4.1.5-stable review

This is the start of the stable review cycle for the 4.1.5 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon Aug 10 22:06:48 UTC 2015. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.5-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.1.5-rc1

Dave Chinner <[email protected]>
xfs: remote attributes need to be considered data

Dave Chinner <[email protected]>
xfs: remote attribute headers contain an invalid LSN

Kamil Dudka <[email protected]>

    drm/nouveau/drm/nv04-nv40/instmem: protect access to priv->heap by mutex

Kamil Dudka <[email protected]>
drm/nouveau: hold mutex when calling nouveau_abi16_fini()

Ben Skeggs <[email protected]>
drm/nouveau/kms/nv50-: guard against enabling cursor on disabled heads

Ilia Mirkin <[email protected]>
drm/nouveau/fbcon/nv11-: correctly account for ring space usage

Roland Dreier <[email protected]>
qla2xxx: kill sessions/log out initiator on RSCN and port down events

Kanoj Sarcar <[email protected]>
qla2xxx: fix command initialization in target mode.

Himanshu Madhani <[email protected]>
qla2xxx: Remove msleep in qlt_send_term_exchange

Quinn Tran <[email protected]>
qla2xxx: release request queue reservation.

Saurav Kashyap <[email protected]>
qla2xxx: Fix hardware lock/unlock issue causing kernel panic.

Lukasz Anaczkowski <[email protected]>
intel_pstate: Add get_scaling cpu_defaults param to Knights Landing

Nicholas Bellinger <[email protected]>
iscsi-target: Fix iser explicit logout TX kthread leak

Nicholas Bellinger <[email protected]>
iscsi-target: Fix iscsit_start_kthreads failure OOPs

Nicholas Bellinger <[email protected]>
iscsi-target: Fix use-after-free during TPG session shutdown

Jason Gunthorpe <[email protected]>
IB/ipoib: Fix CONFIG_INFINIBAND_IPOIB_CM

Trond Myklebust <[email protected]>
NFS: Fix a memory leak in nfs_do_recoalesce

Trond Myklebust <[email protected]>
NFSv4: We must set NFS_OPEN_STATE flag in nfs_resync_open_stateid_locked

Andy Shevchenko <[email protected]>
avr32: handle NULL as a valid clock object

Trond Myklebust <[email protected]>
NFS: Don't revalidate the mapping if both size and change attr are up to date

Guenter Roeck <[email protected]>
hwmon: (nct7904) Rename pwm attributes to match hwmon ABI

Guenter Roeck <[email protected]>
hwmon: (nct7802) Fix integer overflow seen when writing voltage limits

Marc-André Lureau <[email protected]>
vhost: actually track log eventfd file

Matt Fleming <[email protected]>
perf/x86/intel/cqm: Return cached counter value from IRQ context

Arnaldo Carvalho de Melo <[email protected]>
perf hists browser: Take the --comm, --dsos, etc filters into account

Ming Lei <[email protected]>
blk-mq: set default timeout as 30 seconds

Peter Hurley <[email protected]>
n_tty: signal and flush atomically

Wengang Wang <[email protected]>
rds: rds_ib_device.refcount overflow

Vineet Gupta <[email protected]>
ARC: Make ARC bitops "safer" (add anti-optimization)

Vineet Gupta <[email protected]>
ARC: Reduce bitops lines of code using macros

Dmitry Skorodumov <[email protected]>
x86/efi: Use all 64 bit of efi_memmap in setup_e820()

Ricardo Neri <[email protected]>
efi: Check for NULL efi kernel parameters

Ard Biesheuvel <[email protected]>
arm64/efi: map the entire UEFI vendor string before reading it

Tony Luck <[email protected]>
efi: Handle memory error structures produced based on old versions of standard

Dave Hansen <[email protected]>
x86/mm: Add parenthesis for TLB tracepoint size calculation

Tomas Winkler <[email protected]>
mei: prevent unloading mei hw modules while the device is opened.

Zhuang Jin Can <[email protected]>
xhci: do not report PLC when link is in internal resume state

Zhuang Jin Can <[email protected]>
xhci: prevent bus_suspend if SS port resuming in phase 1

Zhuang Jin Can <[email protected]>
xhci: report U3 when link is in resume state

Brian Campbell <[email protected]>
xhci: Calculate old endpoints correctly on device reset

Peter Hurley <[email protected]>
serial: core: Fix crashes while echoing when closing

David Jander <[email protected]>
Revert "serial: imx: initialized DMA w/o HW flow enabled"

Oliver Neukum <[email protected]>

    usb-storage: ignore ZTE MF 823 card reader in mode 0x1225

Lior Amsalem <[email protected]>
ata: pmp: add quirk for Marvell 4140 SATA PMP

Krzysztof Kozlowski <[email protected]>
regulator: s2mps11: Fix GPIO suspend enable shift wrapping bug

Tejun Heo <[email protected]>
blkcg: fix gendisk reference leak in blkg_conf_prep()

Bernhard Bender <[email protected]>
Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen

Oleksij Rempel <[email protected]>
Input: zforce - don't overwrite the stack

Chris Metcalf <[email protected]>
tile: use free_bootmem_late() for initrd

Sascha Hauer <[email protected]>
spi: imx: Fix small DMA transfers

Sifan Naeem <[email protected]>
spi: img-spfi: fix support for speeds up to 1/4th input clock

NeilBrown <[email protected]>
md/raid1: fix test for 'was read error from last working device'.

Emmanuel Grumbach <[email protected]>
iwlwifi: pcie: prepare the device before accessing it

Liad Kaufman <[email protected]>
iwlwifi: nvm: remove mac address byte swapping in 8000 family

Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix antenna selection when BT is active

Antonio Borneo <[email protected]>
HID: cp2112: fix to force single data-report reply

Jingju Hou <[email protected]>
mmc: sdhci-pxav3: fix platform_data is not initialized

Joakim Tjernlund <[email protected]>
mmc: sdhci-esdhc: Make 8BIT bus work

Peng Fan <[email protected]>
mmc: sdhci check parameters before call dma_free_coherent

Kishon Vijay Abraham I <[email protected]>
mmc: omap_hsmmc: Fix DTO and DCRC handling

Alex Williamson <[email protected]>
iommu/vt-d: Fix VM domain ID leak

Steven Rostedt (Red Hat) <[email protected]>
ftrace: Fix breakage of set_ftrace_pid

Eric W. Biederman <[email protected]>
mnt: In detach_mounts detach the appropriate unmounted mount

Eric W. Biederman <[email protected]>
mnt: Clarify and correct the disconnect logic in umount_tree

Uwe Kleine-König <[email protected]>
Subject: pinctrl: imx1-core: Fix debug output in .pin_config_set callback

Tom Hughes <[email protected]>
mac80211: clear subdir_stations when removing debugfs

Pankaj Dev <[email protected]>
drivers: clk: st: Incorrect register offset used for lock_status

Gabriel Fernandez <[email protected]>
drivers: clk: st: Fix mux bit-setting for Cortex A9 clocks

Giuseppe Cavallaro <[email protected]>
drivers: clk: st: Fix flexgen lock init

Seymour, Shane M <[email protected]>
st: null pointer dereference panic caused by use after kref_put by st_open

Tony Battersby <[email protected]>
scsi: fix memory leak with scsi-mq

Jens Axboe <[email protected]>
scsi: fix host max depth checking for the 'queue_depth' sysfs interface

Marc Zyngier <[email protected]>
irqchip/gicv3-its: Fix mapping of LPIs to collections

Mike Snitzer <[email protected]>
Revert "dm: only run the queue on completion if congested or no requests pending"

Peter Zijlstra <[email protected]>
x86, perf: Fix static_key bug in load_mm_cr4()

Takashi Iwai <[email protected]>
ALSA: hda - Fix MacBook Pro 5,2 quirk

Yao-Wen Mao <[email protected]>
ALSA: usb-audio: add dB range mapping for some devices

Takashi Iwai <[email protected]>
ALSA: hda - Apply a fixup to Dell Vostro 5480

Takashi Iwai <[email protected]>
ALSA: hda - Apply fixup for another Toshiba Satellite S50D

David Henningsson <[email protected]>
ALSA: hda - Add headset mic pin quirk for a Dell device

Aaron Plattner <[email protected]>

    ALSA: hda - Add new GPU codec ID 0x10de007d to snd-hda

Maruthi Srinivas Bayyavarapu <[email protected]>
ALSA: hda: add new AMD PCI IDs with proper driver caps

Mateusz Sylwestrzak <[email protected]>
ALSA: hda - Add headset mic support for Acer Aspire V5-573G

Takashi Iwai <[email protected]>
ALSA: pcm: Fix lockdep warning with nonatomic PCM ops

Takashi Iwai <[email protected]>
ALSA: line6: Fix -EBUSY error during active monitoring

Dominic Sacré <[email protected]>
ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4

Thomas Gleixner <[email protected]>
genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD

Haggai Eran <[email protected]>
dma-debug: skip debug_dma_assert_idle() when disabled

Mike Snitzer <[email protected]>
bio integrity: do not assume bio_integrity_pool exists if bioset exists

Michal Marek <[email protected]>
kbuild: Allow arch Makefiles to override {cpp,ld,c}flags

Alexey Brodkin <[email protected]>
ARC: make sure instruction_pointer() returns unsigned value

Vineet Gupta <[email protected]>
ARC: Override toplevel default -O2 with -O3

Heiko Carstens <[email protected]>
s390/cachinfo: add missing facility check to init_cache_level()

Michael Holzheu <[email protected]>
s390/bpf: clear correct BPF accumulator register

Heiko Carstens <[email protected]>
s390/nmi: fix vector register corruption

Martin Schwidefsky <[email protected]>
s390/sclp: clear upper register halves in _sclp_print_early

Heiko Carstens <[email protected]>
s390/process: fix sfpc inline assembly

Vutla, Lokesh <[email protected]>
crypto: omap-des - Fix unmapping of dma channels

Andrey Ryabinin <[email protected]>
x86/kasan: Fix boot crash on AMD processors

Andrey Ryabinin <[email protected]>
x86/kasan: Flush TLBs after switching CR3

Alexander Popov <[email protected]>
x86/kasan: Fix KASAN shadow region page tables

Andrey Ryabinin <[email protected]>
x86/init: Clear 'init_level4_pgt' earlier

Al Viro <[email protected]>
freeing unlinked file indefinitely delayed

Stefan Agner <[email protected]>
can: mcp251x: fix resume when device is down

Sergei Shtylyov <[email protected]>
can: rcar_can: print signed IRQ #

J.D. Schroeder <[email protected]>
can: c_can: Fix default pinmux glitch at init

Sergei Shtylyov <[email protected]>
can: rcar_can: fix IRQ check

Oliver Hartkopp <[email protected]>
can: replace timestamp as unique skb attribute

Markos Chandras <[email protected]>
MIPS: fpu.h: Allow 64-bit FPU on a 64-bit MIPS R6 CPU

Paul Burton <[email protected]>
MIPS: Require O32 FP64 support for MIPS64 with O32 compat

Markos Chandras <[email protected]>
MIPS: c-r4k: Fix cache flushing for MT cores

Markos Chandras <[email protected]>
MIPS: Fix erroneous JR emulation for MIPS R6

Lucas Stach <[email protected]>
ARM: imx6: gpc: always enable PU domain if CONFIG_PM is not set

Marek Szyprowski <[email protected]>
ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check

Roger Quadros <[email protected]>
ARM: dts: am57xx-beagle-x15: Provide supply for usb2_phy2

Roger Quadros <[email protected]>
ARM: dts: dra7x-evm: Prevent glitch on DCAN1 pinmux

Robert Jarzmik <[email protected]>
ARM: pxa: fix dm9000 platform data regression

Christophe Jaillet <[email protected]>
parisc: mm: Fix a memory leak related to pmd not attached to the pgd

John David Anglin <[email protected]>
parisc: Fix some PTE/TLB race conditions and optimize __flush_tlb_range based on timing results

Dmitry Torokhov <[email protected]>
Revert "Input: synaptics - allocate 3 slots to keep stability in image sensors"

Shreyas B. Prabhu <[email protected]>
powerpc/powernv: Fix race in updating core_idle_state

Daniel Axtens <[email protected]>
cxl: Check if afu is not null in cxl_slbia

Ian Munsie <[email protected]>
cxl: Fix off by one error allowing subsequent mmap page to be accessed

-------------

Diffstat:

 Documentation/hwmon/nct7904                        |   4 +-
 Documentation/kbuild/makefiles.txt                 |   8 +
 Makefile                                           |  13 +-
 arch/arc/Makefile                                  |   3 +-
 arch/arc/include/asm/bitops.h                      | 468 ++++++---------------
 arch/arc/include/asm/ptrace.h                      |   2 +-
 arch/arm/boot/dts/am57xx-beagle-x15.dts            |   4 +
 arch/arm/boot/dts/dra7-evm.dts                     |   5 +-
 arch/arm/boot/dts/dra72-evm.dts                    |   5 +-
 arch/arm/mach-imx/gpc.c                            |  27 +-
 arch/arm/mach-pxa/capc7117.c                       |   3 +
 arch/arm/mach-pxa/cm-x2xx.c                        |   3 +
 arch/arm/mach-pxa/cm-x300.c                        |   2 +
 arch/arm/mach-pxa/colibri-pxa270.c                 |   3 +
 arch/arm/mach-pxa/em-x270.c                        |   2 +
 arch/arm/mach-pxa/icontrol.c                       |   3 +
 arch/arm/mach-pxa/trizeps4.c                       |   3 +
 arch/arm/mach-pxa/vpac270.c                        |   3 +
 arch/arm/mach-pxa/zeus.c                           |   2 +
 arch/arm/mm/dma-mapping.c                          |   2 +-
 arch/arm64/kernel/efi.c                            |   4 +-
 arch/avr32/mach-at32ap/clock.c                     |  20 +-
 arch/mips/Kconfig                                  |   1 +
 arch/mips/include/asm/fpu.h                        |   2 +-
 arch/mips/include/asm/smp.h                        |   1 +
 arch/mips/kernel/smp.c                             |  44 +-
 arch/mips/math-emu/cp1emu.c                        |   2 +-
 arch/mips/mm/c-r4k.c                               |  14 +-
 arch/parisc/include/asm/pgalloc.h                  |   3 +-
 arch/parisc/include/asm/pgtable.h                  |  55 ++-
 arch/parisc/include/asm/tlbflush.h                 |  53 +--
 arch/parisc/kernel/cache.c                         | 105 +++--
 arch/parisc/kernel/entry.S                         | 163 ++++---
 arch/parisc/kernel/traps.c                         |   4 -
 arch/powerpc/kernel/idle_power7.S                  |  31 +-
 arch/s390/include/asm/ctl_reg.h                    |   5 +-
 arch/s390/kernel/cache.c                           |   2 +
 arch/s390/kernel/nmi.c                             |  51 ++-
 arch/s390/kernel/process.c                         |   2 +-
 arch/s390/kernel/sclp.S                            |   4 +
 arch/s390/net/bpf_jit_comp.c                       |  14 +-
 arch/tile/kernel/setup.c                           |   2 +-
 arch/x86/boot/compressed/eboot.c                   |   4 +
 arch/x86/include/asm/kasan.h                       |   8 +-
 arch/x86/include/asm/mmu_context.h                 |   2 +-
 arch/x86/kernel/cpu/perf_event_intel_cqm.c         |   8 +
 arch/x86/kernel/head64.c                           |  10 +-
 arch/x86/kernel/head_64.S                          |  29 --
 arch/x86/mm/kasan_init_64.c                        |  44 +-
 arch/x86/mm/tlb.c                                  |   2 +-
 arch/x86/platform/efi/efi.c                        |   5 +
 block/bio-integrity.c                              |   4 +-
 block/blk-cgroup.c                                 |   6 +-
 block/blk-mq.c                                     |   2 +-
 drivers/ata/libata-pmp.c                           |   7 +
 drivers/clk/st/clk-flexgen.c                       |   2 +
 drivers/clk/st/clkgen-fsyn.c                       |   2 +-
 drivers/clk/st/clkgen-mux.c                        |   2 +-
 drivers/cpufreq/intel_pstate.c                     |   1 +
 drivers/crypto/omap-des.c                          |   3 -
 drivers/firmware/efi/cper.c                        |  15 +-
 drivers/firmware/efi/efi.c                         |   5 +
 drivers/gpu/drm/nouveau/nouveau_drm.c              |   2 +
 drivers/gpu/drm/nouveau/nv04_fbcon.c               |   2 +-
 drivers/gpu/drm/nouveau/nv50_display.c             |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c |   8 +
 drivers/hid/hid-cp2112.c                           |   2 +
 drivers/hwmon/nct7802.c                            |   2 +-
 drivers/hwmon/nct7904.c                            |  57 +--
 drivers/infiniband/ulp/ipoib/ipoib_verbs.c         |   3 +-
 drivers/input/mouse/synaptics.c                    |   2 +-
 drivers/input/touchscreen/usbtouchscreen.c         |   3 +
 drivers/input/touchscreen/zforce_ts.c              |   2 +-
 drivers/iommu/intel-iommu.c                        |   9 +-
 drivers/irqchip/irq-gic-v3-its.c                   | 111 +++--
 drivers/md/dm.c                                    |   8 +-
 drivers/md/raid1.c                                 |   2 +-
 drivers/misc/cxl/context.c                         |   4 +-
 drivers/misc/cxl/main.c                            |   2 +-
 drivers/misc/mei/main.c                            |   2 +-
 drivers/mmc/host/omap_hsmmc.c                      |   8 +-
 drivers/mmc/host/sdhci-esdhc.h                     |   2 +-
 drivers/mmc/host/sdhci-pxav3.c                     |   1 +
 drivers/mmc/host/sdhci.c                           |   7 +-
 drivers/net/can/c_can/c_can.c                      |  10 +-
 drivers/net/can/dev.c                              |   7 +-
 drivers/net/can/rcar_can.c                         |   7 +-
 drivers/net/can/slcan.c                            |   2 +-
 drivers/net/can/spi/mcp251x.c                      |  13 +-
 drivers/net/can/vcan.c                             |   3 -
 drivers/net/wireless/iwlwifi/iwl-nvm-parse.c       |  12 +-
 drivers/net/wireless/iwlwifi/mvm/tx.c              |   2 +-
 drivers/net/wireless/iwlwifi/pcie/trans.c          |   6 +
 drivers/pinctrl/freescale/pinctrl-imx1-core.c      |   3 +-
 drivers/regulator/s2mps11.c                        |  14 +-
 drivers/scsi/qla2xxx/qla_dbg.c                     |   2 +-
 drivers/scsi/qla2xxx/qla_init.c                    | 141 +++++--
 drivers/scsi/qla2xxx/qla_target.c                  |  48 +--
 drivers/scsi/scsi_error.c                          |   2 +-
 drivers/scsi/scsi_lib.c                            |   6 +-
 drivers/scsi/scsi_sysfs.c                          |   2 +-
 drivers/scsi/st.c                                  |   2 +-
 drivers/spi/spi-img-spfi.c                         |   2 +
 drivers/spi/spi-imx.c                              |   5 +-
 drivers/target/iscsi/iscsi_target.c                |  48 ++-
 drivers/target/iscsi/iscsi_target_login.c          |  45 +-
 drivers/target/iscsi/iscsi_target_login.h          |   3 +-
 drivers/target/iscsi/iscsi_target_nego.c           |  34 +-
 drivers/tty/n_tty.c                                |  16 +-
 drivers/tty/serial/imx.c                           |  15 +-
 drivers/tty/serial/serial_core.c                   |   3 +-
 drivers/usb/host/xhci-hub.c                        |  22 +-
 drivers/usb/host/xhci-ring.c                       |   3 +
 drivers/usb/host/xhci.c                            |   3 +
 drivers/usb/host/xhci.h                            |   1 +
 drivers/usb/storage/unusual_devs.h                 |  12 +
 drivers/vhost/vhost.c                              |   1 +
 fs/dcache.c                                        |   7 +-
 fs/namespace.c                                     |  42 +-
 fs/nfs/inode.c                                     |   8 +-
 fs/nfs/nfs4proc.c                                  |   3 +
 fs/nfs/pagelist.c                                  |   5 +-
 fs/pnode.h                                         |   2 -
 fs/xfs/libxfs/xfs_attr_remote.c                    |  44 +-
 fs/xfs/xfs_log_recover.c                           |  11 +-
 include/linux/can/skb.h                            |   2 +
 include/linux/cper.h                               |  22 +-
 include/linux/ftrace.h                             |   3 +
 include/target/iscsi/iscsi_target_core.h           |   1 +
 kernel/irq/resend.c                                |  18 +-
 kernel/trace/ftrace.c                              |  52 ++-
 lib/dma-debug.c                                    |   3 +
 net/can/af_can.c                                   |  12 +-
 net/can/bcm.c                                      |   2 +
 net/can/raw.c                                      |   7 +-
 net/mac80211/debugfs_netdev.c                      |   1 +
 net/rds/ib_rdma.c                                  |   4 +-
 sound/core/pcm_native.c                            |   2 +-
 sound/pci/hda/hda_intel.c                          |   8 +
 sound/pci/hda/patch_hdmi.c                         |   2 +
 sound/pci/hda/patch_realtek.c                      |  16 +-
 sound/pci/hda/patch_sigmatel.c                     |   3 +-
 sound/usb/line6/pcm.c                              |   9 +-
 sound/usb/mixer_maps.c                             |  24 ++
 sound/usb/quirks-table.h                           |  68 +++
 tools/perf/ui/browsers/hists.c                     |   2 +-
 146 files changed, 1457 insertions(+), 970 deletions(-)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ian Munsie <[email protected]>

commit 10a5894f2dedd8a26b3132497445b314c0d952c4 upstream.

It was discovered that if a process mmaped their problem state area they were able to access one page more than expected, potentially allowing them to access the problem state area of an unrelated process.

This was due to a simple off by one error in the mmap fault handler introduced in 0712dc7e73e59d79bcead5d5520acf4e9e917e87 ("cxl: Fix issues when unmapping contexts"), which is fixed in this patch.

---
 drivers/misc/cxl/context.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area
 
 	if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
 		area = ctx->afu->psn_phys;
-		if (offset > ctx->afu->adapter->ps_size)
+		if (offset >= ctx->afu->adapter->ps_size)
 			return VM_FAULT_SIGBUS;
 	} else {
 		area = ctx->psn_phys;
-		if (offset > ctx->psn_size)
+		if (offset >= ctx->psn_size)
 			return VM_FAULT_SIGBUS;
 	}
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Axtens <[email protected]>

commit 2c069a118fe1d80c47dca84e1561045fc7f3cc9e upstream.

The pointer to an AFU in the adapter's list of AFUs can be null if we're in the process of removing AFUs. The afu_list_lock doesn't guard against this.

Say we have 2 slices, and we're in the process of removing cxl.
- We remove the AFUs in order (see cxl_remove). In cxl_remove_afu for AFU 0, we take the lock, set adapter->afu[0] = NULL, and release the lock.
- Then we get an slbia. In cxl_slbia we take the lock, and set afu = adapter->afu[0], which is NULL.
- Therefore our attempt to check afu->enabled will blow up.

Therefore, check if afu is a null pointer before dereferencing it.

---
 drivers/misc/cxl/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct
 		spin_lock(&adapter->afu_list_lock);
 		for (slice = 0; slice < adapter->slices; slice++) {
 			afu = adapter->afu[slice];
-			if (!afu->enabled)
+			if (!afu || !afu->enabled)
 				continue;
 			rcu_read_lock();
 			idr_for_each_entry(&afu->contexts_idr, ctx, id)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shreyas B. Prabhu" <[email protected]>

commit b32aadc1a8ed84afbe924cd2ced31cd6a2e67074 upstream.

core_idle_state is maintained for each core. It uses 0-7 bits to track whether a thread in the core has entered fastsleep or winkle. 8th bit is used as a lock bit.
The lock bit is set in these 2 scenarios-
- The thread is first in subcore to wakeup from sleep/winkle.
- If its the last thread in the core about to enter sleep/winkle

While the lock bit is set, if any other thread in the core wakes up, it loops until the lock bit is cleared before proceeding in the wakeup path. This helps prevent race conditions w.r.t fastsleep workaround and prevents threads from switching to process context before core/subcore resources are restored.

But, in the path to sleep/winkle entry, we currently don't check for lock-bit. This exposes us to following race when running with subcore on-

First thread in the subcorea Another thread in the same
waking up core entering sleep/winkle

lwarx   r15,0,r14
ori     r15,r15,PNV_CORE_IDLE_LOCK_BIT
stwcx.  r15,0,r14

[Code to restore subcore state]

						lwarx   r15,0,r14
						[clear thread bit]
						stwcx.  r15,0,r14

andi. r15,r15,PNV_CORE_IDLE_THREAD_BITS
stw r15,0(r14)

Here, after the thread entering sleep clears its thread bit in core_idle_state, the value is overwritten by the thread waking up. In such cases when the core enters fastsleep, code mistakes an idle thread as running. Because of this, the first thread waking up from fastsleep which is supposed to resync timebase skips it. So we can end up having a core with stale timebase value.

This patch fixes the above race by looping on the lock bit even while entering the idle states.

---
 arch/powerpc/kernel/idle_power7.S |   31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

@@ -52,6 +52,22 @@
 	.text
 
 /*
+ * Used by threads when the lock bit of core_idle_state is set.
+ * Threads will spin in HMT_LOW until the lock bit is cleared.
+ * r14 - pointer to core_idle_state
+ * r15 - used to load contents of core_idle_state
+ */
+
+core_idle_lock_held:
+	HMT_LOW
+3:	lwz	r15,0(r14)
+	andi.   r15,r15,PNV_CORE_IDLE_LOCK_BIT
+	bne	3b
+	HMT_MEDIUM
+	lwarx	r15,0,r14
+	blr
+
+/*
  * Pass requested state in r3:
  *	r3 - PNV_THREAD_NAP/SLEEP/WINKLE
  *

@@ -150,6 +166,10 @@ power7_enter_nap_mode:
 	ld	r14,PACA_CORE_IDLE_STATE_PTR(r13)
 lwarx_loop1:
 	lwarx	r15,0,r14
+
+	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
+	bnel	core_idle_lock_held
+
 	andc	r15,r15,r7			/* Clear thread bit */
 
 	andi.	r15,r15,PNV_CORE_IDLE_THREAD_BITS

@@ -294,7 +314,7 @@ lwarx_loop2:
 	 * workaround undo code or resyncing timebase or restoring context
 	 * In either case loop until the lock bit is cleared.
 	 */
-	bne	core_idle_lock_held
+	bnel	core_idle_lock_held
 
 	cmpwi	cr2,r15,0
 	lbz	r4,PACA_SUBCORE_SIBLING_MASK(r13)

@@ -319,15 +339,6 @@ lwarx_loop2:
 	isync
 	b	common_exit
 
-core_idle_lock_held:
-	HMT_LOW
-core_idle_lock_loop:
-	lwz	r15,0(14)
-	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
-	bne	core_idle_lock_loop
-	HMT_MEDIUM
-	b	lwarx_loop2
-
 first_thread_in_subcore:
 	/* First thread in subcore to wakeup */
 	ori	r15,r15,PNV_CORE_IDLE_LOCK_BIT

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <[email protected]>

commit dbf3c370862d73fcd2c74ca55e254bb02143238d upstream.

This reverts commit 63c4fda3c0bb841b1aad1298fc7fe94058fc79f8 as it causes issues with detecting 3-finger taps.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=100481

---
 drivers/input/mouse/synaptics.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1199,7 +1199,7 @@ static void set_input_params(struct psmo
 					ABS_MT_POSITION_Y);
 		/* Image sensors can report per-contact pressure */
 		input_set_abs_params(dev, ABS_MT_PRESSURE, 0, 255, 0, 0);
-		input_mt_init_slots(dev, 3, INPUT_MT_POINTER | INPUT_MT_TRACK);
+		input_mt_init_slots(dev, 2, INPUT_MT_POINTER | INPUT_MT_TRACK);
 
 		/* Image sensors can signal 4 and 5 finger clicks */
 		__set_bit(BTN_TOOL_QUADTAP, dev->keybit);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: John David Anglin <[email protected]>

commit 01ab60570427caa24b9debc369e452e86cd9beb4 upstream.

The increased use of pdtlb/pitlb instructions seemed to increase the frequency of random segmentation faults building packages. Further, we had a number of cases where TLB inserts would repeatedly fail and all forward progress would stop. The Haskell ghc package caused a lot of trouble in this area. The final indication of a race in pte handling was this syslog entry on sibaris (C8000):

swap_free: Unused swap offset entry 00000004

 BUG: Bad page map in process mysqld  pte:00000100 pmd:019bbec5
 addr:00000000ec464000 vm_flags:00100073 anon_vma:0000000221023828 mapping: (null) index:ec464
 CPU: 1 PID: 9176 Comm: mysqld Not tainted 4.0.0-2-parisc64-smp #1 Debian 4.0.5-1
 Backtrace:
  [<0000000040173eb0>] show_stack+0x20/0x38
  [<0000000040444424>] dump_stack+0x9c/0x110
  [<00000000402a0d38>] print_bad_pte+0x1a8/0x278
  [<00000000402a28b8>] unmap_single_vma+0x3d8/0x770
  [<00000000402a4090>] zap_page_range+0xf0/0x198
  [<00000000402ba2a4>] SyS_madvise+0x404/0x8c0

Note that the pte value is 0 except for the accessed bit 0x100. This bit shouldn't be set without the present bit.

It should be noted that the madvise system call is probably a trigger for many of the random segmentation faults.

In looking at the kernel code, I found the following problems:

1) The pte_clear define didn't take TLB lock when clearing a pte.
2) We didn't test pte present bit inside lock in exception support.
3) The pte and tlb locks needed to merged in order to ensure consistency between page table and TLB. This also has the effect of serializing TLB broadcasts on SMP systems.

The attached change implements the above and a few other tweaks to try to improve performance. Based on the timing code, TLB purges are very slow (e.g., ~ 209 cycles per page on rp3440). Thus, I think it beneficial to test the split_tlb variable to avoid duplicate purges. Probably, all PA 2.0 machines have combined TLBs.

I dropped using __flush_tlb_range in flush_tlb_mm as I realized all applications and most threads have a stack size that is too large to make this useful. I added some comments to this effect.

Since implementing 1 through 3, I haven't had any random segmentation faults on mx3210 (rp3440) in about one week of building code and running as a Debian buildd.

---
 arch/parisc/include/asm/pgtable.h  |   57 ++++++++----
 arch/parisc/include/asm/tlbflush.h |   53 ++++++------
 arch/parisc/kernel/cache.c         |  105 +++++++++++++++--------
 arch/parisc/kernel/entry.S         |  163 +++++++++++++++++--------------------
 arch/parisc/kernel/traps.c         |    4 
 5 files changed, 213 insertions(+), 169 deletions(-)

@@ -16,7 +16,7 @@
 #include <asm/processor.h>
 #include <asm/cache.h>
 
-extern spinlock_t pa_dbit_lock;
+extern spinlock_t pa_tlb_lock;
 
 /*
  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel

@@ -33,6 +33,19 @@ extern spinlock_t pa_dbit_lock;
  */
 #define kern_addr_valid(addr)	(1)
 
+/* Purge data and instruction TLB entries.  Must be called holding
+ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
+ * machines since the purge must be broadcast to all CPUs.
+ */
+
+static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+{
+	mtsp(mm->context, 1);
+	pdtlb(addr);
+	if (unlikely(split_tlb))
+		pitlb(addr);
+}
+
 /* Certain architectures need to do special things when PTEs
  * within a page table are directly modified.  Thus, the following
  * hook is made available.

@@ -42,15 +55,20 @@ extern spinlock_t pa_dbit_lock;
                 *(pteptr) = (pteval);                           \
         } while(0)
 
-extern void purge_tlb_entries(struct mm_struct *, unsigned long);
-
-#define set_pte_at(mm, addr, ptep, pteval)                      \
-	do {                                                    \
+#define pte_inserted(x)						\
+	((pte_val(x) & (_PAGE_PRESENT|_PAGE_ACCESSED))		\
+	 == (_PAGE_PRESENT|_PAGE_ACCESSED))
+
+#define set_pte_at(mm, addr, ptep, pteval)			\
+	do {							\
+		pte_t old_pte;					\
 		unsigned long flags;				\
-		spin_lock_irqsave(&pa_dbit_lock, flags);	\
-		set_pte(ptep, pteval);                          \
-		purge_tlb_entries(mm, addr);                    \
-		spin_unlock_irqrestore(&pa_dbit_lock, flags);	\
+		spin_lock_irqsave(&pa_tlb_lock, flags);		\
+		old_pte = *ptep;				\
+		set_pte(ptep, pteval);				\
+		if (pte_inserted(old_pte))			\
+			purge_tlb_entries(mm, addr);		\
+		spin_unlock_irqrestore(&pa_tlb_lock, flags);	\
 	} while (0)
 
 #endif /* !__ASSEMBLY__ */

@@ -268,7 +286,7 @@ extern unsigned long *empty_zero_page;
 
 #define pte_none(x)     (pte_val(x) == 0)
 #define pte_present(x)	(pte_val(x) & _PAGE_PRESENT)
-#define pte_clear(mm,addr,xp)	do { pte_val(*(xp)) = 0; } while (0)
+#define pte_clear(mm, addr, xp)  set_pte_at(mm, addr, xp, __pte(0))
 
 #define pmd_flag(x)	(pmd_val(x) & PxD_FLAG_MASK)
 #define pmd_address(x)	((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)

@@ -435,15 +453,15 @@ static inline int ptep_test_and_clear_yo
 	if (!pte_young(*ptep))
 		return 0;
 
-	spin_lock_irqsave(&pa_dbit_lock, flags);
+	spin_lock_irqsave(&pa_tlb_lock, flags);
 	pte = *ptep;
 	if (!pte_young(pte)) {
-		spin_unlock_irqrestore(&pa_dbit_lock, flags);
+		spin_unlock_irqrestore(&pa_tlb_lock, flags);
 		return 0;
 	}
 	set_pte(ptep, pte_mkold(pte));
 	purge_tlb_entries(vma->vm_mm, addr);
-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+	spin_unlock_irqrestore(&pa_tlb_lock, flags);
 	return 1;
 }
 

@@ -453,11 +471,12 @@ static inline pte_t ptep_get_and_clear(s
 	pte_t old_pte;
 	unsigned long flags;
 
-	spin_lock_irqsave(&pa_dbit_lock, flags);
+	spin_lock_irqsave(&pa_tlb_lock, flags);
 	old_pte = *ptep;
-	pte_clear(mm,addr,ptep);
-	purge_tlb_entries(mm, addr);
-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+	set_pte(ptep, __pte(0));
+	if (pte_inserted(old_pte))
+		purge_tlb_entries(mm, addr);
+	spin_unlock_irqrestore(&pa_tlb_lock, flags);
 
 	return old_pte;
 }

@@ -465,10 +484,10 @@ static inline pte_t ptep_get_and_clear(s
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
 	unsigned long flags;
-	spin_lock_irqsave(&pa_dbit_lock, flags);
+	spin_lock_irqsave(&pa_tlb_lock, flags);
 	set_pte(ptep, pte_wrprotect(*ptep));
 	purge_tlb_entries(mm, addr);
-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+	spin_unlock_irqrestore(&pa_tlb_lock, flags);
 }
 
 #define pte_same(A,B)	(pte_val(A) == pte_val(B))

@@ -43,10 +43,6 @@
 
 #include "../math-emu/math-emu.h"	/* for handle_fpe() */
 
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
-DEFINE_SPINLOCK(pa_dbit_lock);
-#endif
-
 static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
 	struct pt_regs *regs);
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe Jaillet <[email protected]>

commit 4c4ac9a48ac512c6b5a6cca06cfad2ad96e8caaa upstream.

Commit 0e0da48dee8d ("parisc: mm: don't count preallocated pmds") introduced a memory leak.

After this commit, the 'return' statement in pmd_free is executed in all cases. Even for pmd that are not attached to the pgd. So 'free_pages' can never be called anymore, leading to a memory leak.

---
 arch/parisc/include/asm/pgalloc.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struc
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-	if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
+	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
 		/*
 		 * This is the permanent pmd attached to the pgd;
 		 * cannot free it.

@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_st
 		 */
 		mm_inc_nr_pmds(mm);
 		return;
+	}
 	free_pages((unsigned long)pmd, PMD_ORDER);
 }
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Robert Jarzmik <[email protected]>

commit a927ef895e288e79f1bfed221f27d7bfa37e907f upstream.

Since dm9000 driver added support for a vcc regulator, platform data based platforms have their ethernet broken, as the regulator claiming returns -EPROBE_DEFER and prevents dm9000 loading.

This patch fixes this for all pxa boards using dm9000, by using the specific regulator_has_full_constraints() function.

This was discovered and tested on the cm-x300 board.

---
 arch/arm/mach-pxa/capc7117.c       |    3 +++
 arch/arm/mach-pxa/cm-x2xx.c        |    3 +++
 arch/arm/mach-pxa/cm-x300.c        |    2 ++
 arch/arm/mach-pxa/colibri-pxa270.c |    3 +++
 arch/arm/mach-pxa/em-x270.c        |    2 ++
 arch/arm/mach-pxa/icontrol.c       |    3 +++
 arch/arm/mach-pxa/trizeps4.c       |    3 +++
 arch/arm/mach-pxa/vpac270.c        |    3 +++
 arch/arm/mach-pxa/zeus.c           |    2 ++
 9 files changed, 24 insertions(+)

@@ -24,6 +24,7 @@
 #include <linux/ata_platform.h>
 #include <linux/serial_8250.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>

@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
 
 	capc7117_uarts_init();
 	capc7117_ide_init();
+
+	regulator_has_full_constraints();
 }
 
 MACHINE_START(CAPC7117,

@@ -13,6 +13,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 
 #include <linux/dm9000.h>
 #include <linux/leds.h>

@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
 	cmx2xx_init_ac97();
 	cmx2xx_init_touchscreen();
 	cmx2xx_init_leds();
+
+	regulator_has_full_constraints();
 }
 
 static void __init cmx2xx_init_irq(void)

@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
 	cm_x300_init_ac97();
 	cm_x300_init_wi2wi();
 	cm_x300_init_bl();
+
+	regulator_has_full_constraints();
 }
 
 static void __init cm_x300_fixup(struct tag *tags, char **cmdline)

@@ -18,6 +18,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <linux/regulator/machine.h>
 #include <linux/ucb1400.h>
 
 #include <asm/mach/arch.h>

@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(v
 		printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
 				colibri_pxa270_baseboard);
 	}
+
+	regulator_has_full_constraints();
 }
 
 /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either

@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
 	em_x270_init_i2c();
 	em_x270_init_camera();
 	em_x270_userspace_consumers_init();
+
+	regulator_has_full_constraints();
 }
 
 MACHINE_START(EM_X270, "Compulab EM-X270")

@@ -26,6 +26,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/pxa2xx_spi.h>
 #include <linux/can/platform/mcp251x.h>
+#include <linux/regulator/machine.h>
 
 #include "generic.h"
 

@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
 	mxm_8x10_mmc_init();
 
 	icontrol_can_init();
+
+	regulator_has_full_constraints();
 }
 
 MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")

@@ -26,6 +26,7 @@
 #include <linux/dm9000.h>
 #include <linux/mtd/physmap.h>
 #include <linux/mtd/partitions.h>
+#include <linux/regulator/machine.h>
 #include <linux/i2c/pxa-i2c.h>
 
 #include <asm/types.h>

@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
 
 	BCR_writew(trizeps_conxs_bcr);
 	board_backlight_power(1);
+
+	regulator_has_full_constraints();
 }
 
 static void __init trizeps4_map_io(void)

@@ -24,6 +24,7 @@
 #include <linux/dm9000.h>
 #include <linux/ucb1400.h>
 #include <linux/ata_platform.h>
+#include <linux/regulator/machine.h>
 #include <linux/regulator/max1586.h>
 #include <linux/i2c/pxa-i2c.h>
 

@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
 	vpac270_ts_init();
 	vpac270_rtc_init();
 	vpac270_ide_init();
+
+	regulator_has_full_constraints();
 }
 
 MACHINE_START(VPAC270, "Voipac PXA270")

@@ -868,6 +868,8 @@ static void __init zeus_init(void)
 	i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
 	pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
 	spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
+
+	regulator_has_full_constraints();
 }
 
 static struct map_desc zeus_io_desc[] __initdata = {

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit 2acb5c301edf39ab6d066687ce70da1166e4de9e upstream.

Driver core sets "default" pinmux on on probe and CAN driver sets "sleep" pinmux during register. This causes a small window where the CAN pins are in "default" state with the DCAN module being disabled.

Change the "default" state to be like sleep so this glitch is avoided. Add a new "active" state that is used by the driver when CAN is actually active.

---
 arch/arm/boot/dts/dra7-evm.dts  |    5 +++--
 arch/arm/boot/dts/dra72-evm.dts |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

@@ -686,7 +686,8 @@
 
 &dcan1 {
 	status = "ok";
-	pinctrl-names = "default", "sleep";
-	pinctrl-0 = <&dcan1_pins_default>;
+	pinctrl-names = "default", "sleep", "active";
+	pinctrl-0 = <&dcan1_pins_sleep>;
 	pinctrl-1 = <&dcan1_pins_sleep>;
+	pinctrl-2 = <&dcan1_pins_default>;
 };

@@ -497,9 +497,10 @@
 
 &dcan1 {
 	status = "ok";
-	pinctrl-names = "default", "sleep";
-	pinctrl-0 = <&dcan1_pins_default>;
+	pinctrl-names = "default", "sleep", "active";
+	pinctrl-0 = <&dcan1_pins_sleep>;
 	pinctrl-1 = <&dcan1_pins_sleep>;
+	pinctrl-2 = <&dcan1_pins_default>;
 };
 
 &qspi {

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit 9ab402aed38b95d9ce453108622be0fc6f167568 upstream.

Without this USB2 breaks if USB1 is disabled or USB1 initializes after USB2 e.g. due to deferred probing.

---
 arch/arm/boot/dts/am57xx-beagle-x15.dts |    4 ++++
 1 file changed, 4 insertions(+)

@@ -544,6 +544,10 @@
 	phy-supply = <&ldousb_reg>;
 };
 
+&usb2_phy2 {
+	phy-supply = <&ldousb_reg>;
+};
+
 &usb1 {
 	dr_mode = "host";
 	pinctrl-names = "default";

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marek Szyprowski <[email protected]>

commit 462859aa7bbe1ac83ec4377a0a06fe60778f3f27 upstream.

nr_bitmaps member of mapping structure stores the number of already allocated bitmaps and it is interpreted as loop iterator (it starts from 0 not from 1), so a comparison against number of possible bitmap extensions should include this fact. This patch fixes this by changing the extension failure condition. This issue has been introduced by commit 4d852ef8c2544ce21ae41414099a7504c61164a0 ("arm: dma-mapping: Add support to extend DMA IOMMU mappings").

---
 arch/arm/mm/dma-mapping.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1953,7 +1953,7 @@ static int extend_iommu_mapping(struct d
 {
 	int next_bitmap;
 
-	if (mapping->nr_bitmaps > mapping->extensions)
+	if (mapping->nr_bitmaps >= mapping->extensions)
 		return -EINVAL;
 
 	next_bitmap = mapping->nr_bitmaps;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lucas Stach <[email protected]>

commit d438462c20a300139c2e5e65b96cadaa21b58d9a upstream.

If CONFIG_PM is not set the PU power domain needs to be enabled always, otherwise there are two failure scenarios which will hang the system if one of the devices in the PU domain is accessed.

1. New DTs (4.1+) drop the "always-on" property from the PU regulator, so if it isn't properly enabled by the GPC code it will be disabled at the end of boot.

2. If the bootloader already disabled the PU domain the GPC explicitly needs to enable it again, even if the kernel doesn't do any power management. This is a bit hypothetical, as it requires to boot a mainline kernel on a downstream bootloader, as no mainline bootloader disables the PM domains.

---
 arch/arm/mach-imx/gpc.c |   27 ++++++---------------------
 1 file changed, 6 insertions(+), 21 deletions(-)

@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
 	}
 }
 
-#ifdef CONFIG_PM_GENERIC_DOMAINS
-
 static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
 {
 	int iso, iso2sw;

@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc
 static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
 {
 	struct clk *clk;
-	bool is_off;
 	int i;
 
 	imx6q_pu_domain.reg = pu_reg;

@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct dev
 	}
 	imx6q_pu_domain.num_clks = i;
 
-	is_off = IS_ENABLED(CONFIG_PM);
-	if (is_off) {
-		_imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
-	} else {
-		/*
-		 * Enable power if compiled without CONFIG_PM in case the
-		 * bootloader disabled it.
-		 */
-		imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
-	}
+	/* Enable power always in case bootloader disabled it. */
+	imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
 
-	pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
+	if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
+		return 0;
+
+	pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
 	return of_genpd_add_provider_onecell(dev->of_node,
 					     &imx_gpc_onecell_data);
 

@@ -437,13 +429,6 @@ clk_err:
 	return -EINVAL;
 }
 
-#else
-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
-{
-	return 0;
-}
-#endif /* CONFIG_PM_GENERIC_DOMAINS */
-
 static int imx_gpc_probe(struct platform_device *pdev)
 {
 	struct regulator *pu_reg;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Markos Chandras <[email protected]>

commit 143fefc8f315cd10e046e6860913c421c3385cb1 upstream.

Commit 5f9f41c474befb4ebbc40b27f65bb7d649241581 ("MIPS: kernel: Prepare the JR instruction for emulation on MIPS R6") added support for emulating the JR instruction on MIPS R6 cores but that introduced a bug which could be triggered when hitting a JALR opcode because the code used the wrong field in the 'r_format' struct to determine the instruction opcode. This lead to crashes because an emulated JALR instruction was treated as a JR one when the R6 emulator was turned off.

Patchwork: https://patchwork.linux-mips.org/patch/10583/

---
 arch/mips/math-emu/cp1emu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -451,7 +451,7 @@ static int isBranchInstr(struct pt_regs
 			/* Fall through */
 		case jr_op:
 			/* For R6, JR already emulated in jalr_op */
-			if (NO_R6EMU && insn.r_format.opcode == jr_op)
+			if (NO_R6EMU && insn.r_format.func == jr_op)
 				break;
 			*contpc = regs->regs[insn.r_format.rs];
 			return 1;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Markos Chandras <[email protected]>

commit cccf34e9411c41b0cbfb41980fe55fc8e7c98fd2 upstream.

MT_SMP is not the only SMP option for MT cores. The MT_SMP option allows more than one VPE per core to appear as a secondary CPU in the system. Because of how CM works, it propagates the address-based cache ops to the secondary cores but not the index-based ones. Because of that, the code does not use IPIs to flush the L1 caches on secondary cores because the CM would have done that already. However, the CM functionality is independent of the type of SMP kernel so even in non-MT kernels, IPIs are not necessary. As a result of which, we change the conditional to depend on the CM presence. Moreover, since VPEs on the same core share the same L1 caches, there is no need to send an IPI on all of them so we calculate a suitable cpumask with only one VPE per core.

Patchwork: https://patchwork.linux-mips.org/patch/10654/

---
 arch/mips/include/asm/smp.h |    1 +
 arch/mips/kernel/smp.c      |   44 +++++++++++++++++++++++++++++++++++++++++++-
 arch/mips/mm/c-r4k.c        |   14 +++++++++++---
 3 files changed, 55 insertions(+), 4 deletions(-)

@@ -23,6 +23,7 @@
 extern int smp_num_siblings;
 extern cpumask_t cpu_sibling_map[];
 extern cpumask_t cpu_core_map[];
+extern cpumask_t cpu_foreign_map;
 
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 

@@ -37,6 +37,7 @@
 #include <asm/cacheflush.h> /* for run_uncached() */
 #include <asm/traps.h>
 #include <asm/dma-coherence.h>
+#include <asm/mips-cm.h>
 
 /*
  * Special Variant of smp_call_function for use by cache functions:

@@ -51,9 +52,16 @@ static inline void r4k_on_each_cpu(void
 {
 	preempt_disable();
 
-#ifndef CONFIG_MIPS_MT_SMP
-	smp_call_function(func, info, 1);
-#endif
+	/*
+	 * The Coherent Manager propagates address-based cache ops to other
+	 * cores but not index-based ops. However, r4k_on_each_cpu is used
+	 * in both cases so there is no easy way to tell what kind of op is
+	 * executed to the other cores. The best we can probably do is
+	 * to restrict that call when a CM is not present because both
+	 * CM-based SMP protocols (CMP & CPS) restrict index-based cache ops.
+	 */
+	if (!mips_cm_present())
+		smp_call_function_many(&cpu_foreign_map, func, info, 1);
 	func(info);
 	preempt_enable();
 }

Yes, I have objection. Please look into excepts from my mail exchange with Markos:

(history is skipped)

Note: the replacement of

if (config_enabled(CONFIG_SMP))

to
if (!mips_cm_present())

doesn't solve a problem - in CM-based environment the index cache ops MUST be delivered to other core via IPI.

- Leonid.

So, this is broken in Linus's tree too? Or is it fixed there, and if so, what is the git commit id?

thanks,

greg k-h

Yes.

There is no an accepted fix. My old patch is in

https://git.linux-mips.org/cgit/yegoshin/mips.git/commit/?id=98f6c462eb5319a4dcb3830f902c48141f38cd12

It was a precursor for my EVA set of patches since2.6.35.9 but was never accepted and was lost during redesign of EVA by Markos.

- Leonid.

I hope you realize that blocking this patch from the stable trees does not actually fix the problem. The patch may not be perfect but it's better than what we had before.

markos

Great, as long as I am consistent, that's all that I care about :)

Please work with the mips developers to get this accepted, and mark it for -stable as well.

thanks,

greg k-h

You asked "If anyone has any objections, please let me know" and I did that.

- Leonid.

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Burton <[email protected]>

commit 4e9d324d4288b082497c30bc55b8ad13acc7cf01 upstream.

MIPS32r6 code requires FP64 (ie. FR=1) support. Building a kernel with support for MIPS32r6 binaries but without support for O32 with FP64 is therefore a problem which can lead to incorrectly executed userland.

CONFIG_MIPS_O32_FP64_SUPPORT is already selected when the kernel is configured for MIPS32r6, but not when the kernel is configured for MIPS64r6 with O32 compat support. Select CONFIG_MIPS_O32_FP64_SUPPORT in such configurations to prevent building kernels which execute MIPS32r6 userland incorrectly.

Patchwork: https://patchwork.linux-mips.org/patch/10674/

---
 arch/mips/Kconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -1417,6 +1417,7 @@ config CPU_MIPS64_R6
 	select CPU_SUPPORTS_HIGHMEM
 	select CPU_SUPPORTS_MSA
 	select GENERIC_CSUM
+	select MIPS_O32_FP64_SUPPORT if MIPS32_O32
 	help
 	  Choose this option to build a kernel for release 6 or later of the
 	  MIPS64 architecture.  New MIPS processors, starting with the Warrior

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Markos Chandras <[email protected]>

commit fcc53b5f6c38acbf5d311ffc3e0da517491c6f7b upstream.

Commit 6134d94923d0 ("MIPS: asm: fpu: Allow 64-bit FPU on MIPS32 R6") added support for 64-bit FPU on a 32-bit MIPS R6 processor but it missed the 64-bit CPU case leading to FPU failures when requesting FR=1 mode (which is always the case for MIPS R6 userland) when running a 32-bit kernel on a 64-bit CPU. We also fix the MIPS R2 case.

Patchwork: https://patchwork.linux-mips.org/patch/10734/

---
 arch/mips/include/asm/fpu.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_
 		goto fr_common;
 
 	case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
+#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
       || defined(CONFIG_64BIT))
 		/* we only have a 32-bit FPU */
 		return SIGFPE;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <[email protected]>

commit d3b58c47d330de8c29898fe9746f7530408f8a59 upstream.

Commit 514ac99c64b "can: fix multiple delivery of a single CAN frame for overlapping CAN filters" requires the skb->tstamp to be set to check for identical CAN skbs.

Without timestamping to be required by user space applications this timestamp was not generated which lead to commit 36c01245eb8 "can: fix loss of CAN frames in raw_rcv" - which forces the timestamp to be set in all CAN related skbuffs by introducing several __net_timestamp() calls.

This forces e.g. out of tree drivers which are not using alloc_can{,fd}_skb() to add __net_timestamp() after skbuff creation to prevent the frame loss fixed in mainline Linux.

This patch removes the timestamp dependency and uses an atomic counter to create an unique identifier together with the skbuff pointer.

Btw: the new skbcnt element introduced in struct can_skb_priv has to be initialized with zero in out-of-tree drivers which are not using alloc_can{,fd}_skb() too.

---
 drivers/net/can/dev.c   |    7 ++-----
 drivers/net/can/slcan.c |    2 +-
 drivers/net/can/vcan.c  |    3 ---
 include/linux/can/skb.h |    2 ++
 net/can/af_can.c        |   12 +++++++-----
 net/can/bcm.c           |    2 ++
 net/can/raw.c           |    7 ++++---
 7 files changed, 18 insertions(+), 17 deletions(-)

@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net
 		struct can_frame *cf = (struct can_frame *)skb->data;
 		u8 dlc = cf->can_dlc;
 
-		if (!(skb->tstamp.tv64))
-			__net_timestamp(skb);
-
 		netif_rx(priv->echo_skb[idx]);
 		priv->echo_skb[idx] = NULL;
 

@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net
 	if (unlikely(!skb))
 		return NULL;
 
-	__net_timestamp(skb);
 	skb->protocol = htons(ETH_P_CAN);
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;

@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 
 	*cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
 	memset(*cf, 0, sizeof(struct can_frame));

@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct n
 	if (unlikely(!skb))
 		return NULL;
 
-	__net_timestamp(skb);
 	skb->protocol = htons(ETH_P_CANFD);
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;

@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct n
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 
 	*cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
 	memset(*cfd, 0, sizeof(struct canfd_frame));

@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
 	if (!skb)
 		return;
 
-	__net_timestamp(skb);
 	skb->dev = sl->dev;
 	skb->protocol = htons(ETH_P_CAN);
 	skb->pkt_type = PACKET_BROADCAST;

@@ -215,6 +214,7 @@ static void slc_bump(struct slcan *sl)
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = sl->dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 
 	memcpy(skb_put(skb, sizeof(struct can_frame)),
 	       &cf, sizeof(struct can_frame));

@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb,
 	skb->dev       = dev;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-	if (!(skb->tstamp.tv64))
-		__net_timestamp(skb);
-
 	netif_rx_ni(skb);
 }
 

@@ -27,10 +27,12 @@
 /**
  * struct can_skb_priv - private additional data inside CAN sk_buffs
  * @ifindex:	ifindex of the first interface the CAN frame appeared on
+ * @skbcnt:	atomic counter to have an unique id together with skb pointer
  * @cf:		align to the following CAN frame at skb->data
  */
 struct can_skb_priv {
 	int ifindex;
+	int skbcnt;
 	struct can_frame cf[0];
 };
 

@@ -89,6 +89,8 @@ struct timer_list can_stattimer;   /* ti
 struct s_stats    can_stats;       /* packet statistics */
 struct s_pstats   can_pstats;      /* receive list statistics */
 
+static atomic_t skbcounter = ATOMIC_INIT(0);
+
 /*
  * af_can socket functions
  */

@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int lo
 		return err;
 	}
 
-	if (newskb) {
-		if (!(newskb->tstamp.tv64))
-			__net_timestamp(newskb);
-
+	if (newskb)
 		netif_rx_ni(newskb);
-	}
 
 	/* update statistics */
 	can_stats.tx_frames++;

@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *
 	can_stats.rx_frames++;
 	can_stats.rx_frames_delta++;
 
+	/* create non-zero unique skb identifier together with *skb */
+	while (!(can_skb_prv(skb)->skbcnt))
+		can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
+
 	rcu_read_lock();
 
 	/* deliver the packet to sockets listening on all devices */

@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 
 	memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
 

@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *ms
 	}
 
 	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 	skb->dev = dev;
 	can_skb_set_owner(skb, sk);
 	err = can_send(skb, 1); /* send with loopback */

@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
  */
 
 struct uniqframe {
-	ktime_t tstamp;
+	int skbcnt;
 	const struct sk_buff *skb;
 	unsigned int join_rx_count;
 };

@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb
 
 	/* eliminate multiple filter matches for the same skb */
 	if (this_cpu_ptr(ro->uniq)->skb == oskb &&
-	    ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
+	    this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
 		if (ro->join_filters) {
 			this_cpu_inc(ro->uniq->join_rx_count);
 			/* drop frame until all enabled filters matched */

@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb
 		}
 	} else {
 		this_cpu_ptr(ro->uniq)->skb = oskb;
-		this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
+		this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
 		this_cpu_ptr(ro->uniq)->join_rx_count = 1;
 		/* drop first frame to check all enabled filters? */
 		if (ro->join_filters && ro->count > 1)

@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *so
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 
 	err = memcpy_from_msg(skb_put(skb, size), msg, size);
 	if (err < 0)

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergei Shtylyov <[email protected]>

commit 5e63e6baa159fa8c787cf783dbf3d77fbea97331 upstream.

rcar_can_probe() regards 0 as a wrong IRQ #, despite platform_get_irq() that it calls returns negative error code in that case. This leads to the following being printed to the console when attempting to open the device:

error requesting interrupt fffffffa

because rcar_can_open() calls request_irq() with a negative IRQ #, and that function naturally fails with -EINVAL.

Check for the negative error codes instead and propagate them upstream instead of just returning -ENODEV.

---
 drivers/net/can/rcar_can.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -758,8 +758,9 @@ static int rcar_can_probe(struct platfor
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
+	if (irq < 0) {
 		dev_err(&pdev->dev, "No IRQ resource\n");
+		err = irq;
 		goto fail;
 	}
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "J.D. Schroeder" <[email protected]>

commit 033365191136c97f88c81b7bd0011414db28bb4e upstream.

The previous change 3973c526ae9c (net: can: c_can: Disable pins when CAN interface is down) causes a slight glitch on the pinctrl settings when used. Since commit ab78029 (drivers/pinctrl: grab default handles from device core), the device core will automatically set the default pins. This causes the pins to be momentarily set to the default and then to the sleep state in register_c_can_dev(). By adding an optional "enable" state, boards can set the default pin state to be disabled and avoid the glitch when the switch from default to sleep first occurs. If the "enable" state is not available c_can_pinctrl_select_state() falls back to using the "default" pinctrl state.

[Roger Q] - Forward port to v4.2 and use pinctrl_get_select().

---
 drivers/net/can/c_can/c_can.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

@@ -592,6 +592,7 @@ static int c_can_start(struct net_device
 {
 	struct c_can_priv *priv = netdev_priv(dev);
 	int err;
+	struct pinctrl *p;
 
 	/* basic c_can configuration */
 	err = c_can_chip_config(dev);

@@ -604,8 +605,13 @@ static int c_can_start(struct net_device
 
 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
-	/* activate pins */
-	pinctrl_pm_select_default_state(dev->dev.parent);
+	/* Attempt to use "active" if available else use "default" */
+	p = pinctrl_get_select(priv->device, "active");
+	if (!IS_ERR(p))
+		pinctrl_put(p);
+	else
+		pinctrl_pm_select_default_state(priv->device);
+
 	return 0;
 }
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergei Shtylyov <[email protected]>

commit c1a4c87b06fa564d6e2760a12d4e5a09badc684b upstream.

Printing IRQ # using "%x" and "%u" unsigned formats isn't quite correct as 'ndev->irq' is of type *int*, so the "%d" format needs to be used instead.

While fixing this, beautify the dev_info() message in rcar_can_probe() a bit.

---
 drivers/net/can/rcar_can.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -526,7 +526,7 @@ static int rcar_can_open(struct net_devi
 	napi_enable(&priv->napi);
 	err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
 	if (err) {
-		netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
+		netdev_err(ndev, "error requesting interrupt %d\n", ndev->irq);
 		goto out_close;
 	}
 	can_led_event(ndev, CAN_LED_EVENT_OPEN);

@@ -824,7 +824,7 @@ static int rcar_can_probe(struct platfor
 
 	devm_can_led_init(ndev);
 
-	dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
+	dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
 		 priv->regs, ndev->irq);
 
 	return 0;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Agner <[email protected]>

commit 25b401c1816ae64bcc5dcb1d39ab41812522a0ce upstream.

If a valid power regulator or a dummy regulator is used (which happens to be the case when no regulator is specified), restart_work is queued no matter whether the device was running or not at suspend time. Since work queues get initialized in the ndo_open callback, resuming leads to a NULL pointer exception.

Reverse exactly the steps executed at suspend time:
- Enable the power regulator in any case
- Enable the transceiver regulator if the device was running, even in case we have a power regulator
- Queue restart_work only in case the device was running

---
 drivers/net/can/spi/mcp251x.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

@@ -1221,17 +1221,16 @@ static int __maybe_unused mcp251x_can_re
 	struct spi_device *spi = to_spi_device(dev);
 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
 
-	if (priv->after_suspend & AFTER_SUSPEND_POWER) {
+	if (priv->after_suspend & AFTER_SUSPEND_POWER)
 		mcp251x_power_enable(priv->power, 1);
+
+	if (priv->after_suspend & AFTER_SUSPEND_UP) {
+		mcp251x_power_enable(priv->transceiver, 1);
 		queue_work(priv->wq, &priv->restart_work);
 	} else {
-		if (priv->after_suspend & AFTER_SUSPEND_UP) {
-			mcp251x_power_enable(priv->transceiver, 1);
-			queue_work(priv->wq, &priv->restart_work);
-		} else {
-			priv->after_suspend = 0;
-		}
+		priv->after_suspend = 0;
 	}
+
 	priv->force_quit = 0;
 	enable_irq(spi->irq);
 	return 0;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Al Viro <[email protected]>

commit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e upstream.

Normally opening a file, unlinking it and then closing will have
the inode freed upon close() (provided that it's not otherwise busy and has no remaining links, of course). However, there's one case where that does *not* happen. Namely, if you open it by fhandle with cold dcache, then unlink() and close().

In normal case you get d_delete() in unlink(2) notice that dentry
is busy and unhash it; on the final dput() it will be forcibly evicted from dcache, triggering iput() and inode removal. In this case, though, we end up with *two* dentries - disconnected (created by open-by-fhandle) and regular one (used by unlink()). The latter will have its reference to inode dropped just fine, but the former will not - it's considered hashed (it is on the ->s_anon list), so it will stay around until the memory pressure will finally do it in. As the result, we have the final iput() delayed indefinitely. It's trivial to reproduce -

void flush_dcache(void)

{
        system("mount -o remount,rw /");
}

static char buf[20 * 1024 * 1024];

main()

{
        int fd;
        union {
                struct file_handle f;
                char buf[MAX_HANDLE_SZ];
        } x;
        int m;

        x.f.handle_bytes = sizeof(x);
        chdir("/root");
        mkdir("foo", 0700);
        fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
        close(fd);
        name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
        flush_dcache();
        fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
        unlink("foo/bar");
        write(fd, buf, sizeof(buf));
        system("df .");			/* 20Mb eaten */
        close(fd);
        system("df .");			/* should've freed those 20Mb */
        flush_dcache();
        system("df .");			/* should be the same as #2 */
}

will spit out something like
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 303843 1131 100% /
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 303843 1131 100% /
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 283282 21692 93% /
- inode gets freed only when dentry is finally evicted (here we trigger than by remount; normally it would've happened in response to memory pressure hell knows when).

---
 fs/dcache.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dent
 
 	/*
 	 * If we have a d_op->d_delete() operation, we sould not
-	 * let the dentry count go to zero, so use "put__or_lock".
+	 * let the dentry count go to zero, so use "put_or_lock".
 	 */
 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
 		return lockref_put_or_lock(&dentry->d_lockref);

@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dent
 	 */
 	smp_rmb();
 	d_flags = ACCESS_ONCE(dentry->d_flags);
-	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
+	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
 
 	/* Nothing to do? Dropping the reference was all we needed? */
 	if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))

@@ -776,6 +776,9 @@ repeat:
 	if (unlikely(d_unhashed(dentry)))
 		goto kill_it;
 
+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+		goto kill_it;
+
 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
 		if (dentry->d_op->d_delete(dentry))
 			goto kill_it;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <[email protected]>

commit d0f77d4d04b222a817925d33ba3589b190bfa863 upstream.

Currently x86_64_start_kernel() has two KASAN related function calls. The first call maps shadow to early_level4_pgt, the second maps shadow to init_level4_pgt.

If we move clear_page(init_level4_pgt) earlier, we could hide KASAN low level detail from generic x86_64 initialization code. The next patch will do it.

---
 arch/x86/kernel/head64.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -166,6 +166,8 @@ asmlinkage __visible void __init x86_64_
 	/* clear bss before set_intr_gate with early_idt_handler */
 	clear_bss();
 
+	clear_page(init_level4_pgt);
+
 	for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
 		set_intr_gate(i, early_idt_handler_array[i]);
 	load_idt((const struct desc_ptr *)&idt_descr);

@@ -177,7 +179,6 @@ asmlinkage __visible void __init x86_64_
 	 */
 	load_ucode_bsp();
 
-	clear_page(init_level4_pgt);
 	/* set init_level4_pgt kernel high mapping*/
 	init_level4_pgt[511] = early_level4_pgt[511];
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Popov <[email protected]>

commit 5d5aa3cfca5cf74cd928daf3674642e6004328d1 upstream.

Currently KASAN shadow region page tables created without respect of physical offset (phys_base). This causes kernel halt when phys_base is not zero.

So let's initialize KASAN shadow region page tables in kasan_early_init() using __pa_nodebug() which considers phys_base.

This patch also separates x86_64_start_kernel() from KASAN low level details by moving kasan_map_early_shadow(init_level4_pgt) into kasan_early_init().

Remove the comment before clear_bss() which stopped bringing much profit to the code readability. Otherwise describing all the new order dependencies would be too verbose.

---
 arch/x86/include/asm/kasan.h |    8 ++------
 arch/x86/kernel/head64.c     |    7 ++-----
 arch/x86/kernel/head_64.S    |   29 -----------------------------
 arch/x86/mm/kasan_init_64.c  |   36 ++++++++++++++++++++++++++++++++++--
 4 files changed, 38 insertions(+), 42 deletions(-)

@@ -14,15 +14,11 @@
 
 #ifndef __ASSEMBLY__
 
-extern pte_t kasan_zero_pte[];
-extern pte_t kasan_zero_pmd[];
-extern pte_t kasan_zero_pud[];
-
 #ifdef CONFIG_KASAN
-void __init kasan_map_early_shadow(pgd_t *pgd);
+void __init kasan_early_init(void);
 void __init kasan_init(void);
 #else
-static inline void kasan_map_early_shadow(pgd_t *pgd) { }
+static inline void kasan_early_init(void) { }
 static inline void kasan_init(void) { }
 #endif
 

@@ -161,13 +161,12 @@ asmlinkage __visible void __init x86_64_
 	/* Kill off the identity-map trampoline */
 	reset_early_page_tables();
 
-	kasan_map_early_shadow(early_level4_pgt);
-
-	/* clear bss before set_intr_gate with early_idt_handler */
 	clear_bss();
 
 	clear_page(init_level4_pgt);
 
+	kasan_early_init();
+
 	for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
 		set_intr_gate(i, early_idt_handler_array[i]);
 	load_idt((const struct desc_ptr *)&idt_descr);

@@ -182,8 +181,6 @@ asmlinkage __visible void __init x86_64_
 	/* set init_level4_pgt kernel high mapping*/
 	init_level4_pgt[511] = early_level4_pgt[511];
 
-	kasan_map_early_shadow(init_level4_pgt);
-
 	x86_64_start_reservations(real_mode_data);
 }
 

@@ -516,38 +516,9 @@ ENTRY(phys_base)
 	/* This must match the first entry in level2_kernel_pgt */
 	.quad   0x0000000000000000
 
-#ifdef CONFIG_KASAN
-#define FILL(VAL, COUNT)				\
-	.rept (COUNT) ;					\
-	.quad	(VAL) ;					\
-	.endr
-
-NEXT_PAGE(kasan_zero_pte)
-	FILL(kasan_zero_page - __START_KERNEL_map + _KERNPG_TABLE, 512)
-NEXT_PAGE(kasan_zero_pmd)
-	FILL(kasan_zero_pte - __START_KERNEL_map + _KERNPG_TABLE, 512)
-NEXT_PAGE(kasan_zero_pud)
-	FILL(kasan_zero_pmd - __START_KERNEL_map + _KERNPG_TABLE, 512)
-
-#undef FILL
-#endif
-
-
 #include "../../x86/xen/xen-head.S"
 	
 	__PAGE_ALIGNED_BSS
 NEXT_PAGE(empty_zero_page)
 	.skip PAGE_SIZE
 
-#ifdef CONFIG_KASAN
-/*
- * This page used as early shadow. We don't use empty_zero_page
- * at early stages, stack instrumentation could write some garbage
- * to this page.
- * Latter we reuse it as zero shadow for large ranges of memory
- * that allowed to access, but not instrumented by kasan
- * (vmalloc/vmemmap ...).
- */
-NEXT_PAGE(kasan_zero_page)
-	.skip PAGE_SIZE
-#endif

@@ -11,7 +11,19 @@
 extern pgd_t early_level4_pgt[PTRS_PER_PGD];
 extern struct range pfn_mapped[E820_X_MAX];
 
-extern unsigned char kasan_zero_page[PAGE_SIZE];
+static pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
+static pmd_t kasan_zero_pmd[PTRS_PER_PMD] __page_aligned_bss;
+static pte_t kasan_zero_pte[PTRS_PER_PTE] __page_aligned_bss;
+
+/*
+ * This page used as early shadow. We don't use empty_zero_page
+ * at early stages, stack instrumentation could write some garbage
+ * to this page.
+ * Latter we reuse it as zero shadow for large ranges of memory
+ * that allowed to access, but not instrumented by kasan
+ * (vmalloc/vmemmap ...).
+ */
+static unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
 
 static int __init map_range(struct range *range)
 {

@@ -36,7 +48,7 @@ static void __init clear_pgds(unsigned l
 		pgd_clear(pgd_offset_k(start));
 }
 
-void __init kasan_map_early_shadow(pgd_t *pgd)
+static void __init kasan_map_early_shadow(pgd_t *pgd)
 {
 	int i;
 	unsigned long start = KASAN_SHADOW_START;

@@ -166,6 +178,26 @@ static struct notifier_block kasan_die_n
 };
 #endif
 
+void __init kasan_early_init(void)
+{
+	int i;
+	pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
+	pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
+	pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
+
+	for (i = 0; i < PTRS_PER_PTE; i++)
+		kasan_zero_pte[i] = __pte(pte_val);
+
+	for (i = 0; i < PTRS_PER_PMD; i++)
+		kasan_zero_pmd[i] = __pmd(pmd_val);
+
+	for (i = 0; i < PTRS_PER_PUD; i++)
+		kasan_zero_pud[i] = __pud(pud_val);
+
+	kasan_map_early_shadow(early_level4_pgt);
+	kasan_map_early_shadow(init_level4_pgt);
+}
+
 void __init kasan_init(void)
 {
 	int i;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <[email protected]>

commit 241d2c54c62fa0939fc9a9512b48ac3434e90a89 upstream.

load_cr3() doesn't cause tlb_flush if PGE enabled.

This may cause tons of false positive reports spamming the kernel to death.

To fix this __flush_tlb_all() should be called explicitly after CR3 changed.

---
 arch/x86/mm/kasan_init_64.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -208,6 +208,7 @@ void __init kasan_init(void)
 
 	memcpy(early_level4_pgt, init_level4_pgt, sizeof(early_level4_pgt));
 	load_cr3(early_level4_pgt);
+	__flush_tlb_all();
 
 	clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 

@@ -234,5 +235,6 @@ void __init kasan_init(void)
 	memset(kasan_zero_page, 0, PAGE_SIZE);
 
 	load_cr3(init_level4_pgt);
+	__flush_tlb_all();
 	init_task.kasan_depth = 0;
 }

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <[email protected]>

commit d4f86beacc21d538dc41e1fc75a22e084f547edf upstream.

While populating zero shadow wrong bits in upper level page tables used. __PAGE_KERNEL_RO that was used for pgd/pud/pmd has _PAGE_BIT_GLOBAL set. Global bit is present only in the lowest level of the page translation hierarchy (ptes), and it should be zero in upper levels.

This bug seems doesn't cause any troubles on Intel cpus, while on AMDs it cause kernel crash on boot.

Use _KERNPG_TABLE bits for pgds/puds/pmds to fix this.

---
 arch/x86/mm/kasan_init_64.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -85,7 +85,7 @@ static int __init zero_pmd_populate(pud_
 	while (IS_ALIGNED(addr, PMD_SIZE) && addr + PMD_SIZE <= end) {
 		WARN_ON(!pmd_none(*pmd));
 		set_pmd(pmd, __pmd(__pa_nodebug(kasan_zero_pte)
-					| __PAGE_KERNEL_RO));
+					| _KERNPG_TABLE));
 		addr += PMD_SIZE;
 		pmd = pmd_offset(pud, addr);
 	}

@@ -111,7 +111,7 @@ static int __init zero_pud_populate(pgd_
 	while (IS_ALIGNED(addr, PUD_SIZE) && addr + PUD_SIZE <= end) {
 		WARN_ON(!pud_none(*pud));
 		set_pud(pud, __pud(__pa_nodebug(kasan_zero_pmd)
-					| __PAGE_KERNEL_RO));
+					| _KERNPG_TABLE));
 		addr += PUD_SIZE;
 		pud = pud_offset(pgd, addr);
 	}

@@ -136,7 +136,7 @@ static int __init zero_pgd_populate(unsi
 	while (IS_ALIGNED(addr, PGDIR_SIZE) && addr + PGDIR_SIZE <= end) {
 		WARN_ON(!pgd_none(*pgd));
 		set_pgd(pgd, __pgd(__pa_nodebug(kasan_zero_pud)
-					| __PAGE_KERNEL_RO));
+					| _KERNPG_TABLE));
 		addr += PGDIR_SIZE;
 		pgd = pgd_offset_k(addr);
 	}

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Vutla, Lokesh" <[email protected]>

commit acb33cc541d7a5495b16a133702d4c401ea4e294 upstream.

dma_unmap_sg() is being called twice after completing the task. Looks like this is a copy paste error when creating des driver.
With this the following warn appears during boot:

[    4.210457] ------------[ cut here ]------------
[    4.215114] WARNING: CPU: 0 PID: 0 at lib/dma-debug.c:1080 check_unmap+0x710/0x9a0()
[    4.222899] omap-des 480a5000.des: DMA-API: device driver tries to free DMA memory it has not allocated [device address=0x00000000ab2ce000] [size=8 bytes]
[    4.236785] Modules linked in:
[    4.239860] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.14.39-02999-g1bc045a-dirty #182
[    4.247918] [<c001678c>] (unwind_backtrace) from [<c0012574>] (show_stack+0x10/0x14)
[    4.255710] [<c0012574>] (show_stack) from [<c05a37e8>] (dump_stack+0x84/0xb8)
[    4.262977] [<c05a37e8>] (dump_stack) from [<c0046464>] (warn_slowpath_common+0x68/0x8c)
[    4.271107] [<c0046464>] (warn_slowpath_common) from [<c004651c>] (warn_slowpath_fmt+0x30/0x40)
[    4.279854] [<c004651c>] (warn_slowpath_fmt) from [<c02d50a4>] (check_unmap+0x710/0x9a0)
[    4.287991] [<c02d50a4>] (check_unmap) from [<c02d5478>] (debug_dma_unmap_sg+0x90/0x19c)
[    4.296128] [<c02d5478>] (debug_dma_unmap_sg) from [<c04a77d8>] (omap_des_done_task+0x1cc/0x3e4)
[    4.304963] [<c04a77d8>] (omap_des_done_task) from [<c004a090>] (tasklet_action+0x84/0x124)
[    4.313370] [<c004a090>] (tasklet_action) from [<c004a4ac>] (__do_softirq+0xf0/0x20c)
[    4.321235] [<c004a4ac>] (__do_softirq) from [<c004a840>] (irq_exit+0x98/0xec)
[    4.328500] [<c004a840>] (irq_exit) from [<c000f9ac>] (handle_IRQ+0x50/0xb0)
[    4.335589] [<c000f9ac>] (handle_IRQ) from [<c0008688>] (gic_handle_irq+0x28/0x5c)

Removing the duplicate call to dma_unmap_sg().

---
 drivers/crypto/omap-des.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struc
 	dmaengine_terminate_all(dd->dma_lch_in);
 	dmaengine_terminate_all(dd->dma_lch_out);
 
-	dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
-	dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
-
 	return err;
 }
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit e47994dd44bcb4a77b4152bd0eada585934703c0 upstream.

The sfpc inline assembly within execve_tail() may incorrectly set bits 28-31 of the sfpc instruction to a value which is not zero. These bits however are currently unused and therefore should be zero so we won't get surprised if these bits will be used in the future.

Therefore remove the second operand from the inline assembly.

---
 arch/s390/kernel/process.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flag
 asmlinkage void execve_tail(void)
 {
 	current->thread.fp_regs.fpc = 0;
-	asm volatile("sfpc %0,%0" : : "d" (0));
+	asm volatile("sfpc %0" : : "d" (0));
 }
 
 /*

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <[email protected]>

commit f9c87a6f46d508eae0d9ae640be98d50f237f827 upstream.

If the kernel is compiled with gcc 5.1 and the XZ compression option the decompress_kernel function calls _sclp_print_early in 64-bit mode while the content of the upper register half of %r6 is non-zero. This causes a specification exception on the servc instruction in _sclp_servc.

The _sclp_print_early function saves and restores the upper registers halves but it fails to clear them for the 31-bit code of the mini sclp driver.

---
 arch/s390/kernel/sclp.S |    4 ++++
 1 file changed, 4 insertions(+)

@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
 	jno	.Lesa2
 	ahi	%r15,-80
 	stmh	%r6,%r15,96(%r15)		# store upper register halves
+	basr	%r13,0
+	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
 .Lesa2:
 	lr	%r10,%r2			# save string pointer
 	lhi	%r2,0

@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
 .Lesa3:
 	lm	%r6,%r15,120(%r15)		# restore registers
 	br	%r14
+.Lzeroes:
+	.fill	64,4,0
 
 .LwritedataS4:
 	.long	0x00760005			# SCLP command for write data

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit cad49cfc44a5160e3fa09b18e4e7f7cacd13f27d upstream.

If a machine check happens, the machine has the vector facility installed and the extended save area exists, the cpu will save vector register contents into the extended save area. This is regardless of control register 0 contents, which enables and disables the vector facility during runtime.

On each machine check we should validate the vector registers. The current code however tries to validate the registers only if the running task is using vector registers in user space.

However even the current code is broken and causes vector register corruption on machine checks, if user space uses them:
the prefix area contains a pointer (absolute address) to the machine check extended save area. In order to save some space the save area was put into an unused area of the second prefix page.
When validating vector register contents the code uses the absolute address of the extended save area, which is wrong. Due to prefixing the vector instructions will then access contents using absolute addresses instead of real addresses, where the machine stored the contents.

If the above would work there is still the problem that register validition would only happen if user space uses vector registers. If kernel space uses them also, this may also lead to vector register content corruption:
if the kernel makes use of vector instructions, but the current running user space context does not, the machine check handler will validate floating point registers instead of vector registers.
Given the fact that writing to a floating point register may change the upper halve of the corresponding vector register, we also experience vector register corruption in this case.

Fix all of these issues, and always validate vector registers on each machine check, if the machine has the vector facility installed and the extended save area is defined.

---
 arch/s390/include/asm/ctl_reg.h |    5 +++
 arch/s390/kernel/nmi.c          |   51 +++++++++++++++++++++++-----------------
 2 files changed, 34 insertions(+), 22 deletions(-)

@@ -57,7 +57,10 @@ union ctlreg0 {
 		unsigned long lap  : 1; /* Low-address-protection control */
 		unsigned long	   : 4;
 		unsigned long edat : 1; /* Enhanced-DAT-enablement control */
-		unsigned long	   : 23;
+		unsigned long	   : 4;
+		unsigned long afp  : 1; /* AFP-register control */
+		unsigned long vx   : 1; /* Vector enablement control */
+		unsigned long	   : 17;
 	};
 };
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Holzheu <[email protected]>

commit 30342fe65e511007672437741158d493472f427f upstream.

Currently we assumed the following BPF to eBPF register mapping:

- BPF_REG_A -> BPF_REG_7
- BPF_REG_X -> BPF_REG_8

Unfortunately this mapping is wrong. The correct mapping is:

- BPF_REG_A -> BPF_REG_0
- BPF_REG_X -> BPF_REG_7

So clear the correct registers and use the BPF_REG_A and BPF_REG_X macros instead of BPF_REG_0/7.

---
 arch/s390/net/bpf_jit_comp.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -415,13 +415,13 @@ static void bpf_jit_prologue(struct bpf_
 		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
 			      BPF_REG_1, offsetof(struct sk_buff, data));
 	}
-	/* BPF compatibility: clear A (%b7) and X (%b8) registers */
-	if (REG_SEEN(BPF_REG_7))
-		/* lghi %b7,0 */
-		EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
-	if (REG_SEEN(BPF_REG_8))
-		/* lghi %b8,0 */
-		EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
+	/* BPF compatibility: clear A (%b0) and X (%b7) registers */
+	if (REG_SEEN(BPF_REG_A))
+		/* lghi %ba,0 */
+		EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
+	if (REG_SEEN(BPF_REG_X))
+		/* lghi %bx,0 */
+		EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
 }
 
 /*

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit 0b991f5cdcd6201e5401f83ca3a672343c3bfc49 upstream.

Stephen Powell reported the following crash on a z890 machine:

Kernel BUG at 00000000001219d0 [verbose debug info unavailable]
illegal operation: 0001 ilc:3 [#1] SMP
Krnl PSW : 0704e00180000000 00000000001219d0 (init_cache_level+0x38/0xe0)
	   R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 EA:3
Krnl Code: 00000000001219c2: a7840056		brc	8,121a6e
	   00000000001219c6: a7190000		lghi	%r1,0
	  #00000000001219ca: eb101000004c	ecag	%r1,%r0,0(%r1)
	  >00000000001219d0: a7390000		lghi	%r3,0
	   00000000001219d4: e310f0a00024	stg	%r1,160(%r15)
	   00000000001219da: a7080000		lhi	%r0,0
	   00000000001219de: a7b9f000		lghi	%r11,-4096
	   00000000001219e2: c0a0002899d9	larl	%r10,634d94
Call Trace:
 [<0000000000478ee2>] detect_cache_attributes+0x2a/0x2b8
 [<000000000097c9b0>] cacheinfo_sysfs_init+0x60/0xc8
 [<00000000001001c0>] do_one_initcall+0x98/0x1c8
 [<000000000094fdc2>] kernel_init_freeable+0x212/0x2d8
 [<000000000062352e>] kernel_init+0x26/0x118
 [<000000000062fd2e>] kernel_thread_starter+0x6/0xc

The illegal operation was executed because of a missing facility check, which should have made sure that the ECAG execution would only be executed on machines which have the general-instructions-extension facility installed.

---
 arch/s390/kernel/cache.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
 	union cache_topology ct;
 	enum cache_type ctype;
 
+	if (!test_facility(34))
+		return -EOPNOTSUPP;
 	if (!this_cpu_ci)
 		return -EINVAL;
 	ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vineet Gupta <[email protected]>

commit 97709069214eb75312c14946803b9da4d3814203 upstream.

ARC kernels have historically been built with -O3, despite top level Makefile defaulting to -O2. This was facilitated by implicitly ordering of arch makefile include AFTER top level assigned -O2.

An upstream fix to top level a1c48bb160f ("Makefile: Fix unrecognized cross-compiler command line options") changed the ordering, making ARC -O3 defunct.

Fix that by NOT relying on any ordering whatsoever and use the proper arch override facility now present in kbuild (ARCH_*FLAGS)

Depends-on: ("kbuild: Allow arch Makefiles to override {cpp,ld,c}flags")

---
 arch/arc/Makefile |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -43,7 +43,8 @@ endif
 
 ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
 # Generic build system uses -O2, we want -O3
-cflags-y  += -O3
+# Note: No need to add to cflags-y as that happens anyways
+ARCH_CFLAGS += -O3
 endif
 
 # small data is default for elf32 tool-chain. If not usable, disable it

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Brodkin <[email protected]>

commit f51e2f1911122879eefefa4c592dea8bf794b39c upstream.

Currently instruction_pointer() returns pt_regs->ret and so return value is of type "long", which implicitly stands for "signed long".

While that's perfectly fine when dealing with 32-bit values if return value of instruction_pointer() gets assigned to 64-bit variable sign extension may happen.

And at least in one real use-case it happens already.
In perf_prepare_sample() return value of perf_instruction_pointer() (which is an alias to instruction_pointer() in case of ARC) is assigned to (struct perf_sample_data)->ip (which type is "u64").

And what we see if instuction pointer points to user-space application that in case of ARC lays below 0x8000_0000 "ip" gets set properly with leading 32 zeros. But if instruction pointer points to kernel address space that starts from 0x8000_0000 then "ip" is set with 32 leadig "f"-s. I.e. id instruction_pointer() returns 0x8100_0000, "ip" will be assigned with 0xffff_ffff__8100_0000. Which is obviously wrong.

In particular that issuse broke output of perf, because perf was unable to associate addresses like 0xffff_ffff__8100_0000 with anything from /proc/kallsyms.

That's what we used to see:
----------->8----------

  6.27%  ls       [unknown]                [k] 0xffffffff8046c5cc
  2.96%  ls       libuClibc-0.9.34-git.so  [.] memcpy
  2.25%  ls       libuClibc-0.9.34-git.so  [.] memset
  1.66%  ls       [unknown]                [k] 0xffffffff80666536
  1.54%  ls       libuClibc-0.9.34-git.so  [.] 0x000224d6
  1.18%  ls       libuClibc-0.9.34-git.so  [.] 0x00022472

----------->8----------

With that change perf output looks much better now:
----------->8----------

  8.21%  ls       [kernel.kallsyms]        [k] memset
  3.52%  ls       libuClibc-0.9.34-git.so  [.] memcpy
  2.11%  ls       libuClibc-0.9.34-git.so  [.] malloc
  1.88%  ls       libuClibc-0.9.34-git.so  [.] memset
  1.64%  ls       [kernel.kallsyms]        [k] _raw_spin_unlock_irqrestore
  1.41%  ls       [kernel.kallsyms]        [k] __d_lookup_rcu

----------->8----------

---
 arch/arc/include/asm/ptrace.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -63,7 +63,7 @@ struct callee_regs {
 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
 };
 
-#define instruction_pointer(regs)	((regs)->ret)
+#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
 #define profile_pc(regs)		instruction_pointer(regs)
 
 /* return 1 if user mode or 0 if kernel mode */

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Marek <[email protected]>

commit 61754c18752ffb78145671e94f053fb202fff041 upstream.

Since commit a1c48bb1 (Makefile: Fix unrecognized cross-compiler command line options), the arch Makefile is included earlier by the main Makefile, preventing the arc architecture to set its -O3 compiler option. Since there might be more use cases for an arch Makefile to fine-tune the options, add support for ARCH_CPPFLAGS, ARCH_AFLAGS and ARCH_CFLAGS variables that are appended to the respective kbuild variables. The user still has the final say via the KCPPFLAGS, KAFLAGS and KCFLAGS variables.

---
 Documentation/kbuild/makefiles.txt |    8 ++++++++
 Makefile                           |    9 +++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

@@ -952,6 +952,14 @@ When kbuild executes, the following step
 	$(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
 	mode) if this option is supported by $(AR).
 
+    ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS   Overrides the kbuild defaults
+
+	These variables are appended to the KBUILD_CPPFLAGS,
+	KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
+	top-level Makefile has set any other flags. This provides a
+	means for an architecture to override the defaults.
+
+
 --- 6.2 Add prerequisites to archheaders:
 
 	The archheaders: rule is used to generate header files that

@@ -783,10 +783,11 @@ endif
 include scripts/Makefile.kasan
 include scripts/Makefile.extrawarn
 
-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
-KBUILD_CPPFLAGS += $(KCPPFLAGS)
-KBUILD_AFLAGS += $(KAFLAGS)
-KBUILD_CFLAGS += $(KCFLAGS)
+# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
+# last assignments
+KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
+KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
+KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
 
 # Use --build-id when available.
 LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <[email protected]>

commit bb8bd38b9a1685334b73e8c62e128cbedb875867 upstream.

bio_integrity_alloc() and bio_integrity_free() assume that if a bio was allocated from a bioset that that bioset also had its bio_integrity_pool allocated using bioset_integrity_create(). This is a very bad assumption given that bioset_create() and bioset_integrity_create() are completely disjoint. Not all callers of bioset_create() have been trained to also call bioset_integrity_create() -- and they may not care to be.

Fix this by falling back to kmalloc'ing 'struct bio_integrity_payload' rather than force all bioset consumers to (wastefully) preallocate a bio_integrity_pool that they very likely won't actually need (given the niche nature of the current block integrity support).

Otherwise, a NULL pointer "Kernel BUG" with a trace like the following will be observed (as seen on s390x using zfcp storage) because dm-io doesn't use bioset_integrity_create() when creating its bioset:

    [  791.643338] Call Trace:
    [  791.643339] ([<00000003df98b848>] 0x3df98b848)
    [  791.643341]  [<00000000002c5de8>] bio_integrity_alloc+0x48/0xf8
    [  791.643348]  [<00000000002c6486>] bio_integrity_prep+0xae/0x2f0
    [  791.643349]  [<0000000000371e38>] blk_queue_bio+0x1c8/0x3d8
    [  791.643355]  [<000000000036f8d0>] generic_make_request+0xc0/0x100
    [  791.643357]  [<000000000036f9b2>] submit_bio+0xa2/0x198
    [  791.643406]  [<000003ff801f9774>] dispatch_io+0x15c/0x3b0 [dm_mod]
    [  791.643419]  [<000003ff801f9b3e>] dm_io+0x176/0x2f0 [dm_mod]
    [  791.643423]  [<000003ff8074b28a>] do_reads+0x13a/0x1a8 [dm_mirror]
    [  791.643425]  [<000003ff8074b43a>] do_mirror+0x142/0x298 [dm_mirror]
    [  791.643428]  [<0000000000154fca>] process_one_work+0x18a/0x3f8
    [  791.643432]  [<000000000015598a>] worker_thread+0x132/0x3b0
    [  791.643435]  [<000000000015d49a>] kthread+0xd2/0xd8
    [  791.643438]  [<00000000005bc0ca>] kernel_thread_starter+0x6/0xc
    [  791.643446]  [<00000000005bc0c4>] kernel_thread_starter+0x0/0xc

---
 block/bio-integrity.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integr
 	unsigned long idx = BIO_POOL_NONE;
 	unsigned inline_vecs;
 
-	if (!bs) {
+	if (!bs || !bs->bio_integrity_pool) {
 		bip = kmalloc(sizeof(struct bio_integrity_payload) +
 			      sizeof(struct bio_vec) * nr_vecs, gfp_mask);
 		inline_vecs = nr_vecs;

@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
 		kfree(page_address(bip->bip_vec->bv_page) +
 		      bip->bip_vec->bv_offset);
 
-	if (bs) {
+	if (bs && bs->bio_integrity_pool) {
 		if (bip->bip_slab != BIO_POOL_NONE)
 			bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
 				  bip->bip_slab);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Haggai Eran <[email protected]>

commit c9d120b0b2b5069cb2ae62f8eac0cef31c8544be upstream.

If dma-debug is disabled due to a memory error, DMA unmaps do not affect the dma_active_cacheline radix tree anymore, and debug_dma_assert_idle() can print false warnings.

Disable debug_dma_assert_idle() when dma_debug_disabled() is true.

---
 lib/dma-debug.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *
 	unsigned long flags;
 	phys_addr_t cln;
 
+	if (dma_debug_disabled())
+		return;
+
 	if (!page)
 		return;
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 4d0e677523a999e1dec28e55cc314c47ba09ca12 upstream.

When a monitor stream is active, the next PCM stream access results in EBUSY error because of the check in line6_stream_start(). Fix this by just skipping the submission of pending URBs when the stream is already running instead.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101431

---
 sound/usb/line6/pcm.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd
 	int ret = 0;
 
 	spin_lock_irqsave(&pstr->lock, flags);
-	if (!test_and_set_bit(type, &pstr->running)) {
-		if (pstr->active_urbs || pstr->unlink_urbs) {
-			ret = -EBUSY;
-			goto error;
-		}
-
+	if (!test_and_set_bit(type, &pstr->running) &&
+	    !(pstr->active_urbs || pstr->unlink_urbs)) {
 		pstr->count = 0;
 		/* Submit all currently available URBs */
 		if (direction == SNDRV_PCM_STREAM_PLAYBACK)

@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd
 		else
 			ret = line6_submit_audio_in_all_urbs(line6pcm);
 	}
- error:
 	if (ret < 0)
 		clear_bit(type, &pstr->running);
 	spin_unlock_irqrestore(&pstr->lock, flags);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 67756e3191c90e7c0b94b8b2fb63de255b6cd337 upstream.

With the nonatomic PCM ops, the system may spew lockdep warnings like:

=============================================
[ INFO: possible recursive locking detected ]
4.2.0-rc1-jeejaval3 #12 Not tainted
---------------------------------------------
aplay/4029 is trying to acquire lock:
(snd_pcm_link_rwsem){.+.+.+}, at: [<ffffffff816fd473>] snd_pcm_stream_lock+0x43/0x60

but task is already holding lock:
(snd_pcm_link_rwsem){.+.+.+}, at: [<ffffffff816fcf29>] snd_pcm_action_nonatomic+0x29/0x80

other info that might help us debug this:

  Possible unsafe locking scenario:

        CPU0
        ----

lock(snd_pcm_link_rwsem);
lock(snd_pcm_link_rwsem);

Although this is false-positive as the rwsem is taken always as read-only for these code paths, it's certainly annoying to see this at any occasion. A simple fix is to use down_read_nested() in snd_pcm_stream_lock() that can be called inside another lock.

---
 sound/core/pcm_native.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem)
 void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
 {
 	if (substream->pcm->nonatomic) {
-		down_read(&snd_pcm_link_rwsem);
+		down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
 		mutex_lock(&substream->self_group.mutex);
 	} else {
 		read_lock(&snd_pcm_link_rwlock);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mateusz Sylwestrzak <[email protected]>

commit 0420694dddeb9e269a1ab2129a0119a5cea294a4 upstream.

Acer Aspire V5 with the ALC282 codec is given the wrong value for the 0x19 PIN by the laptop's BIOS. Overriding it with the correct value adds support for the headset microphone which would not otherwise be visible in the system.

The fix is based on commit 7819717b1134 with a similar quirk for Acer Aspire with the ALC269 codec.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96201

---
 sound/pci/hda/patch_realtek.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -5004,7 +5004,7 @@ static const struct hda_fixup alc269_fix
 			{ 0x14, 0x90170110 },
 			{ 0x17, 0x40000008 },
 			{ 0x18, 0x411111f0 },
-			{ 0x19, 0x411111f0 },
+			{ 0x19, 0x01a1913c },
 			{ 0x1a, 0x411111f0 },
 			{ 0x1b, 0x411111f0 },
 			{ 0x1d, 0x40f89b2d },

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maruthi Srinivas Bayyavarapu <[email protected]>

commit 5022813ddb28b7679e8285812d52aaeb7e1e7657 upstream.

Fixes audio problems on newer asics

---
 sound/pci/hda/hda_intel.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -2056,6 +2056,8 @@ static const struct pci_device_id azx_id
 	/* ATI HDMI */
 	{ PCI_DEVICE(0x1002, 0x1308),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+	{ PCI_DEVICE(0x1002, 0x157a),
+	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
 	{ PCI_DEVICE(0x1002, 0x793b),
 	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
 	{ PCI_DEVICE(0x1002, 0x7919),

@@ -2110,8 +2112,14 @@ static const struct pci_device_id azx_id
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
 	{ PCI_DEVICE(0x1002, 0xaab0),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+	{ PCI_DEVICE(0x1002, 0xaac0),
+	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
 	{ PCI_DEVICE(0x1002, 0xaac8),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+	{ PCI_DEVICE(0x1002, 0xaad8),
+	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+	{ PCI_DEVICE(0x1002, 0xaae8),
+	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
 	/* VIA VT8251/VT8237A */
 	{ PCI_DEVICE(0x1106, 0x3288),
 	  .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aaron Plattner <[email protected]>

commit 6c3d91193d829bf58a35a10650415b05a736ca6c upstream.

Vendor ID 0x10de007d is used by a yet-to-be-named GPU chip.

This chip also has the 2-ch audio swapping bug, so patch_nvhdmi is appropriate here.

---
 sound/pci/hda/patch_hdmi.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -3333,6 +3333,7 @@ static const struct hda_codec_preset snd
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",	.patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",	.patch = patch_nvhdmi },
 { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",	.patch = patch_nvhdmi },
+{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP",	.patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },

@@ -3396,6 +3397,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067"
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
 MODULE_ALIAS("snd-hda-codec-id:10de0072");
+MODULE_ALIAS("snd-hda-codec-id:10de007d");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Henningsson <[email protected]>

commit cba59972a1191a0c1647a52fe745eed7a4b34b38 upstream.

Without this patch, the headset mic will not work on this machine.

---
 sound/pci/hda/patch_realtek.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

@@ -5382,6 +5382,17 @@ static const struct snd_hda_pin_quirk al
 		{0x1d, 0x40700001},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x12, 0x40000000},
+		{0x14, 0x90170130},
+		{0x17, 0x411111f0},
+		{0x18, 0x411111f0},
+		{0x19, 0x411111f0},
+		{0x1a, 0x411111f0},
+		{0x1b, 0x01014020},
+		{0x1d, 0x4054c029},
+		{0x1e, 0x411111f0},
+		{0x21, 0x0221103f}),
+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		{0x12, 0x90a60160},
 		{0x14, 0x90170120},
 		{0x17, 0x90170140},

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit b9d9c9efc292dd0ffe172780f915ed74eba3556c upstream.

Toshiba Satellite S50D has another model with a different PCI SSID (1179:fa93) while the previous fixup was for 1179:fa91. Adjust the fixup entry with SND_PCI_QUIRK_MASK() to match with both devices.

---
 sound/pci/hda/patch_sigmatel.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2920,7 +2920,8 @@ static const struct snd_pci_quirk stac92
 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
 		      "HP Mini", STAC_92HD83XXX_HP_LED),
 	SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
-	SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
+	/* match both for 0xfa91 and 0xfa93 */
+	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_TOSHIBA, 0xfffd, 0xfa91,
 		      "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
 	{} /* terminator */
 };

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 3a05d12f46cb95a6a685114819363a56e6170996 upstream.

Dell Vostro 5480 (1028:069a) needs the very same quirk used for Vostro 5470 model to make bass speakers properly working.

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

@@ -5114,6 +5114,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
+	SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
 	SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yao-Wen Mao <[email protected]>

commit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.

Add the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.

---
 sound/usb/mixer_maps.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

@@ -341,6 +341,20 @@ static const struct usbmix_name_map scms
 	{ 0 }
 };
 
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+	{ 3, NULL, .dB = &bose_companion5_dB },
+	{ 0 }	/* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+	{ 7, NULL, .dB = &dragonfly_1_2_dB },
+	{ 0 }	/* terminator */
+};
+
 /*
  * Control map entries
  */

@@ -451,6 +465,16 @@ static struct usbmix_ctl_map usbmix_ctl_
 		.id = USB_ID(0x25c4, 0x0003),
 		.map = scms_usb3318_map,
 	},
+	{
+		/* Bose Companion 5 */
+		.id = USB_ID(0x05a7, 0x1020),
+		.map = bose_companion5_map,
+	},
+	{
+		/* Dragonfly DAC 1.2 */
+		.id = USB_ID(0x21b4, 0x0081),
+		.map = dragonfly_1_2_map,
+	},
 	{ 0 } /* terminator */
 };
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 649ccd08534ee26deb2e5b08509800d0e95167f5 upstream.

MacBook Pro 5,2 with ALC889 codec had already a fixup entry, but this seems not working correctly, a fix for pin NID 0x15 is needed in addition. It's equivalent with the fixup for MacBook Air 1,1, so use this instead.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102131

---
 sound/pci/hda/patch_realtek.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2224,7 +2224,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
-	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
+	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
 
 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email protected]>

commit a833581e372a4adae2319d8dc379493edbc444e9 upstream.

Mikulas reported his K6-3 not booting. This is because the static_key API confusion struck and bit Andy, this wants to be static_key_false().

---
 arch/x86/include/asm/mmu_context.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_av
 
 static inline void load_mm_cr4(struct mm_struct *mm)
 {
-	if (static_key_true(&rdpmc_always_available) ||
+	if (static_key_false(&rdpmc_always_available) ||
 	    atomic_read(&mm->context.perf_rdpmc_allowed))
 		cr4_set_bits(X86_CR4_PCE);
 	else

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <[email protected]>

commit 621739b00e16ca2d80411dc9b111cb15b91f3ba9 upstream.

This reverts commit 9a0e609e3fd8a95c96629b9fbde6b8c5b9a1456a. (Resolved a conflict during revert due to commit bfebd1cdb4 that came after)

This revert is motivated by a couple failure reports on request-based DM multipath testbeds:
1) Netapp reported that their multipath fault injection test under heavy IO load can stall longer than 300 seconds.
2) IBM reported elevated lock contention in their testbed (likely due to increased back pressure due to IO not being dispatched as quickly):
https://www.redhat.com/archives/dm-devel/2015-July/msg00057.html

---
 drivers/md/dm.c |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

@@ -1053,13 +1053,10 @@ static struct dm_rq_target_io *tio_from_
  */
 static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
 {
-	int nr_requests_pending;
-
 	atomic_dec(&md->pending[rw]);
 
 	/* nudge anyone waiting on suspend queue */
-	nr_requests_pending = md_in_flight(md);
-	if (!nr_requests_pending)
+	if (!md_in_flight(md))
 		wake_up(&md->wait);
 
 	/*

@@ -1071,8 +1068,7 @@ static void rq_completed(struct mapped_d
 	if (run_queue) {
 		if (md->queue->mq_ops)
 			blk_mq_run_hw_queues(md->queue, true);
-		else if (!nr_requests_pending ||
-			 (nr_requests_pending >= md->queue->nr_congestion_on))
+		else
 			blk_run_queue_async(md->queue);
 	}
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <[email protected]>

commit 591e5bec13f15feb13fc445b6c9c59954711c4ac upstream.

The GICv3 ITS architecture allows a given [DevID, EventID] pair to be translated to a [LPI, Collection] pair, where DevID is the device writing the MSI, EventID is the payload being written, LPI is the actual interrupt number, and Collection is roughly equivalent to a target CPU.

Each LPI can be mapped to a separate collection, but the ITS driver insists on maintaining the collection on a device basis, instead of doing it on a per interrupt basis.

This is obviously flawed, and this patch fixes it by adding a per interrupt index that indicates which collection number is in use.

---
 drivers/irqchip/irq-gic-v3-its.c |  111 ++++++++++++++++++++++++++-------------
 1 file changed, 75 insertions(+), 36 deletions(-)

@@ -75,6 +75,13 @@ struct its_node {
 
 #define ITS_ITT_ALIGN		SZ_256
 
+struct event_lpi_map {
+	unsigned long		*lpi_map;
+	u16			*col_map;
+	irq_hw_number_t		lpi_base;
+	int			nr_lpis;
+};
+
 /*
  * The ITS view of a device - belongs to an ITS, a collection, owns an
  * interrupt translation table, and a list of interrupts.

@@ -82,11 +89,8 @@ struct its_node {
 struct its_device {
 	struct list_head	entry;
 	struct its_node		*its;
-	struct its_collection	*collection;
+	struct event_lpi_map	event_map;
 	void			*itt;
-	unsigned long		*lpi_map;
-	irq_hw_number_t		lpi_base;
-	int			nr_lpis;
 	u32			nr_ites;
 	u32			device_id;
 };

@@ -99,6 +103,14 @@ static struct rdists *gic_rdists;
 #define gic_data_rdist()		(raw_cpu_ptr(gic_rdists->rdist))
 #define gic_data_rdist_rd_base()	(gic_data_rdist()->rd_base)
 
+static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+					       u32 event)
+{
+	struct its_node *its = its_dev->its;
+
+	return its->collections + its_dev->event_map.col_map[event];
+}
+
 /*
  * ITS command descriptors - parameters to be encoded in a command
  * block.

@@ -134,7 +146,7 @@ struct its_cmd_desc {
 		struct {
 			struct its_device *dev;
 			struct its_collection *col;
-			u32 id;
+			u32 event_id;
 		} its_movi_cmd;
 
 		struct {

@@ -241,7 +253,7 @@ static struct its_collection *its_build_
 
 	its_fixup_cmd(cmd);
 
-	return desc->its_mapd_cmd.dev->collection;
+	return NULL;
 }
 
 static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,

@@ -260,52 +272,72 @@ static struct its_collection *its_build_
 static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
 						  struct its_cmd_desc *desc)
 {
+	struct its_collection *col;
+
+	col = dev_event_to_col(desc->its_mapvi_cmd.dev,
+			       desc->its_mapvi_cmd.event_id);
+
 	its_encode_cmd(cmd, GITS_CMD_MAPVI);
 	its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
 	its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
 	its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
-	its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
+	its_encode_collection(cmd, col->col_id);
 
 	its_fixup_cmd(cmd);
 
-	return desc->its_mapvi_cmd.dev->collection;
+	return col;
 }
 
 static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
 						 struct its_cmd_desc *desc)
 {
+	struct its_collection *col;
+
+	col = dev_event_to_col(desc->its_movi_cmd.dev,
+			       desc->its_movi_cmd.event_id);
+
 	its_encode_cmd(cmd, GITS_CMD_MOVI);
 	its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
-	its_encode_event_id(cmd, desc->its_movi_cmd.id);
+	its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
 	its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
 
 	its_fixup_cmd(cmd);
 
-	return desc->its_movi_cmd.dev->collection;
+	return col;
 }
 
 static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
 						    struct its_cmd_desc *desc)
 {
+	struct its_collection *col;
+
+	col = dev_event_to_col(desc->its_discard_cmd.dev,
+			       desc->its_discard_cmd.event_id);
+
 	its_encode_cmd(cmd, GITS_CMD_DISCARD);
 	its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
 	its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
 
 	its_fixup_cmd(cmd);
 
-	return desc->its_discard_cmd.dev->collection;
+	return col;
 }
 
 static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
 						struct its_cmd_desc *desc)
 {
+	struct its_collection *col;
+
+	col = dev_event_to_col(desc->its_inv_cmd.dev,
+			       desc->its_inv_cmd.event_id);
+
 	its_encode_cmd(cmd, GITS_CMD_INV);
 	its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
 	its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
 
 	its_fixup_cmd(cmd);
 
-	return desc->its_inv_cmd.dev->collection;
+	return col;
 }
 
 static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,

@@ -497,7 +529,7 @@ static void its_send_movi(struct its_dev
 
 	desc.its_movi_cmd.dev = dev;
 	desc.its_movi_cmd.col = col;
-	desc.its_movi_cmd.id = id;
+	desc.its_movi_cmd.event_id = id;
 
 	its_send_single_command(dev->its, its_build_movi_cmd, &desc);
 }

@@ -528,7 +560,7 @@ static void its_send_invall(struct its_n
 static inline u32 its_get_event_id(struct irq_data *d)
 {
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
-	return d->hwirq - its_dev->lpi_base;
+	return d->hwirq - its_dev->event_map.lpi_base;
 }
 
 static void lpi_set_config(struct irq_data *d, bool enable)

@@ -583,7 +615,7 @@ static int its_set_affinity(struct irq_d
 
 	target_col = &its_dev->its->collections[cpu];
 	its_send_movi(its_dev, target_col, id);
-	its_dev->collection = target_col;
+	its_dev->event_map.col_map[id] = cpu;
 
 	return IRQ_SET_MASK_OK_DONE;
 }

@@ -713,8 +745,10 @@ out:
 	return bitmap;
 }
 
-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+static void its_lpi_free(struct event_lpi_map *map)
 {
+	int base = map->lpi_base;
+	int nr_ids = map->nr_lpis;
 	int lpi;
 
 	spin_lock(&lpi_lock);

@@ -731,7 +765,8 @@ static void its_lpi_free(unsigned long *
 
 	spin_unlock(&lpi_lock);
 
-	kfree(bitmap);
+	kfree(map->lpi_map);
+	kfree(map->col_map);
 }
 
 /*

@@ -1099,11 +1134,11 @@ static struct its_device *its_create_dev
 	struct its_device *dev;
 	unsigned long *lpi_map;
 	unsigned long flags;
+	u16 *col_map = NULL;
 	void *itt;
 	int lpi_base;
 	int nr_lpis;
 	int nr_ites;
-	int cpu;
 	int sz;
 
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);

@@ -1117,20 +1152,24 @@ static struct its_device *its_create_dev
 	sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
 	itt = kzalloc(sz, GFP_KERNEL);
 	lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
+	if (lpi_map)
+		col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
 
-	if (!dev || !itt || !lpi_map) {
+	if (!dev || !itt || !lpi_map || !col_map) {
 		kfree(dev);
 		kfree(itt);
 		kfree(lpi_map);
+		kfree(col_map);
 		return NULL;
 	}
 
 	dev->its = its;
 	dev->itt = itt;
 	dev->nr_ites = nr_ites;
-	dev->lpi_map = lpi_map;
-	dev->lpi_base = lpi_base;
-	dev->nr_lpis = nr_lpis;
+	dev->event_map.lpi_map = lpi_map;
+	dev->event_map.col_map = col_map;
+	dev->event_map.lpi_base = lpi_base;
+	dev->event_map.nr_lpis = nr_lpis;
 	dev->device_id = dev_id;
 	INIT_LIST_HEAD(&dev->entry);
 

@@ -1138,10 +1177,6 @@ static struct its_device *its_create_dev
 	list_add(&dev->entry, &its->its_device_list);
 	raw_spin_unlock_irqrestore(&its->lock, flags);
 
-	/* Bind the device to the first possible CPU */
-	cpu = cpumask_first(cpu_online_mask);
-	dev->collection = &its->collections[cpu];
-
 	/* Map device to its ITT */
 	its_send_mapd(dev, 1);
 

@@ -1163,12 +1198,13 @@ static int its_alloc_device_irq(struct i
 {
 	int idx;
 
-	idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
-	if (idx == dev->nr_lpis)
+	idx = find_first_zero_bit(dev->event_map.lpi_map,
+				  dev->event_map.nr_lpis);
+	if (idx == dev->event_map.nr_lpis)
 		return -ENOSPC;
 
-	*hwirq = dev->lpi_base + idx;
-	set_bit(idx, dev->lpi_map);
+	*hwirq = dev->event_map.lpi_base + idx;
+	set_bit(idx, dev->event_map.lpi_map);
 
 	return 0;
 }

@@ -1288,7 +1324,8 @@ static int its_irq_domain_alloc(struct i
 		irq_domain_set_hwirq_and_chip(domain, virq + i,
 					      hwirq, &its_irq_chip, its_dev);
 		dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
-			(int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
+			(int)(hwirq - its_dev->event_map.lpi_base),
+			(int)hwirq, virq + i);
 	}
 
 	return 0;

@@ -1300,6 +1337,9 @@ static void its_irq_domain_activate(stru
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
 	u32 event = its_get_event_id(d);
 
+	/* Bind the LPI to the first possible CPU */
+	its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
+
 	/* Map the GIC IRQ and event to the device */
 	its_send_mapvi(its_dev, d->hwirq, event);
 }

@@ -1327,17 +1367,16 @@ static void its_irq_domain_free(struct i
 		u32 event = its_get_event_id(data);
 
 		/* Mark interrupt index as unused */
-		clear_bit(event, its_dev->lpi_map);
+		clear_bit(event, its_dev->event_map.lpi_map);
 
 		/* Nuke the entry in the domain */
 		irq_domain_reset_irq_data(data);
 	}
 
 	/* If all interrupts have been freed, start mopping the floor */
-	if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
-		its_lpi_free(its_dev->lpi_map,
-			     its_dev->lpi_base,
-			     its_dev->nr_lpis);
+	if (bitmap_empty(its_dev->event_map.lpi_map,
+			 its_dev->event_map.nr_lpis)) {
+		its_lpi_free(&its_dev->event_map);
 
 		/* Unmap device/itt */
 		its_send_mapd(its_dev, 0);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jens Axboe <[email protected]>

commit 1278dd6809b11dc298e19d81ac0916275f7318c1 upstream.

Commit 1e6f2416044c0 changed the scsi sysfs 'queue_depth' code to rejects depths higher than the scsi host template setting. But lots of hosts set this to 1, and update the settings in the scsi host when the controller/devices probing happens.

This breaks (at least) mpt2sas and mpt3sas runtime setting of queue depth, returning EINVAL for all settings but '1'. And once it's set to 1, there's no way to go back up.

---
 drivers/scsi/scsi_sysfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *de
 
 	depth = simple_strtoul(buf, NULL, 0);
 
-	if (depth < 1 || depth > sht->can_queue)
+	if (depth < 1 || depth > sdev->host->can_queue)
 		return -EINVAL;
 
 	retval = sht->change_queue_depth(sdev, depth);

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Battersby <[email protected]>

commit 0c958ecc69c277b25f38f72bc6d18ab145e8167c upstream.

Fix a memory leak with scsi-mq triggered by commands with large data transfer length.

__sg_alloc_table() sets both table->nents and table->orig_nents to the same value. When the scatterlist is DMA-mapped, table->nents is overwritten with the (possibly smaller) size of the DMA-mapped scatterlist, while table->orig_nents retains the original size of the allocated scatterlist. scsi_free_sgtable() should therefore check orig_nents instead of nents, and all code that initializes sdb->table without calling __sg_alloc_table() should set both nents and orig_nents.

---
 drivers/scsi/scsi_error.c |    2 +-
 drivers/scsi/scsi_lib.c   |    6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd
 			    scmd->sdb.length);
 		scmd->sdb.table.sgl = &ses->sense_sgl;
 		scmd->sc_data_direction = DMA_FROM_DEVICE;
-		scmd->sdb.table.nents = 1;
+		scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
 		scmd->cmnd[0] = REQUEST_SENSE;
 		scmd->cmnd[4] = scmd->sdb.length;
 		scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);

@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc
 
 static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
 {
-	if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS)
+	if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
 		return;
 	__sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
 }

@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scs
 
 	if (mq) {
 		if (nents <= SCSI_MAX_SG_SEGMENTS) {
-			sdb->table.nents = nents;
-			sg_init_table(sdb->table.sgl, sdb->table.nents);
+			sdb->table.nents = sdb->table.orig_nents = nents;
+			sg_init_table(sdb->table.sgl, nents);
 			return 0;
 		}
 		first_chunk = sdb->table.sgl;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Giuseppe Cavallaro <[email protected]>

commit 0f4f2afd4402883a51ad27a1d9e046643bb1e3cb upstream.

While proving lock, the following warning happens and it is fixed after initializing lock in the setup function

INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.10.27-02861-g39df285-dirty #33
[<c00154ac>] (unwind_backtrace+0x0/0xf4) from [<c0011b50>] (show_stack+0x10/0x14)
[<c0011b50>] (show_stack+0x10/0x14) from [<c00689ac>] (__lock_acquire+0x900/0xb14)
[<c00689ac>] (__lock_acquire+0x900/0xb14) from [<c0069394>] (lock_acquire+0x68/0x7c)
[<c0069394>] (lock_acquire+0x68/0x7c) from [<c04958f8>] (_raw_spin_lock_irqsave+0x48/0x5c)
[<c04958f8>] (_raw_spin_lock_irqsave+0x48/0x5c) from [<c0381e6c>] (clk_gate_endisable+0x28/0x88)
[<c0381e6c>] (clk_gate_endisable+0x28/0x88) from [<c0381ee0>] (clk_gate_enable+0xc/0x14)
[<c0381ee0>] (clk_gate_enable+0xc/0x14) from [<c0386c68>] (flexgen_enable+0x28/0x40)
[<c0386c68>] (flexgen_enable+0x28/0x40) from [<c037f260>] (__clk_enable+0x5c/0x9c)
[<c037f260>] (__clk_enable+0x5c/0x9c) from [<c037f558>] (clk_enable+0x18/0x2c)
[<c037f558>] (clk_enable+0x18/0x2c) from [<c064a1dc>] (st_lpc_of_register+0xc0/0x248)
[<c064a1dc>] (st_lpc_of_register+0xc0/0x248) from [<c0649e44>] (clocksource_of_init+0x34/0x58)
[<c0649e44>] (clocksource_of_init+0x34/0x58) from [<c0637ddc>] (sti_timer_init+0x10/0x18)
[<c0637ddc>] (sti_timer_init+0x10/0x18) from [<c06343f8>] (time_init+0x20/0x30)
[<c06343f8>] (time_init+0x20/0x30) from [<c0632984>] (start_kernel+0x20c/0x2e8)
[<c0632984>] (start_kernel+0x20c/0x2e8) from [<40008074>] (0x40008074)

---
 drivers/clk/st/clk-flexgen.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -303,6 +303,8 @@ void __init st_of_flexgen_setup(struct d
 	if (!rlock)
 		goto err;
 
+	spin_lock_init(rlock);
+
 	for (i = 0; i < clk_data->clk_num; i++) {
 		struct clk *clk;
 		const char *clk_name;

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gabriel Fernandez <[email protected]>

commit 3be6d8ce639d92e60d144fb99dd74a53fe3799bb upstream.

This patch fixes the mux bit-setting for ClockgenA9.

---
 drivers/clk/st/clkgen-mux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -582,7 +582,7 @@ static struct clkgen_mux_data stih416_a9
 };
 static struct clkgen_mux_data stih407_a9_mux_data = {
 	.offset = 0x1a4,
-	.shift = 1,
+	.shift = 0,
 	.width = 2,
 };
 

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pankaj Dev <[email protected]>

commit 56551da9255f20ffd3a9711728a1a3ad4b7100af upstream.

Incorrect register offset used for sthi407 clockgenC

---
 drivers/clk/st/clkgen-fsyn.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -340,7 +340,7 @@ static const struct clkgen_quadfs_data s
 		    CLKGEN_FIELD(0x30c, 0xf, 20),
 		    CLKGEN_FIELD(0x310, 0xf, 20) },
 	.lockstatus_present = true,
-	.lock_status = CLKGEN_FIELD(0x2A0, 0x1, 24),
+	.lock_status = CLKGEN_FIELD(0x2f0, 0x1, 24),
 	.powerup_polarity = 1,
 	.standby_polarity = 1,
 	.pll_ops	= &st_quadfs_pll_c32_ops,

4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tom Hughes <[email protected]>

commit 4479004e6409087d1b4986881dc98c6c15dffb28 upstream.