--- /dev/null
+From 6726655dfdd2dc60c035c690d9f10cb69d7ea075 Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Wed, 3 Sep 2014 15:04:28 +0200
+Subject: ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 6726655dfdd2dc60c035c690d9f10cb69d7ea075 upstream.
+
+There is a following AB-BA dependency between cpu_hotplug.lock and
+cpuidle_lock:
+
+1) cpu_hotplug.lock -> cpuidle_lock
+enable_nonboot_cpus()
+ _cpu_up()
+ cpu_hotplug_begin()
+ LOCK(cpu_hotplug.lock)
+ cpu_notify()
+ ...
+ acpi_processor_hotplug()
+ cpuidle_pause_and_lock()
+ LOCK(cpuidle_lock)
+
+2) cpuidle_lock -> cpu_hotplug.lock
+acpi_os_execute_deferred() workqueue
+ ...
+ acpi_processor_cst_has_changed()
+ cpuidle_pause_and_lock()
+ LOCK(cpuidle_lock)
+ get_online_cpus()
+ LOCK(cpu_hotplug.lock)
+
+Fix this by reversing the order acpi_processor_cst_has_changed() does
+thigs -- let it first execute the protection against CPU hotplug by
+calling get_online_cpus() and obtain the cpuidle lock only after that (and
+perform the symmentric change when allowing CPUs hotplug again and
+dropping cpuidle lock).
+
+Spotted by lockdep.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/processor_idle.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1071,9 +1071,9 @@ int acpi_processor_cst_has_changed(struc
+
+ if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) {
+
+- cpuidle_pause_and_lock();
+ /* Protect against cpu-hotplug */
+ get_online_cpus();
++ cpuidle_pause_and_lock();
+
+ /* Disable all cpuidle devices */
+ for_each_online_cpu(cpu) {
+@@ -1100,8 +1100,8 @@ int acpi_processor_cst_has_changed(struc
+ cpuidle_enable_device(dev);
+ }
+ }
+- put_online_cpus();
+ cpuidle_resume_and_unlock();
++ put_online_cpus();
+ }
+
+ return 0;
--- /dev/null
+From 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Thu, 21 Aug 2014 14:41:26 +0800
+Subject: ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream.
+
+There is platform refusing to respond QR_EC when SCI_EVT isn't set
+which is Acer Aspire V5-573G.
+
+By disallowing QR_EC to be issued before the previous one has been
+completed we are able to reduce the possibilities to trigger issues on
+such platforms.
+
+Note that this fix can only reduce the occurrence rate of this issue, but
+this issue may still occur when such a platform doesn't clear SCI_EVT
+before or immediately after completing the previous QR_EC transaction.
+This patch cannot fix the CLEAR_ON_RESUME quirk which also relies on
+the assumption that the platforms are able to respond even when SCI_EVT
+isn't set.
+
+But this patch is still useful as it can help to reduce the number of
+scheduled QR_EC work items.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611
+Reported-and-tested-by: Alexander Mezin <mezin.alexander@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -303,11 +303,11 @@ static int acpi_ec_transaction_unlocked(
+ /* following two actions should be kept atomic */
+ ec->curr = t;
+ start_transaction(ec);
+- if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
+- clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+ spin_unlock_irqrestore(&ec->lock, tmp);
+ ret = ec_poll(ec);
+ spin_lock_irqsave(&ec->lock, tmp);
++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
++ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+ ec->curr = NULL;
+ spin_unlock_irqrestore(&ec->lock, tmp);
+ return ret;
--- /dev/null
+From 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Thu, 21 Aug 2014 14:41:13 +0800
+Subject: ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 upstream.
+
+There is a platform refusing to respond QR_EC when SCI_EVT isn't set
+(Acer Aspire V5-573G).
+
+Currently, we rely on the behaviour that the EC firmware can respond
+something (for example, 0x00 to indicate "no outstanding events") to
+QR_EC even when SCI_EVT is not set, but the reporter has complained
+about AC/battery pluging/unpluging and video brightness change delay
+on that platform.
+
+This is because the work item that has issued QR_EC has to wait until
+timeout in this case, and the _Qxx method evaluation work item queued
+after QR_EC one is delayed.
+
+It sounds reasonable to fix this issue by:
+ 1. Implementing SCI_EVT sanity check before issuing QR_EC in the EC
+ driver's main state machine.
+ 2. Moving QR_EC issuing out of the work queue used by _Qxx evaluation
+ to a seperate IRQ handling thread.
+
+This patch fixes this issue using solution 1.
+
+By disallowing QR_EC to be issued when SCI_EVT isn't set, we are able to
+handle such platform in the EC driver's main state machine. This patch
+enhances the state machine in this way to survive with such malfunctioning
+EC firmware.
+
+Note that this patch can also fix CLEAR_ON_RESUME quirk which also relies
+on the assumption that the platforms are able to respond even when SCI_EVT
+isn't set.
+
+Fixes: c0d653412fc8 ACPI / EC: Fix race condition in ec_transaction_completed()
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611
+Reported-and-tested-by: Alexander Mezin <mezin.alexander@gmail.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ec.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -197,6 +197,8 @@ static bool advance_transaction(struct a
+ t->rdata[t->ri++] = acpi_ec_read_data(ec);
+ if (t->rlen == t->ri) {
+ t->flags |= ACPI_EC_COMMAND_COMPLETE;
++ if (t->command == ACPI_EC_COMMAND_QUERY)
++ pr_debug("hardware QR_EC completion\n");
+ wakeup = true;
+ }
+ } else
+@@ -208,7 +210,20 @@ static bool advance_transaction(struct a
+ }
+ return wakeup;
+ } else {
+- if ((status & ACPI_EC_FLAG_IBF) == 0) {
++ /*
++ * There is firmware refusing to respond QR_EC when SCI_EVT
++ * is not set, for which case, we complete the QR_EC
++ * without issuing it to the firmware.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=86211
++ */
++ if (!(status & ACPI_EC_FLAG_SCI) &&
++ (t->command == ACPI_EC_COMMAND_QUERY)) {
++ t->flags |= ACPI_EC_COMMAND_POLL;
++ t->rdata[t->ri++] = 0x00;
++ t->flags |= ACPI_EC_COMMAND_COMPLETE;
++ pr_debug("software QR_EC completion\n");
++ wakeup = true;
++ } else if ((status & ACPI_EC_FLAG_IBF) == 0) {
+ acpi_ec_write_cmd(ec, t->command);
+ t->flags |= ACPI_EC_COMMAND_POLL;
+ } else
--- /dev/null
+From dee1592638ab7ea35a32179b73f9284dead49c03 Mon Sep 17 00:00:00 2001
+From: Tang Chen <tangchen@cn.fujitsu.com>
+Date: Fri, 8 Aug 2014 10:30:45 +0800
+Subject: ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove()
+
+From: Tang Chen <tangchen@cn.fujitsu.com>
+
+commit dee1592638ab7ea35a32179b73f9284dead49c03 upstream.
+
+When ACPI_HOTPLUG_MEMORY is not configured, memory_device_handler.attach
+is not set. In acpi_scan_attach_handler(), the acpi_device->handler will
+not be initialized.
+
+In acpi_scan_hot_remove(), it doesn't check if acpi_device->handler is NULL.
+If we do memory hot-remove without ACPI_HOTPLUG_MEMORY configured, the kernel
+will panic.
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000088
+ IP: [<ffffffff813e318f>] acpi_device_hotplug+0x1d7/0x4c4
+ PGD 0
+ Oops: 0000 [#1] SMP
+ Modules linked in: sd_mod(E) sr_mod(E) cdrom(E) crc_t10dif(E) crct10dif_common(E) ata_piix(E) libata(E)
+ CPU: 0 PID: 41 Comm: kworker/u2:1 Tainted: G E 3.16.0-rc7--3.16-rc7-tangchen+ #20
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
+ Workqueue: kacpi_hotplug acpi_hotplug_work_fn
+ task: ffff8800182436c0 ti: ffff880018254000 task.ti: ffff880018254000
+ RIP: 0010:[<ffffffff813e318f>] [<ffffffff813e318f>] acpi_device_hotplug+0x1d7/0x4c4
+ RSP: 0000:ffff880018257da8 EFLAGS: 00000246
+ RAX: 0000000000000000 RBX: ffff88001cd8d800 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: ffff88001e40e6f8 RDI: 0000000000000246
+ RBP: ffff880018257df0 R08: 0000000000000096 R09: 00000000000011a0
+ R10: 63735f6970636120 R11: 725f746f685f6e61 R12: 0000000000000003
+ R13: ffff88001cc1c400 R14: ffff88001e062028 R15: 0000000000000040
+ FS: 0000000000000000(0000) GS:ffff88001e400000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 0000000000000088 CR3: 000000001a9a2000 CR4: 00000000000006f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Stack:
+ 00000000523cab58 ffff88001cd8d9f8 ffff88001852d480 00000000523cab58
+ ffff88001852d480 ffff880018221e40 ffff88001cc1c400 ffff88001cce2d00
+ 0000000000000040 ffff880018257e08 ffffffff813dc31d ffff88001852d480
+ Call Trace:
+ [<ffffffff813dc31d>] acpi_hotplug_work_fn+0x1e/0x29
+ [<ffffffff8108eefb>] process_one_work+0x17b/0x460
+ [<ffffffff8108f69d>] worker_thread+0x11d/0x5b0
+ [<ffffffff8108f580>] ? rescuer_thread+0x3a0/0x3a0
+ [<ffffffff81096811>] kthread+0xe1/0x100
+ [<ffffffff81096730>] ? kthread_create_on_node+0x1a0/0x1a0
+ [<ffffffff816cc6bc>] ret_from_fork+0x7c/0xb0
+ [<ffffffff81096730>] ? kthread_create_on_node+0x1a0/0x1a0
+
+This patch fixes this problem by checking if acpi_device->handler is NULL
+in acpi_scan_hot_remove().
+
+Fixes: d22ddcbc4fb7 (ACPI / hotplug: Add demand_offline hotplug profile flag)
+Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
+[rjw: Subject]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/scan.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -351,7 +351,8 @@ static int acpi_scan_hot_remove(struct a
+ unsigned long long sta;
+ acpi_status status;
+
+- if (device->handler->hotplug.demand_offline && !acpi_force_hot_remove) {
++ if (device->handler && device->handler->hotplug.demand_offline
++ && !acpi_force_hot_remove) {
+ if (!acpi_scan_is_offline(device, true))
+ return -EBUSY;
+ } else {
--- /dev/null
+From 236105db632c6279a020f78c83e22eaef746006b Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Tue, 26 Aug 2014 01:29:24 +0200
+Subject: ACPI: Run fixed event device notifications in process context
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 236105db632c6279a020f78c83e22eaef746006b upstream.
+
+Currently, notify callbacks for fixed button events are run from
+interrupt context. That is not necessary and after commit 0bf6368ee8f2
+(ACPI / button: Add ACPI Button event via netlink routine) it causes
+netlink routines to be called from interrupt context which is not
+correct.
+
+Also, that is different from non-fixed device events (including
+non-fixed button events) whose notify callbacks are all executed from
+process context.
+
+For the above reasons, make fixed button device notify callbacks run
+in process context which will avoid the deadlock when using netlink
+to report button events to user space.
+
+Fixes: 0bf6368ee8f2 (ACPI / button: Add ACPI Button event via netlink routine)
+Link: https://lkml.org/lkml/2014/8/21/606
+Reported-by: Benjamin Block <bebl@mageta.org>
+Reported-by: Knut Petersen <Knut_Petersen@t-online.de>
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+[rjw: Function names, subject and changelog.]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/scan.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -920,12 +920,17 @@ static void acpi_device_notify(acpi_hand
+ device->driver->ops.notify(device, event);
+ }
+
+-static acpi_status acpi_device_notify_fixed(void *data)
++static void acpi_device_notify_fixed(void *data)
+ {
+ struct acpi_device *device = data;
+
+ /* Fixed hardware devices have no handles */
+ acpi_device_notify(NULL, ACPI_FIXED_HARDWARE_EVENT, device);
++}
++
++static acpi_status acpi_device_fixed_event(void *data)
++{
++ acpi_os_execute(OSL_NOTIFY_HANDLER, acpi_device_notify_fixed, data);
+ return AE_OK;
+ }
+
+@@ -936,12 +941,12 @@ static int acpi_device_install_notify_ha
+ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
+ status =
+ acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
+- acpi_device_notify_fixed,
++ acpi_device_fixed_event,
+ device);
+ else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
+ status =
+ acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
+- acpi_device_notify_fixed,
++ acpi_device_fixed_event,
+ device);
+ else
+ status = acpi_install_notify_handler(device->handle,
+@@ -958,10 +963,10 @@ static void acpi_device_remove_notify_ha
+ {
+ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
+ acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
+- acpi_device_notify_fixed);
++ acpi_device_fixed_event);
+ else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
+ acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
+- acpi_device_notify_fixed);
++ acpi_device_fixed_event);
+ else
+ acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY,
+ acpi_device_notify);
--- /dev/null
+From fc2e0a8326d1b21d11ef8213298e5302867fed2c Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 26 Aug 2014 01:29:21 +0200
+Subject: ACPI / scan: Allow ACPI drivers to bind to PNP device objects
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit fc2e0a8326d1b21d11ef8213298e5302867fed2c upstream.
+
+We generally don't allow ACPI drivers to bind to ACPI device objects
+that companion "physical" device objects are created for to avoid
+situations in which two different drivers may attempt to handle one
+device at the same time. Recent ACPI device enumeration rework
+extended that approach to ACPI PNP devices by starting to use a scan
+handler for enumerating them. However, we previously allowed ACPI
+drivers to bind to ACPI device objects with existing PNP device
+companions and changing that led to functional regressions on some
+systems.
+
+For this reason, add a special check for PNP devices in
+acpi_device_probe() so that ACPI drivers can bind to ACPI device
+objects having existing PNP device companions as before.
+
+Fixes: eec15edbb0e1 (ACPI / PNP: use device ID list for PNPACPI device enumeration)
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=81511
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=81971
+Reported-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
+Reported-by: Dirk Griesbach <spamthis@freenet.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -978,7 +978,7 @@ static int acpi_device_probe(struct devi
+ struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver);
+ int ret;
+
+- if (acpi_dev->handler)
++ if (acpi_dev->handler && !acpi_is_pnp_device(acpi_dev))
+ return -EINVAL;
+
+ if (!acpi_drv->ops.add)
--- /dev/null
+From a383b68d9fe9864c4d3b86f67ad6488f58136435 Mon Sep 17 00:00:00 2001
+From: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+Date: Wed, 3 Sep 2014 13:39:13 +0900
+Subject: ACPI / scan: not cache _SUN value in struct acpi_device_pnp
+
+From: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+
+commit a383b68d9fe9864c4d3b86f67ad6488f58136435 upstream.
+
+The _SUN device indentification object is not guaranteed to return
+the same value every time it is executed, so we should not cache its
+return value, but rather execute it every time as needed. If it is
+cached, an incorrect stale value may be used in some situations.
+
+This issue was exposed by commit 202317a573b2 (ACPI / scan: Add
+acpi_device objects for all device nodes in the namespace). Fix it
+by avoiding to cache the return value of _SUN.
+
+Fixes: 202317a573b2 (ACPI / scan: Add acpi_device objects for all device nodes in the namespace)
+Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+[ rjw: Changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/scan.c | 15 ++++++++-------
+ include/acpi/acpi_bus.h | 1 -
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -665,8 +665,14 @@ static ssize_t
+ acpi_device_sun_show(struct device *dev, struct device_attribute *attr,
+ char *buf) {
+ struct acpi_device *acpi_dev = to_acpi_device(dev);
++ acpi_status status;
++ unsigned long long sun;
++
++ status = acpi_evaluate_integer(acpi_dev->handle, "_SUN", NULL, &sun);
++ if (ACPI_FAILURE(status))
++ return -ENODEV;
+
+- return sprintf(buf, "%lu\n", acpi_dev->pnp.sun);
++ return sprintf(buf, "%llu\n", sun);
+ }
+ static DEVICE_ATTR(sun, 0444, acpi_device_sun_show, NULL);
+
+@@ -688,7 +694,6 @@ static int acpi_device_setup_files(struc
+ {
+ struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
+ acpi_status status;
+- unsigned long long sun;
+ int result = 0;
+
+ /*
+@@ -729,14 +734,10 @@ static int acpi_device_setup_files(struc
+ if (dev->pnp.unique_id)
+ result = device_create_file(&dev->dev, &dev_attr_uid);
+
+- status = acpi_evaluate_integer(dev->handle, "_SUN", NULL, &sun);
+- if (ACPI_SUCCESS(status)) {
+- dev->pnp.sun = (unsigned long)sun;
++ if (acpi_has_method(dev->handle, "_SUN")) {
+ result = device_create_file(&dev->dev, &dev_attr_sun);
+ if (result)
+ goto end;
+- } else {
+- dev->pnp.sun = (unsigned long)-1;
+ }
+
+ if (acpi_has_method(dev->handle, "_STA")) {
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -246,7 +246,6 @@ struct acpi_device_pnp {
+ acpi_device_name device_name; /* Driver-determined */
+ acpi_device_class device_class; /* " */
+ union acpi_object *str_obj; /* unicode string for _STR method */
+- unsigned long sun; /* _SUN */
+ };
+
+ #define acpi_device_bid(d) ((d)->pnp.bus_id)
--- /dev/null
+From 5f24079b021cd3147c8d24ba65833f7a0df7e80d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 28 Aug 2014 10:20:46 +0200
+Subject: ACPI / video: Add a disable_native_backlight quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 5f24079b021cd3147c8d24ba65833f7a0df7e80d upstream.
+
+Some laptops have a working acpi_video backlight control, and using native
+backlight on these causes a regression where backlight control does not work
+when userspace is not handling brightness key events. Disable native_backlight
+on these to fix this.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=81691
+Reported-and-tested-by: Andre Müller <andre.muller@web.de>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -415,6 +415,12 @@ static int __init video_set_use_native_b
+ return 0;
+ }
+
++static int __init video_disable_native_backlight(const struct dmi_system_id *d)
++{
++ use_native_backlight_dmi = false;
++ return 0;
++}
++
+ static struct dmi_system_id video_dmi_table[] __initdata = {
+ /*
+ * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
+@@ -645,6 +651,30 @@ static struct dmi_system_id video_dmi_ta
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
+ },
+ },
++
++ /*
++ * These models have a working acpi_video backlight control, and using
++ * native backlight causes a regression where backlight does not work
++ * when userspace is not handling brightness key events. Disable
++ * native_backlight on these to fix this:
++ * https://bugzilla.kernel.org/show_bug.cgi?id=81691
++ */
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "ThinkPad T420",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T420"),
++ },
++ },
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "ThinkPad T520",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+From 84c34858a85ecf9dabd72847d860c7d3fb7536e7 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 28 Aug 2014 10:20:47 +0200
+Subject: ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 84c34858a85ecf9dabd72847d860c7d3fb7536e7 upstream.
+
+Link: https://bugs.freedesktop.org/show_bug.cgi?id=81515
+Reported-and-tested-by: Hohahiu <rakothedin@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -675,6 +675,17 @@ static struct dmi_system_id video_dmi_ta
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"),
+ },
+ },
++
++ /* The native backlight controls do not work on some older machines */
++ {
++ /* https://bugs.freedesktop.org/show_bug.cgi?id=81515 */
++ .callback = video_disable_native_backlight,
++ .ident = "HP ENVY 15 Notebook",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+From 25294e9f00f03b2b4f4c56e913bc8c573972f33b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 28 Aug 2014 10:20:45 +0200
+Subject: ACPI / video: Fix use_native_backlight selection logic
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 25294e9f00f03b2b4f4c56e913bc8c573972f33b upstream.
+
+Commit 751109aad583 ("ACPI / video: Change the default for
+video.use_native_backlight to 1") has changed the default for
+use_native_backlight from 0 to 1, but instead of changing
+use_native_backlight_dmi to true, and leaving use_native_backlight_param at -1,
+it has changed use_native_backlight_param to 1.
+
+This causes acpi_video_use_native_backlight() to always think that a value was
+specified through the param, making it impossible to add a dmi based quirk
+to force 0 now that the default is 1.
+
+This fixes this by restoring the use_native_backlight_param default to -1, and
+instead setting the use_native_backlight_dmi default to true.
+
+Fixes: 751109aad583 (ACPI / video: Change the default for video.use_native_backlight to 1)
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -82,9 +82,9 @@ module_param(allow_duplicates, bool, 064
+ * For Windows 8 systems: used to decide if video module
+ * should skip registering backlight interface of its own.
+ */
+-static int use_native_backlight_param = 1;
++static int use_native_backlight_param = -1;
+ module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
+-static bool use_native_backlight_dmi = false;
++static bool use_native_backlight_dmi = true;
+
+ static int register_count;
+ static struct mutex video_list_lock;
--- /dev/null
+From e23d9b8297546c6ceb7e70771e4915f2a41733cd Mon Sep 17 00:00:00 2001
+From: "David E. Box" <david.e.box@linux.intel.com>
+Date: Tue, 8 Jul 2014 10:06:24 +0800
+Subject: ACPICA: Namespace: Properly null terminate objects detached from a namespace node
+
+From: "David E. Box" <david.e.box@linux.intel.com>
+
+commit e23d9b8297546c6ceb7e70771e4915f2a41733cd upstream.
+
+Fixes a bug exposed by an ACPICA unit test around the
+acpi_attach_data()/acpi_detach_data() APIs where the failure to null
+terminate a detached object led to the creation of a circular linked list
+(and infinite looping) when the object is reattached.
+
+Reported in acpica bugzilla #1063
+
+Link: https://bugs.acpica.org/show_bug.cgi?id=1063
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/nsobject.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/acpi/acpica/nsobject.c
++++ b/drivers/acpi/acpica/nsobject.c
+@@ -239,6 +239,17 @@ void acpi_ns_detach_object(struct acpi_n
+ }
+ }
+
++ /*
++ * Detach the object from any data objects (which are still held by
++ * the namespace node)
++ */
++
++ if (obj_desc->common.next_object &&
++ ((obj_desc->common.next_object)->common.type ==
++ ACPI_TYPE_LOCAL_DATA)) {
++ obj_desc->common.next_object = NULL;
++ }
++
+ /* Reset the node type to untyped */
+
+ node->type = ACPI_TYPE_ANY;
--- /dev/null
+From 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce Mon Sep 17 00:00:00 2001
+From: "David E. Box" <david.e.box@linux.intel.com>
+Date: Tue, 8 Jul 2014 10:05:52 +0800
+Subject: ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
+
+From: "David E. Box" <david.e.box@linux.intel.com>
+
+commit 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce upstream.
+
+Adds return status check on copy routines to delete the allocated destination
+object if either copy fails. Reported by Colin Ian King on bugs.acpica.org,
+Bug 1087.
+The last applicable commit:
+ Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61
+ Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro
+
+Link: https://bugs.acpica.org/show_bug.cgi?id=1087
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/utcopy.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/acpi/acpica/utcopy.c
++++ b/drivers/acpi/acpica/utcopy.c
+@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union ac
+ status = acpi_ut_copy_simple_object(source_desc, *dest_desc);
+ }
+
++ /* Delete the allocated object if copy failed */
++
++ if (ACPI_FAILURE(status)) {
++ acpi_ut_remove_reference(*dest_desc);
++ }
++
+ return_ACPI_STATUS(status);
+ }
--- /dev/null
+From 3ad80b828b2533f37c221e2df155774efd6ed814 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Thu, 3 Jul 2014 16:51:36 +0200
+Subject: ASoC: adau1701: fix adau1701_reg_read()
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 3ad80b828b2533f37c221e2df155774efd6ed814 upstream.
+
+Fix a long standing bug in the read register routing of adau1701.
+The bytes arrive in the buffer in big-endian, so the result has to be
+shifted before and-ing the bytes in the loop.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/adau1701.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/adau1701.c
++++ b/sound/soc/codecs/adau1701.c
+@@ -230,8 +230,10 @@ static int adau1701_reg_read(void *conte
+
+ *value = 0;
+
+- for (i = 0; i < size; i++)
+- *value |= recv_buf[i] << (i * 8);
++ for (i = 0; i < size; i++) {
++ *value <<= 8;
++ *value |= recv_buf[i];
++ }
+
+ return 0;
+ }
--- /dev/null
+From d1555c407a65db42126b295425379acb393ba83a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20F=C3=A4rber?= <afaerber@suse.de>
+Date: Mon, 28 Jul 2014 15:05:03 +0200
+Subject: ASoC: axi: Fix ADI AXI SPDIF specification
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Andreas=20F=C3=A4rber?= <afaerber@suse.de>
+
+commit d1555c407a65db42126b295425379acb393ba83a upstream.
+
+The specification requires compatible = "adi,axi-spdif-1.00.a" but
+driver and example and file name indicate "adi,axi-spdif-tx-1.00.a".
+Change the specification to match the implementation.
+
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Michal Simek <michal.simek@xilinx.com>
+Fixes: d7b528eff927 ("dt: Add bindings documentation for the ADI AXI-SPDIF audio controller")
+Signed-off-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
++++ b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
+@@ -1,7 +1,7 @@
+ ADI AXI-SPDIF controller
+
+ Required properties:
+- - compatible : Must be "adi,axi-spdif-1.00.a"
++ - compatible : Must be "adi,axi-spdif-tx-1.00.a"
+ - reg : Must contain SPDIF core's registers location and length
+ - clocks : Pairs of phandle and specifier referencing the controller's clocks.
+ The controller expects two clocks, the clock used for the AXI interface and
--- /dev/null
+From 30443408fd7201fd1911b09daccf92fae3cc700d Mon Sep 17 00:00:00 2001
+From: Scott Jiang <scott.jiang.linux@gmail.com>
+Date: Fri, 18 Jul 2014 16:14:57 +0800
+Subject: ASoC: blackfin: use samples to set silence
+
+From: Scott Jiang <scott.jiang.linux@gmail.com>
+
+commit 30443408fd7201fd1911b09daccf92fae3cc700d upstream.
+
+The third parameter for snd_pcm_format_set_silence needs the number
+of samples instead of sample bytes.
+
+Signed-off-by: Scott Jiang <scott.jiang.linux@gmail.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c
++++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c
+@@ -290,19 +290,19 @@ static int bf5xx_pcm_silence(struct snd_
+ unsigned int sample_size = runtime->sample_bits / 8;
+ void *buf = runtime->dma_area;
+ struct bf5xx_i2s_pcm_data *dma_data;
+- unsigned int offset, size;
++ unsigned int offset, samples;
+
+ dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
+
+ if (dma_data->tdm_mode) {
+ offset = pos * 8 * sample_size;
+- size = count * 8 * sample_size;
++ samples = count * 8;
+ } else {
+ offset = frames_to_bytes(runtime, pos);
+- size = frames_to_bytes(runtime, count);
++ samples = count * runtime->channels;
+ }
+
+- snd_pcm_format_set_silence(runtime->format, buf + offset, size);
++ snd_pcm_format_set_silence(runtime->format, buf + offset, samples);
+
+ return 0;
+ }
--- /dev/null
+From 8e89761876611f06ef4be865b4780b4361caf4af Mon Sep 17 00:00:00 2001
+From: Jie Yang <yang.jie@intel.com>
+Date: Mon, 14 Jul 2014 17:37:36 +0800
+Subject: ASoC: Intel: Cleanup HSW pcm format support
+
+From: Jie Yang <yang.jie@intel.com>
+
+commit 8e89761876611f06ef4be865b4780b4361caf4af upstream.
+
+This change removes unsupported formats from System,
+Capture and Loopback FE DAIs.
+Also it fixes S24_LE support on all DAIs.
+While at this fix 24 bit flag for BYT as well.
+
+Signed-off-by: Jie Yang <yang.jie@intel.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/sst-baytrail-pcm.c | 2 +-
+ sound/soc/intel/sst-haswell-pcm.c | 27 ++++++++++++++++++---------
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+--- a/sound/soc/intel/sst-baytrail-pcm.c
++++ b/sound/soc/intel/sst-baytrail-pcm.c
+@@ -32,7 +32,7 @@ static const struct snd_pcm_hardware sst
+ SNDRV_PCM_INFO_PAUSE |
+ SNDRV_PCM_INFO_RESUME,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+- SNDRV_PCM_FORMAT_S24_LE,
++ SNDRV_PCM_FMTBIT_S24_LE,
+ .period_bytes_min = 384,
+ .period_bytes_max = 48000,
+ .periods_min = 2,
+--- a/sound/soc/intel/sst-haswell-pcm.c
++++ b/sound/soc/intel/sst-haswell-pcm.c
+@@ -80,7 +80,7 @@ static const struct snd_pcm_hardware hsw
+ SNDRV_PCM_INFO_PAUSE |
+ SNDRV_PCM_INFO_RESUME |
+ SNDRV_PCM_INFO_NO_PERIOD_WAKEUP,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_S24_LE |
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
+ SNDRV_PCM_FMTBIT_S32_LE,
+ .period_bytes_min = PAGE_SIZE,
+ .period_bytes_max = (HSW_PCM_PERIODS_MAX / HSW_PCM_PERIODS_MIN) * PAGE_SIZE,
+@@ -400,7 +400,15 @@ static int hsw_pcm_hw_params(struct snd_
+ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 16);
+ break;
+ case SNDRV_PCM_FORMAT_S24_LE:
+- bits = SST_HSW_DEPTH_24BIT;
++ bits = SST_HSW_DEPTH_32BIT;
++ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 24);
++ break;
++ case SNDRV_PCM_FORMAT_S8:
++ bits = SST_HSW_DEPTH_8BIT;
++ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 8);
++ break;
++ case SNDRV_PCM_FORMAT_S32_LE:
++ bits = SST_HSW_DEPTH_32BIT;
+ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 32);
+ break;
+ default:
+@@ -685,8 +693,9 @@ static int hsw_pcm_new(struct snd_soc_pc
+ }
+
+ #define HSW_FORMATS \
+- (SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S32_LE)
++ (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \
++ SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
++ SNDRV_PCM_FMTBIT_S8)
+
+ static struct snd_soc_dai_driver hsw_dais[] = {
+ {
+@@ -696,7 +705,7 @@ static struct snd_soc_dai_driver hsw_dai
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ },
+ {
+@@ -727,8 +736,8 @@ static struct snd_soc_dai_driver hsw_dai
+ .stream_name = "Loopback Capture",
+ .channels_min = 2,
+ .channels_max = 2,
+- .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = HSW_FORMATS,
++ .rates = SNDRV_PCM_RATE_48000,
++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ },
+ {
+@@ -737,8 +746,8 @@ static struct snd_soc_dai_driver hsw_dai
+ .stream_name = "Analog Capture",
+ .channels_min = 2,
+ .channels_max = 2,
+- .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = HSW_FORMATS,
++ .rates = SNDRV_PCM_RATE_48000,
++ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ },
+ };
--- /dev/null
+From 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Thu, 19 Jun 2014 09:32:05 +0300
+Subject: ASoC: max98090: Fix missing free_irq
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 upstream.
+
+max98090.c doesn't free the threaded interrupt it requests. This causes
+an oops when doing "cat /proc/interrupts" after snd-soc-max98090.ko is
+unloaded.
+
+Fix this by requesting the interrupt by using devm_request_threaded_irq().
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/max98090.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -2284,7 +2284,7 @@ static int max98090_probe(struct snd_soc
+ /* Register for interrupts */
+ dev_dbg(codec->dev, "irq = %d\n", max98090->irq);
+
+- ret = request_threaded_irq(max98090->irq, NULL,
++ ret = devm_request_threaded_irq(codec->dev, max98090->irq, NULL,
+ max98090_interrupt, IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ "max98090_interrupt", codec);
+ if (ret < 0) {
--- /dev/null
+From fdaf42c0105a24de8aefa60f6f7360842c4e673e Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 29 Aug 2014 13:30:23 +0300
+Subject: ASoC: omap-twl4030: Fix typo in 2nd dai link's platform_name
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit fdaf42c0105a24de8aefa60f6f7360842c4e673e upstream.
+
+The platform_name should be omap-mcasp3 for the 2nd link which is used for
+voice connection.
+
+Reported-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie+linaro@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/omap/omap-twl4030.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/omap/omap-twl4030.c
++++ b/sound/soc/omap/omap-twl4030.c
+@@ -260,7 +260,7 @@ static struct snd_soc_dai_link omap_twl4
+ .stream_name = "TWL4030 Voice",
+ .cpu_dai_name = "omap-mcbsp.3",
+ .codec_dai_name = "twl4030-voice",
+- .platform_name = "omap-mcbsp.2",
++ .platform_name = "omap-mcbsp.3",
+ .codec_name = "twl4030-codec",
+ .dai_fmt = SND_SOC_DAIFMT_DSP_A | SND_SOC_DAIFMT_IB_NF |
+ SND_SOC_DAIFMT_CBM_CFM,
--- /dev/null
+From 7ed9de76ff342cbd717a9cf897044b99272cb8f8 Mon Sep 17 00:00:00 2001
+From: Qiao Zhou <zhouqiao@marvell.com>
+Date: Wed, 4 Jun 2014 19:42:06 +0800
+Subject: ASoC: pcm: fix dpcm_path_put in dpcm runtime update
+
+From: Qiao Zhou <zhouqiao@marvell.com>
+
+commit 7ed9de76ff342cbd717a9cf897044b99272cb8f8 upstream.
+
+we need to release dapm widget list after dpcm_path_get in
+soc_dpcm_runtime_update. otherwise, there will be potential memory
+leak. add dpcm_path_put to fix it.
+
+Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2069,6 +2069,7 @@ int soc_dpcm_runtime_update(struct snd_s
+ dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK);
+ }
+
++ dpcm_path_put(&list);
+ capture:
+ /* skip if FE doesn't have capture capability */
+ if (!fe->cpu_dai->driver->capture.channels_min)
--- /dev/null
+From 4548728981de259d7d37d0ae968a777b09794168 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 31 Jul 2014 15:57:51 +0300
+Subject: ASoC: pxa: pxa-ssp: small leak in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 4548728981de259d7d37d0ae968a777b09794168 upstream.
+
+There is a small memory leak if probe() fails.
+
+Fixes: 2023c90c3a2c ('ASoC: pxa: pxa-ssp: add DT bindings')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/pxa/pxa-ssp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/pxa/pxa-ssp.c
++++ b/sound/soc/pxa/pxa-ssp.c
+@@ -723,7 +723,8 @@ static int pxa_ssp_probe(struct snd_soc_
+ ssp_handle = of_parse_phandle(dev->of_node, "port", 0);
+ if (!ssp_handle) {
+ dev_err(dev, "unable to get 'port' phandle\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_priv;
+ }
+
+ priv->ssp = pxa_ssp_request_of(ssp_handle, "SoC audio");
--- /dev/null
+From 9301503af016eb537ccce76adec0c1bb5c84871e Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Wed, 13 Aug 2014 21:51:06 +0200
+Subject: ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 9301503af016eb537ccce76adec0c1bb5c84871e upstream.
+
+This mode is unsupported, as the DMA controller can't do zero-padding
+of samples.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Johannes Stezenbach <js@sig21.net>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/pxa/pxa-ssp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/sound/soc/pxa/pxa-ssp.c
++++ b/sound/soc/pxa/pxa-ssp.c
+@@ -765,9 +765,7 @@ static int pxa_ssp_remove(struct snd_soc
+ SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
+ SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
+
+-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S24_LE | \
+- SNDRV_PCM_FMTBIT_S32_LE)
++#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+ static const struct snd_soc_dai_ops pxa_ssp_dai_ops = {
+ .startup = pxa_ssp_startup,
--- /dev/null
+From f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Tue, 26 Aug 2014 17:03:13 +0300
+Subject: ASoC: rt5640: Do not allow regmap to use bulk read-write operations
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 upstream.
+
+Debugging showed Realtek RT5642 doesn't support autoincrementing writes so
+driver should set the use_single_rw flag for regmap.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5640.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2059,6 +2059,7 @@ static struct snd_soc_codec_driver soc_c
+ static const struct regmap_config rt5640_regmap = {
+ .reg_bits = 8,
+ .val_bits = 16,
++ .use_single_rw = true,
+
+ .max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) *
+ RT5640_PR_SPACING),
--- /dev/null
+From d3d4e5247b013008a39e4d5f69ce4c60ed57f997 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Fri, 4 Jul 2014 16:05:45 +0200
+Subject: ASoC: samsung: Correct I2S DAI suspend/resume ops
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+commit d3d4e5247b013008a39e4d5f69ce4c60ed57f997 upstream.
+
+We should save/restore relevant I2S registers regardless of
+the dai->active flag, otherwise some settings are being lost
+after system suspend/resume cycle. E.g. I2S slave mode set only
+during dai initialization is not preserved and the device ends
+up in master mode after system resume.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/samsung/i2s.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -920,11 +920,9 @@ static int i2s_suspend(struct snd_soc_da
+ {
+ struct i2s_dai *i2s = to_info(dai);
+
+- if (dai->active) {
+- i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
+- i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
+- i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
+- }
++ i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
++ i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
++ i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
+
+ return 0;
+ }
+@@ -933,11 +931,9 @@ static int i2s_resume(struct snd_soc_dai
+ {
+ struct i2s_dai *i2s = to_info(dai);
+
+- if (dai->active) {
+- writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
+- writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
+- writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
+- }
++ writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
++ writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
++ writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
+
+ return 0;
+ }
--- /dev/null
+From a72d2abbe5752f3a773c4d8b7b41ae41f617f772 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 25 Jul 2014 13:12:54 +0300
+Subject: ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init()
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit a72d2abbe5752f3a773c4d8b7b41ae41f617f772 upstream.
+
+We need to return the error codes from aic31xx_device_init() and return
+from the i2c_probe with the error code.
+We will have kernel panic (NULL pointer dereference) in
+regulator_register_notifier() in case the devm_regulator_bulk_get() fails
+(with -EPROBE_DEFER for example).
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tlv320aic31xx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -1178,7 +1178,7 @@ static void aic31xx_pdata_from_of(struct
+ }
+ #endif /* CONFIG_OF */
+
+-static void aic31xx_device_init(struct aic31xx_priv *aic31xx)
++static int aic31xx_device_init(struct aic31xx_priv *aic31xx)
+ {
+ int ret, i;
+
+@@ -1197,7 +1197,7 @@ static void aic31xx_device_init(struct a
+ "aic31xx-reset-pin");
+ if (ret < 0) {
+ dev_err(aic31xx->dev, "not able to acquire gpio\n");
+- return;
++ return ret;
+ }
+ }
+
+@@ -1210,6 +1210,7 @@ static void aic31xx_device_init(struct a
+ if (ret != 0)
+ dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret);
+
++ return ret;
+ }
+
+ static int aic31xx_i2c_probe(struct i2c_client *i2c,
+@@ -1239,7 +1240,9 @@ static int aic31xx_i2c_probe(struct i2c_
+
+ aic31xx->pdata.codec_type = id->driver_data;
+
+- aic31xx_device_init(aic31xx);
++ ret = aic31xx_device_init(aic31xx);
++ if (ret)
++ return ret;
+
+ return snd_soc_register_codec(&i2c->dev, &soc_codec_driver_aic31xx,
+ aic31xx_dai_driver,
--- /dev/null
+From b38314179c9ccb789e6fe967cff171fa817e8978 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Mon, 16 Jun 2014 21:24:03 +0100
+Subject: ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit b38314179c9ccb789e6fe967cff171fa817e8978 upstream.
+
+wm1811_micd_stop takes the accdet_lock mutex, and is called from two
+places, one of which is already holding the accdet_lock. This obviously
+causes a lock up.
+
+This patch fixes this issue by removing the lock from wm1811_micd_stop
+and ensuring that it is always locked externally.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3505,6 +3505,7 @@ static irqreturn_t wm8994_mic_irq(int ir
+ return IRQ_HANDLED;
+ }
+
++/* Should be called with accdet_lock held */
+ static void wm1811_micd_stop(struct snd_soc_codec *codec)
+ {
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -3512,14 +3513,10 @@ static void wm1811_micd_stop(struct snd_
+ if (!wm8994->jackdet)
+ return;
+
+- mutex_lock(&wm8994->accdet_lock);
+-
+ snd_soc_update_bits(codec, WM8958_MIC_DETECT_1, WM8958_MICD_ENA, 0);
+
+ wm1811_jackdet_set_mode(codec, WM1811_JACKDET_MODE_JACK);
+
+- mutex_unlock(&wm8994->accdet_lock);
+-
+ if (wm8994->wm8994->pdata.jd_ext_cap)
+ snd_soc_dapm_disable_pin(&codec->dapm,
+ "MICBIAS2");
+@@ -3560,10 +3557,10 @@ static void wm8958_open_circuit_work(str
+ open_circuit_work.work);
+ struct device *dev = wm8994->wm8994->dev;
+
+- wm1811_micd_stop(wm8994->hubs.codec);
+-
+ mutex_lock(&wm8994->accdet_lock);
+
++ wm1811_micd_stop(wm8994->hubs.codec);
++
+ dev_dbg(dev, "Reporting open circuit\n");
+
+ wm8994->jack_mic = false;
--- /dev/null
+From 0a37c6efec4a2fdc2563c5a8faa472b814deee80 Mon Sep 17 00:00:00 2001
+From: Praveen Diwakar <praveen.diwakar@intel.com>
+Date: Fri, 4 Jul 2014 11:17:41 +0530
+Subject: ASoC: wm_adsp: Add missing MODULE_LICENSE
+
+From: Praveen Diwakar <praveen.diwakar@intel.com>
+
+commit 0a37c6efec4a2fdc2563c5a8faa472b814deee80 upstream.
+
+Since MODULE_LICENSE is missing the module load fails,
+so add this for module.
+
+Signed-off-by: Praveen Diwakar <praveen.diwakar@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_adsp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1758,3 +1758,5 @@ int wm_adsp2_init(struct wm_adsp *adsp,
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_init);
++
++MODULE_LICENSE("GPL v2");
--- /dev/null
+From 03a6c3ff3282ee9fa893089304d951e0be93a144 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 8 Jun 2014 23:33:25 +0100
+Subject: bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.
+
+bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
+each way. In two places the argument type is dma_addr_t, which may be
+32-bit, in which case the effect of the bit shift is undefined:
+
+drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
+drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
+ addr = bfa_sgaddr_le(sg_dma_address(sg));
+ ^
+drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
+drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
+ addr = bfa_sgaddr_le(sg_dma_address(sg));
+ ^
+drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]
+
+Avoid this by adding casts to u64 in bfa_swap_words().
+
+Compile-tested only.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Anil Gurumurthy <anil.gurumurthy@qlogic.com>
+Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/bfa/bfa_ioc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/bfa/bfa_ioc.h
++++ b/drivers/scsi/bfa/bfa_ioc.h
+@@ -72,7 +72,7 @@ struct bfa_sge_s {
+ } while (0)
+
+ #define bfa_swap_words(_x) ( \
+- ((_x) << 32) | ((_x) >> 32))
++ ((u64)(_x) << 32) | ((u64)(_x) >> 32))
+
+ #ifdef __BIG_ENDIAN
+ #define bfa_sge_to_be(_x)
--- /dev/null
+From 3c0185046c0ee49a6e55c714612ef3bcd5385df3 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sre@kernel.org>
+Date: Mon, 7 Apr 2014 13:14:04 +0200
+Subject: bq2415x_charger: Fix Atomic Sleep Bug
+
+From: Sebastian Reichel <sre@kernel.org>
+
+commit 3c0185046c0ee49a6e55c714612ef3bcd5385df3 upstream.
+
+Move sysfs_notify and i2c_transfer calls from bq2415x_notifier_call
+to bq2415x_timer_work to avoid sleeping in atomic context.
+
+This fixes the following bug:
+
+[ 7.667449] Workqueue: events power_supply_changed_work
+[ 7.673034] [<c0015c28>] (unwind_backtrace+0x0/0xe0) from [<c0011e1c>] (show_stack+0x10/0x14)
+[ 7.682098] [<c0011e1c>] (show_stack+0x10/0x14) from [<c052cdd0>] (dump_stack+0x78/0xac)
+[ 7.690704] [<c052cdd0>] (dump_stack+0x78/0xac) from [<c052a044>] (__schedule_bug+0x48/0x60)
+[ 7.699645] [<c052a044>] (__schedule_bug+0x48/0x60) from [<c053071c>] (__schedule+0x74/0x638)
+[ 7.708618] [<c053071c>] (__schedule+0x74/0x638) from [<c05301fc>] (schedule_timeout+0x1dc/0x24c)
+[ 7.718017] [<c05301fc>] (schedule_timeout+0x1dc/0x24c) from [<c05316ec>] (wait_for_common+0x138/0x17c)
+[ 7.727966] [<c05316ec>] (wait_for_common+0x138/0x17c) from [<c0362a70>] (omap_i2c_xfer+0x340/0x4a0)
+[ 7.737640] [<c0362a70>] (omap_i2c_xfer+0x340/0x4a0) from [<c035d928>] (__i2c_transfer+0x40/0x74)
+[ 7.747039] [<c035d928>] (__i2c_transfer+0x40/0x74) from [<c035e22c>] (i2c_transfer+0x6c/0x90)
+[ 7.756195] [<c035e22c>] (i2c_transfer+0x6c/0x90) from [<c037ad24>] (bq2415x_i2c_write+0x48/0x78)
+[ 7.765563] [<c037ad24>] (bq2415x_i2c_write+0x48/0x78) from [<c037ae60>] (bq2415x_set_weak_battery_voltage+0x4c/0x50)
+[ 7.776824] [<c037ae60>] (bq2415x_set_weak_battery_voltage+0x4c/0x50) from [<c037bce8>] (bq2415x_set_mode+0xdc/0x14c)
+[ 7.788085] [<c037bce8>] (bq2415x_set_mode+0xdc/0x14c) from [<c037bfb8>] (bq2415x_notifier_call+0xa8/0xb4)
+[ 7.798309] [<c037bfb8>] (bq2415x_notifier_call+0xa8/0xb4) from [<c005f228>] (notifier_call_chain+0x38/0x68)
+[ 7.808715] [<c005f228>] (notifier_call_chain+0x38/0x68) from [<c005f284>] (__atomic_notifier_call_chain+0x2c/0x3c)
+[ 7.819732] [<c005f284>] (__atomic_notifier_call_chain+0x2c/0x3c) from [<c005f2a8>] (atomic_notifier_call_chain+0x14/0x18)
+[ 7.831420] [<c005f2a8>] (atomic_notifier_call_chain+0x14/0x18) from [<c0378078>] (power_supply_changed_work+0x6c/0xb8)
+[ 7.842864] [<c0378078>] (power_supply_changed_work+0x6c/0xb8) from [<c00556c0>] (process_one_work+0x248/0x440)
+[ 7.853546] [<c00556c0>] (process_one_work+0x248/0x440) from [<c0055d6c>] (worker_thread+0x208/0x350)
+[ 7.863372] [<c0055d6c>] (worker_thread+0x208/0x350) from [<c005b0ac>] (kthread+0xc8/0xdc)
+[ 7.872131] [<c005b0ac>] (kthread+0xc8/0xdc) from [<c000e138>] (ret_from_fork+0x14/0x3c)
+
+Fixes: 32260308b4ca ("bq2415x_charger: Use power_supply notifier for automode")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/bq2415x_charger.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/bq2415x_charger.c
++++ b/drivers/power/bq2415x_charger.c
+@@ -840,8 +840,7 @@ static int bq2415x_notifier_call(struct
+ if (bq->automode < 1)
+ return NOTIFY_OK;
+
+- sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode");
+- bq2415x_set_mode(bq, bq->reported_mode);
++ schedule_delayed_work(&bq->work, 0);
+
+ return NOTIFY_OK;
+ }
+@@ -892,6 +891,11 @@ static void bq2415x_timer_work(struct wo
+ int error;
+ int boost;
+
++ if (bq->automode > 0 && (bq->reported_mode != bq->mode)) {
++ sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode");
++ bq2415x_set_mode(bq, bq->reported_mode);
++ }
++
+ if (!bq->autotimer)
+ return;
+
--- /dev/null
+From 81b6b06197606b4bef4e427a197aeb808e8d89e1 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sat, 30 Aug 2014 18:32:05 -0400
+Subject: fix EBUSY on umount() from MNT_SHRINKABLE
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 81b6b06197606b4bef4e427a197aeb808e8d89e1 upstream.
+
+We need the parents of victims alive until namespace_unlock() gets to
+dput() of the (ex-)mountpoints. However, that screws up the "is it
+busy" checks in case when we have shrinkable mounts that need to be
+killed. Solution: go ahead and decrement refcounts of parents right
+in umount_tree(), increment them again just before dropping rwsem in
+namespace_unlock() (and let the loop in the end of namespace_unlock()
+finally drop those references for good, as we do now). Parents can't
+get freed until we drop rwsem - at least one reference is kept until
+then, both in case when parent is among the victims and when it is
+not. So they'll still be around when we get to namespace_unlock().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1226,6 +1226,11 @@ static void namespace_unlock(void)
+ head.first->pprev = &head.first;
+ INIT_HLIST_HEAD(&unmounted);
+
++ /* undo decrements we'd done in umount_tree() */
++ hlist_for_each_entry(mnt, &head, mnt_hash)
++ if (mnt->mnt_ex_mountpoint.mnt)
++ mntget(mnt->mnt_ex_mountpoint.mnt);
++
+ up_write(&namespace_sem);
+
+ synchronize_rcu();
+@@ -1277,6 +1282,7 @@ void umount_tree(struct mount *mnt, int
+ p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+ if (mnt_has_parent(p)) {
+ put_mountpoint(p->mnt_mp);
++ mnt_add_count(p->mnt_parent, -1);
+ /* move the reference to mountpoint into ->mnt_ex_mountpoint */
+ p->mnt_ex_mountpoint.dentry = p->mnt_mountpoint;
+ p->mnt_ex_mountpoint.mnt = &p->mnt_parent->mnt;
--- /dev/null
+From 88b368f27a094277143d8ecd5a056116f6a41520 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 18 Aug 2014 15:09:26 -0400
+Subject: get rid of propagate_umount() mistakenly treating slaves as busy.
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 88b368f27a094277143d8ecd5a056116f6a41520 upstream.
+
+The check in __propagate_umount() ("has somebody explicitly mounted
+something on that slave?") is done *before* taking the already doomed
+victims out of the child lists.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 4 +++-
+ fs/pnode.c | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1262,6 +1262,9 @@ void umount_tree(struct mount *mnt, int
+ hlist_add_head(&p->mnt_hash, &tmp_list);
+ }
+
++ hlist_for_each_entry(p, &tmp_list, mnt_hash)
++ list_del_init(&p->mnt_child);
++
+ if (how)
+ propagate_umount(&tmp_list);
+
+@@ -1272,7 +1275,6 @@ void umount_tree(struct mount *mnt, int
+ p->mnt_ns = NULL;
+ if (how < 2)
+ p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+- list_del_init(&p->mnt_child);
+ if (mnt_has_parent(p)) {
+ put_mountpoint(p->mnt_mp);
+ /* move the reference to mountpoint into ->mnt_ex_mountpoint */
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -381,6 +381,7 @@ static void __propagate_umount(struct mo
+ * other children
+ */
+ if (child && list_empty(&child->mnt_mounts)) {
++ list_del_init(&child->mnt_child);
+ hlist_del_init_rcu(&child->mnt_hash);
+ hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash);
+ }
--- /dev/null
+From db181ce011e3c033328608299cd6fac06ea50130 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 29 Jul 2014 15:50:44 -0700
+Subject: mnt: Add tests for unprivileged remount cases that have found to be faulty
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit db181ce011e3c033328608299cd6fac06ea50130 upstream.
+
+Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
+read-only bind mount read-only in a user namespace the
+MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
+to the remount a read-only mount read-write.
+
+Upon review of the code in remount it was discovered that the code allowed
+nosuid, noexec, and nodev to be cleared. It was also discovered that
+the code was allowing the per mount atime flags to be changed.
+
+The first naive patch to fix these issues contained the flaw that using
+default atime settings when remounting a filesystem could be disallowed.
+
+To avoid this problems in the future add tests to ensure unprivileged
+remounts are succeeding and failing at the appropriate times.
+
+Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/Makefile | 1
+ tools/testing/selftests/mount/Makefile | 17
+ tools/testing/selftests/mount/unprivileged-remount-test.c | 242 ++++++++++++++
+ 3 files changed, 260 insertions(+)
+
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -4,6 +4,7 @@ TARGETS += efivarfs
+ TARGETS += kcmp
+ TARGETS += memory-hotplug
+ TARGETS += mqueue
++TARGETS += mount
+ TARGETS += net
+ TARGETS += ptrace
+ TARGETS += timers
+--- /dev/null
++++ b/tools/testing/selftests/mount/Makefile
+@@ -0,0 +1,17 @@
++# Makefile for mount selftests.
++
++all: unprivileged-remount-test
++
++unprivileged-remount-test: unprivileged-remount-test.c
++ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
++
++# Allow specific tests to be selected.
++test_unprivileged_remount: unprivileged-remount-test
++ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
++
++run_tests: all test_unprivileged_remount
++
++clean:
++ rm -f unprivileged-remount-test
++
++.PHONY: all test_unprivileged_remount
+--- /dev/null
++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
+@@ -0,0 +1,242 @@
++#define _GNU_SOURCE
++#include <sched.h>
++#include <stdio.h>
++#include <errno.h>
++#include <string.h>
++#include <sys/types.h>
++#include <sys/mount.h>
++#include <sys/wait.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <fcntl.h>
++#include <grp.h>
++#include <stdbool.h>
++#include <stdarg.h>
++
++#ifndef CLONE_NEWNS
++# define CLONE_NEWNS 0x00020000
++#endif
++#ifndef CLONE_NEWUTS
++# define CLONE_NEWUTS 0x04000000
++#endif
++#ifndef CLONE_NEWIPC
++# define CLONE_NEWIPC 0x08000000
++#endif
++#ifndef CLONE_NEWNET
++# define CLONE_NEWNET 0x40000000
++#endif
++#ifndef CLONE_NEWUSER
++# define CLONE_NEWUSER 0x10000000
++#endif
++#ifndef CLONE_NEWPID
++# define CLONE_NEWPID 0x20000000
++#endif
++
++#ifndef MS_RELATIME
++#define MS_RELATIME (1 << 21)
++#endif
++#ifndef MS_STRICTATIME
++#define MS_STRICTATIME (1 << 24)
++#endif
++
++static void die(char *fmt, ...)
++{
++ va_list ap;
++ va_start(ap, fmt);
++ vfprintf(stderr, fmt, ap);
++ va_end(ap);
++ exit(EXIT_FAILURE);
++}
++
++static void write_file(char *filename, char *fmt, ...)
++{
++ char buf[4096];
++ int fd;
++ ssize_t written;
++ int buf_len;
++ va_list ap;
++
++ va_start(ap, fmt);
++ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
++ va_end(ap);
++ if (buf_len < 0) {
++ die("vsnprintf failed: %s\n",
++ strerror(errno));
++ }
++ if (buf_len >= sizeof(buf)) {
++ die("vsnprintf output truncated\n");
++ }
++
++ fd = open(filename, O_WRONLY);
++ if (fd < 0) {
++ die("open of %s failed: %s\n",
++ filename, strerror(errno));
++ }
++ written = write(fd, buf, buf_len);
++ if (written != buf_len) {
++ if (written >= 0) {
++ die("short write to %s\n", filename);
++ } else {
++ die("write to %s failed: %s\n",
++ filename, strerror(errno));
++ }
++ }
++ if (close(fd) != 0) {
++ die("close of %s failed: %s\n",
++ filename, strerror(errno));
++ }
++}
++
++static void create_and_enter_userns(void)
++{
++ uid_t uid;
++ gid_t gid;
++
++ uid = getuid();
++ gid = getgid();
++
++ if (unshare(CLONE_NEWUSER) !=0) {
++ die("unshare(CLONE_NEWUSER) failed: %s\n",
++ strerror(errno));
++ }
++
++ write_file("/proc/self/uid_map", "0 %d 1", uid);
++ write_file("/proc/self/gid_map", "0 %d 1", gid);
++
++ if (setgroups(0, NULL) != 0) {
++ die("setgroups failed: %s\n",
++ strerror(errno));
++ }
++ if (setgid(0) != 0) {
++ die ("setgid(0) failed %s\n",
++ strerror(errno));
++ }
++ if (setuid(0) != 0) {
++ die("setuid(0) failed %s\n",
++ strerror(errno));
++ }
++}
++
++static
++bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
++{
++ pid_t child;
++
++ child = fork();
++ if (child == -1) {
++ die("fork failed: %s\n",
++ strerror(errno));
++ }
++ if (child != 0) { /* parent */
++ pid_t pid;
++ int status;
++ pid = waitpid(child, &status, 0);
++ if (pid == -1) {
++ die("waitpid failed: %s\n",
++ strerror(errno));
++ }
++ if (pid != child) {
++ die("waited for %d got %d\n",
++ child, pid);
++ }
++ if (!WIFEXITED(status)) {
++ die("child did not terminate cleanly\n");
++ }
++ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
++ }
++
++ create_and_enter_userns();
++ if (unshare(CLONE_NEWNS) != 0) {
++ die("unshare(CLONE_NEWNS) failed: %s\n",
++ strerror(errno));
++ }
++
++ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
++ die("mount of /tmp failed: %s\n",
++ strerror(errno));
++ }
++
++ create_and_enter_userns();
++
++ if (unshare(CLONE_NEWNS) != 0) {
++ die("unshare(CLONE_NEWNS) failed: %s\n",
++ strerror(errno));
++ }
++
++ if (mount("/tmp", "/tmp", "none",
++ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
++ /* system("cat /proc/self/mounts"); */
++ die("remount of /tmp failed: %s\n",
++ strerror(errno));
++ }
++
++ if (mount("/tmp", "/tmp", "none",
++ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
++ /* system("cat /proc/self/mounts"); */
++ die("remount of /tmp with invalid flags "
++ "succeeded unexpectedly\n");
++ }
++ exit(EXIT_SUCCESS);
++}
++
++static bool test_unpriv_remount_simple(int mount_flags)
++{
++ return test_unpriv_remount(mount_flags, mount_flags, 0);
++}
++
++static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
++{
++ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
++}
++
++int main(int argc, char **argv)
++{
++ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
++ die("MS_RDONLY malfunctions\n");
++ }
++ if (!test_unpriv_remount_simple(MS_NODEV)) {
++ die("MS_NODEV malfunctions\n");
++ }
++ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
++ die("MS_NOSUID malfunctions\n");
++ }
++ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
++ die("MS_NOEXEC malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
++ MS_NOATIME|MS_NODEV))
++ {
++ die("MS_RELATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
++ MS_NOATIME|MS_NODEV))
++ {
++ die("MS_STRICTATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
++ MS_STRICTATIME|MS_NODEV))
++ {
++ die("MS_RELATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
++ MS_NOATIME|MS_NODEV))
++ {
++ die("MS_RELATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
++ MS_NOATIME|MS_NODEV))
++ {
++ die("MS_RELATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
++ MS_STRICTATIME|MS_NODEV))
++ {
++ die("MS_RELATIME malfunctions\n");
++ }
++ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
++ MS_NOATIME|MS_NODEV))
++ {
++ die("Default atime malfunctions\n");
++ }
++ return EXIT_SUCCESS;
++}
--- /dev/null
+From ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 28 Jul 2014 17:36:04 -0700
+Subject: mnt: Change the default remount atime from relatime to the existing value
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e upstream.
+
+Since March 2009 the kernel has treated the state that if no
+MS_..ATIME flags are passed then the kernel defaults to relatime.
+
+Defaulting to relatime instead of the existing atime state during a
+remount is silly, and causes problems in practice for people who don't
+specify any MS_...ATIME flags and to get the default filesystem atime
+setting. Those users may encounter a permission error because the
+default atime setting does not work.
+
+A default that does not work and causes permission problems is
+ridiculous, so preserve the existing value to have a default
+atime setting that is always guaranteed to work.
+
+Using the default atime setting in this way is particularly
+interesting for applications built to run in restricted userspace
+environments without /proc mounted, as the existing atime mount
+options of a filesystem can not be read from /proc/mounts.
+
+In practice this fixes user space that uses the default atime
+setting on remount that are broken by the permission checks
+keeping less privileged users from changing more privileged users
+atime settings.
+
+Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2473,6 +2473,14 @@ long do_mount(const char *dev_name, cons
+ if (flags & MS_RDONLY)
+ mnt_flags |= MNT_READONLY;
+
++ /* The default atime for remount is preservation */
++ if ((flags & MS_REMOUNT) &&
++ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
++ MS_STRICTATIME)) == 0)) {
++ mnt_flags &= ~MNT_ATIME_MASK;
++ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
++ }
++
+ flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
+ MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
+ MS_STRICTATIME);
--- /dev/null
+From 9566d6742852c527bf5af38af5cbb878dad75705 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 28 Jul 2014 17:26:07 -0700
+Subject: mnt: Correct permission checks in do_remount
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit 9566d6742852c527bf5af38af5cbb878dad75705 upstream.
+
+While invesgiating the issue where in "mount --bind -oremount,ro ..."
+would result in later "mount --bind -oremount,rw" succeeding even if
+the mount started off locked I realized that there are several
+additional mount flags that should be locked and are not.
+
+In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime
+flags in addition to MNT_READONLY should all be locked. These
+flags are all per superblock, can all be changed with MS_BIND,
+and should not be changable if set by a more privileged user.
+
+The following additions to the current logic are added in this patch.
+- nosuid may not be clearable by a less privileged user.
+- nodev may not be clearable by a less privielged user.
+- noexec may not be clearable by a less privileged user.
+- atime flags may not be changeable by a less privileged user.
+
+The logic with atime is that always setting atime on access is a
+global policy and backup software and auditing software could break if
+atime bits are not updated (when they are configured to be updated),
+and serious performance degradation could result (DOS attack) if atime
+updates happen when they have been explicitly disabled. Therefore an
+unprivileged user should not be able to mess with the atime bits set
+by a more privileged user.
+
+The additional restrictions are implemented with the addition of
+MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME
+mnt flags.
+
+Taken together these changes and the fixes for MNT_LOCK_READONLY
+should make it safe for an unprivileged user to create a user
+namespace and to call "mount --bind -o remount,... ..." without
+the danger of mount flags being changed maliciously.
+
+Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 36 +++++++++++++++++++++++++++++++++---
+ include/linux/mount.h | 5 +++++
+ 2 files changed, 38 insertions(+), 3 deletions(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -890,8 +890,21 @@ static struct mount *clone_mnt(struct mo
+
+ mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
+ /* Don't allow unprivileged users to change mount flags */
+- if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
+- mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
++ if (flag & CL_UNPRIVILEGED) {
++ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
++
++ if (mnt->mnt.mnt_flags & MNT_READONLY)
++ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
++
++ if (mnt->mnt.mnt_flags & MNT_NODEV)
++ mnt->mnt.mnt_flags |= MNT_LOCK_NODEV;
++
++ if (mnt->mnt.mnt_flags & MNT_NOSUID)
++ mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID;
++
++ if (mnt->mnt.mnt_flags & MNT_NOEXEC)
++ mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC;
++ }
+
+ /* Don't allow unprivileged users to reveal what is under a mount */
+ if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire))
+@@ -1931,6 +1944,23 @@ static int do_remount(struct path *path,
+ !(mnt_flags & MNT_READONLY)) {
+ return -EPERM;
+ }
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
++ !(mnt_flags & MNT_NODEV)) {
++ return -EPERM;
++ }
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
++ !(mnt_flags & MNT_NOSUID)) {
++ return -EPERM;
++ }
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) &&
++ !(mnt_flags & MNT_NOEXEC)) {
++ return -EPERM;
++ }
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
++ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) {
++ return -EPERM;
++ }
++
+ err = security_sb_remount(sb, data);
+ if (err)
+ return err;
+@@ -2129,7 +2159,7 @@ static int do_new_mount(struct path *pat
+ */
+ if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) {
+ flags |= MS_NODEV;
+- mnt_flags |= MNT_NODEV;
++ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
+ }
+ }
+
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -45,12 +45,17 @@ struct mnt_namespace;
+ #define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \
+ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \
+ | MNT_READONLY)
++#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME )
+
+ #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
+ MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
+
+ #define MNT_INTERNAL 0x4000
+
++#define MNT_LOCK_ATIME 0x040000
++#define MNT_LOCK_NOEXEC 0x080000
++#define MNT_LOCK_NOSUID 0x100000
++#define MNT_LOCK_NODEV 0x200000
+ #define MNT_LOCK_READONLY 0x400000
+ #define MNT_LOCKED 0x800000
+ #define MNT_DOOMED 0x1000000
--- /dev/null
+From 07b645589dcda8b7a5249e096fece2a67556f0f4 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 28 Jul 2014 17:10:56 -0700
+Subject: mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit 07b645589dcda8b7a5249e096fece2a67556f0f4 upstream.
+
+There are no races as locked mount flags are guaranteed to never change.
+
+Moving the test into do_remount makes it more visible, and ensures all
+filesystem remounts pass the MNT_LOCK_READONLY permission check. This
+second case is not an issue today as filesystem remounts are guarded
+by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged
+mount namespaces, but it could become an issue in the future.
+
+Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1896,9 +1896,6 @@ static int change_mount_flags(struct vfs
+ if (readonly_request == __mnt_is_readonly(mnt))
+ return 0;
+
+- if (mnt->mnt_flags & MNT_LOCK_READONLY)
+- return -EPERM;
+-
+ if (readonly_request)
+ error = mnt_make_readonly(real_mount(mnt));
+ else
+@@ -1924,6 +1921,16 @@ static int do_remount(struct path *path,
+ if (path->dentry != path->mnt->mnt_root)
+ return -EINVAL;
+
++ /* Don't allow changing of locked mnt flags.
++ *
++ * No locks need to be held here while testing the various
++ * MNT_LOCK flags because those flags can never be cleared
++ * once they are set.
++ */
++ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
++ !(mnt_flags & MNT_READONLY)) {
++ return -EPERM;
++ }
+ err = security_sb_remount(sb, data);
+ if (err)
+ return err;
--- /dev/null
+From a6138db815df5ee542d848318e5dae681590fccd Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 28 Jul 2014 16:26:53 -0700
+Subject: mnt: Only change user settable mount flags in remount
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit a6138db815df5ee542d848318e5dae681590fccd upstream.
+
+Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
+read-only bind mount read-only in a user namespace the
+MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
+to the remount a read-only mount read-write.
+
+Correct this by replacing the mask of mount flags to preserve
+with a mask of mount flags that may be changed, and preserve
+all others. This ensures that any future bugs with this mask and
+remount will fail in an easy to detect way where new mount flags
+simply won't change.
+
+Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 2 +-
+ include/linux/mount.h | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1937,7 +1937,7 @@ static int do_remount(struct path *path,
+ err = do_remount_sb(sb, flags, data, 0);
+ if (!err) {
+ lock_mount_hash();
+- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK;
++ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
+ mnt->mnt.mnt_flags = mnt_flags;
+ touch_mnt_namespace(mnt->mnt_ns);
+ unlock_mount_hash();
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -42,7 +42,9 @@ struct mnt_namespace;
+ * flag, consider how it interacts with shared mounts.
+ */
+ #define MNT_SHARED_MASK (MNT_UNBINDABLE)
+-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE)
++#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \
++ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \
++ | MNT_READONLY)
+
+ #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
+ MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
--- /dev/null
+From 651e22f2701b4113989237c3048d17337dd2185c Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Wed, 6 Aug 2014 14:11:33 -0400
+Subject: ring-buffer: Always reset iterator to reader page
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 651e22f2701b4113989237c3048d17337dd2185c upstream.
+
+When performing a consuming read, the ring buffer swaps out a
+page from the ring buffer with a empty page and this page that
+was swapped out becomes the new reader page. The reader page
+is owned by the reader and since it was swapped out of the ring
+buffer, writers do not have access to it (there's an exception
+to that rule, but it's out of scope for this commit).
+
+When reading the "trace" file, it is a non consuming read, which
+means that the data in the ring buffer will not be modified.
+When the trace file is opened, a ring buffer iterator is allocated
+and writes to the ring buffer are disabled, such that the iterator
+will not have issues iterating over the data.
+
+Although the ring buffer disabled writes, it does not disable other
+reads, or even consuming reads. If a consuming read happens, then
+the iterator is reset and starts reading from the beginning again.
+
+My tests would sometimes trigger this bug on my i386 box:
+
+WARNING: CPU: 0 PID: 5175 at kernel/trace/trace.c:1527 __trace_find_cmdline+0x66/0xaa()
+Modules linked in:
+CPU: 0 PID: 5175 Comm: grep Not tainted 3.16.0-rc3-test+ #8
+Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
+ 00000000 00000000 f09c9e1c c18796b3 c1b5d74c f09c9e4c c103a0e3 c1b5154b
+ f09c9e78 00001437 c1b5d74c 000005f7 c10bd85a c10bd85a c1cac57c f09c9eb0
+ ed0e0000 f09c9e64 c103a185 00000009 f09c9e5c c1b5154b f09c9e78 f09c9e80^M
+Call Trace:
+ [<c18796b3>] dump_stack+0x4b/0x75
+ [<c103a0e3>] warn_slowpath_common+0x7e/0x95
+ [<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
+ [<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
+ [<c103a185>] warn_slowpath_fmt+0x33/0x35
+ [<c10bd85a>] __trace_find_cmdline+0x66/0xaa^M
+ [<c10bed04>] trace_find_cmdline+0x40/0x64
+ [<c10c3c16>] trace_print_context+0x27/0xec
+ [<c10c4360>] ? trace_seq_printf+0x37/0x5b
+ [<c10c0b15>] print_trace_line+0x319/0x39b
+ [<c10ba3fb>] ? ring_buffer_read+0x47/0x50
+ [<c10c13b1>] s_show+0x192/0x1ab
+ [<c10bfd9a>] ? s_next+0x5a/0x7c
+ [<c112e76e>] seq_read+0x267/0x34c
+ [<c1115a25>] vfs_read+0x8c/0xef
+ [<c112e507>] ? seq_lseek+0x154/0x154
+ [<c1115ba2>] SyS_read+0x54/0x7f
+ [<c188488e>] syscall_call+0x7/0xb
+---[ end trace 3f507febd6b4cc83 ]---
+>>>> ##### CPU 1 buffer started ####
+
+Which was the __trace_find_cmdline() function complaining about the pid
+in the event record being negative.
+
+After adding more test cases, this would trigger more often. Strangely
+enough, it would never trigger on a single test, but instead would trigger
+only when running all the tests. I believe that was the case because it
+required one of the tests to be shutting down via delayed instances while
+a new test started up.
+
+After spending several days debugging this, I found that it was caused by
+the iterator becoming corrupted. Debugging further, I found out why
+the iterator became corrupted. It happened with the rb_iter_reset().
+
+As consuming reads may not read the full reader page, and only part
+of it, there's a "read" field to know where the last read took place.
+The iterator, must also start at the read position. In the rb_iter_reset()
+code, if the reader page was disconnected from the ring buffer, the iterator
+would start at the head page within the ring buffer (where writes still
+happen). But the mistake there was that it still used the "read" field
+to start the iterator on the head page, where it should always start
+at zero because readers never read from within the ring buffer where
+writes occur.
+
+I originally wrote a patch to have it set the iter->head to 0 instead
+of iter->head_page->read, but then I questioned why it wasn't always
+setting the iter to point to the reader page, as the reader page is
+still valid. The list_empty(reader_page->list) just means that it was
+successful in swapping out. But the reader_page may still have data.
+
+There was a bug report a long time ago that was not reproducible that
+had something about trace_pipe (consuming read) not matching trace
+(iterator read). This may explain why that happened.
+
+Anyway, the correct answer to this bug is to always use the reader page
+an not reset the iterator to inside the writable ring buffer.
+
+Fixes: d769041f8653 "ring_buffer: implement new locking"
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -3357,21 +3357,16 @@ static void rb_iter_reset(struct ring_bu
+ struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
+
+ /* Iterator usage is expected to have record disabled */
+- if (list_empty(&cpu_buffer->reader_page->list)) {
+- iter->head_page = rb_set_head_page(cpu_buffer);
+- if (unlikely(!iter->head_page))
+- return;
+- iter->head = iter->head_page->read;
+- } else {
+- iter->head_page = cpu_buffer->reader_page;
+- iter->head = cpu_buffer->reader_page->read;
+- }
++ iter->head_page = cpu_buffer->reader_page;
++ iter->head = cpu_buffer->reader_page->read;
++
++ iter->cache_reader_page = iter->head_page;
++ iter->cache_read = iter->head;
++
+ if (iter->head)
+ iter->read_stamp = cpu_buffer->read_stamp;
+ else
+ iter->read_stamp = iter->head_page->page->time_stamp;
+- iter->cache_reader_page = cpu_buffer->reader_page;
+- iter->cache_read = cpu_buffer->read;
+ }
+
+ /**
--- /dev/null
+From 021de3d904b88b1771a3a2cfc5b75023c391e646 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Wed, 6 Aug 2014 15:36:31 -0400
+Subject: ring-buffer: Up rb_iter_peek() loop count to 3
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 021de3d904b88b1771a3a2cfc5b75023c391e646 upstream.
+
+After writting a test to try to trigger the bug that caused the
+ring buffer iterator to become corrupted, I hit another bug:
+
+ WARNING: CPU: 1 PID: 5281 at kernel/trace/ring_buffer.c:3766 rb_iter_peek+0x113/0x238()
+ Modules linked in: ipt_MASQUERADE sunrpc [...]
+ CPU: 1 PID: 5281 Comm: grep Tainted: G W 3.16.0-rc3-test+ #143
+ Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
+ 0000000000000000 ffffffff81809a80 ffffffff81503fb0 0000000000000000
+ ffffffff81040ca1 ffff8800796d6010 ffffffff810c138d ffff8800796d6010
+ ffff880077438c80 ffff8800796d6010 ffff88007abbe600 0000000000000003
+ Call Trace:
+ [<ffffffff81503fb0>] ? dump_stack+0x4a/0x75
+ [<ffffffff81040ca1>] ? warn_slowpath_common+0x7e/0x97
+ [<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
+ [<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
+ [<ffffffff810c14df>] ? ring_buffer_iter_peek+0x2d/0x5c
+ [<ffffffff810c6f73>] ? tracing_iter_reset+0x6e/0x96
+ [<ffffffff810c74a3>] ? s_start+0xd7/0x17b
+ [<ffffffff8112b13e>] ? kmem_cache_alloc_trace+0xda/0xea
+ [<ffffffff8114cf94>] ? seq_read+0x148/0x361
+ [<ffffffff81132d98>] ? vfs_read+0x93/0xf1
+ [<ffffffff81132f1b>] ? SyS_read+0x60/0x8e
+ [<ffffffff8150bf9f>] ? tracesys+0xdd/0xe2
+
+Debugging this bug, which triggers when the rb_iter_peek() loops too
+many times (more than 2 times), I discovered there's a case that can
+cause that function to legitimately loop 3 times!
+
+rb_iter_peek() is different than rb_buffer_peek() as the rb_buffer_peek()
+only deals with the reader page (it's for consuming reads). The
+rb_iter_peek() is for traversing the buffer without consuming it, and as
+such, it can loop for one more reason. That is, if we hit the end of
+the reader page or any page, it will go to the next page and try again.
+
+That is, we have this:
+
+ 1. iter->head > iter->head_page->page->commit
+ (rb_inc_iter() which moves the iter to the next page)
+ try again
+
+ 2. event = rb_iter_head_event()
+ event->type_len == RINGBUF_TYPE_TIME_EXTEND
+ rb_advance_iter()
+ try again
+
+ 3. read the event.
+
+But we never get to 3, because the count is greater than 2 and we
+cause the WARNING and return NULL.
+
+Up the counter to 3.
+
+Fixes: 69d1b839f7ee "ring-buffer: Bind time extend and data events together"
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1984,7 +1984,7 @@ rb_add_time_stamp(struct ring_buffer_eve
+
+ /**
+ * rb_update_event - update event type and data
+- * @event: the even to update
++ * @event: the event to update
+ * @type: the type of event
+ * @length: the size of the event field in the ring buffer
+ *
+@@ -3759,12 +3759,14 @@ rb_iter_peek(struct ring_buffer_iter *it
+ return NULL;
+
+ /*
+- * We repeat when a time extend is encountered.
+- * Since the time extend is always attached to a data event,
+- * we should never loop more than once.
+- * (We never hit the following condition more than twice).
++ * We repeat when a time extend is encountered or we hit
++ * the end of the page. Since the time extend is always attached
++ * to a data event, we should never loop more than three times.
++ * Once for going to next page, once on time extend, and
++ * finally once to get the event.
++ * (We never hit the following condition more than thrice).
+ */
+- if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
++ if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3))
+ return NULL;
+
+ if (rb_per_cpu_empty(cpu_buffer))
mips-eva-add-new-eva-header.patch
mips-malta-eva-rename-eva_entry-to-platform_eva_init.patch
mips-cps-initialize-eva-before-bringing-up-vpes-from-secondary-cores.patch
+asoc-wm8994-prevent-double-lock-of-accdet_lock-mutex-on-wm1811.patch
+asoc-pcm-fix-dpcm_path_put-in-dpcm-runtime-update.patch
+asoc-wm_adsp-add-missing-module_license.patch
+asoc-blackfin-use-samples-to-set-silence.patch
+asoc-samsung-correct-i2s-dai-suspend-resume-ops.patch
+asoc-adau1701-fix-adau1701_reg_read.patch
+asoc-max98090-fix-missing-free_irq.patch
+asoc-tlv320aic31xx-do-not-ignore-errors-in-aic31xx_device_init.patch
+asoc-intel-cleanup-hsw-pcm-format-support.patch
+asoc-pxa-pxa-ssp-small-leak-in-probe.patch
+asoc-pxa-ssp-drop-sndrv_pcm_fmtbit_s24_le.patch
+asoc-axi-fix-adi-axi-spdif-specification.patch
+asoc-rt5640-do-not-allow-regmap-to-use-bulk-read-write-operations.patch
+asoc-omap-twl4030-fix-typo-in-2nd-dai-link-s-platform_name.patch
+bfa-fix-undefined-bit-shift-on-big-endian-architectures-with-32-bit-dma-address.patch
+bq2415x_charger-fix-atomic-sleep-bug.patch
+acpica-utilities-fix-memory-leak-in-acpi_ut_copy_iobject_to_iobject.patch
+acpica-namespace-properly-null-terminate-objects-detached-from-a-namespace-node.patch
+acpi-hotplug-check-scan-handlers-in-acpi_scan_hot_remove.patch
+spi-pxa2xx-add-acpi-id-for-intel-braswell.patch
+acpi-run-fixed-event-device-notifications-in-process-context.patch
+acpi-scan-allow-acpi-drivers-to-bind-to-pnp-device-objects.patch
+acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-when-sci_evt-isn-t-set.patch
+acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch
+acpi-scan-not-cache-_sun-value-in-struct-acpi_device_pnp.patch
+acpi-cpuidle-fix-deadlock-between-cpuidle_lock-and-cpu_hotplug.lock.patch
+acpi-video-fix-use_native_backlight-selection-logic.patch
+acpi-video-add-a-disable_native_backlight-quirk.patch
+acpi-video-disable-native_backlight-on-hp-envy-15-notebook-pc.patch
+xen-events-fifo-reset-control-block-and-local-heads-on-resume.patch
+ring-buffer-always-reset-iterator-to-reader-page.patch
+ring-buffer-up-rb_iter_peek-loop-count-to-3.patch
+mnt-only-change-user-settable-mount-flags-in-remount.patch
+mnt-move-the-test-for-mnt_lock_readonly-from-change_mount_flags-into-do_remount.patch
+mnt-correct-permission-checks-in-do_remount.patch
+mnt-change-the-default-remount-atime-from-relatime-to-the-existing-value.patch
+mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch
+get-rid-of-propagate_umount-mistakenly-treating-slaves-as-busy.patch
+fix-ebusy-on-umount-from-mnt_shrinkable.patch
--- /dev/null
+From aca26364689e00e3b2052072424682231bdae6ae Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Wed, 20 Aug 2014 13:57:26 +0300
+Subject: spi/pxa2xx: Add ACPI ID for Intel Braswell
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit aca26364689e00e3b2052072424682231bdae6ae upstream.
+
+The SPI host controller is the same as used in Baytrail, only the ACPI ID
+is different so add this new ID to the list.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-pxa2xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1074,6 +1074,7 @@ static struct acpi_device_id pxa2xx_spi_
+ { "INT3430", 0 },
+ { "INT3431", 0 },
+ { "80860F0E", 0 },
++ { "8086228E", 0 },
+ { },
+ };
+ MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match);
--- /dev/null
+From c12784c3d14a2110468ec4d1383f60cfd2665576 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 31 Jul 2014 16:22:24 +0100
+Subject: xen/events/fifo: reset control block and local HEADs on resume
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+commit c12784c3d14a2110468ec4d1383f60cfd2665576 upstream.
+
+When using the FIFO-based event channel ABI, if the control block or
+the local HEADs are not reset after resuming the guest may see stale
+HEAD values and will fail to traverse the FIFO correctly.
+
+This may prevent one or more VCPUs from receiving any events following
+a resume.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/events/events_fifo.c | 48 ++++++++++++++++++++++-----------------
+ 1 file changed, 28 insertions(+), 20 deletions(-)
+
+--- a/drivers/xen/events/events_fifo.c
++++ b/drivers/xen/events/events_fifo.c
+@@ -99,6 +99,25 @@ static unsigned evtchn_fifo_nr_channels(
+ return event_array_pages * EVENT_WORDS_PER_PAGE;
+ }
+
++static int init_control_block(int cpu,
++ struct evtchn_fifo_control_block *control_block)
++{
++ struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
++ struct evtchn_init_control init_control;
++ unsigned int i;
++
++ /* Reset the control block and the local HEADs. */
++ clear_page(control_block);
++ for (i = 0; i < EVTCHN_FIFO_MAX_QUEUES; i++)
++ q->head[i] = 0;
++
++ init_control.control_gfn = virt_to_mfn(control_block);
++ init_control.offset = 0;
++ init_control.vcpu = cpu;
++
++ return HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
++}
++
+ static void free_unused_array_pages(void)
+ {
+ unsigned i;
+@@ -323,7 +342,6 @@ static void evtchn_fifo_resume(void)
+
+ for_each_possible_cpu(cpu) {
+ void *control_block = per_cpu(cpu_control_block, cpu);
+- struct evtchn_init_control init_control;
+ int ret;
+
+ if (!control_block)
+@@ -340,12 +358,7 @@ static void evtchn_fifo_resume(void)
+ continue;
+ }
+
+- init_control.control_gfn = virt_to_mfn(control_block);
+- init_control.offset = 0;
+- init_control.vcpu = cpu;
+-
+- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control,
+- &init_control);
++ ret = init_control_block(cpu, control_block);
+ if (ret < 0)
+ BUG();
+ }
+@@ -373,30 +386,25 @@ static const struct evtchn_ops evtchn_op
+ .resume = evtchn_fifo_resume,
+ };
+
+-static int evtchn_fifo_init_control_block(unsigned cpu)
++static int evtchn_fifo_alloc_control_block(unsigned cpu)
+ {
+- struct page *control_block = NULL;
+- struct evtchn_init_control init_control;
++ void *control_block = NULL;
+ int ret = -ENOMEM;
+
+- control_block = alloc_page(GFP_KERNEL|__GFP_ZERO);
++ control_block = (void *)__get_free_page(GFP_KERNEL);
+ if (control_block == NULL)
+ goto error;
+
+- init_control.control_gfn = virt_to_mfn(page_address(control_block));
+- init_control.offset = 0;
+- init_control.vcpu = cpu;
+-
+- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
++ ret = init_control_block(cpu, control_block);
+ if (ret < 0)
+ goto error;
+
+- per_cpu(cpu_control_block, cpu) = page_address(control_block);
++ per_cpu(cpu_control_block, cpu) = control_block;
+
+ return 0;
+
+ error:
+- __free_page(control_block);
++ free_page((unsigned long)control_block);
+ return ret;
+ }
+
+@@ -410,7 +418,7 @@ static int evtchn_fifo_cpu_notification(
+ switch (action) {
+ case CPU_UP_PREPARE:
+ if (!per_cpu(cpu_control_block, cpu))
+- ret = evtchn_fifo_init_control_block(cpu);
++ ret = evtchn_fifo_alloc_control_block(cpu);
+ break;
+ default:
+ break;
+@@ -427,7 +435,7 @@ int __init xen_evtchn_fifo_init(void)
+ int cpu = get_cpu();
+ int ret;
+
+- ret = evtchn_fifo_init_control_block(cpu);
++ ret = evtchn_fifo_alloc_control_block(cpu);
+ if (ret < 0)
+ goto out;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
