--- /dev/null
+From 61f8ff693923e4b19748b0e8287b99778f2661c7 Mon Sep 17 00:00:00 2001
+From: Chris Bainbridge <chris.bainbridge@gmail.com>
+Date: Wed, 22 Apr 2015 16:40:21 +0100
+Subject: ACPI / SBS: Enable battery manager when present
+
+From: Chris Bainbridge <chris.bainbridge@gmail.com>
+
+commit 61f8ff693923e4b19748b0e8287b99778f2661c7 upstream.
+
+Commit 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on
+Apple) introduced a regression disabling the SBS battery manager.
+The battery manager should be marked as present when
+acpi_manager_get_info() returns 0.
+
+Fixes: 9faf6136ff46 (ACPI / SBS: Disable smart battery manager on Apple)
+Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/sbs.c
++++ b/drivers/acpi/sbs.c
+@@ -670,7 +670,7 @@ static int acpi_sbs_add(struct acpi_devi
+ if (!sbs_manager_broken) {
+ result = acpi_manager_get_info(sbs);
+ if (!result) {
+- sbs->manager_present = 0;
++ sbs->manager_present = 1;
+ for (id = 0; id < MAX_SBS_BAT; ++id)
+ if ((sbs->batteries_supported & (1 << id)))
+ acpi_battery_add(sbs, id);
--- /dev/null
+From 7241ea558c6715501e777396b5fc312c372e11d9 Mon Sep 17 00:00:00 2001
+From: Peter Zubaj <pzubaj@marticonet.sk>
+Date: Tue, 28 Apr 2015 21:57:29 +0200
+Subject: ALSA: emu10k1: Emu10k2 32 bit DMA mode
+
+From: Peter Zubaj <pzubaj@marticonet.sk>
+
+commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream.
+
+Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two
+modes for DMA. Second mode is useful for 64 bit os with more then 2 GB
+of ram (fixes problems with big soundfont loading)
+
+1) 32MB from 2 GB address space using 8192 pages (used now as default)
+2) 16MB from 4 GB address space using 4096 pages
+
+Mode is set using HCFG_EXPANDED_MEM flag in HCFG register.
+Also format of emu10k2 page table is then different.
+
+Signed-off-by: Peter Zubaj <pzubaj@marticonet.sk>
+Tested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/emu10k1.h | 14 +++++++++-----
+ sound/pci/emu10k1/emu10k1_callback.c | 4 ++--
+ sound/pci/emu10k1/emu10k1_main.c | 17 ++++++++++++-----
+ sound/pci/emu10k1/emupcm.c | 2 +-
+ sound/pci/emu10k1/memory.c | 11 ++++++-----
+ 5 files changed, 30 insertions(+), 18 deletions(-)
+
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -41,7 +41,8 @@
+
+ #define EMUPAGESIZE 4096
+ #define MAXREQVOICES 8
+-#define MAXPAGES 8192
++#define MAXPAGES0 4096 /* 32 bit mode */
++#define MAXPAGES1 8192 /* 31 bit mode */
+ #define RESERVED 0
+ #define NUM_MIDI 16
+ #define NUM_G 64 /* use all channels */
+@@ -50,8 +51,7 @@
+
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
+-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
+- /* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */
+
+ #define TMEMSIZE 256*1024
+ #define TMEMSIZEREG 4
+@@ -466,8 +466,11 @@
+
+ #define MAPB 0x0d /* Cache map B */
+
+-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
+-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
++
++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
+
+ /* 0x0e, 0x0f: Not used */
+
+@@ -1704,6 +1707,7 @@ struct snd_emu10k1 {
+ unsigned short model; /* subsystem id */
+ unsigned int card_type; /* EMU10K1_CARD_* */
+ unsigned int ecard_ctrl; /* ecard control bits */
++ unsigned int address_mode; /* address mode */
+ unsigned long dma_mask; /* PCI DMA mask */
+ unsigned int delay_pcm_irq; /* in samples */
+ int max_cache_pages; /* max memory size / PAGE_SIZE */
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+
+ /* invalidate maps */
+- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+
+ /* invalidate maps */
+- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_e
+ snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
+ snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */
+
+- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ for (ch = 0; ch < NUM_G; ch++) {
+ snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_e
+ outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ }
+
++ if (emu->address_mode == 0) {
++ /* use 16M in 4G */
++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++ }
++
+ return 0;
+ }
+
+@@ -1877,8 +1882,10 @@ int snd_emu10k1_create(struct snd_card *
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
++ /* set addressing mode */
++ emu->address_mode = is_audigy ? 0 : 1;
+ /* set the DMA transfer mask */
+- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ dev_err(card->dev,
+@@ -1903,7 +1910,7 @@ int snd_emu10k1_create(struct snd_card *
+
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+- 32 * 1024, &emu->ptb_pages) < 0) {
++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ err = -ENOMEM;
+ goto error;
+ }
+@@ -2002,8 +2009,8 @@ int snd_emu10k1_create(struct snd_card *
+
+ /* Clear silent pages and set up pointers */
+ memset(emu->silent_page.area, 0, PAGE_SIZE);
+- silent_page = emu->silent_page.addr << 1;
+- for (idx = 0; idx < MAXPAGES; idx++)
++ silent_page = emu->silent_page.addr << emu->address_mode;
++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+
+ /* set up voice indices */
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -380,7 +380,7 @@ static void snd_emu10k1_pcm_init_voice(s
+ snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ /* invalidate maps */
+- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ /* modulation envelope */
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+ * aligned pages in others
+ */
+ #define __set_ptb_entry(emu,page,addr) \
+- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+
+ #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct
+ }
+ page = blk->mapped_page + blk->pages;
+ }
+- size = MAX_ALIGN_PAGES - page;
++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ if (size >= max_size) {
+ *nextp = pos;
+ return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10
+ q = get_emu10k1_memblk(p, mapped_link);
+ end_page = q->mapped_page;
+ } else
+- end_page = MAX_ALIGN_PAGES;
++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+
+ /* remove links */
+ list_del(&blk->mapped_link);
+@@ -307,7 +308,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10
+ if (snd_BUG_ON(!emu))
+ return NULL;
+ if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ return NULL;
+ hdr = emu->memhdr;
+ if (snd_BUG_ON(!hdr))
--- /dev/null
+From d02260824e2cad626fb2a9d62e27006d34b6dedc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 27 Apr 2015 13:00:09 +0200
+Subject: ALSA: emu10k1: Fix card shortname string buffer overflow
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.
+
+Some models provide too long string for the shortname that has 32bytes
+including the terminator, and it results in a non-terminated string
+exposed to the user-space. This isn't too critical, though, as the
+string is stopped at the succeeding longname string.
+
+This patch fixes such entries by dropping "SB" prefix (it's enough to
+fit within 32 bytes, so far). Meanwhile, it also changes strcpy()
+with strlcpy() to make sure that this kind of problem won't happen in
+future, too.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/emu10k1/emu10k1.c | 6 ++++--
+ sound/pci/emu10k1/emu10k1_main.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct
+ }
+ #endif
+
+- strcpy(card->driver, emu->card_capabilities->driver);
+- strcpy(card->shortname, emu->card_capabilities->name);
++ strlcpy(card->driver, emu->card_capabilities->driver,
++ sizeof(card->driver));
++ strlcpy(card->shortname, emu->card_capabilities->name,
++ sizeof(card->shortname));
+ snprintf(card->longname, sizeof(card->longname),
+ "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -1421,7 +1421,7 @@ static struct snd_emu_chip_details emu_c
+ *
+ */
+ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0108_chip = 1,
+@@ -1571,7 +1571,7 @@ static struct snd_emu_chip_details emu_c
+ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
+ .ac97_chip = 1} ,
+ {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0102_chip = 1,
--- /dev/null
+From 07b0e5d49d227e3950cb13a3e8caf248ef2a310e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 27 Apr 2015 14:50:39 +0200
+Subject: ALSA: emux: Fix mutex deadlock at unloading
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 07b0e5d49d227e3950cb13a3e8caf248ef2a310e upstream.
+
+The emux-synth driver has a possible AB/BA mutex deadlock at unloading
+the emu10k1 driver:
+
+ snd_emux_free() ->
+ snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) ->
+ snd_seq_delete_kernel_client() ->
+ snd_seq_free_client(): mutex_lock(®ister_mutex)
+
+ snd_seq_release() ->
+ snd_seq_free_client(): mutex_lock(®ister_mutex) ->
+ snd_seq_delete_all_ports() ->
+ snd_emux_unuse(): mutex_lock(&emu->register_mutex)
+
+Basically snd_emux_detach_seq() doesn't need a protection of
+emu->register_mutex as it's already being unregistered. So, we can
+get rid of this for avoiding the deadlock.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/synth/emux/emux_seq.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu
+ if (emu->voices)
+ snd_emux_terminate_all(emu);
+
+- mutex_lock(&emu->register_mutex);
+ if (emu->client >= 0) {
+ snd_seq_delete_kernel_client(emu->client);
+ emu->client = -1;
+ }
+- mutex_unlock(&emu->register_mutex);
+ }
+
+
--- /dev/null
+From 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Apr 2015 17:11:44 +0200
+Subject: ALSA: emux: Fix mutex deadlock in OSS emulation
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream.
+
+The OSS emulation in synth-emux helper has a potential AB/BA deadlock
+at the simultaneous closing and opening:
+
+ close ->
+ snd_seq_release() ->
+ sne_seq_free_client() ->
+ snd_seq_delete_all_ports(): takes client->ports_mutex ->
+ port_delete() ->
+ snd_emux_unuse(): takes emux->register_mutex
+
+ open ->
+ snd_seq_oss_open() ->
+ snd_emux_open_seq_oss(): takes emux->register_mutex ->
+ snd_seq_event_port_attach() ->
+ snd_seq_create_port(): takes client->ports_mutex
+
+This patch addresses the deadlock by reducing the rance taking
+emux->register_mutex in snd_emux_open_seq_oss(). The lock is needed
+for the refcount handling, so move it locally. The calls in
+emux_seq.c are already with the mutex, thus they are replaced with the
+version without mutex lock/unlock.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/synth/emux/emux_oss.c | 11 +----------
+ sound/synth/emux/emux_seq.c | 27 +++++++++++++++++++++------
+ 2 files changed, 22 insertions(+), 16 deletions(-)
+
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss
+ if (snd_BUG_ON(!arg || !emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+-
+- if (!snd_emux_inc_count(emu)) {
+- mutex_unlock(&emu->register_mutex);
++ if (!snd_emux_inc_count(emu))
+ return -EFAULT;
+- }
+
+ memset(&callback, 0, sizeof(callback));
+ callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss
+ if (p == NULL) {
+ snd_printk(KERN_ERR "can't create port\n");
+ snd_emux_dec_count(emu);
+- mutex_unlock(&emu->register_mutex);
+ return -ENOMEM;
+ }
+
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss
+ reset_port_mode(p, arg->seq_mode);
+
+ snd_emux_reset_port(p);
+-
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_os
+ if (snd_BUG_ON(!emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+ snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ snd_emux_dec_count(emu);
+
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -267,8 +267,8 @@ snd_emux_event_input(struct snd_seq_even
+ /*
+ * increment usage count
+ */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ emu->used++;
+ if (!try_module_get(emu->ops.owner))
+@@ -282,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ return 1;
+ }
+
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++ int ret;
++
++ mutex_lock(&emu->register_mutex);
++ ret = __snd_emux_inc_count(emu);
++ mutex_unlock(&emu->register_mutex);
++ return ret;
++}
+
+ /*
+ * decrease usage count
+ */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ module_put(emu->card->module);
+ emu->used--;
+@@ -296,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ module_put(emu->ops.owner);
+ }
+
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++ mutex_lock(&emu->register_mutex);
++ __snd_emux_dec_count(emu);
++ mutex_unlock(&emu->register_mutex);
++}
+
+ /*
+ * Routine that is called upon a first use of a particular port
+@@ -315,7 +330,7 @@ snd_emux_use(void *private_data, struct
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_init_port(p);
+- snd_emux_inc_count(emu);
++ __snd_emux_inc_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+@@ -338,7 +353,7 @@ snd_emux_unuse(void *private_data, struc
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+- snd_emux_dec_count(emu);
++ __snd_emux_dec_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
--- /dev/null
+From 7290006d8c0900c56d8c58428134f02c35109d17 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 27 Apr 2015 10:40:45 +0200
+Subject: ALSA: hda - Add mute-LED mode control to Thinkpad
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7290006d8c0900c56d8c58428134f02c35109d17 upstream.
+
+This patch adds the missing flag to enable "Mute-LED Mode" mixer enum
+ctl for Thinkpads that have also the software mute-LED control.
+
+Reported-and-tested-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/thinkpad_helper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -72,6 +72,7 @@ static void hda_fixup_thinkpad_acpi(stru
+ if (led_set_func(TPACPI_LED_MUTE, false) >= 0) {
+ old_vmaster_hook = spec->vmaster_mute.hook;
+ spec->vmaster_mute.hook = update_tpacpi_mute_led;
++ spec->vmaster_mute_enum = 1;
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
--- /dev/null
+From ee52e56e7b12834476cd0031c5986254ba1b6317 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 27 Apr 2015 10:36:11 +0200
+Subject: ALSA: hda - Fix mute-LED fixed mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream.
+
+The mute-LED mode control has the fixed on/off states that are
+supposed to remain on/off regardless of the master switch. However,
+this doesn't work actually because the vmaster hook is called in the
+vmaster code itself.
+
+This patch fixes it by calling the hook indirectly after checking the
+mute LED mode.
+
+Reported-and-tested-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3027,6 +3027,16 @@ static struct snd_kcontrol_new vmaster_m
+ .put = vmaster_mute_mode_put,
+ };
+
++/* meta hook to call each driver's vmaster hook */
++static void vmaster_hook(void *private_data, int enabled)
++{
++ struct hda_vmaster_mute_hook *hook = private_data;
++
++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER)
++ enabled = hook->mute_mode;
++ hook->hook(hook->codec, enabled);
++}
++
+ /**
+ * snd_hda_add_vmaster_hook - Add a vmaster hook for mute-LED
+ * @codec: the HDA codec
+@@ -3045,9 +3055,9 @@ int snd_hda_add_vmaster_hook(struct hda_
+
+ if (!hook->hook || !hook->sw_kctl)
+ return 0;
+- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec);
+ hook->codec = codec;
+ hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER;
++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook);
+ if (!expose_enum_ctl)
+ return 0;
+ kctl = snd_ctl_new1(&vmaster_mute_mode, hook);
+@@ -3073,14 +3083,7 @@ void snd_hda_sync_vmaster_hook(struct hd
+ */
+ if (hook->codec->bus->shutdown)
+ return;
+- switch (hook->mute_mode) {
+- case HDA_VMUTE_FOLLOW_MASTER:
+- snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+- break;
+- default:
+- hook->hook(hook->codec, hook->mute_mode);
+- break;
+- }
++ snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_sync_vmaster_hook);
+
--- /dev/null
+From 2cff98b99c469880ce830cbcde015b53b67e0a7b Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Wed, 29 Apr 2015 16:09:18 +0100
+Subject: arm64: add missing PAGE_ALIGN() to __dma_free()
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 2cff98b99c469880ce830cbcde015b53b67e0a7b upstream.
+
+__dma_alloc() does a PAGE_ALIGN() on the passed in size argument before
+doing anything else. __dma_free() does not. And because it doesn't, it is
+possible to leak memory should size not be an integer multiple of PAGE_SIZE.
+
+The solution is to add a PAGE_ALIGN() to __dma_free() like is done in
+__dma_alloc().
+
+Additionally, this patch removes a redundant PAGE_ALIGN() from
+__dma_alloc_coherent(), since __dma_alloc_coherent() can only be called
+from __dma_alloc(), which already does a PAGE_ALIGN() before the call.
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/dma-mapping.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -104,7 +104,6 @@ static void *__dma_alloc_coherent(struct
+ struct page *page;
+ void *addr;
+
+- size = PAGE_ALIGN(size);
+ page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
+ get_order(size));
+ if (!page)
+@@ -193,6 +192,8 @@ static void __dma_free(struct device *de
+ {
+ void *swiotlb_addr = phys_to_virt(dma_to_phys(dev, dma_handle));
+
++ size = PAGE_ALIGN(size);
++
+ if (!is_device_dma_coherent(dev)) {
+ if (__free_from_pool(vaddr, size))
+ return;
--- /dev/null
+From 6829e274a623187c24f7cfc0e3d35f25d087fcc5 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 23 Apr 2015 12:46:16 +0100
+Subject: arm64: dma-mapping: always clear allocated buffers
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 upstream.
+
+Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha,
+ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.
+It turned out that some drivers rely on this 'feature'. Allocated buffer
+might be also exposed to userspace with dma_mmap() call, so clearing it
+is desired from security point of view to avoid exposing random memory
+to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64
+architecture with other implementations by unconditionally zeroing
+allocated buffer.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/dma-mapping.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -67,8 +67,7 @@ static void *__alloc_from_pool(size_t si
+
+ *ret_page = phys_to_page(phys);
+ ptr = (void *)val;
+- if (flags & __GFP_ZERO)
+- memset(ptr, 0, size);
++ memset(ptr, 0, size);
+ }
+
+ return ptr;
+@@ -113,8 +112,7 @@ static void *__dma_alloc_coherent(struct
+
+ *dma_handle = phys_to_dma(dev, page_to_phys(page));
+ addr = page_address(page);
+- if (flags & __GFP_ZERO)
+- memset(addr, 0, size);
++ memset(addr, 0, size);
+ return addr;
+ } else {
+ return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
--- /dev/null
+From a2d97723cb3a7741af81868427b36bba274b681b Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Wed, 22 Apr 2015 13:58:47 +0100
+Subject: ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit a2d97723cb3a7741af81868427b36bba274b681b upstream.
+
+Correct small copy and paste error where autodisable was not being
+enabled for the SOC_DAPM_SINGLE_TLV_AUTODISABLE control.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/soc-dapm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -287,7 +287,7 @@ struct device;
+ .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_READWRITE,\
+ .tlv.p = (tlv_array), \
+ .get = snd_soc_dapm_get_volsw, .put = snd_soc_dapm_put_volsw, \
+- .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 0) }
++ .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 1) }
+ #define SOC_DAPM_SINGLE_TLV_VIRT(xname, max, tlv_array) \
+ SOC_DAPM_SINGLE(xname, SND_SOC_NOPM, 0, max, 0, tlv_array)
+ #define SOC_DAPM_ENUM(xname, xenum) \
--- /dev/null
+From 74d6ea52aeef0236242221c6eff6d892565c5a92 Mon Sep 17 00:00:00 2001
+From: Bard Liao <bardliao@realtek.com>
+Date: Fri, 24 Apr 2015 15:19:29 +0800
+Subject: ASoC: rt5677: add register patch for PLL
+
+From: Bard Liao <bardliao@realtek.com>
+
+commit 74d6ea52aeef0236242221c6eff6d892565c5a92 upstream.
+
+The PLL output will be unstable in some cases. We can fix it by
+setting some registers.
+
+Signed-off-by: Bard Liao <bardliao@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5677.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -62,6 +62,9 @@ static const struct reg_default init_lis
+ {RT5677_PR_BASE + 0x1e, 0x0000},
+ {RT5677_PR_BASE + 0x12, 0x0eaa},
+ {RT5677_PR_BASE + 0x14, 0x018a},
++ {RT5677_PR_BASE + 0x15, 0x0490},
++ {RT5677_PR_BASE + 0x38, 0x0f71},
++ {RT5677_PR_BASE + 0x39, 0x0f71},
+ };
+ #define RT5677_INIT_REG_LEN ARRAY_SIZE(init_list)
+
--- /dev/null
+From 60a8d62b8497c23eb3d48149af7e55dac2dd83a2 Mon Sep 17 00:00:00 2001
+From: Bard Liao <bardliao@realtek.com>
+Date: Tue, 28 Apr 2015 11:27:39 +0800
+Subject: ASoC: rt5677: fixed wrong DMIC ref clock
+
+From: Bard Liao <bardliao@realtek.com>
+
+commit 60a8d62b8497c23eb3d48149af7e55dac2dd83a2 upstream.
+
+DMIC clock source is not from codec system clock directly. it is
+generated from the division of system clock. And it should be 256 *
+sample rate of AIF1.
+
+Signed-off-by: Bard Liao <bardliao@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5677.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -904,7 +904,7 @@ static int set_dmic_clk(struct snd_soc_d
+ {
+ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+ struct rt5677_priv *rt5677 = snd_soc_codec_get_drvdata(codec);
+- int idx = rl6231_calc_dmic_clk(rt5677->sysclk);
++ int idx = rl6231_calc_dmic_clk(rt5677->lrck[RT5677_AIF1] << 8);
+
+ if (idx < 0)
+ dev_err(codec->dev, "Failed to set DMIC clock\n");
--- /dev/null
+From c479163a1b6ab424786fbcd9225b4e3c1c58eb0b Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Thu, 16 Apr 2015 20:18:02 +0800
+Subject: ASoC: samsung: s3c24xx-i2s: Fix return value check in s3c24xx_iis_dev_probe()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit c479163a1b6ab424786fbcd9225b4e3c1c58eb0b upstream.
+
+In case of error, the function devm_ioremap_resource() returns
+ERR_PTR() and never returns NULL. The NULL test in the return
+value check should be replaced with IS_ERR().
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Reviewed-by: Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/samsung/s3c24xx-i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/samsung/s3c24xx-i2s.c
++++ b/sound/soc/samsung/s3c24xx-i2s.c
+@@ -461,8 +461,8 @@ static int s3c24xx_iis_dev_probe(struct
+ return -ENOENT;
+ }
+ s3c24xx_i2s.regs = devm_ioremap_resource(&pdev->dev, res);
+- if (s3c24xx_i2s.regs == NULL)
+- return -ENXIO;
++ if (IS_ERR(s3c24xx_i2s.regs))
++ return PTR_ERR(s3c24xx_i2s.regs);
+
+ s3c24xx_i2s_pcm_stereo_out.dma_addr = res->start + S3C2410_IISFIFO;
+ s3c24xx_i2s_pcm_stereo_in.dma_addr = res->start + S3C2410_IISFIFO;
--- /dev/null
+From 427ced4b203dfea4f08b1298cd1f88e19039fca4 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Thu, 16 Apr 2015 20:17:46 +0800
+Subject: ASoC: tfa9879: Fix return value check in tfa9879_i2c_probe()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit 427ced4b203dfea4f08b1298cd1f88e19039fca4 upstream.
+
+In case of error, the function devm_kzalloc() returns NULL
+not ERR_PTR(). The IS_ERR() test in the return value check
+should be replaced with NULL test.
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Acked-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tfa9879.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/tfa9879.c
++++ b/sound/soc/codecs/tfa9879.c
+@@ -280,8 +280,8 @@ static int tfa9879_i2c_probe(struct i2c_
+ int i;
+
+ tfa9879 = devm_kzalloc(&i2c->dev, sizeof(*tfa9879), GFP_KERNEL);
+- if (IS_ERR(tfa9879))
+- return PTR_ERR(tfa9879);
++ if (!tfa9879)
++ return -ENOMEM;
+
+ i2c_set_clientdata(i2c, tfa9879);
+
--- /dev/null
+From 909e26dce3f7600f5e293ac0522c28790a0c8c9c Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <osandov@osandov.com>
+Date: Fri, 10 Apr 2015 14:20:40 -0700
+Subject: btrfs: unlock i_mutex after attempting to delete subvolume during send
+
+From: Omar Sandoval <osandov@osandov.com>
+
+commit 909e26dce3f7600f5e293ac0522c28790a0c8c9c upstream.
+
+Whenever the check for a send in progress introduced in commit
+521e0546c970 (btrfs: protect snapshots from deleting during send) is
+hit, we return without unlocking inode->i_mutex. This is easy to see
+with lockdep enabled:
+
+[ +0.000059] ================================================
+[ +0.000028] [ BUG: lock held when returning to user space! ]
+[ +0.000029] 4.0.0-rc5-00096-g3c435c1 #93 Not tainted
+[ +0.000026] ------------------------------------------------
+[ +0.000029] btrfs/211 is leaving the kernel with locks still held!
+[ +0.000029] 1 lock held by btrfs/211:
+[ +0.000023] #0: (&type->i_mutex_dir_key){+.+.+.}, at: [<ffffffff8135b8df>] btrfs_ioctl_snap_destroy+0x2df/0x7a0
+
+Make sure we unlock it in the error path.
+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.cz>
+Signed-off-by: Omar Sandoval <osandov@osandov.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2403,7 +2403,7 @@ static noinline int btrfs_ioctl_snap_des
+ "Attempt to delete subvolume %llu during send",
+ dest->root_key.objectid);
+ err = -EPERM;
+- goto out_dput;
++ goto out_unlock_inode;
+ }
+
+ d_invalidate(dentry);
+@@ -2498,6 +2498,7 @@ out_up_write:
+ root_flags & ~BTRFS_ROOT_SUBVOL_DEAD);
+ spin_unlock(&dest->root_item_lock);
+ }
++out_unlock_inode:
+ mutex_unlock(&inode->i_mutex);
+ if (!err) {
+ shrink_dcache_sb(root->fs_info->sb);
--- /dev/null
+From 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e Mon Sep 17 00:00:00 2001
+From: Quentin Casasnovas <quentin.casasnovas@oracle.com>
+Date: Tue, 14 Apr 2015 11:25:43 +0200
+Subject: cdc-acm: prevent infinite loop when parsing CDC headers.
+
+From: Quentin Casasnovas <quentin.casasnovas@oracle.com>
+
+commit 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e upstream.
+
+Phil and I found out a problem with commit:
+
+ 7e860a6e7aa6 ("cdc-acm: add sanity checks")
+
+It added some sanity checks to ignore potential garbage in CDC headers but
+also introduced a potential infinite loop. This can happen at the first
+loop iteration (elength = 0 in that case) if the description isn't a
+DT_CS_INTERFACE or later if 'buffer[0]' is zero.
+
+It should also be noted that the wrong length was being added to 'buffer'
+in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was
+assigned after that check in the loop.
+
+A specially crafted USB device could be used to trigger this infinite loop.
+
+Fixes: 7e860a6e7aa6 ("cdc-acm: add sanity checks")
+Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
+Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
+CC: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+CC: Oliver Neukum <oneukum@suse.de>
+CC: Adam Lee <adam8157@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1133,11 +1133,16 @@ static int acm_probe(struct usb_interfac
+ }
+
+ while (buflen > 0) {
++ elength = buffer[0];
++ if (!elength) {
++ dev_err(&intf->dev, "skipping garbage byte\n");
++ elength = 1;
++ goto next_desc;
++ }
+ if (buffer[1] != USB_DT_CS_INTERFACE) {
+ dev_err(&intf->dev, "skipping garbage\n");
+ goto next_desc;
+ }
+- elength = buffer[0];
+
+ switch (buffer[2]) {
+ case USB_CDC_UNION_TYPE: /* we've found it */
--- /dev/null
+From d2dc317d564a46dfc683978a2e5a4f91434e9711 Mon Sep 17 00:00:00 2001
+From: Lukas Czerner <lczerner@redhat.com>
+Date: Sat, 2 May 2015 21:36:55 -0400
+Subject: ext4: fix data corruption caused by unwritten and delayed extents
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+commit d2dc317d564a46dfc683978a2e5a4f91434e9711 upstream.
+
+Currently it is possible to lose whole file system block worth of data
+when we hit the specific interaction with unwritten and delayed extents
+in status extent tree.
+
+The problem is that when we insert delayed extent into extent status
+tree the only way to get rid of it is when we write out delayed buffer.
+However there is a limitation in the extent status tree implementation
+so that when inserting unwritten extent should there be even a single
+delayed block the whole unwritten extent would be marked as delayed.
+
+At this point, there is no way to get rid of the delayed extents,
+because there are no delayed buffers to write out. So when a we write
+into said unwritten extent we will convert it to written, but it still
+remains delayed.
+
+When we try to write into that block later ext4_da_map_blocks() will set
+the buffer new and delayed and map it to invalid block which causes
+the rest of the block to be zeroed loosing already written data.
+
+For now we can fix this by simply not allowing to set delayed status on
+written extent in the extent status tree. Also add WARN_ON() to make
+sure that we notice if this happens in the future.
+
+This problem can be easily reproduced by running the following xfs_io.
+
+xfs_io -f -c "pwrite -S 0xaa 4096 2048" \
+ -c "falloc 0 131072" \
+ -c "pwrite -S 0xbb 65536 2048" \
+ -c "fsync" /mnt/test/fff
+
+echo 3 > /proc/sys/vm/drop_caches
+xfs_io -c "pwrite -S 0xdd 67584 2048" /mnt/test/fff
+
+This can be theoretically also reproduced by at random by running fsx,
+but it's not very reliable, though on machines with bigger page size
+(like ppc) this can be seen more often (especially xfstest generic/127)
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents_status.c | 8 ++++++++
+ fs/ext4/inode.c | 2 ++
+ 2 files changed, 10 insertions(+)
+
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -705,6 +705,14 @@ int ext4_es_insert_extent(struct inode *
+
+ BUG_ON(end < lblk);
+
++ if ((status & EXTENT_STATUS_DELAYED) &&
++ (status & EXTENT_STATUS_WRITTEN)) {
++ ext4_warning(inode->i_sb, "Inserting extent [%u/%u] as "
++ " delayed and written which can potentially "
++ " cause data loss.\n", lblk, len);
++ WARN_ON(1);
++ }
++
+ newes.es_lblk = lblk;
+ newes.es_len = len;
+ ext4_es_store_pblock_status(&newes, pblk, status);
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -534,6 +534,7 @@ int ext4_map_blocks(handle_t *handle, st
+ status = map->m_flags & EXT4_MAP_UNWRITTEN ?
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
++ !(status & EXTENT_STATUS_WRITTEN) &&
+ ext4_find_delalloc_range(inode, map->m_lblk,
+ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+@@ -638,6 +639,7 @@ found:
+ status = map->m_flags & EXT4_MAP_UNWRITTEN ?
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
++ !(status & EXTENT_STATUS_WRITTEN) &&
+ ext4_find_delalloc_range(inode, map->m_lblk,
+ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
--- /dev/null
+From 280227a75b56ab5d35854f3a77ef74a7ad56a203 Mon Sep 17 00:00:00 2001
+From: Davide Italiano <dccitaliano@gmail.com>
+Date: Sat, 2 May 2015 23:21:15 -0400
+Subject: ext4: move check under lock scope to close a race.
+
+From: Davide Italiano <dccitaliano@gmail.com>
+
+commit 280227a75b56ab5d35854f3a77ef74a7ad56a203 upstream.
+
+fallocate() checks that the file is extent-based and returns
+EOPNOTSUPP in case is not. Other tasks can convert from and to
+indirect and extent so it's safe to check only after grabbing
+the inode mutex.
+
+Signed-off-by: Davide Italiano <dccitaliano@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4934,13 +4934,6 @@ long ext4_fallocate(struct file *file, i
+ if (ret)
+ return ret;
+
+- /*
+- * currently supporting (pre)allocate mode for extent-based
+- * files _only_
+- */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- return -EOPNOTSUPP;
+-
+ if (mode & FALLOC_FL_COLLAPSE_RANGE)
+ return ext4_collapse_range(inode, offset, len);
+
+@@ -4962,6 +4955,14 @@ long ext4_fallocate(struct file *file, i
+
+ mutex_lock(&inode->i_mutex);
+
++ /*
++ * We only support preallocation for extent-based files only
++ */
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
+ offset + len > i_size_read(inode)) {
+ new_size = offset + len;
--- /dev/null
+From 082a75dad84d79d1c15ea9e50f31cb4bb4fa7fd6 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Sat, 25 Apr 2015 15:56:15 +0300
+Subject: rbd: end I/O the entire obj_request on error
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 082a75dad84d79d1c15ea9e50f31cb4bb4fa7fd6 upstream.
+
+When we end I/O struct request with error, we need to pass
+obj_request->length as @nr_bytes so that the entire obj_request worth
+of bytes is completed. Otherwise block layer ends up confused and we
+trip on
+
+ rbd_assert(more ^ (which == img_request->obj_request_count));
+
+in rbd_img_obj_callback() due to more being true no matter what. We
+already do it in most cases but we are missing some, in particular
+those where we don't even get a chance to submit any obj_requests, due
+to an early -ENOMEM for example.
+
+A number of obj_request->xferred assignments seem to be redundant but
+I haven't touched any of obj_request->xferred stuff to keep this small
+and isolated.
+
+Cc: Alex Elder <elder@linaro.org>
+Reported-by: Shawn Edwards <lesser.evil@gmail.com>
+Reviewed-by: Sage Weil <sage@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2264,6 +2264,11 @@ static bool rbd_img_obj_end_request(stru
+ result, xferred);
+ if (!img_request->result)
+ img_request->result = result;
++ /*
++ * Need to end I/O on the entire obj_request worth of
++ * bytes in case of error.
++ */
++ xferred = obj_request->length;
+ }
+
+ /* Image object requests don't own their page array */
--- /dev/null
+From 6befa9d883385c580369a2cc9e53fbf329771f6d Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Tue, 14 Apr 2015 12:03:09 +0200
+Subject: serial: of-serial: Remove device_type = "serial" registration
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 6befa9d883385c580369a2cc9e53fbf329771f6d upstream.
+
+Do not probe all serial drivers by of_serial.c which are using
+device_type = "serial"; property. Only drivers which have valid
+compatible strings listed in the driver should be probed.
+
+When PORT_UNKNOWN is setup probe will fail anyway.
+
+Arnd quotation about driver historical background:
+"when I wrote that driver initially, the idea was that it would
+get used as a stub to hook up all other serial drivers but after
+that, the common code learned to create platform devices from DT"
+
+This patch fix the problem with on the system with xilinx_uartps and
+16550a where of_serial failed to register for xilinx_uartps and because
+of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking
+for irq with request_irq() EINVAL is returned.
+
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/of_serial.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -344,7 +344,6 @@ static struct of_device_id of_platform_s
+ { .compatible = "ibm,qpace-nwp-serial",
+ .data = (void *)PORT_NWPSERIAL, },
+ #endif
+- { .type = "serial", .data = (void *)PORT_UNKNOWN, },
+ { /* end of list */ },
+ };
+
--- /dev/null
+From 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Mon, 13 Apr 2015 16:34:21 +0200
+Subject: serial: xilinx: Use platform_get_irq to get irq description structure
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed upstream.
+
+For systems with CONFIG_SERIAL_OF_PLATFORM=y and device_type =
+"serial"; property in DT of_serial.c driver maps and unmaps IRQ (because
+driver probe fails). Then a driver is called but irq mapping is not
+created that's why driver is failing again in again on request_irq().
+Based on this use platform_get_irq() instead of platform_get_resource()
+which is doing irq_desc allocation and driver itself can request IRQ.
+
+Fix both xilinx serial drivers in the tree.
+
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/uartlite.c | 11 ++++++-----
+ drivers/tty/serial/xilinx_uartps.c | 12 ++++++------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -632,7 +632,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+
+ static int ulite_probe(struct platform_device *pdev)
+ {
+- struct resource *res, *res2;
++ struct resource *res;
++ int irq;
+ int id = pdev->id;
+ #ifdef CONFIG_OF
+ const __be32 *prop;
+@@ -646,11 +647,11 @@ static int ulite_probe(struct platform_d
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+- return ulite_assign(&pdev->dev, id, res->start, res2->start);
++ return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+
+ static int ulite_remove(struct platform_device *pdev)
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1325,9 +1325,9 @@ static SIMPLE_DEV_PM_OPS(cdns_uart_dev_p
+ */
+ static int cdns_uart_probe(struct platform_device *pdev)
+ {
+- int rc, id;
++ int rc, id, irq;
+ struct uart_port *port;
+- struct resource *res, *res2;
++ struct resource *res;
+ struct cdns_uart *cdns_uart_data;
+
+ cdns_uart_data = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_data),
+@@ -1374,9 +1374,9 @@ static int cdns_uart_probe(struct platfo
+ goto err_out_clk_disable;
+ }
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2) {
+- rc = -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0) {
++ rc = -ENXIO;
+ goto err_out_clk_disable;
+ }
+
+@@ -1405,7 +1405,7 @@ static int cdns_uart_probe(struct platfo
+ * and triggers invocation of the config_port() entry point.
+ */
+ port->mapbase = res->start;
+- port->irq = res2->start;
++ port->irq = irq;
+ port->dev = &pdev->dev;
+ port->uartclk = clk_get_rate(cdns_uart_data->uartclk);
+ port->private_data = cdns_uart_data;
mips-bcm47xx-fix-detecting-microsoft-mn-700-asus-wl500g.patch
mips-asm-elf-set-o32-default-fpu-flags.patch
mips-makefile-fix-mips-ase-detection-code.patch
+alsa-emux-fix-mutex-deadlock-at-unloading.patch
+alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch
+alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch
+alsa-emu10k1-emu10k2-32-bit-dma-mode.patch
+alsa-hda-fix-mute-led-fixed-mode.patch
+alsa-hda-add-mute-led-mode-control-to-thinkpad.patch
+cdc-acm-prevent-infinite-loop-when-parsing-cdc-headers.patch
+serial-of-serial-remove-device_type-serial-registration.patch
+serial-xilinx-use-platform_get_irq-to-get-irq-description-structure.patch
+arm64-dma-mapping-always-clear-allocated-buffers.patch
+arm64-add-missing-page_align-to-__dma_free.patch
+usb-chipidea-otg-remove-mutex-unlock-and-lock-while-stop-and-start-role.patch
+asoc-samsung-s3c24xx-i2s-fix-return-value-check-in-s3c24xx_iis_dev_probe.patch
+asoc-tfa9879-fix-return-value-check-in-tfa9879_i2c_probe.patch
+asoc-rt5677-add-register-patch-for-pll.patch
+asoc-dapm-enable-autodisable-on-soc_dapm_single_tlv_autodisable.patch
+asoc-rt5677-fixed-wrong-dmic-ref-clock.patch
+btrfs-unlock-i_mutex-after-attempting-to-delete-subvolume-during-send.patch
+acpi-sbs-enable-battery-manager-when-present.patch
+tty-serial-at91-maxburst-was-missing-for-dma-transfers.patch
+rbd-end-i-o-the-entire-obj_request-on-error.patch
+uas-allow-uas_use_uas_driver-to-return-usb-storage-flags.patch
+uas-add-us_fl_max_sectors_240-flag.patch
+uas-set-max_sectors_240-quirk-for-asm1053-devices.patch
+ext4-fix-data-corruption-caused-by-unwritten-and-delayed-extents.patch
+ext4-move-check-under-lock-scope-to-close-a-race.patch
--- /dev/null
+From a8d4e01637902311c5643b69a5c80e2805f04054 Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Thu, 16 Apr 2015 16:58:12 +0200
+Subject: tty/serial: at91: maxburst was missing for dma transfers
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit a8d4e01637902311c5643b69a5c80e2805f04054 upstream.
+
+Maxburst was not set when doing the dma slave configuration. This value
+is checked by the recently introduced xdmac. It causes an error when
+doing the slave configuration and so prevents from using dma.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -880,6 +880,7 @@ static int atmel_prepare_tx_dma(struct u
+ config.direction = DMA_MEM_TO_DEV;
+ config.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ config.dst_addr = port->mapbase + ATMEL_US_THR;
++ config.dst_maxburst = 1;
+
+ ret = dmaengine_slave_config(atmel_port->chan_tx,
+ &config);
+@@ -1059,6 +1060,7 @@ static int atmel_prepare_rx_dma(struct u
+ config.direction = DMA_DEV_TO_MEM;
+ config.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+ config.src_addr = port->mapbase + ATMEL_US_RHR;
++ config.src_maxburst = 1;
+
+ ret = dmaengine_slave_config(atmel_port->chan_rx,
+ &config);
--- /dev/null
+From ee136af4a064c2f61e2025873584d2c7ec93f4ae Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 21 Apr 2015 11:20:31 +0200
+Subject: uas: Add US_FL_MAX_SECTORS_240 flag
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit ee136af4a064c2f61e2025873584d2c7ec93f4ae upstream.
+
+The usb-storage driver sets max_sectors = 240 in its scsi-host template,
+for uas we do not want to do that for all devices, but testing has shown
+that some devices need it.
+
+This commit adds a US_FL_MAX_SECTORS_240 flag for such devices, and
+implements support for it in uas.c, while at it it also adds support
+for US_FL_MAX_SECTORS_64 to uas.c.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/kernel-parameters.txt | 2 ++
+ drivers/usb/storage/uas.c | 10 +++++++++-
+ drivers/usb/storage/usb.c | 6 +++++-
+ include/linux/usb_usual.h | 2 ++
+ 4 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -3746,6 +3746,8 @@ bytes respectively. Such letter suffixes
+ READ_CAPACITY_16 command);
+ f = NO_REPORT_OPCODES (don't use report opcodes
+ command, uas only);
++ g = MAX_SECTORS_240 (don't transfer more than
++ 240 sectors at a time, uas only);
+ h = CAPACITY_HEURISTICS (decrease the
+ reported device capacity by one
+ sector if the number is odd);
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -759,7 +759,10 @@ static int uas_eh_bus_reset_handler(stru
+
+ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+- sdev->hostdata = (void *)sdev->host->hostdata;
++ struct uas_dev_info *devinfo =
++ (struct uas_dev_info *)sdev->host->hostdata;
++
++ sdev->hostdata = devinfo;
+
+ /* USB has unusual DMA-alignment requirements: Although the
+ * starting address of each scatter-gather element doesn't matter,
+@@ -778,6 +781,11 @@ static int uas_slave_alloc(struct scsi_d
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
++ if (devinfo->flags & US_FL_MAX_SECTORS_64)
++ blk_queue_max_hw_sectors(sdev->request_queue, 64);
++ else if (devinfo->flags & US_FL_MAX_SECTORS_240)
++ blk_queue_max_hw_sectors(sdev->request_queue, 240);
++
+ return 0;
+ }
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -479,7 +479,8 @@ void usb_stor_adjust_quirks(struct usb_d
+ US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT |
+ US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 |
+ US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
+- US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES);
++ US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
++ US_FL_MAX_SECTORS_240);
+
+ p = quirks;
+ while (*p) {
+@@ -520,6 +521,9 @@ void usb_stor_adjust_quirks(struct usb_d
+ case 'f':
+ f |= US_FL_NO_REPORT_OPCODES;
+ break;
++ case 'g':
++ f |= US_FL_MAX_SECTORS_240;
++ break;
+ case 'h':
+ f |= US_FL_CAPACITY_HEURISTICS;
+ break;
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -77,6 +77,8 @@
+ /* Cannot handle ATA_12 or ATA_16 CDBs */ \
+ US_FLAG(NO_REPORT_OPCODES, 0x04000000) \
+ /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \
++ US_FLAG(MAX_SECTORS_240, 0x08000000) \
++ /* Sets max_sectors to 240 */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
--- /dev/null
+From a5011d44f0e1117a6db14b19b57c51f8be5673a0 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 21 Apr 2015 11:20:30 +0200
+Subject: uas: Allow uas_use_uas_driver to return usb-storage flags
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit a5011d44f0e1117a6db14b19b57c51f8be5673a0 upstream.
+
+uas_use_uas_driver may set some US_FL_foo flags during detection, currently
+these are stored in a local variable and then throw away, but these may be
+of interest to the caller, so add an extra parameter to (optionally) return
+the detected flags, and use this in the uas driver.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/uas-detect.h | 6 +++++-
+ drivers/usb/storage/uas.c | 6 +++---
+ drivers/usb/storage/usb.c | 2 +-
+ 3 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -51,7 +51,8 @@ static int uas_find_endpoints(struct usb
+ }
+
+ static int uas_use_uas_driver(struct usb_interface *intf,
+- const struct usb_device_id *id)
++ const struct usb_device_id *id,
++ unsigned long *flags_ret)
+ {
+ struct usb_host_endpoint *eps[4] = { };
+ struct usb_device *udev = interface_to_usbdev(intf);
+@@ -132,5 +133,8 @@ static int uas_use_uas_driver(struct usb
+ return 0;
+ }
+
++ if (flags_ret)
++ *flags_ret = flags;
++
+ return 1;
+ }
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -887,8 +887,9 @@ static int uas_probe(struct usb_interfac
+ struct Scsi_Host *shost = NULL;
+ struct uas_dev_info *devinfo;
+ struct usb_device *udev = interface_to_usbdev(intf);
++ unsigned long dev_flags;
+
+- if (!uas_use_uas_driver(intf, id))
++ if (!uas_use_uas_driver(intf, id, &dev_flags))
+ return -ENODEV;
+
+ if (uas_switch_interface(udev, intf))
+@@ -910,8 +911,7 @@ static int uas_probe(struct usb_interfac
+ devinfo->udev = udev;
+ devinfo->resetting = 0;
+ devinfo->shutdown = 0;
+- devinfo->flags = id->driver_info;
+- usb_stor_adjust_quirks(udev, &devinfo->flags);
++ devinfo->flags = dev_flags;
+ init_usb_anchor(&devinfo->cmd_urbs);
+ init_usb_anchor(&devinfo->sense_urbs);
+ init_usb_anchor(&devinfo->data_urbs);
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -1080,7 +1080,7 @@ static int storage_probe(struct usb_inte
+
+ /* If uas is enabled and this device can do uas then ignore it. */
+ #if IS_ENABLED(CONFIG_USB_UAS)
+- if (uas_use_uas_driver(intf, id))
++ if (uas_use_uas_driver(intf, id, NULL))
+ return -ENXIO;
+ #endif
+
--- /dev/null
+From 8e779c6c4a398763c21371fe40f649206041dc1e Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 21 Apr 2015 11:20:32 +0200
+Subject: uas: Set max_sectors_240 quirk for ASM1053 devices
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 8e779c6c4a398763c21371fe40f649206041dc1e upstream.
+
+Testing has shown that ASM1053 devices do not work properly with transfers
+larger than 240 sectors, so set max_sectors to 240 on these.
+
+Reported-by: Steve Bangert <sbangert@frontier.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Steve Bangert <sbangert@frontier.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/uas-detect.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -74,7 +74,7 @@ static int uas_use_uas_driver(struct usb
+ * this writing the following versions exist:
+ * ASM1051 - no uas support version
+ * ASM1051 - with broken (*) uas support
+- * ASM1053 - with working uas support
++ * ASM1053 - with working uas support, but problems with large xfers
+ * ASM1153 - with working uas support
+ *
+ * Devices with these chips re-use a number of device-ids over the
+@@ -104,6 +104,9 @@ static int uas_use_uas_driver(struct usb
+ } else if (usb_ss_max_streams(&eps[1]->ss_ep_comp) == 32) {
+ /* Possibly an ASM1051, disable uas */
+ flags |= US_FL_IGNORE_UAS;
++ } else {
++ /* ASM1053, these have issues with large transfers */
++ flags |= US_FL_MAX_SECTORS_240;
+ }
+ }
+
--- /dev/null
+From a5a356cee89f86ff86cc3ce24136ca1f802c1bf1 Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@freescale.com>
+Date: Sun, 12 Apr 2015 17:51:02 +0800
+Subject: usb: chipidea: otg: remove mutex unlock and lock while stop and start role
+
+From: Li Jun <jun.li@freescale.com>
+
+commit a5a356cee89f86ff86cc3ce24136ca1f802c1bf1 upstream.
+
+Wrongly release mutex lock during otg_statemachine may result in re-enter
+otg_statemachine, which is not allowed, we should do next state transtition
+after previous one completed.
+
+Fixes: 826cfe751f3e ("usb: chipidea: add OTG fsm operation functions implementation")
+Signed-off-by: Li Jun <jun.li@freescale.com>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/otg_fsm.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/usb/chipidea/otg_fsm.c
++++ b/drivers/usb/chipidea/otg_fsm.c
+@@ -537,7 +537,6 @@ static int ci_otg_start_host(struct otg_
+ {
+ struct ci_hdrc *ci = container_of(fsm, struct ci_hdrc, fsm);
+
+- mutex_unlock(&fsm->lock);
+ if (on) {
+ ci_role_stop(ci);
+ ci_role_start(ci, CI_ROLE_HOST);
+@@ -546,7 +545,6 @@ static int ci_otg_start_host(struct otg_
+ hw_device_reset(ci);
+ ci_role_start(ci, CI_ROLE_GADGET);
+ }
+- mutex_lock(&fsm->lock);
+ return 0;
+ }
+
+@@ -554,12 +552,10 @@ static int ci_otg_start_gadget(struct ot
+ {
+ struct ci_hdrc *ci = container_of(fsm, struct ci_hdrc, fsm);
+
+- mutex_unlock(&fsm->lock);
+ if (on)
+ usb_gadget_vbus_connect(&ci->gadget);
+ else
+ usb_gadget_vbus_disconnect(&ci->gadget);
+- mutex_lock(&fsm->lock);
+
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
