--- /dev/null
+From 2d369c748c2ecc2a012ee85412a04007e67913ec Mon Sep 17 00:00:00 2001
+From: Aaron Plattner <aplattner@nvidia.com>
+Date: Sun, 13 Mar 2016 13:58:57 -0700
+Subject: ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda
+
+From: Aaron Plattner <aplattner@nvidia.com>
+
+commit 2d369c748c2ecc2a012ee85412a04007e67913ec upstream.
+
+Vendor ID 0x10de0082 is used by a yet-to-be-named GPU chip.
+
+This chip also has the 2-ch audio swapping bug, so patch_nvhdmi is
+appropriate here.
+
+Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3663,6 +3663,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI
+ HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi),
--- /dev/null
+From 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 11:33:43 +0100
+Subject: ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 upstream.
+
+Just like CX20722, CX7024 codec also requires the power down at reboot
+in order to reduce the noise at reboot/shutdown.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=113511
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct
+ {
+ struct conexant_spec *spec = codec->spec;
+
+- if (codec->core.vendor_id != 0x14f150f2)
++ switch (codec->core.vendor_id) {
++ case 0x14f150f2: /* CX20722 */
++ case 0x14f150f4: /* CX20724 */
++ break;
++ default:
+ return;
++ }
+
+ /* Turn the CX20722 codec into D3 to avoid spurious noises
+ from the internal speaker during (and after) reboot */
--- /dev/null
+From 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 12:02:49 +0100
+Subject: ALSA: hda - Don't handle ELD notify from invalid port
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 upstream.
+
+The current Intel HDMI codec driver supports only three fixed ports
+from port B to port D. However, i915 driver may assign a DP on other
+ports, e.g. port A, when no eDP is used. This incompatibility is
+caught later at pin_nid_to_pin_index() and results in a warning
+message like "HDMI: pin nid 4 not registered" at each time.
+
+This patch filters out such invalid events beforehand, so that the
+kernel won't be too grumbling.
+
+Reported-by: Stefan Assmann <sassmann@kpanic.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2432,6 +2432,10 @@ static void intel_pin_eld_notify(void *a
+ struct hda_codec *codec = audio_ptr;
+ int pin_nid = port + 0x04;
+
++ /* we assume only from port-B to port-D */
++ if (port < 1 || port > 3)
++ return;
++
+ /* skip notification during system suspend (but not in runtime PM);
+ * the state will be updated at resume
+ */
--- /dev/null
+From bd48128539ab89986b24ad08ecd3e027dd1993a1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 18 Mar 2016 18:01:53 +0100
+Subject: ALSA: hda - Fix forgotten HDMI monitor_present update
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit bd48128539ab89986b24ad08ecd3e027dd1993a1 upstream.
+
+We forgot to copy monitor_present value when updating the ELD
+information. This won't change the ELD retrieval and the jack
+notification behavior, but appears only in the proc output. In that
+sense, it's no fatal error, but a bug is a bug is a bug.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1566,6 +1566,7 @@ static void update_eld(struct hda_codec
+ eld->eld_size) != 0)
+ eld_changed = true;
+
++ pin_eld->monitor_present = eld->monitor_present;
+ pin_eld->eld_valid = eld->eld_valid;
+ pin_eld->eld_size = eld->eld_size;
+ if (eld->eld_valid)
--- /dev/null
+From c64c1437afb14ebc900e40910f31ffb20bf652ad Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 21 Mar 2016 16:07:30 +0100
+Subject: ALSA: hda - Fix missing ELD update at unplugging
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c64c1437afb14ebc900e40910f31ffb20bf652ad upstream.
+
+i915 get_eld ops may return an error when no encoder is connected, and
+currently we regard the error as fatal and skip the whole ELD
+handling. This ended up with the missing ELD update at unplugging.
+
+This patch fixes the issue by treating the error as the unplugged
+state, instead of skipping the rest.
+
+Reported-by: Libin Yang <libin.yang@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1670,11 +1670,10 @@ static void sync_eld_via_acomp(struct hd
+ int size;
+
+ mutex_lock(&per_pin->lock);
++ eld->monitor_present = false;
+ size = snd_hdac_acomp_get_eld(&codec->bus->core, per_pin->pin_nid,
+ &eld->monitor_present, eld->eld_buffer,
+ ELD_MAX_SIZE);
+- if (size < 0)
+- goto unlock;
+ if (size > 0) {
+ size = min(size, ELD_MAX_SIZE);
+ if (snd_hdmi_parse_eld(codec, &eld->info,
--- /dev/null
+From 93a9ff151754fbdf951b1b993bcf96453f6e36b3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 18 Mar 2016 19:45:13 +0100
+Subject: ALSA: hda - Fix spurious kernel WARNING on Baytrail HDMI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 93a9ff151754fbdf951b1b993bcf96453f6e36b3 upstream.
+
+snd_hdac_sync_audio_rate() call is mandatory only for HSW and later
+models, but we call the function unconditionally blindly assuming that
+the function doesn't do anything harmful. But since recently, the
+function checks the validity of the passed pin NID, and eventually
+spews the warning if an unexpected pin is passed. This is seen on old
+chips like Baytrail.
+
+The fix is to limit the call of this function again only for the chips
+with the proper binding. This can be identified by the same flag as
+the eld notifier.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1873,7 +1873,8 @@ static int generic_hdmi_playback_pcm_pre
+
+ /* Call sync_audio_rate to set the N/CTS/M manually if necessary */
+ /* Todo: add DP1.2 MST audio support later */
+- snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate);
++ if (codec_has_acomp(codec))
++ snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate);
+
+ non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
+ mutex_lock(&per_pin->lock);
--- /dev/null
+From 6ef2f68fa38bf415830f67903d87180d933e0f47 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 11 Mar 2016 12:04:02 +0800
+Subject: ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 6ef2f68fa38bf415830f67903d87180d933e0f47 upstream.
+
+This Lenovo ThinkCentre AIO also uses Line2 as mic mute button and
+uses GPIO2 to control the mic mute led, so applying this quirk can
+make both the button and led work.
+
+BugLink: https://bugs.launchpad.net/bugs/1555912
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5556,6 +5556,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
--- /dev/null
+From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Mar 2016 16:44:55 +0100
+Subject: ALSA: hda - Fix unconditional GPIO toggle via automute
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.
+
+Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically
+depending on the jack plug state. This works fine for the auto-mute
+mode where the speaker gets muted upon the HP jack plug. OTOH, when
+the auto-mute mode is off, this turns off the EAPD unexpectedly
+depending on the jack state, which results in the silent speaker
+output.
+
+This patch fixes the silent speaker output issue by setting GPIO bits
+constantly when the auto-mute mode is off.
+
+Reported-and-tested-by: moosotc@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec
+ snd_hda_gen_update_outputs(codec);
+
+ if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
+- spec->gpio_data = spec->gen.hp_jack_present ?
+- spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ if (spec->gen.automute_speaker)
++ spec->gpio_data = spec->gen.hp_jack_present ?
++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ else
++ spec->gpio_data =
++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
+ snd_hda_codec_write(codec, 0x01, 0,
+ AC_VERB_SET_GPIO_DATA, spec->gpio_data);
+ }
--- /dev/null
+From fc4f000bf8c0cbf38f44de6bd5e225574e572ed4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 4 Mar 2016 11:34:18 +0100
+Subject: ALSA: hda - Fix unexpected resume through regmap code path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fc4f000bf8c0cbf38f44de6bd5e225574e572ed4 upstream.
+
+HD-audio driver has a mechanism to trigger the runtime resume
+automatically at accessing the verbs. This auto-resume, however,
+causes the mutex deadlock when invoked from the regmap handler since
+the regmap keeps the mutex while auto-resuming. For avoiding that,
+there is some tricky check in the HDA regmap handler to return -EAGAIN
+error to back-off when the codec is powered down. Then the caller of
+regmap r/w will retry after properly turning on the codec power.
+
+This works in most cases, but there seems a slight race between the
+codec power check and the actual on-demand auto-resume trigger. This
+resulted in the lockdep splat, eventually leading to a real deadlock.
+
+This patch tries to address the race window by getting the runtime PM
+refcount at the check time using pm_runtime_get_if_in_use(). With
+this call, we can keep the power on only when the codec has been
+already turned on, and back off if not.
+
+For keeping the code consistency, the code touching the runtime PM is
+stored in hdac_device.c although it's used only locally in
+hdac_regmap.c.
+
+Reported-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/hdaudio.h | 2 +
+ sound/hda/hdac_device.c | 16 +++++++++++
+ sound/hda/hdac_regmap.c | 69 ++++++++++++++++++++++++++++++++----------------
+ 3 files changed, 64 insertions(+), 23 deletions(-)
+
+--- a/include/sound/hdaudio.h
++++ b/include/sound/hdaudio.h
+@@ -168,11 +168,13 @@ int snd_hdac_power_up(struct hdac_device
+ int snd_hdac_power_down(struct hdac_device *codec);
+ int snd_hdac_power_up_pm(struct hdac_device *codec);
+ int snd_hdac_power_down_pm(struct hdac_device *codec);
++int snd_hdac_keep_power_up(struct hdac_device *codec);
+ #else
+ static inline int snd_hdac_power_up(struct hdac_device *codec) { return 0; }
+ static inline int snd_hdac_power_down(struct hdac_device *codec) { return 0; }
+ static inline int snd_hdac_power_up_pm(struct hdac_device *codec) { return 0; }
+ static inline int snd_hdac_power_down_pm(struct hdac_device *codec) { return 0; }
++static inline int snd_hdac_keep_power_up(struct hdac_device *codec) { return 0; }
+ #endif
+
+ /*
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -611,6 +611,22 @@ int snd_hdac_power_up_pm(struct hdac_dev
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm);
+
++/* like snd_hdac_power_up_pm(), but only increment the pm count when
++ * already powered up. Returns -1 if not powered up, 1 if incremented
++ * or 0 if unchanged. Only used in hdac_regmap.c
++ */
++int snd_hdac_keep_power_up(struct hdac_device *codec)
++{
++ if (!atomic_inc_not_zero(&codec->in_pm)) {
++ int ret = pm_runtime_get_if_in_use(&codec->dev);
++ if (!ret)
++ return -1;
++ if (ret < 0)
++ return 0;
++ }
++ return 1;
++}
++
+ /**
+ * snd_hdac_power_down_pm - power down the codec
+ * @codec: the codec object
+--- a/sound/hda/hdac_regmap.c
++++ b/sound/hda/hdac_regmap.c
+@@ -21,13 +21,16 @@
+ #include <sound/hdaudio.h>
+ #include <sound/hda_regmap.h>
+
+-#ifdef CONFIG_PM
+-#define codec_is_running(codec) \
+- (atomic_read(&(codec)->in_pm) || \
+- !pm_runtime_suspended(&(codec)->dev))
+-#else
+-#define codec_is_running(codec) true
+-#endif
++static int codec_pm_lock(struct hdac_device *codec)
++{
++ return snd_hdac_keep_power_up(codec);
++}
++
++static void codec_pm_unlock(struct hdac_device *codec, int lock)
++{
++ if (lock == 1)
++ snd_hdac_power_down_pm(codec);
++}
+
+ #define get_verb(reg) (((reg) >> 8) & 0xfff)
+
+@@ -238,20 +241,28 @@ static int hda_reg_read(void *context, u
+ struct hdac_device *codec = context;
+ int verb = get_verb(reg);
+ int err;
++ int pm_lock = 0;
+
+- if (!codec_is_running(codec) && verb != AC_VERB_GET_POWER_STATE)
+- return -EAGAIN;
++ if (verb != AC_VERB_GET_POWER_STATE) {
++ pm_lock = codec_pm_lock(codec);
++ if (pm_lock < 0)
++ return -EAGAIN;
++ }
+ reg |= (codec->addr << 28);
+- if (is_stereo_amp_verb(reg))
+- return hda_reg_read_stereo_amp(codec, reg, val);
+- if (verb == AC_VERB_GET_PROC_COEF)
+- return hda_reg_read_coef(codec, reg, val);
++ if (is_stereo_amp_verb(reg)) {
++ err = hda_reg_read_stereo_amp(codec, reg, val);
++ goto out;
++ }
++ if (verb == AC_VERB_GET_PROC_COEF) {
++ err = hda_reg_read_coef(codec, reg, val);
++ goto out;
++ }
+ if ((verb & 0x700) == AC_VERB_SET_AMP_GAIN_MUTE)
+ reg &= ~AC_AMP_FAKE_MUTE;
+
+ err = snd_hdac_exec_verb(codec, reg, 0, val);
+ if (err < 0)
+- return err;
++ goto out;
+ /* special handling for asymmetric reads */
+ if (verb == AC_VERB_GET_POWER_STATE) {
+ if (*val & AC_PWRST_ERROR)
+@@ -259,7 +270,9 @@ static int hda_reg_read(void *context, u
+ else /* take only the actual state */
+ *val = (*val >> 4) & 0x0f;
+ }
+- return 0;
++ out:
++ codec_pm_unlock(codec, pm_lock);
++ return err;
+ }
+
+ static int hda_reg_write(void *context, unsigned int reg, unsigned int val)
+@@ -267,6 +280,7 @@ static int hda_reg_write(void *context,
+ struct hdac_device *codec = context;
+ unsigned int verb;
+ int i, bytes, err;
++ int pm_lock = 0;
+
+ if (codec->caps_overwriting)
+ return 0;
+@@ -275,14 +289,21 @@ static int hda_reg_write(void *context,
+ reg |= (codec->addr << 28);
+ verb = get_verb(reg);
+
+- if (!codec_is_running(codec) && verb != AC_VERB_SET_POWER_STATE)
+- return codec->lazy_cache ? 0 : -EAGAIN;
++ if (verb != AC_VERB_SET_POWER_STATE) {
++ pm_lock = codec_pm_lock(codec);
++ if (pm_lock < 0)
++ return codec->lazy_cache ? 0 : -EAGAIN;
++ }
+
+- if (is_stereo_amp_verb(reg))
+- return hda_reg_write_stereo_amp(codec, reg, val);
++ if (is_stereo_amp_verb(reg)) {
++ err = hda_reg_write_stereo_amp(codec, reg, val);
++ goto out;
++ }
+
+- if (verb == AC_VERB_SET_PROC_COEF)
+- return hda_reg_write_coef(codec, reg, val);
++ if (verb == AC_VERB_SET_PROC_COEF) {
++ err = hda_reg_write_coef(codec, reg, val);
++ goto out;
++ }
+
+ switch (verb & 0xf00) {
+ case AC_VERB_SET_AMP_GAIN_MUTE:
+@@ -319,10 +340,12 @@ static int hda_reg_write(void *context,
+ reg |= (verb + i) << 8 | ((val >> (8 * i)) & 0xff);
+ err = snd_hdac_exec_verb(codec, reg, 0, NULL);
+ if (err < 0)
+- return err;
++ goto out;
+ }
+
+- return 0;
++ out:
++ codec_pm_unlock(codec, pm_lock);
++ return err;
+ }
+
+ static const struct regmap_config hda_regmap_cfg = {
--- /dev/null
+From b62232d429fa8b1dcf5d8503aa5a5397a03e646a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Mar 2016 18:15:26 +0100
+Subject: ALSA: hda - Limit i915 HDMI binding only for HSW and later
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b62232d429fa8b1dcf5d8503aa5a5397a03e646a upstream.
+
+It turned out that the pre-HSW Intel chips are incompatible with the
+naive assumption we had -- the fixed mapping between the port and the
+HD-audio widget. This may result in the bad access, as captured by
+the recent patch to add a WARN_ON() for the port mapping check.
+
+As a quick workaround, disable the i915 audio component binding for
+all pre-Haswell models.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2460,9 +2460,10 @@ static int patch_generic_hdmi(struct hda
+ codec->spec = spec;
+ hdmi_array_init(spec, 4);
+
+- /* Try to bind with i915 for any Intel codecs (if not done yet) */
++ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */
+ if (!codec_has_acomp(codec) &&
+- (codec->core.vendor_id >> 16) == 0x8086)
++ (codec->core.vendor_id >> 16) == 0x8086 &&
++ is_haswell_plus(codec))
+ if (!snd_hdac_i915_init(&codec->bus->core))
+ spec->i915_bound = true;
+
--- /dev/null
+From 691be973c0621255abb31572a98e35c57be70212 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 18 Mar 2016 15:10:08 +0100
+Subject: ALSA: hda - Really restrict i915 notifier to HSW+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 691be973c0621255abb31572a98e35c57be70212 upstream.
+
+The commit [b62232d429fa: ALSA: hda - Limit i915 HDMI binding only for
+HSW and later] tried to limit the usage of i915 audio notifier to the
+recent Intel models and switch to the old method on pre-Haswell
+models. However, it assumed that the i915 component binding hasn't
+been done on such models, and the assumption was wrong: namely,
+Baytrail had already the i915 component binding due to powerwell
+control. Thus, the workaround wasn't applied to Baytrail.
+
+For fixing this properly, this patch introduces a new flag indicating
+the usage of audio notifier and codec_has_acomp() refers to this flag
+instead of checking the existence of audio component.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -152,13 +152,17 @@ struct hdmi_spec {
+ struct hda_pcm_stream pcm_playback;
+
+ /* i915/powerwell (Haswell+/Valleyview+) specific */
++ bool use_acomp_notifier; /* use i915 eld_notify callback for hotplug */
+ struct i915_audio_component_audio_ops i915_audio_ops;
+ bool i915_bound; /* was i915 bound in this driver? */
+ };
+
+ #ifdef CONFIG_SND_HDA_I915
+-#define codec_has_acomp(codec) \
+- ((codec)->bus->core.audio_component != NULL)
++static inline bool codec_has_acomp(struct hda_codec *codec)
++{
++ struct hdmi_spec *spec = codec->spec;
++ return spec->use_acomp_notifier;
++}
+ #else
+ #define codec_has_acomp(codec) false
+ #endif
+@@ -2461,12 +2465,18 @@ static int patch_generic_hdmi(struct hda
+ codec->spec = spec;
+ hdmi_array_init(spec, 4);
+
++#ifdef CONFIG_SND_HDA_I915
+ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */
+- if (!codec_has_acomp(codec) &&
+- (codec->core.vendor_id >> 16) == 0x8086 &&
+- is_haswell_plus(codec))
+- if (!snd_hdac_i915_init(&codec->bus->core))
+- spec->i915_bound = true;
++ if ((codec->core.vendor_id >> 16) == 0x8086 &&
++ is_haswell_plus(codec)) {
++ if (!codec->bus->core.audio_component)
++ if (!snd_hdac_i915_init(&codec->bus->core))
++ spec->i915_bound = true;
++ /* use i915 audio component notifier for hotplug */
++ if (codec->bus->core.audio_component)
++ spec->use_acomp_notifier = true;
++ }
++#endif
+
+ if (is_haswell_plus(codec)) {
+ intel_haswell_enable_all_pins(codec, true);
--- /dev/null
+From 7169701ad3f9fadd7413b354ae317e67c0b37389 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 19 Mar 2016 10:40:21 +0100
+Subject: ALSA: hda - Workaround for unbalanced i915 power refcount by concurrent probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7169701ad3f9fadd7413b354ae317e67c0b37389 upstream.
+
+The recent addition of on-demand i915 audio component binding in the
+codec driver seems leading to the unbalanced i915 power refcount,
+according to Intel CI tests. Typically, it gets a kernel WARNING
+like:
+ WARNING: CPU: 3 PID: 173 at sound/hda/hdac_i915.c:91 snd_hdac_display_power+0xf1/0x110 [snd_hda_core]()
+ Call Trace:
+ [<ffffffff813fef15>] dump_stack+0x67/0x92
+ [<ffffffff81078a21>] warn_slowpath_common+0x81/0xc0
+ [<ffffffff81078b15>] warn_slowpath_null+0x15/0x20
+ [<ffffffffa00f77e1>] snd_hdac_display_power+0xf1/0x110 [snd_hda_core]
+ [<ffffffffa015039d>] azx_intel_link_power+0xd/0x10 [snd_hda_intel]
+ [<ffffffffa011e32a>] azx_link_power+0x1a/0x30 [snd_hda_codec]
+ [<ffffffffa00f21f9>] snd_hdac_link_power+0x29/0x40 [snd_hda_core]
+ [<ffffffffa01192a6>] hda_codec_runtime_suspend+0x76/0xa0 [snd_hda_codec]
+ .....
+
+The scenario is like below:
+- HD-audio driver and i915 driver are probed concurrently at the
+ (almost) same time; HDA bus tries to bind with i915, but it fails
+ because i915 initialization is still being processed.
+- Later on, HD-audio probes the HDMI codec, where it again tries to
+ bind with i915. At this time, it succeeds.
+- At finishing the probe of HDA, it decreases the refcount as if it
+ were already bound at the bus probe, since the component is bound
+ now. This triggers a kernel WARNING due to the unbalance.
+
+As a workaround, in this patch, we just disable the on-demand i915
+component binding in the codec driver. This essentially reverts back
+to the state of 4.4 kernel.
+
+We know that this is no real solution, but it's a minimalistic simple
+change that can be applied to 4.5.x kernel as stable.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94566
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2470,9 +2470,15 @@ static int patch_generic_hdmi(struct hda
+ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */
+ if ((codec->core.vendor_id >> 16) == 0x8086 &&
+ is_haswell_plus(codec)) {
++#if 0
++ /* on-demand binding leads to an unbalanced refcount when
++ * both i915 and hda drivers are probed concurrently;
++ * disabled temporarily for now
++ */
+ if (!codec->bus->core.audio_component)
+ if (!snd_hdac_i915_init(&codec->bus->core))
+ spec->i915_bound = true;
++#endif
+ /* use i915 audio component notifier for hotplug */
+ if (codec->bus->core.audio_component)
+ spec->use_acomp_notifier = true;
--- /dev/null
+From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001
+From: "Vittorio Gambaletta (VittGam)" <linuxbugs@vittgam.net>
+Date: Sun, 13 Mar 2016 22:19:34 +0100
+Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
+
+From: Vittorio Gambaletta (VittGam) <linuxbugs@vittgam.net>
+
+commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.
+
+The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
+will often fail, so add a quirk entry to fix it.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/intel8x0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(
+
+ static struct snd_pci_quirk intel8x0_clock_list[] = {
+ SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
+ SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
+ SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
+ SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
--- /dev/null
+From 0ab1ace856205d10cbc1924b2d931c01ffd216a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2016 20:56:20 +0100
+Subject: ALSA: pcm: Avoid "BUG:" string for warnings again
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0ab1ace856205d10cbc1924b2d931c01ffd216a6 upstream.
+
+The commit [d507941beb1e: ALSA: pcm: Correct PCM BUG error message]
+made the warning prefix back to "BUG:" due to its previous wrong
+prefix. But a kernel message containing "BUG:" seems taken as an Oops
+message wrongly by some brain-dead daemons, and it annoys users in the
+end. Instead of teaching daemons, change the string again to a more
+reasonable one.
+
+Fixes: 507941beb1e ('ALSA: pcm: Correct PCM BUG error message')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct
+ char name[16];
+ snd_pcm_debug_name(substream, name, sizeof(name));
+ pcm_err(substream->pcm,
+- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
++ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n",
+ name, pos, runtime->buffer_size,
+ runtime->period_size);
+ }
--- /dev/null
+From fdc69e7df3cb24f18a93192641786e5b7ecd1dfe Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Wed, 9 Mar 2016 16:31:29 +0000
+Subject: arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit fdc69e7df3cb24f18a93192641786e5b7ecd1dfe upstream.
+
+The set_pte_at() function must update the hardware PTE_RDONLY bit
+depending on the state of the PTE_WRITE and PTE_DIRTY bits of the given
+entry value. However, it currently only performs this for pte_valid()
+entries, ignoring PTE_PROT_NONE. The side-effect is that PROT_NONE
+mappings would not have the PTE_RDONLY bit set. Without
+CONFIG_ARM64_HW_AFDBM, this is not an issue since such PROT_NONE pages
+are not accessible anyway.
+
+With commit 2f4b829c625e ("arm64: Add support for hardware updates of
+the access and dirty pte bits"), the ptep_set_wrprotect() function was
+re-written to cope with automatic hardware updates of the dirty state.
+As an optimisation, only PTE_RDONLY is checked to assess the "dirty"
+status. Since set_pte_at() does not set this bit for PROT_NONE mappings,
+such pages may be considered "dirty" as a result of
+ptep_set_wrprotect().
+
+This patch updates the pte_valid() check to pte_present() in
+set_pte_at(). It also adds PTE_PROT_NONE to the swap entry bits comment.
+
+Fixes: 2f4b829c625e ("arm64: Add support for hardware updates of the access and dirty pte bits")
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Reported-by: Ganapatrao Kulkarni <gkulkarni@caviumnetworks.com>
+Tested-by: Ganapatrao Kulkarni <gkulkarni@cavium.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/pgtable.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -279,7 +279,7 @@ extern void __sync_icache_dcache(pte_t p
+ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+ pte_t *ptep, pte_t pte)
+ {
+- if (pte_valid(pte)) {
++ if (pte_present(pte)) {
+ if (pte_sw_dirty(pte) && pte_write(pte))
+ pte_val(pte) &= ~PTE_RDONLY;
+ else
+@@ -649,6 +649,7 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
+ * bits 0-1: present (must be zero)
+ * bits 2-7: swap type
+ * bits 8-57: swap offset
++ * bit 58: PTE_PROT_NONE (must be zero)
+ */
+ #define __SWP_TYPE_SHIFT 2
+ #define __SWP_TYPE_BITS 6
--- /dev/null
+From 9b299728ed777428b3908ac72ace5f8f84b97789 Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Fri, 26 Feb 2016 14:33:56 -0800
+Subject: bcache: cleaned up error handling around register_cache()
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream.
+
+Fix null pointer dereference by changing register_cache() to return an int
+instead of being void. This allows it to return -ENOMEM or -ENODEV and
+enables upper layers to handle the OOM case without NULL pointer issues.
+
+See this thread:
+ http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521
+
+Fixes this error:
+ gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register
+
+ bcache: register_cache() error opening sdh2: cannot allocate memory
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8
+ IP: [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache]
+ PGD 120dff067 PUD 1119a3067 PMD 0
+ Oops: 0000 [#1] SMP
+ Modules linked in: veth ip6table_filter ip6_tables
+ (...)
+ CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3
+ Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013
+ Workqueue: events cache_set_flush [bcache]
+ task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000
+ RIP: 0010:[<ffffffffc05a7e8d>] [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache]
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1828,11 +1828,12 @@ static int cache_alloc(struct cache_sb *
+ return 0;
+ }
+
+-static void register_cache(struct cache_sb *sb, struct page *sb_page,
++static int register_cache(struct cache_sb *sb, struct page *sb_page,
+ struct block_device *bdev, struct cache *ca)
+ {
+ char name[BDEVNAME_SIZE];
+- const char *err = "cannot allocate memory";
++ const char *err = NULL;
++ int ret = 0;
+
+ memcpy(&ca->sb, sb, sizeof(struct cache_sb));
+ ca->bdev = bdev;
+@@ -1847,27 +1848,35 @@ static void register_cache(struct cache_
+ if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+ ca->discard = CACHE_DISCARD(&ca->sb);
+
+- if (cache_alloc(sb, ca) != 0)
++ ret = cache_alloc(sb, ca);
++ if (ret != 0)
+ goto err;
+
+- err = "error creating kobject";
+- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache"))
+- goto err;
++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
++ err = "error calling kobject_add";
++ ret = -ENOMEM;
++ goto out;
++ }
+
+ mutex_lock(&bch_register_lock);
+ err = register_cache_set(ca);
+ mutex_unlock(&bch_register_lock);
+
+- if (err)
+- goto err;
++ if (err) {
++ ret = -ENODEV;
++ goto out;
++ }
+
+ pr_info("registered cache device %s", bdevname(bdev, name));
++
+ out:
+ kobject_put(&ca->kobj);
+- return;
++
+ err:
+- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+- goto out;
++ if (err)
++ pr_notice("error opening %s: %s", bdevname(bdev, name), err);
++
++ return ret;
+ }
+
+ /* Global interfaces/init */
+@@ -1965,7 +1974,8 @@ static ssize_t register_bcache(struct ko
+ if (!ca)
+ goto err_close;
+
+- register_cache(sb, sb_page, bdev, ca);
++ if (register_cache(sb, sb_page, bdev, ca) != 0)
++ goto err_close;
+ }
+ out:
+ if (sb_page)
--- /dev/null
+From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Mon, 7 Mar 2016 15:17:50 -0800
+Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit f8b11260a445169989d01df75d35af0f56178f95 upstream.
+
+When bch_cache_set_alloc() fails to kzalloc the cache_set, the
+asyncronous closure handling tries to dereference a cache_set that
+hadn't yet been allocated inside of cache_set_flush() which is called
+by __cache_set_unregister() during cleanup. This appears to happen only
+during an OOM condition on bcache_register.
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1373,6 +1373,9 @@ static void cache_set_flush(struct closu
+ struct btree *b;
+ unsigned i;
+
++ if (!c)
++ closure_return(cl);
++
+ bch_cache_accounting_destroy(&c->accounting);
+
+ kobject_put(&c->internal);
--- /dev/null
+From 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Fri, 26 Feb 2016 14:39:06 -0800
+Subject: bcache: fix race of writeback thread starting before complete initialization
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d upstream.
+
+The bch_writeback_thread might BUG_ON in read_dirty() if
+dc->sb==BDEV_STATE_DIRTY and bch_sectors_dirty_init has not yet completed
+its related initialization. This patch downs the dc->writeback_lock until
+after initialization is complete, thus preventing bch_writeback_thread
+from proceeding prematurely.
+
+See this thread:
+ http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3453
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_
+ */
+ atomic_set(&dc->count, 1);
+
+- if (bch_cached_dev_writeback_start(dc))
++ /* Block writeback thread, but spawn it */
++ down_write(&dc->writeback_lock);
++ if (bch_cached_dev_writeback_start(dc)) {
++ up_write(&dc->writeback_lock);
+ return -ENOMEM;
++ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+ bch_sectors_dirty_init(dc);
+@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+
++ /* Allow the writeback thread to proceed */
++ up_write(&dc->writeback_lock);
++
+ pr_info("Caching %s as %s on set %pU",
+ bdevname(dc->bdev, buf), dc->disk.disk->disk_name,
+ dc->disk.c->sb.set_uuid);
--- /dev/null
+From 28c971d82fb58ef7cba22e5308be6d2d2590473d Mon Sep 17 00:00:00 2001
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+Date: Wed, 10 Feb 2016 00:49:11 +0300
+Subject: Bluetooth: Add new AR3012 ID 0489:e095
+
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+
+commit 28c971d82fb58ef7cba22e5308be6d2d2590473d upstream.
+
+T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e095 Rev=00.01
+C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+This device requires ar3k/AthrBT_0x31010100.dfu and
+ar3k/ramps_0x31010100_40.dfu firmware files that are not in
+linux-firmware yet.
+
+BugLink: https://bugs.launchpad.net/bugs/1542944
+
+Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/ath3k.c | 2 ++
+ drivers/bluetooth/btusb.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x0489, 0xe05f) },
+ { USB_DEVICE(0x0489, 0xe076) },
+ { USB_DEVICE(0x0489, 0xe078) },
++ { USB_DEVICE(0x0489, 0xe095) },
+ { USB_DEVICE(0x04c5, 0x1330) },
+ { USB_DEVICE(0x04CA, 0x3004) },
+ { USB_DEVICE(0x04CA, 0x3005) },
+@@ -147,6 +148,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -196,6 +196,7 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
--- /dev/null
+From 6a0e78072c2ae7b20b14e0249d8108441ea928d2 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Fri, 11 Mar 2016 09:56:33 +0200
+Subject: Bluetooth: Fix potential buffer overflow with Add Advertising
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 6a0e78072c2ae7b20b14e0249d8108441ea928d2 upstream.
+
+The Add Advertising command handler does the appropriate checks for
+the AD and Scan Response data, however fails to take into account the
+general length of the mgmt command itself, which could lead to
+potential buffer overflows. This patch adds the necessary check that
+the mgmt command length is consistent with the given ad and scan_rsp
+lengths.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -5979,6 +5979,10 @@ static int add_advertising(struct sock *
+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+ MGMT_STATUS_INVALID_PARAMS);
+
++ if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
++ MGMT_STATUS_INVALID_PARAMS);
++
+ flags = __le32_to_cpu(cp->flags);
+ timeout = __le16_to_cpu(cp->timeout);
+ duration = __le16_to_cpu(cp->duration);
--- /dev/null
+From 5e4298be45e83ecdffaabb370eea9396889b07f1 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Tue, 15 Dec 2015 16:38:22 +0100
+Subject: brd: Fix discard request processing
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 5e4298be45e83ecdffaabb370eea9396889b07f1 upstream.
+
+Avoid that discard requests with size => PAGE_SIZE fail with
+-EIO. Refuse discard requests if the discard size is not a
+multiple of the page size.
+
+Fixes: 2dbe54957636 ("brd: Refuse improperly aligned discard requests")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Reviewed-by: Jan Kara <jack@suse.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Robert Elliot <elliott@hp.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/brd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -341,7 +341,7 @@ static blk_qc_t brd_make_request(struct
+
+ if (unlikely(bio->bi_rw & REQ_DISCARD)) {
+ if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) ||
+- bio->bi_iter.bi_size & PAGE_MASK)
++ bio->bi_iter.bi_size & ~PAGE_MASK)
+ goto io_error;
+ discard_from_brd(brd, sector, bio->bi_iter.bi_size);
+ goto out;
--- /dev/null
+From 2b021cbf3cb6208f0d40fd2f1869f237934340ed Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 15 Mar 2016 20:43:04 -0400
+Subject: cgroup: ignore css_sets associated with dead cgroups during migration
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2b021cbf3cb6208f0d40fd2f1869f237934340ed upstream.
+
+Before 2e91fa7f6d45 ("cgroup: keep zombies associated with their
+original cgroups"), all dead tasks were associated with init_css_set.
+If a zombie task is requested for migration, while migration prep
+operations would still be performed on init_css_set, the actual
+migration would ignore zombie tasks. As init_css_set is always valid,
+this worked fine.
+
+However, after 2e91fa7f6d45, zombie tasks stay with the css_set it was
+associated with at the time of death. Let's say a task T associated
+with cgroup A on hierarchy H-1 and cgroup B on hiearchy H-2. After T
+becomes a zombie, it would still remain associated with A and B. If A
+only contains zombie tasks, it can be removed. On removal, A gets
+marked offline but stays pinned until all zombies are drained. At
+this point, if migration is initiated on T to a cgroup C on hierarchy
+H-2, migration path would try to prepare T's css_set for migration and
+trigger the following.
+
+ WARNING: CPU: 0 PID: 1576 at kernel/cgroup.c:474 cgroup_get+0x121/0x160()
+ CPU: 0 PID: 1576 Comm: bash Not tainted 4.4.0-work+ #289
+ ...
+ Call Trace:
+ [<ffffffff8127e63c>] dump_stack+0x4e/0x82
+ [<ffffffff810445e8>] warn_slowpath_common+0x78/0xb0
+ [<ffffffff810446d5>] warn_slowpath_null+0x15/0x20
+ [<ffffffff810c33e1>] cgroup_get+0x121/0x160
+ [<ffffffff810c349b>] link_css_set+0x7b/0x90
+ [<ffffffff810c4fbc>] find_css_set+0x3bc/0x5e0
+ [<ffffffff810c5269>] cgroup_migrate_prepare_dst+0x89/0x1f0
+ [<ffffffff810c7547>] cgroup_attach_task+0x157/0x230
+ [<ffffffff810c7a17>] __cgroup_procs_write+0x2b7/0x470
+ [<ffffffff810c7bdc>] cgroup_tasks_write+0xc/0x10
+ [<ffffffff810c4790>] cgroup_file_write+0x30/0x1b0
+ [<ffffffff811c68fc>] kernfs_fop_write+0x13c/0x180
+ [<ffffffff81151673>] __vfs_write+0x23/0xe0
+ [<ffffffff81152494>] vfs_write+0xa4/0x1a0
+ [<ffffffff811532d4>] SyS_write+0x44/0xa0
+ [<ffffffff814af2d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
+
+It doesn't make sense to prepare migration for css_sets pointing to
+dead cgroups as they are guaranteed to contain only zombies which are
+ignored later during migration. This patch makes cgroup destruction
+path mark all affected css_sets as dead and updates the migration path
+to ignore them during preparation.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Fixes: 2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/cgroup-defs.h | 3 +++
+ kernel/cgroup.c | 20 ++++++++++++++++++--
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -210,6 +210,9 @@ struct css_set {
+ /* all css_task_iters currently walking this cset */
+ struct list_head task_iters;
+
++ /* dead and being drained, ignore for migration */
++ bool dead;
++
+ /* For RCU-protected deletion */
+ struct rcu_head rcu_head;
+ };
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2474,6 +2474,14 @@ static void cgroup_migrate_add_src(struc
+ lockdep_assert_held(&cgroup_mutex);
+ lockdep_assert_held(&css_set_lock);
+
++ /*
++ * If ->dead, @src_set is associated with one or more dead cgroups
++ * and doesn't contain any migratable tasks. Ignore it early so
++ * that the rest of migration path doesn't get confused by it.
++ */
++ if (src_cset->dead)
++ return;
++
+ src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
+
+ if (!list_empty(&src_cset->mg_preload_node))
+@@ -5114,6 +5122,7 @@ static int cgroup_destroy_locked(struct
+ __releases(&cgroup_mutex) __acquires(&cgroup_mutex)
+ {
+ struct cgroup_subsys_state *css;
++ struct cgrp_cset_link *link;
+ int ssid;
+
+ lockdep_assert_held(&cgroup_mutex);
+@@ -5134,11 +5143,18 @@ static int cgroup_destroy_locked(struct
+ return -EBUSY;
+
+ /*
+- * Mark @cgrp dead. This prevents further task migration and child
+- * creation by disabling cgroup_lock_live_group().
++ * Mark @cgrp and the associated csets dead. The former prevents
++ * further task migration and child creation by disabling
++ * cgroup_lock_live_group(). The latter makes the csets ignored by
++ * the migration path.
+ */
+ cgrp->self.flags &= ~CSS_ONLINE;
+
++ spin_lock_bh(&css_set_lock);
++ list_for_each_entry(link, &cgrp->cset_links, cset_link)
++ link->cset->dead = true;
++ spin_unlock_bh(&css_set_lock);
++
+ /* initiate massacre of all css's */
+ for_each_css(css, ssid, cgrp)
+ kill_css(css);
--- /dev/null
+From 4c11e554fb894b381a3dc47069259d87a2e6ffc9 Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Thu, 17 Mar 2016 14:17:20 -0700
+Subject: drivers/firmware/broadcom/bcm47xx_nvram.c: fix incorrect __ioread32_copy
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+commit 4c11e554fb894b381a3dc47069259d87a2e6ffc9 upstream.
+
+Commit 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use
+__ioread32_copy() instead of open-coding") switched to use a generic
+copy function, but failed to notice that the header pointer is updated
+between the two copies, resulting in bogus data being copied in the
+latter one. Fix by keeping the old header pointer.
+
+The patch fixes totally broken networking on WRT54GL router (both LAN and
+WLAN interfaces fail to probe).
+
+Fixes: 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use __ioread32_copy() instead of open-coding")
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Cc: Rafal Milecki <zajec5@gmail.com>
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/broadcom/bcm47xx_nvram.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/firmware/broadcom/bcm47xx_nvram.c
++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c
+@@ -94,15 +94,14 @@ static int nvram_find_and_copy(void __io
+
+ found:
+ __ioread32_copy(nvram_buf, header, sizeof(*header) / 4);
+- header = (struct nvram_header *)nvram_buf;
+- nvram_len = header->len;
++ nvram_len = ((struct nvram_header *)(nvram_buf))->len;
+ if (nvram_len > size) {
+ pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
+ nvram_len = size;
+ }
+ if (nvram_len >= NVRAM_SPACE) {
+ pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+- header->len, NVRAM_SPACE - 1);
++ nvram_len, NVRAM_SPACE - 1);
+ nvram_len = NVRAM_SPACE - 1;
+ }
+ /* proceed reading data after header */
--- /dev/null
+From e0a8604f1300cefab4aeafe214fc57954a7b4487 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 11 Mar 2016 17:31:27 +0100
+Subject: gpio: pca953x: Fix pca953x_gpio_set_multiple() on 64-bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit e0a8604f1300cefab4aeafe214fc57954a7b4487 upstream.
+
+pca953x_gpio_set_multiple() divides by 4 to convert from longs to bytes,
+which assumes a 32-bit platform, and is not correct on 64-bit platforms.
+Use "sizeof(...)" instead to fix this.
+
+Fixes: b4818afeacbd8182 ("gpio: pca953x: Add set_multiple to allow multiple bits to be set in one write.")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Phil Reid <preid@electromag.com.au>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-pca953x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -367,9 +367,11 @@ static void pca953x_gpio_set_multiple(st
+ memcpy(reg_val, chip->reg_output, NBANK(chip));
+ mutex_lock(&chip->i2c_lock);
+ for(bank=0; bank<NBANK(chip); bank++) {
+- unsigned bankmask = mask[bank/4] >> ((bank % 4) * 8);
++ unsigned bankmask = mask[bank / sizeof(*mask)] >>
++ ((bank % sizeof(*mask)) * 8);
+ if(bankmask) {
+- unsigned bankval = bits[bank/4] >> ((bank % 4) * 8);
++ unsigned bankval = bits[bank / sizeof(*bits)] >>
++ ((bank % sizeof(*bits)) * 8);
+ reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval;
+ }
+ }
--- /dev/null
+From b0f84ac352762ed02d7ea9f284942a8cab7f9077 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Thu, 17 Mar 2016 14:17:16 -0700
+Subject: ia64: define ioremap_uc()
+
+From: Luis R. Rodriguez <mcgrof@kernel.org>
+
+commit b0f84ac352762ed02d7ea9f284942a8cab7f9077 upstream.
+
+All architectures now need ioremap_uc(), ia64 seems defines this already
+through its ioremap_nocache() and it already ensures it *only* uses UC.
+
+This is needed since v4.3 to complete an allyesconfig compile on ia64,
+there were others archs that needed this, and this one seems to have
+fallen through the cracks.
+
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Acked-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/ia64/include/asm/io.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/ia64/include/asm/io.h
++++ b/arch/ia64/include/asm/io.h
+@@ -433,6 +433,7 @@ static inline void __iomem * ioremap_cac
+ return ioremap(phys_addr, size);
+ }
+ #define ioremap_cache ioremap_cache
++#define ioremap_uc ioremap_nocache
+
+
+ /*
--- /dev/null
+From 51093254bf879bc9ce96590400a87897c7498463 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 11 Feb 2016 11:03:09 -0800
+Subject: IB/srpt: Simplify srpt_handle_tsk_mgmt()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 51093254bf879bc9ce96590400a87897c7498463 upstream.
+
+Let the target core check task existence instead of the SRP target
+driver. Additionally, let the target core check the validity of the
+task management request instead of the ib_srpt driver.
+
+This patch fixes the following kernel crash:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
+IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt]
+Oops: 0002 [#1] SMP
+Call Trace:
+ [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt]
+ [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt]
+ [<ffffffff8109726f>] kthread+0xcf/0xe0
+ [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr")
+Tested-by: Alex Estrin <alex.estrin@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ----------------------------------
+ 1 file changed, 1 insertion(+), 58 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1670,47 +1670,6 @@ send_sense:
+ return -1;
+ }
+
+-/**
+- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag.
+- * @ch: RDMA channel of the task management request.
+- * @fn: Task management function to perform.
+- * @req_tag: Tag of the SRP task management request.
+- * @mgmt_ioctx: I/O context of the task management request.
+- *
+- * Returns zero if the target core will process the task management
+- * request asynchronously.
+- *
+- * Note: It is assumed that the initiator serializes tag-based task management
+- * requests.
+- */
+-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag)
+-{
+- struct srpt_device *sdev;
+- struct srpt_rdma_ch *ch;
+- struct srpt_send_ioctx *target;
+- int ret, i;
+-
+- ret = -EINVAL;
+- ch = ioctx->ch;
+- BUG_ON(!ch);
+- BUG_ON(!ch->sport);
+- sdev = ch->sport->sdev;
+- BUG_ON(!sdev);
+- spin_lock_irq(&sdev->spinlock);
+- for (i = 0; i < ch->rq_size; ++i) {
+- target = ch->ioctx_ring[i];
+- if (target->cmd.se_lun == ioctx->cmd.se_lun &&
+- target->cmd.tag == tag &&
+- srpt_get_cmd_state(target) != SRPT_STATE_DONE) {
+- ret = 0;
+- /* now let the target core abort &target->cmd; */
+- break;
+- }
+- }
+- spin_unlock_irq(&sdev->spinlock);
+- return ret;
+-}
+-
+ static int srp_tmr_to_tcm(int fn)
+ {
+ switch (fn) {
+@@ -1745,7 +1704,6 @@ static void srpt_handle_tsk_mgmt(struct
+ struct se_cmd *cmd;
+ struct se_session *sess = ch->sess;
+ uint64_t unpacked_lun;
+- uint32_t tag = 0;
+ int tcm_tmr;
+ int rc;
+
+@@ -1761,25 +1719,10 @@ static void srpt_handle_tsk_mgmt(struct
+ srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
+ send_ioctx->cmd.tag = srp_tsk->tag;
+ tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
+- if (tcm_tmr < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
+- goto fail;
+- }
+ unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun,
+ sizeof(srp_tsk->lun));
+-
+- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) {
+- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag);
+- if (rc < 0) {
+- send_ioctx->cmd.se_tmr_req->response =
+- TMR_TASK_DOES_NOT_EXIST;
+- goto fail;
+- }
+- tag = srp_tsk->task_tag;
+- }
+ rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun,
+- srp_tsk, tcm_tmr, GFP_KERNEL, tag,
++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag,
+ TARGET_SCF_ACK_KREF);
+ if (rc != 0) {
+ send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
--- /dev/null
+From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Wed, 9 Mar 2016 23:47:25 -0500
+Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream.
+
+On umount path, jbd2_journal_destroy() writes latest transaction ID
+(->j_tail_sequence) to be used at next mount.
+
+The bug is that ->j_tail_sequence is not holding latest transaction ID
+in some cases. So, at next mount, there is chance to conflict with
+remaining (not overwritten yet) transactions.
+
+ mount (id=10)
+ write transaction (id=11)
+ write transaction (id=12)
+ umount (id=10) <= the bug doesn't write latest ID
+
+ mount (id=10)
+ write transaction (id=11)
+ crash
+
+ mount
+ [recovery process]
+ transaction (id=11)
+ transaction (id=12) <= valid transaction ID, but old commit
+ must not replay
+
+Like above, this bug become the cause of recovery failure, or FS
+corruption.
+
+So why ->j_tail_sequence doesn't point latest ID?
+
+Because if checkpoint transactions was reclaimed by memory pressure
+(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated.
+(And another case is, __jbd2_journal_clean_checkpoint_list() is called
+with empty transaction.)
+
+So in above cases, ->j_tail_sequence is not pointing latest
+transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not
+done too.
+
+So, to fix this problem with minimum changes, this patch updates
+->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes,
+some optimizations would be possible to avoid unnecessary REQ_FLUSH
+for example though.)
+
+BTW,
+
+ journal->j_tail_sequence =
+ ++journal->j_transaction_sequence;
+
+Increment of ->j_transaction_sequence seems to be unnecessary, but
+ext3 does this.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/journal.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1408,11 +1408,12 @@ out:
+ /**
+ * jbd2_mark_journal_empty() - Mark on disk journal as empty.
+ * @journal: The journal to update.
++ * @write_op: With which operation should we write the journal sb
+ *
+ * Update a journal's dynamic superblock fields to show that journal is empty.
+ * Write updated superblock to disk waiting for IO to complete.
+ */
+-static void jbd2_mark_journal_empty(journal_t *journal)
++static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
+
+@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(jour
+ sb->s_start = cpu_to_be32(0);
+ read_unlock(&journal->j_state_lock);
+
+- jbd2_write_superblock(journal, WRITE_FUA);
++ jbd2_write_superblock(journal, write_op);
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *jour
+ if (journal->j_sb_buffer) {
+ if (!is_journal_aborted(journal)) {
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++
++ write_lock(&journal->j_state_lock);
++ journal->j_tail_sequence =
++ ++journal->j_transaction_sequence;
++ write_unlock(&journal->j_state_lock);
++
++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ } else
+ err = -EIO;
+@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journa
+ * the magic code for a fully-recovered superblock. Any future
+ * commits of data to the journal will restore the current
+ * s_start value. */
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ write_lock(&journal->j_state_lock);
+ J_ASSERT(!journal->j_running_transaction);
+@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal
+ if (write) {
+ /* Lock to make assertions happy... */
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ }
+
--- /dev/null
+From b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 17 Mar 2016 14:20:28 -0700
+Subject: mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f upstream.
+
+Setting the original memory.limit_in_bytes hardlimit is subject to a
+race condition when the desired value is below the current usage. The
+code tries a few times to first reclaim and then see if the usage has
+dropped to where we would like it to be, but there is no locking, and
+the workload is free to continue making new charges up to the old limit.
+Thus, attempting to shrink a workload relies on pure luck and hope that
+the workload happens to cooperate.
+
+To fix this in the cgroup2 memory.max knob, do it the other way round:
+set the limit first, then try enforcement. And if reclaim is not able
+to succeed, trigger OOM kills in the group. Keep going until the new
+limit is met, we run out of OOM victims and there's only unreclaimable
+memory left, or the task writing to memory.max is killed. This allows
+users to shrink groups reliably, and the behavior is consistent with
+what happens when new charges are attempted in excess of memory.max.
+
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/cgroup-v2.txt | 6 ++++++
+ mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++----
+ 2 files changed, 40 insertions(+), 4 deletions(-)
+
+--- a/Documentation/cgroup-v2.txt
++++ b/Documentation/cgroup-v2.txt
+@@ -1368,6 +1368,12 @@ system than killing the group. Otherwis
+ limit this type of spillover and ultimately contain buggy or even
+ malicious applications.
+
++Setting the original memory.limit_in_bytes below the current usage was
++subject to a race condition, where concurrent charges could cause the
++limit setting to fail. memory.max on the other hand will first set the
++limit to prevent new charges, and then reclaim and OOM kill until the
++new limit is met - or the task writing to memory.max is killed.
++
+ The combined memory+swap accounting and limiting is replaced by real
+ control over swap space.
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1262,7 +1262,7 @@ static unsigned long mem_cgroup_get_limi
+ return limit;
+ }
+
+-static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
++static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
+ int order)
+ {
+ struct oom_control oc = {
+@@ -1340,6 +1340,7 @@ static void mem_cgroup_out_of_memory(str
+ }
+ unlock:
+ mutex_unlock(&oom_lock);
++ return chosen;
+ }
+
+ #if MAX_NUMNODES > 1
+@@ -5088,6 +5089,8 @@ static ssize_t memory_max_write(struct k
+ char *buf, size_t nbytes, loff_t off)
+ {
+ struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
++ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES;
++ bool drained = false;
+ unsigned long max;
+ int err;
+
+@@ -5096,9 +5099,36 @@ static ssize_t memory_max_write(struct k
+ if (err)
+ return err;
+
+- err = mem_cgroup_resize_limit(memcg, max);
+- if (err)
+- return err;
++ xchg(&memcg->memory.limit, max);
++
++ for (;;) {
++ unsigned long nr_pages = page_counter_read(&memcg->memory);
++
++ if (nr_pages <= max)
++ break;
++
++ if (signal_pending(current)) {
++ err = -EINTR;
++ break;
++ }
++
++ if (!drained) {
++ drain_all_stock(memcg);
++ drained = true;
++ continue;
++ }
++
++ if (nr_reclaims) {
++ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max,
++ GFP_KERNEL, true))
++ nr_reclaims--;
++ continue;
++ }
++
++ mem_cgroup_events(memcg, MEMCG_OOM, 1);
++ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0))
++ break;
++ }
+
+ memcg_wb_domain_size_changed(memcg);
+ return nbytes;
--- /dev/null
+From 588083bb37a3cea8533c392370a554417c8f29cb Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 17 Mar 2016 14:20:25 -0700
+Subject: mm: memcontrol: reclaim when shrinking memory.high below usage
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 588083bb37a3cea8533c392370a554417c8f29cb upstream.
+
+When setting memory.high below usage, nothing happens until the next
+charge comes along, and then it will only reclaim its own charge and not
+the now potentially huge excess of the new memory.high. This can cause
+groups to stay in excess of their memory.high indefinitely.
+
+To fix that, when shrinking memory.high, kick off a reclaim cycle that
+goes after the delta.
+
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5051,6 +5051,7 @@ static ssize_t memory_high_write(struct
+ char *buf, size_t nbytes, loff_t off)
+ {
+ struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
++ unsigned long nr_pages;
+ unsigned long high;
+ int err;
+
+@@ -5061,6 +5062,11 @@ static ssize_t memory_high_write(struct
+
+ memcg->high = high;
+
++ nr_pages = page_counter_read(&memcg->memory);
++ if (nr_pages > high)
++ try_to_free_mem_cgroup_pages(memcg, nr_pages - high,
++ GFP_KERNEL, true);
++
+ memcg_wb_domain_size_changed(memcg);
+ return nbytes;
+ }
mtip32xx-handle-ftl-rebuild-failure-state-during-device-initialization.patch
mtip32xx-implement-timeout-handler.patch
mtip32xx-cleanup-queued-requests-after-surprise-removal.patch
+alsa-hda-fix-unexpected-resume-through-regmap-code-path.patch
+alsa-hda-apply-reboot-d3-fix-for-cx20724-codec-too.patch
+alsa-pcm-avoid-bug-string-for-warnings-again.patch
+alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch
+alsa-hda-don-t-handle-eld-notify-from-invalid-port.patch
+alsa-hda-fix-the-mic-mute-button-and-led-problem-for-a-lenovo-aio.patch
+alsa-hda-add-new-gpu-codec-id-0x10de0082-to-snd-hda.patch
+alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch
+alsa-hda-limit-i915-hdmi-binding-only-for-hsw-and-later.patch
+alsa-hda-fix-spurious-kernel-warning-on-baytrail-hdmi.patch
+alsa-hda-really-restrict-i915-notifier-to-hsw.patch
+alsa-hda-fix-forgotten-hdmi-monitor_present-update.patch
+alsa-hda-workaround-for-unbalanced-i915-power-refcount-by-concurrent-probe.patch
+alsa-hda-fix-missing-eld-update-at-unplugging.patch
+tools-hv-use-include-uapi-with-__exported_headers__.patch
+jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch
+gpio-pca953x-fix-pca953x_gpio_set_multiple-on-64-bit.patch
+arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch
+brd-fix-discard-request-processing.patch
+ib-srpt-simplify-srpt_handle_tsk_mgmt.patch
+bcache-cleaned-up-error-handling-around-register_cache.patch
+bcache-fix-race-of-writeback-thread-starting-before-complete-initialization.patch
+bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch
+mm-memcontrol-reclaim-when-shrinking-memory.high-below-usage.patch
+mm-memcontrol-reclaim-and-oom-kill-when-shrinking-memory.max-below-usage.patch
+ia64-define-ioremap_uc.patch
+drivers-firmware-broadcom-bcm47xx_nvram.c-fix-incorrect-__ioread32_copy.patch
+watchdog-don-t-run-proc_watchdog_update-if-new-value-is-same-as-old.patch
+watchdog-rc32434_wdt-fix-ioctl-error-handling.patch
+bluetooth-add-new-ar3012-id-0489-e095.patch
+bluetooth-fix-potential-buffer-overflow-with-add-advertising.patch
+cgroup-ignore-css_sets-associated-with-dead-cgroups-during-migration.patch
--- /dev/null
+From 50fe6dd10069e7c062e27f29606f6e91ea979399 Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Wed, 27 Jan 2016 22:29:33 -0800
+Subject: tools/hv: Use include/uapi with __EXPORTED_HEADERS__
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit 50fe6dd10069e7c062e27f29606f6e91ea979399 upstream.
+
+Use the local uapi headers to keep in sync with "recently" added #define's
+(e.g. VSS_OP_REGISTER1).
+
+Fixes: 3eb2094c59e8 ("Adding makefile for tools/hv")
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/hv/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/hv/Makefile
++++ b/tools/hv/Makefile
+@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread
+ WARNINGS = -Wall -Wextra
+ CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS)
+
++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
++
+ all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
+ %: %.c
+ $(CC) $(CFLAGS) -o $@ $^
--- /dev/null
+From a1ee1932aa6bea0bb074f5e3ced112664e4637ed Mon Sep 17 00:00:00 2001
+From: Joshua Hunt <johunt@akamai.com>
+Date: Thu, 17 Mar 2016 14:17:23 -0700
+Subject: watchdog: don't run proc_watchdog_update if new value is same as old
+
+From: Joshua Hunt <johunt@akamai.com>
+
+commit a1ee1932aa6bea0bb074f5e3ced112664e4637ed upstream.
+
+While working on a script to restore all sysctl params before a series of
+tests I found that writing any value into the
+/proc/sys/kernel/{nmi_watchdog,soft_watchdog,watchdog,watchdog_thresh}
+causes them to call proc_watchdog_update().
+
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+ NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
+
+There doesn't appear to be a reason for doing this work every time a write
+occurs, so only do it when the values change.
+
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Reviewed-by: Aaron Tomlin <atomlin@redhat.com>
+Cc: Ulrich Obergfell <uobergfe@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/watchdog.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -923,6 +923,9 @@ static int proc_watchdog_common(int whic
+ * both lockup detectors are disabled if proc_watchdog_update()
+ * returns an error.
+ */
++ if (old == new)
++ goto out;
++
+ err = proc_watchdog_update();
+ }
+ out:
+@@ -967,7 +970,7 @@ int proc_soft_watchdog(struct ctl_table
+ int proc_watchdog_thresh(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+- int err, old;
++ int err, old, new;
+
+ get_online_cpus();
+ mutex_lock(&watchdog_proc_mutex);
+@@ -987,6 +990,10 @@ int proc_watchdog_thresh(struct ctl_tabl
+ /*
+ * Update the sample period. Restore on failure.
+ */
++ new = ACCESS_ONCE(watchdog_thresh);
++ if (old == new)
++ goto out;
++
+ set_sample_period();
+ err = proc_watchdog_update();
+ if (err) {
--- /dev/null
+From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Sun, 28 Feb 2016 17:44:09 +0200
+Subject: watchdog: rc32434_wdt: fix ioctl error handling
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream.
+
+Calling return copy_to_user(...) in an ioctl will not do the right thing
+if there's a pagefault: copy_to_user returns the number of bytes not
+copied in this case.
+
+Fix up watchdog/rc32434_wdt to do
+ return copy_to_user(...)) ? -EFAULT : 0;
+
+instead.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/rc32434_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/rc32434_wdt.c
++++ b/drivers/watchdog/rc32434_wdt.c
+@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil
+ return -EINVAL;
+ /* Fall through */
+ case WDIOC_GETTIMEOUT:
+- return copy_to_user(argp, &timeout, sizeof(int));
++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
+ default:
+ return -ENOTTY;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
