (!chip->companion) {
+			dev_err(&client->dev,
+				"Failed to allocate I2C companion device\n");
+			return -ENODEV;
+		}
 		chip->regmap_companion = regmap_init_i2c(chip->companion,
 							&pm860x_regmap_config);
 		if (IS_ERR(chip->regmap_companion)) {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit a7ab1c8b261305af583ce26bb4a14f555fdaa73e upstream.

During probe the driver allocates dummy I2C device for companion chip and then allocates a regmap for it. If regmap_init_i2c() fails then the I2C driver (allocated with i2c_new_dummy()) is not freed and this resource leaks.

---
 drivers/mfd/88pm860x-core.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_clien
 			ret = PTR_ERR(chip->regmap_companion);
 			dev_err(&chip->companion->dev,
 				"Failed to allocate register map: %d\n", ret);
+			i2c_unregister_device(chip->companion);
 			return ret;
 		}
 		i2c_set_clientdata(chip->companion, chip);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 141050cf3d84fc303df58796d68dc1376b0e8f67 upstream.

During probe the driver allocates two dummy I2C devices for subchips in function pm800_pages_init(). Additionally this function allocates regmaps for these subchips. If any of these steps fail then these dummy I2C devices are not freed and resources leak.

On pm800_pages_init() fail the driver must call pm800_pages_exit() to unregister dummy I2C devices.

---
 drivers/mfd/88pm800.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -571,7 +571,7 @@ static int pm800_probe(struct i2c_client
 	ret = pm800_pages_init(chip);
 	if (ret) {
 		dev_err(&client->dev, "pm800_pages_init failed!\n");
-		goto err_page_init;
+		goto err_device_init;
 	}
 
 	ret = device_800_init(chip, pdata);

@@ -587,7 +587,6 @@ static int pm800_probe(struct i2c_client
 
 err_device_init:
 	pm800_pages_exit(chip);
-err_page_init:
 err_subchip_alloc:
 	pm80x_deinit();
 out_init:

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit b9e183a1d495cd65412abe0f9df19b151716bfe7 upstream.

During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by i2c_unregister_device().

If i2c_new_dummy() fails for RTC device, fail also the probe for main MFD driver.

---
 drivers/mfd/max77686.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c
 		dev_info(max77686->dev, "device found\n");
 
 	max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+	if (!max77686->rtc) {
+		dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max77686->rtc, max77686);
 
 	max77686_irq_init(max77686);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit ad09dd6a1f5d6244bd89314015af506ba7f9810a upstream.

During probe the driver allocates dummy I2C devices for MUIC and haptic with i2c_new_dummy() but it does not check the return value of this calls.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by devm_regmap_init_i2c() and i2c_unregister_device().

If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe for main MFD driver.

---
 drivers/mfd/max77693.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

@@ -148,9 +148,18 @@ static int max77693_i2c_probe(struct i2c
 		dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
 
 	max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+	if (!max77693->muic) {
+		dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max77693->muic, max77693);
 
 	max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+	if (!max77693->haptic) {
+		dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n");
+		ret = -ENODEV;
+		goto err_i2c_haptic;
+	}
 	i2c_set_clientdata(max77693->haptic, max77693);
 
 	/*

@@ -184,8 +193,9 @@ err_mfd:
 	max77693_irq_exit(max77693);
 err_irq:
 err_regmap_muic:
-	i2c_unregister_device(max77693->muic);
 	i2c_unregister_device(max77693->haptic);
+err_i2c_haptic:
+	i2c_unregister_device(max77693->muic);
 	return ret;
 }
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream.

During probe the driver allocates dummy I2C devices for RTC and ADC with i2c_new_dummy() but it does not check the return value of this calls.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by i2c_unregister_device().

If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe for main MFD driver.

---
 drivers/mfd/max8925-i2c.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_clie
 	mutex_init(&chip->io_lock);
 
 	chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR);
+	if (!chip->rtc) {
+		dev_err(chip->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(chip->rtc, chip);
 
 	chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR);
+	if (!chip->adc) {
+		dev_err(chip->dev, "Failed to allocate I2C device for ADC\n");
+		i2c_unregister_device(chip->rtc);
+		return -ENODEV;
+	}
 	i2c_set_clientdata(chip->adc, chip);
 
 	device_init_wakeup(&client->dev, 1);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream.

During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by i2c_unregister_device().

If i2c_new_dummy() fails for RTC device, fail also the probe for main MFD driver.

---
 drivers/mfd/max8998.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_
 	mutex_init(&max8998->iolock);
 
 	max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+	if (!max8998->rtc) {
+		dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max8998->rtc, max8998);
 
 	max8998_irq_init(max8998);

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream.

During probe the driver allocates dummy I2C devices for RTC, haptic and MUIC with i2c_new_dummy() but it does not check the return value of this calls.

In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later used by i2c_unregister_device().

If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the probe for main MFD driver.

---
 drivers/mfd/max8997.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

@@ -208,10 +208,26 @@ static int max8997_i2c_probe(struct i2c_
 	mutex_init(&max8997->iolock);
 
 	max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+	if (!max8997->rtc) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max8997->rtc, max8997);
+
 	max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+	if (!max8997->haptic) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n");
+		ret = -ENODEV;
+		goto err_i2c_haptic;
+	}
 	i2c_set_clientdata(max8997->haptic, max8997);
+
 	max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+	if (!max8997->muic) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n");
+		ret = -ENODEV;
+		goto err_i2c_muic;
+	}
 	i2c_set_clientdata(max8997->muic, max8997);
 
 	pm_runtime_set_active(max8997->dev);

@@ -239,7 +255,9 @@ static int max8997_i2c_probe(struct i2c_
 err_mfd:
 	mfd_remove_devices(max8997->dev);
 	i2c_unregister_device(max8997->muic);
+err_i2c_muic:
 	i2c_unregister_device(max8997->haptic);
+err_i2c_haptic:
 	i2c_unregister_device(max8997->rtc);
 	return ret;
 }

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.

tps65910_irq_init() sets 'tps65910->chip_irq' before calling regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in memory allocation of regmap_irq_chip_data members then:

1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory (because regmap_add_irq_chip() will free it on error)

This results in invalid memory access during driver remove because the tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.

---
 drivers/mfd/tps65910.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -255,8 +255,10 @@ static int tps65910_irq_init(struct tps6
 	ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq,
 		IRQF_ONESHOT, pdata->irq_base,
 		tps6591x_irqs_chip, &tps65910->irq_data);
-	if (ret < 0)
+	if (ret < 0) {
 		dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret);
+		tps65910->chip_irq = 0;
+	}
 	return ret;
 }
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit 204747c970c0d568721c76ab8a57dde0e5dcf0d5 upstream.

On PXT and COMe-cPC2 boards it is observed that the hardware mutex is acquired but not being released during initialization. This can result in a hang-up during boot if the driver is built into the kernel.

Releasing the mutex twice if it was acquired fixes the problem. Subsequent request/release cycles work as expected, so the fix is only needed during initialization.

---
 drivers/mfd/kempld-core.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -322,9 +322,12 @@ static int kempld_detect_device(struct k
 		return -ENODEV;
 	}
 
-	/* Release hardware mutex if aquired */
-	if (!(index_reg & KEMPLD_MUTEX_KEY))
+	/* Release hardware mutex if acquired */
+	if (!(index_reg & KEMPLD_MUTEX_KEY)) {
 		iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+		/* PXT and COMe-cPC2 boards may require a second release */
+		iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+	}
 
 	mutex_unlock(&pld->lock);
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomas Novotny <[email protected]>

commit 56816b700c8c773270f3aaf4c92be53e359a03fd upstream.

There are some unused registers in twl4030 at I2C address 0x49 and function twl4030_49_nop_reg() is used to check accessibility of that registers. These registers are written in decimal format but the values are correct in hexadecimal format. (It can be checked few lines above the patched code - these registers are marked as unused there.)

As a consequence three registers of audio submodule are treated as inaccessible (preamplifier carkit right and both handsfree registers).

---
 drivers/mfd/twl-core.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -282,11 +282,11 @@ static struct reg_default twl4030_49_def
 static bool twl4030_49_nop_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
-	case 0:
-	case 3:
-	case 40:
-	case 41:
-	case 42:
+	case 0x00:
+	case 0x03:
+	case 0x40:
+	case 0x41:
+	case 0x42:
 		return false;
 	default:
 		return true;

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Fries <[email protected]>

commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.

Previous logic,

if (avail > 8) {
	store slave;
	return;
}

send data; clear;

The logic error is, if there isn't space send the buffer and clear, but the slave wasn't added to the now empty buffer loosing that slave id. It also should have been "if (avail >= 8)" because when it is 8, there is space.

Instead, if there isn't space send and clear the buffer, then there is always space for the slave id.

---
 drivers/w1/w1_netlink.c |   27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_mast
 	struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1);
 	struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1);
 	int avail;
+	u64 *data;
 
 	/* update kernel slave list */
 	w1_slave_found(dev, rn);
 
 	avail = dev->priv_size - cmd->len;
 
-	if (avail > 8) {
-		u64 *data = (void *)(cmd + 1) + cmd->len;
-
-		*data = rn;
-		cmd->len += 8;
-		hdr->len += 8;
-		msg->len += 8;
-		return;
+	if (avail < 8) {
+		msg->ack++;
+		cn_netlink_send(msg, 0, GFP_KERNEL);
+
+		msg->len = sizeof(struct w1_netlink_msg) +
+			sizeof(struct w1_netlink_cmd);
+		hdr->len = sizeof(struct w1_netlink_cmd);
+		cmd->len = 0;
 	}
 
-	msg->ack++;
-	cn_netlink_send(msg, 0, GFP_KERNEL);
+	data = (void *)(cmd + 1) + cmd->len;
 
-	msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd);
-	hdr->len = sizeof(struct w1_netlink_cmd);
-	cmd->len = 0;
+	*data = rn;
+	cmd->len += 8;
+	hdr->len += 8;
+	msg->len += 8;
 }
 
 static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg,

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Himangi Saraogi <[email protected]>

commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.

This patch fixes the following sparse warning :
drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer

---
 drivers/staging/serqt_usb2/serqt_usb2.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -724,7 +724,7 @@ static int qt_startup(struct usb_serial
 		goto startup_error;
 	}
 
-	switch (serial->dev->descriptor.idProduct) {
+	switch (le16_to_cpu(serial->dev->descriptor.idProduct)) {
 	case QUATECH_DSU100:
 	case QUATECH_QSU100:
 	case QUATECH_ESU100A:

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Larry Finger <[email protected]>

commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.

Zero-initializing ether_type masked that the ether type would never be obtained for 8021x packets and the comparison against eapol_type would always fail.

---
 drivers/staging/rtl8712/rtl871x_recv.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct
 	struct sta_info *psta;
 	struct	sta_priv *pstapriv;
 	union recv_frame *prtnframe;
-	u16 ether_type = 0;
+	u16 ether_type;
 
 	pstapriv = &adapter->stapriv;
 	ptr = get_recvframe_data(precv_frame);

@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct
 	psta = r8712_get_stainfo(pstapriv, psta_addr);
 	auth_alg = adapter->securitypriv.AuthAlgrthm;
 	if (auth_alg == 2) {
+		/* get ether_type */
+		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+		memcpy(&ether_type, ptr, 2);
+		ether_type = ntohs((unsigned short)ether_type);
+
 		if ((psta != NULL) && (psta->ieee8021x_blocked)) {
 			/* blocked
 			 * only accept EAPOL frame */
-			prtnframe = precv_frame;
-			/*get ether_type */
-			ptr = ptr + pfhdr->attrib.hdrlen +
-			      pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
-			memcpy(&ether_type, ptr, 2);
-			ether_type = ntohs((unsigned short)ether_type);
 			if (ether_type == 0x888e)
 				prtnframe = precv_frame;
 			else {

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: H Hartley Sweeten <[email protected]>

commit 2704f807f9498054b8153002bafa3e818079e9a5 upstream.

In usbdux_ao_cmd(), the channels for the command are transfered from the cmd->chanlist and stored in the private data 'ao_chanlist'. The channel numbers are bit-shifted when stored so that they become the "command" that is transfered to the device. The channel to command conversion results in the 'ao_chanlist' having these values for the channels:

channel 0 -> ao_chanlist = 0x00
channel 1 -> ao_chanlist = 0x40
channel 2 -> ao_chanlist = 0x80
channel 3 -> ao_chanlist = 0xc0

The problem is, the usbduxsub_ao_isoc_irq() function uses the 'chan' value from 'ao_chanlist' to access the 'ao_readback' array in the private data. So instead of accessing the array as 0, 1, 2, 3, it accesses it as 0x00, 0x40, 0x80, 0xc0.

Fix this by storing the raw channel number in 'ao_chanlist' and doing the bit-shift when creating the command.

---
 drivers/staging/comedi/drivers/usbdux.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

@@ -493,7 +493,7 @@ static void usbduxsub_ao_isoc_irq(struct
 			/* pointer to the DA */
 			*datap++ = val & 0xff;
 			*datap++ = (val >> 8) & 0xff;
-			*datap++ = chan;
+			*datap++ = chan << 6;
 			devpriv->ao_readback[chan] = val;
 
 			s->async->events |= COMEDI_CB_BLOCK;

@@ -1040,11 +1040,8 @@ static int usbdux_ao_cmd(struct comedi_d
 	/* set current channel of the running acquisition to zero */
 	s->async->cur_chan = 0;
 
-	for (i = 0; i < cmd->chanlist_len; ++i) {
-		unsigned int chan = CR_CHAN(cmd->chanlist[i]);
-
-		devpriv->ao_chanlist[i] = chan << 6;
-	}
+	for (i = 0; i < cmd->chanlist_len; ++i)
+		devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
 
 	/* we count in steps of 1ms (125us) */
 	/* 125us mode not used yet */

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Larry Finger <[email protected]>

commit 9452bf560273e4de2395ffdd79024debfb0c1290 upstream.

This makes the follow-on check for psta != NULL pointless and makes the whole exercise rather pointless. This is another case of why blindly zero-initializing variables when they are declared is bad.

---
 drivers/staging/rtl8188eu/core/rtw_recv.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -542,7 +542,7 @@ _func_exit_;
 /* set the security information in the recv_frame */
 static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *precv_frame)
 {
-	u8   *psta_addr = NULL, *ptr;
+	u8   *psta_addr, *ptr;
 	uint  auth_alg;
 	struct recv_frame_hdr *pfhdr;
 	struct sta_info *psta;

@@ -556,7 +556,6 @@ static union recv_frame *portctrl(struct
 _func_enter_;
 
 	pstapriv = &adapter->stapriv;
-	psta = rtw_get_stainfo(pstapriv, psta_addr);
 
 	auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
 

@@ -564,6 +563,7 @@ _func_enter_;
 	pfhdr = &precv_frame->u.hdr;
 	pattrib = &pfhdr->attrib;
 	psta_addr = pattrib->ta;
+	psta = rtw_get_stainfo(pstapriv, psta_addr);
 
 	prtnframe = NULL;
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Beulich <[email protected]>

commit 06325190bd577e11429444d54f454b9d13f560c9 upstream.

Just like for other ISA extension instruction uses we should check whether the assembler actually supports them. The fallback here simply is to encode an instruction with fixed operands (%eax and %ecx).

[ hpa: tagging for -stable as a build fix ]

---
 arch/x86/Makefile   |    1 +
 arch/x86/lib/hash.c |    4 ++++
 2 files changed, 5 insertions(+)

@@ -152,6 +152,7 @@ cfi-sections := $(call as-instr,.cfi_sec
 
 # does binutils support specific instructions?
 asinstr := $(call as-instr,fxsaveq (%rax),-DCONFIG_AS_FXSAVEQ=1)
+asinstr += $(call as-instr,crc32l %eax$(comma)%eax,-DCONFIG_AS_CRC32=1)
 avx_instr := $(call as-instr,vxorps %ymm0$(comma)%ymm1$(comma)%ymm2,-DCONFIG_AS_AVX=1)
 avx2_instr :=$(call as-instr,vpbroadcastb %xmm0$(comma)%ymm1,-DCONFIG_AS_AVX2=1)
 

@@ -39,7 +39,11 @@
 
 static inline u32 crc32_u32(u32 crc, u32 val)
 {
+#ifdef CONFIG_AS_CRC32
 	asm ("crc32l %1,%0\n" : "+r" (crc) : "rm" (val));
+#else
+	asm (".byte 0xf2, 0x0f, 0x38, 0xf1, 0xc1" : "+a" (crc) : "c" (val));
+#endif
 	return crc;
 }
 

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fenghua Yu <[email protected]>

commit 8e5780fdeef7dc490b3f0b3a62704593721fa4f3 upstream.

AVX-512 is an extention of AVX2. Its spec can be found at:
http://download-software.intel.com/sites/default/files/managed/71/2e/319433-017.pdf

This patch detects AVX-512 features by CPUID.

---
 arch/x86/include/asm/cpufeature.h |    4 ++++
 1 file changed, 4 insertions(+)

@@ -217,9 +217,13 @@
 #define X86_FEATURE_INVPCID	(9*32+10) /* Invalidate Processor Context ID */
 #define X86_FEATURE_RTM		(9*32+11) /* Restricted Transactional Memory */
 #define X86_FEATURE_MPX		(9*32+14) /* Memory Protection Extension */
+#define X86_FEATURE_AVX512F	(9*32+16) /* AVX-512 Foundation */
 #define X86_FEATURE_RDSEED	(9*32+18) /* The RDSEED instruction */
 #define X86_FEATURE_ADX		(9*32+19) /* The ADCX and ADOX instructions */
 #define X86_FEATURE_SMAP	(9*32+20) /* Supervisor Mode Access Prevention */
+#define X86_FEATURE_AVX512PF	(9*32+26) /* AVX-512 Prefetch */
+#define X86_FEATURE_AVX512ER	(9*32+27) /* AVX-512 Exponential and Reciprocal */
+#define X86_FEATURE_AVX512CD	(9*32+28) /* AVX-512 Conflict Detection */
 
 /*
  * BUG word(s)

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fenghua Yu <[email protected]>

commit c2bc11f10a39527cd1bb252097b5525664560956 upstream.

This patch enables Opmask, ZMM_Hi256, and Hi16_ZMM AVX-512 states for xstate context switch.

---
 arch/x86/include/asm/xsave.h |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

@@ -6,11 +6,14 @@
 
 #define XSTATE_CPUID		0x0000000d
 
-#define XSTATE_FP	0x1
-#define XSTATE_SSE	0x2
-#define XSTATE_YMM	0x4
-#define XSTATE_BNDREGS	0x8
-#define XSTATE_BNDCSR	0x10
+#define XSTATE_FP		0x1
+#define XSTATE_SSE		0x2
+#define XSTATE_YMM		0x4
+#define XSTATE_BNDREGS		0x8
+#define XSTATE_BNDCSR		0x10
+#define XSTATE_OPMASK		0x20
+#define XSTATE_ZMM_Hi256	0x40
+#define XSTATE_Hi16_ZMM		0x80
 
 #define XSTATE_FPSSE	(XSTATE_FP | XSTATE_SSE)
 

@@ -23,7 +26,8 @@
 #define XSAVE_YMM_OFFSET    (XSAVE_HDR_SIZE + XSAVE_HDR_OFFSET)
 
 /* Supported features which support lazy state saving */
-#define XSTATE_LAZY	(XSTATE_FP | XSTATE_SSE | XSTATE_YMM)
+#define XSTATE_LAZY	(XSTATE_FP | XSTATE_SSE | XSTATE_YMM		      \
+			| XSTATE_OPMASK | XSTATE_ZMM_Hi256 | XSTATE_Hi16_ZMM)
 
 /* Supported features which require eager state saving */
 #define XSTATE_EAGER	(XSTATE_BNDREGS | XSTATE_BNDCSR)

3.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Petr Mladek <[email protected]>

commit 12729f14d8357fb845d75155228b21e76360272d upstream.

If a failure occurs while modifying ftrace function, it bails out and will remove the tracepoints to be back to what the code originally was.

There is missing the final sync run across the CPUs after the fix up is done and before the ftrace int3 handler flag is reset.

Here's the description of the problem:

	CPU0				CPU1
	----				----

remove_breakpoint();
modifying_ftrace_code = 0;

[still sees breakpoint] <takes trap>
[sees modifying_ftrace_code as zero] [no breakpoint handler] [goto failed case]
[trap exception - kernel breakpoint, no
handler]
BUG()

---
 arch/x86/kernel/ftrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -659,8 +659,8 @@ ftrace_modify_code(unsigned long ip, uns
 		ret = -EPERM;
 		goto out;
 	}
-	run_sync();
  out:
+	run_sync();
 	return ret;
 
  fail_update: