--- /dev/null
+From b02176f30cd30acccd3b633ab7d9aed8b5da52ff Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 8 Sep 2015 12:20:22 -0400
+Subject: block: don't release bdi while request_queue has live references
+
+From: Tejun Heo <tj@kernel.org>
+
+commit b02176f30cd30acccd3b633ab7d9aed8b5da52ff upstream.
+
+bdi's are initialized in two steps, bdi_init() and bdi_register(), but
+destroyed in a single step by bdi_destroy() which, for a bdi embedded
+in a request_queue, is called during blk_cleanup_queue() which makes
+the queue invisible and starts the draining of remaining usages.
+
+A request_queue's user can access the congestion state of the embedded
+bdi as long as it holds a reference to the queue. As such, it may
+access the congested state of a queue which finished
+blk_cleanup_queue() but hasn't reached blk_release_queue() yet.
+Because the congested state was embedded in backing_dev_info which in
+turn is embedded in request_queue, accessing the congested state after
+bdi_destroy() was called was fine. The bdi was destroyed but the
+memory region for the congested state remained accessible till the
+queue got released.
+
+a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in
+bdi_writeback") changed the situation. Now, the root congested state
+which is expected to be pinned while request_queue remains accessible
+is separately reference counted and the base ref is put during
+bdi_destroy(). This means that the root congested state may go away
+prematurely while the queue is between bdi_dstroy() and
+blk_cleanup_queue(), which was detected by Andrey's KASAN tests.
+
+The root cause of this problem is that bdi doesn't distinguish the two
+steps of destruction, unregistration and release, and now the root
+congested state actually requires a separate release step. To fix the
+issue, this patch separates out bdi_unregister() and bdi_exit() from
+bdi_destroy(). bdi_unregister() is called from blk_cleanup_queue()
+and bdi_exit() from blk_release_queue(). bdi_destroy() is now just a
+simple wrapper calling the two steps back-to-back.
+
+While at it, the prototype of bdi_destroy() is moved right below
+bdi_setup_and_register() so that the counterpart operations are
+located together.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Fixes: a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in bdi_writeback")
+Reported-and-tested-by: Andrey Konovalov <andreyknvl@google.com>
+Link: http://lkml.kernel.org/g/CAAeHK+zUJ74Zn17=rOyxacHU18SgCfC6bsYW=6kCY5GXJBwGfQ@mail.gmail.com
+Reviewed-by: Jan Kara <jack@suse.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-core.c | 2 +-
+ block/blk-sysfs.c | 1 +
+ include/linux/backing-dev.h | 6 +++++-
+ mm/backing-dev.c | 12 +++++++++++-
+ 4 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -578,7 +578,7 @@ void blk_cleanup_queue(struct request_qu
+ q->queue_lock = &q->__queue_lock;
+ spin_unlock_irq(lock);
+
+- bdi_destroy(&q->backing_dev_info);
++ bdi_unregister(&q->backing_dev_info);
+
+ /* @q is and will stay empty, shutdown and put */
+ blk_put_queue(q);
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -502,6 +502,7 @@ static void blk_release_queue(struct kob
+ struct request_queue *q =
+ container_of(kobj, struct request_queue, kobj);
+
++ bdi_exit(&q->backing_dev_info);
+ blkcg_exit_queue(q);
+
+ if (q->elevator) {
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -18,13 +18,17 @@
+ #include <linux/slab.h>
+
+ int __must_check bdi_init(struct backing_dev_info *bdi);
+-void bdi_destroy(struct backing_dev_info *bdi);
++void bdi_exit(struct backing_dev_info *bdi);
+
+ __printf(3, 4)
+ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
+ const char *fmt, ...);
+ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
++void bdi_unregister(struct backing_dev_info *bdi);
++
+ int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
++void bdi_destroy(struct backing_dev_info *bdi);
++
+ void wb_start_writeback(struct bdi_writeback *wb, long nr_pages,
+ bool range_cyclic, enum wb_reason reason);
+ void wb_start_background_writeback(struct bdi_writeback *wb);
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -823,7 +823,7 @@ static void bdi_remove_from_list(struct
+ synchronize_rcu_expedited();
+ }
+
+-void bdi_destroy(struct backing_dev_info *bdi)
++void bdi_unregister(struct backing_dev_info *bdi)
+ {
+ /* make sure nobody finds us on the bdi_list anymore */
+ bdi_remove_from_list(bdi);
+@@ -835,9 +835,19 @@ void bdi_destroy(struct backing_dev_info
+ device_unregister(bdi->dev);
+ bdi->dev = NULL;
+ }
++}
+
++void bdi_exit(struct backing_dev_info *bdi)
++{
++ WARN_ON_ONCE(bdi->dev);
+ wb_exit(&bdi->wb);
+ }
++
++void bdi_destroy(struct backing_dev_info *bdi)
++{
++ bdi_unregister(bdi);
++ bdi_exit(bdi);
++}
+ EXPORT_SYMBOL(bdi_destroy);
+
+ /*
--- /dev/null
+From 625faa6a720d26fc0db9e20b48dc0dfe4c8d8ddf Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 20 Oct 2015 11:49:44 +0100
+Subject: clkdev: fix clk_add_alias() with a NULL alias device name
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 625faa6a720d26fc0db9e20b48dc0dfe4c8d8ddf upstream.
+
+clk_add_alias() was not correctly handling the case where alias_dev_name
+was NULL: rather than producing an entry with a NULL dev_id pointer,
+it would produce a device name of (null). Fix this.
+
+Fixes: 2568999835d7 ("clkdev: add clkdev_create() helper")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clkdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clkdev.c
++++ b/drivers/clk/clkdev.c
+@@ -333,7 +333,8 @@ int clk_add_alias(const char *alias, con
+ if (IS_ERR(r))
+ return PTR_ERR(r);
+
+- l = clkdev_create(r, alias, "%s", alias_dev_name);
++ l = clkdev_create(r, alias, alias_dev_name ? "%s" : NULL,
++ alias_dev_name);
+ clk_put(r);
+
+ return l ? 0 : -ENODEV;
--- /dev/null
+From 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Thu, 22 Oct 2015 10:56:40 -0400
+Subject: dm btree: fix leak of bufio-backed block in btree_split_beneath error path
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be upstream.
+
+btree_split_beneath()'s error path had an outstanding FIXME that speaks
+directly to the potential for _not_ cleaning up a previously allocated
+bufio-backed block.
+
+Fix this by releasing the previously allocated bufio block using
+unlock_block().
+
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Joe Thornber <thornber@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -523,7 +523,7 @@ static int btree_split_beneath(struct sh
+
+ r = new_block(s->info, &right);
+ if (r < 0) {
+- /* FIXME: put left */
++ unlock_block(s->info, left);
+ return r;
+ }
+
--- /dev/null
+From 2871c69e025e8bc507651d5a9cf81a8a7da9d24b Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 21 Oct 2015 18:36:49 +0100
+Subject: dm btree remove: fix a bug when rebalancing nodes after removal
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream.
+
+Commit 4c7e309340ff ("dm btree remove: fix bug in redistribute3") wasn't
+a complete fix for redistribute3().
+
+The redistribute3 function takes 3 btree nodes and shares out the entries
+evenly between them. If the three nodes in total contained
+(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
+rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
+the center.
+
+Fix this issue by being more careful about calculating the target number
+of entries for the left and right nodes.
+
+Unit tested in userspace using this program:
+https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-btree-remove.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btre
+ {
+ int s;
+ uint32_t max_entries = le32_to_cpu(left->header.max_entries);
+- unsigned target = (nr_left + nr_center + nr_right) / 3;
+- BUG_ON(target > max_entries);
++ unsigned total = nr_left + nr_center + nr_right;
++ unsigned target_right = total / 3;
++ unsigned remainder = (target_right * 3) != total;
++ unsigned target_left = target_right + remainder;
++
++ BUG_ON(target_left > max_entries);
++ BUG_ON(target_right > max_entries);
+
+ if (nr_left < nr_right) {
+- s = nr_left - target;
++ s = nr_left - target_left;
+
+ if (s < 0 && nr_center < -s) {
+ /* not enough in central node */
+@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btre
+ } else
+ shift(left, center, s);
+
+- shift(center, right, target - nr_right);
++ shift(center, right, target_right - nr_right);
+
+ } else {
+- s = target - nr_right;
++ s = target_right - nr_right;
+ if (s > 0 && nr_center < s) {
+ /* not enough in central node */
+ shift(center, right, nr_center);
+@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btre
+ } else
+ shift(center, right, s);
+
+- shift(left, center, nr_left - target);
++ shift(left, center, nr_left - target_left);
+ }
+
+ *key_ptr(parent, c->index) = center->keys[0];
--- /dev/null
+From 3201ac452e84a8a368197d648c9b7011e061804a Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Thu, 22 Oct 2015 18:10:55 +0100
+Subject: dm cache: the CLEAN_SHUTDOWN flag was not being set
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 3201ac452e84a8a368197d648c9b7011e061804a upstream.
+
+If the CLEAN_SHUTDOWN flag is not set when a cache is loaded then all cache
+blocks are marked as dirty and a full writeback occurs.
+
+__commit_transaction() is responsible for setting/clearing
+CLEAN_SHUTDOWN (based the flags_mutator that is passed in).
+
+Fix this issue, of the cache's on-disk flags being wrong, by making sure
+__commit_transaction() does not reset the flags after the mutator has
+altered the flags in preparation for them being serialized to disk.
+
+before:
+
+sb_flags = mutator(le32_to_cpu(disk_super->flags));
+disk_super->flags = cpu_to_le32(sb_flags);
+disk_super->flags = cpu_to_le32(cmd->flags);
+
+after:
+
+disk_super->flags = cpu_to_le32(cmd->flags);
+sb_flags = mutator(le32_to_cpu(disk_super->flags));
+disk_super->flags = cpu_to_le32(sb_flags);
+
+Reported-by: Bogdan Vasiliev <bogdan.vasiliev@gmail.com>
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-cache-metadata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -634,10 +634,10 @@ static int __commit_transaction(struct d
+
+ disk_super = dm_block_data(sblock);
+
++ disk_super->flags = cpu_to_le32(cmd->flags);
+ if (mutator)
+ update_flags(disk_super, mutator);
+
+- disk_super->flags = cpu_to_le32(cmd->flags);
+ disk_super->mapping_root = cpu_to_le64(cmd->root);
+ disk_super->hint_root = cpu_to_le64(cmd->hint_root);
+ disk_super->discard_root = cpu_to_le64(cmd->discard_root);
--- /dev/null
+From f235f664a8afabccf863a5dee4777d2d7b676fda Mon Sep 17 00:00:00 2001
+From: Scot Doyle <lkml14@scotdoyle.com>
+Date: Fri, 9 Oct 2015 15:08:10 +0000
+Subject: fbcon: initialize blink interval before calling fb_set_par
+
+From: Scot Doyle <lkml14@scotdoyle.com>
+
+commit f235f664a8afabccf863a5dee4777d2d7b676fda upstream.
+
+Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459
+ fbcon: use the cursor blink interval provided by vt
+
+a PPC64LE kernel fails to boot when fbcon_add_cursor_timer uses an
+uninitialized ops->cur_blink_jiffies. Prevent by initializing
+in fbcon_init before the call to info->fbops->fb_set_par.
+
+Reported-and-tested-by: Alistair Popple <alistair@popple.id.au>
+Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/console/fbcon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -1093,6 +1093,7 @@ static void fbcon_init(struct vc_data *v
+ con_copy_unimap(vc, svc);
+
+ ops = info->fbcon_par;
++ ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+ p->con_rotate = initial_rotation;
+ set_blitting_type(vc, info);
+
--- /dev/null
+From 0729a04977d497cf66234fd7f900ddcec3ef1c52 Mon Sep 17 00:00:00 2001
+From: Hezi Shahmoon <hezi@marvell.com>
+Date: Tue, 20 Oct 2015 16:32:24 +0200
+Subject: i2c: mv64xxx: really allow I2C offloading
+
+From: Hezi Shahmoon <hezi@marvell.com>
+
+commit 0729a04977d497cf66234fd7f900ddcec3ef1c52 upstream.
+
+Commit 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix
+several problems") completely reworked the offload support, but left a
+debugging-related "return false" at the beginning of the
+mv64xxx_i2c_can_offload() function. This has the unfortunate consequence
+that offloading is in fact never used, which wasn't really the
+intention.
+
+This commit fixes that problem by removing the bogus "return false".
+
+Fixes: 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix several problems")
+Signed-off-by: Hezi Shahmoon <hezi@marvell.com>
+[Thomas: reworked commit log and title.]
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-mv64xxx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -669,8 +669,6 @@ mv64xxx_i2c_can_offload(struct mv64xxx_i
+ struct i2c_msg *msgs = drv_data->msgs;
+ int num = drv_data->num_msgs;
+
+- return false;
+-
+ if (!drv_data->offload_enabled)
+ return false;
+
--- /dev/null
+From 275d7d44d802ef271a42dc87ac091a495ba72fc5 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 20 Aug 2015 10:34:59 +0930
+Subject: module: Fix locking in symbol_put_addr()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 275d7d44d802ef271a42dc87ac091a495ba72fc5 upstream.
+
+Poma (on the way to another bug) reported an assertion triggering:
+
+ [<ffffffff81150529>] module_assert_mutex_or_preempt+0x49/0x90
+ [<ffffffff81150822>] __module_address+0x32/0x150
+ [<ffffffff81150956>] __module_text_address+0x16/0x70
+ [<ffffffff81150f19>] symbol_put_addr+0x29/0x40
+ [<ffffffffa04b77ad>] dvb_frontend_detach+0x7d/0x90 [dvb_core]
+
+Laura Abbott <labbott@redhat.com> produced a patch which lead us to
+inspect symbol_put_addr(). This function has a comment claiming it
+doesn't need to disable preemption around the module lookup
+because it holds a reference to the module it wants to find, which
+therefore cannot go away.
+
+This is wrong (and a false optimization too, preempt_disable() is really
+rather cheap, and I doubt any of this is on uber critical paths,
+otherwise it would've retained a pointer to the actual module anyway and
+avoided the second lookup).
+
+While its true that the module cannot go away while we hold a reference
+on it, the data structure we do the lookup in very much _CAN_ change
+while we do the lookup. Therefore fix the comment and add the
+required preempt_disable().
+
+Reported-by: poma <pomidorabelisima@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Fixes: a6e6abd575fc ("module: remove module_text_address()")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1063,11 +1063,15 @@ void symbol_put_addr(void *addr)
+ if (core_kernel_text(a))
+ return;
+
+- /* module_text_address is safe here: we're supposed to have reference
+- * to module from symbol_get, so it can't go away. */
++ /*
++ * Even though we hold a reference on the module; we still need to
++ * disable preemption in order to safely traverse the data structure.
++ */
++ preempt_disable();
+ modaddr = __module_text_address(a);
+ BUG_ON(!modaddr);
+ module_put(modaddr);
++ preempt_enable();
+ }
+ EXPORT_SYMBOL_GPL(symbol_put_addr);
+
--- /dev/null
+From 835da3f99d329b1160a1f7fc82c7ac81163d63d0 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 6 Oct 2015 22:29:48 +0200
+Subject: nvme: fix 32-bit build warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 835da3f99d329b1160a1f7fc82c7ac81163d63d0 upstream.
+
+Compiling the nvme driver on 32-bit warns about a cast from a __u64
+variable to a pointer:
+
+drivers/block/nvme-core.c: In function 'nvme_submit_io':
+drivers/block/nvme-core.c:1847:4: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+ (void __user *)io.addr, length, NULL, 0);
+
+The cast here is intentional and safe, so we can shut up the
+gcc warning by adding an intermediate cast to 'uintptr_t'.
+
+I had previously submitted a patch to fix this problem in the
+nvme driver, but it was accepted on the same day that two new
+warnings got added.
+
+For clarification, I also change the third instance of this cast
+to use uintptr_t instead of unsigned long now.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: d29ec8241c10e ("nvme: submit internal commands through the block layer")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/nvme-core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/block/nvme-core.c
++++ b/drivers/block/nvme-core.c
+@@ -1764,7 +1764,7 @@ static int nvme_submit_io(struct nvme_ns
+
+ length = (io.nblocks + 1) << ns->lba_shift;
+ meta_len = (io.nblocks + 1) * ns->ms;
+- metadata = (void __user *)(unsigned long)io.metadata;
++ metadata = (void __user *)(uintptr_t)io.metadata;
+ write = io.opcode & 1;
+
+ if (ns->ext) {
+@@ -1804,7 +1804,7 @@ static int nvme_submit_io(struct nvme_ns
+ c.rw.metadata = cpu_to_le64(meta_dma);
+
+ status = __nvme_submit_sync_cmd(ns->queue, &c, NULL,
+- (void __user *)io.addr, length, NULL, 0);
++ (void __user *)(uintptr_t)io.addr, length, NULL, 0);
+ unmap:
+ if (meta) {
+ if (status == NVME_SC_SUCCESS && !write) {
+@@ -1846,7 +1846,7 @@ static int nvme_user_cmd(struct nvme_dev
+ timeout = msecs_to_jiffies(cmd.timeout_ms);
+
+ status = __nvme_submit_sync_cmd(ns ? ns->queue : dev->admin_q, &c,
+- NULL, (void __user *)cmd.addr, cmd.data_len,
++ NULL, (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
+ &cmd.result, timeout);
+ if (status >= 0) {
+ if (put_user(cmd.result, &ucmd->result))
--- /dev/null
+From f967fc8f165fadb72166f2bd4785094b3ca21307 Mon Sep 17 00:00:00 2001
+From: Frederic Danis <frederic.danis@linux.intel.com>
+Date: Fri, 9 Oct 2015 17:14:56 +0200
+Subject: Revert "serial: 8250_dma: don't bother DMA with small transfers"
+
+From: Frederic Danis <frederic.danis@linux.intel.com>
+
+commit f967fc8f165fadb72166f2bd4785094b3ca21307 upstream.
+
+This reverts commit 9119fba0cfeda6d415c9f068df66838a104b87cb.
+
+This commit prevents from sending "big" file using Bluetooth.
+When sending a lot of data quickly through the Bluetooth interface, and
+after a variable amount of data sent, transfer fails with error:
+ kernel: [ 415.247453] Bluetooth: hci0 hardware error 0x00
+
+Found on T100TA.
+
+After reverting this commit, send works fine for any file size.
+
+Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com>
+Fixes: 9119fba0cfed (serial: 8250_dma: don't bother DMA with small transfers)
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_dma.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_dma.c
++++ b/drivers/tty/serial/8250/8250_dma.c
+@@ -80,10 +80,6 @@ int serial8250_tx_dma(struct uart_8250_p
+ return 0;
+
+ dma->tx_size = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
+- if (dma->tx_size < p->port.fifosize) {
+- ret = -EINVAL;
+- goto err;
+- }
+
+ desc = dmaengine_prep_slave_single(dma->txchan,
+ dma->tx_addr + xmit->tail,
arm-8449-1-fix-bug-in-vdsomunge-swab32-macro.patch
revert-arm64-unwind-fix-pc-calculation.patch
arm64-kernel-fix-tcr_el1.t0sz-restore-on-systems-with-extended-idmap.patch
+block-don-t-release-bdi-while-request_queue-has-live-references.patch
+dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch
+dm-cache-the-clean_shutdown-flag-was-not-being-set.patch
+dm-btree-fix-leak-of-bufio-backed-block-in-btree_split_beneath-error-path.patch
+nvme-fix-32-bit-build-warning.patch
+revert-serial-8250_dma-don-t-bother-dma-with-small-transfers.patch
+usb-qcserial-add-sierra-wireless-mc74xx-em74xx.patch
+i2c-mv64xxx-really-allow-i2c-offloading.patch
+clkdev-fix-clk_add_alias-with-a-null-alias-device-name.patch
+fbcon-initialize-blink-interval-before-calling-fb_set_par.patch
+xhci-handle-no-ping-response-error-properly.patch
+xhci-add-spurious-wakeup-quirk-for-lynxpoint-lp-controllers.patch
+xen-blkfront-check-for-null-drvdata-in-blkback_changed-xenbusstateclosing.patch
+module-fix-locking-in-symbol_put_addr.patch
--- /dev/null
+From f504ab1888026d15b5be8f9c262bf4ae9cacd177 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Thu, 22 Oct 2015 14:24:24 +0200
+Subject: USB: qcserial: add Sierra Wireless MC74xx/EM74xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+
+commit f504ab1888026d15b5be8f9c262bf4ae9cacd177 upstream.
+
+New device IDs shamelessly lifted from the vendor driver.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/qcserial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -153,6 +153,8 @@ static const struct usb_device_id id_tab
+ {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */
++ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx/EM74xx */
++ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx/EM74xx */
+ {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
--- /dev/null
+From a54c8f0f2d7df525ff997e2afe71866a1a013064 Mon Sep 17 00:00:00 2001
+From: Cathy Avery <cathy.avery@oracle.com>
+Date: Fri, 2 Oct 2015 09:35:01 -0400
+Subject: xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
+
+From: Cathy Avery <cathy.avery@oracle.com>
+
+commit a54c8f0f2d7df525ff997e2afe71866a1a013064 upstream.
+
+xen-blkfront will crash if the check to talk_to_blkback()
+in blkback_changed()(XenbusStateInitWait) returns an error.
+The driver data is freed and info is set to NULL. Later during
+the close process via talk_to_blkback's call to xenbus_dev_fatal()
+the null pointer is passed to and dereference in blkfront_closing.
+
+Signed-off-by: Cathy Avery <cathy.avery@oracle.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/xen-blkfront.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1984,7 +1984,8 @@ static void blkback_changed(struct xenbu
+ break;
+ /* Missed the backend's Closing state -- fallthrough */
+ case XenbusStateClosing:
+- blkfront_closing(info);
++ if (info)
++ blkfront_closing(info);
+ break;
+ }
+ }
--- /dev/null
+From fd7cd061adcf5f7503515ba52b6a724642a839c8 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@fedoraproject.org>
+Date: Mon, 12 Oct 2015 11:30:13 +0300
+Subject: xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
+
+From: Laura Abbott <labbott@fedoraproject.org>
+
+commit fd7cd061adcf5f7503515ba52b6a724642a839c8 upstream.
+
+We received several reports of systems rebooting and powering on
+after an attempted shutdown. Testing showed that setting
+XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT
+quirk allowed the system to shutdown as expected for LynxPoint-LP
+xHCI controllers. Set the quirk back.
+
+Note that the quirk was originally introduced for LynxPoint and
+LynxPoint-LP just for this same reason. See:
+
+commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell")
+
+It was later limited to only concern HP machines as it caused
+regression on some machines, see both bug and commit:
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171
+commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines")
+
+Later it was discovered that the powering on after shutdown
+was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP
+machine suffered from spontaneous resume from S3 (which should
+not be related to the SPURIOUS_WAKEUP quirk at all). An attempt
+to fix this then removed the SPURIOUS_WAKEUP flag usage completely.
+
+commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell")
+
+Current understanding is that LynxPoint-LP (Haswell ULT) machines
+need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and
+plain Lynxpoint (Haswell) machines may _not_ have the quirk
+set otherwise they again will restart.
+
+Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Oliver Neukum <oneukum@suse.com>
+[Added more history to commit message -Mathias]
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct devic
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
++ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
--- /dev/null
+From 3b4739b8951d650becbcd855d7d6f18ac98a9a85 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 12 Oct 2015 11:30:12 +0300
+Subject: xhci: handle no ping response error properly
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 3b4739b8951d650becbcd855d7d6f18ac98a9a85 upstream.
+
+If a host fails to wake up a isochronous SuperSpeed device from U1/U2
+in time for a isoch transfer it will generate a "No ping response error"
+Host will then move to the next transfer descriptor.
+
+Handle this case in the same way as missed service errors, tag the
+current TD as skipped and handle it on the next transfer event.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2239,6 +2239,7 @@ static int handle_tx_event(struct xhci_h
+ u32 trb_comp_code;
+ int ret = 0;
+ int td_num = 0;
++ bool handling_skipped_tds = false;
+
+ slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
+ xdev = xhci->devs[slot_id];
+@@ -2372,6 +2373,10 @@ static int handle_tx_event(struct xhci_h
+ ep->skip = true;
+ xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
+ goto cleanup;
++ case COMP_PING_ERR:
++ ep->skip = true;
++ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
++ goto cleanup;
+ default:
+ if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
+ status = 0;
+@@ -2508,13 +2513,18 @@ static int handle_tx_event(struct xhci_h
+ ep, &status);
+
+ cleanup:
++
++
++ handling_skipped_tds = ep->skip &&
++ trb_comp_code != COMP_MISSED_INT &&
++ trb_comp_code != COMP_PING_ERR;
++
+ /*
+- * Do not update event ring dequeue pointer if ep->skip is set.
+- * Will roll back to continue process missed tds.
++ * Do not update event ring dequeue pointer if we're in a loop
++ * processing missed tds.
+ */
+- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
++ if (!handling_skipped_tds)
+ inc_deq(xhci, xhci->event_ring);
+- }
+
+ if (ret) {
+ urb = td->urb;
+@@ -2549,7 +2559,7 @@ cleanup:
+ * Process them as short transfer until reach the td pointed by
+ * the event.
+ */
+- } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
++ } while (handling_skipped_tds);
+
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
