--- /dev/null
+From 15c75b09f8d190f89ab4db463b87d411ca349dfe Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 17:16:48 +0100
+Subject: ALSA: ctxfi: Fallback DMA mask to 32bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 15c75b09f8d190f89ab4db463b87d411ca349dfe upstream.
+
+Currently ctxfi driver tries to set only the 64bit DMA mask on 64bit
+architectures, and bails out if it fails. This causes a problem on
+some platforms since the 64bit DMA isn't always guaranteed. We should
+fall back to the default 32bit DMA when 64bit DMA fails.
+
+Fixes: 6d74b86d3c0f ("ALSA: ctxfi - Allow 64bit DMA")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ctxfi/cthw20k1.c | 19 ++++++-------------
+ sound/pci/ctxfi/cthw20k2.c | 19 ++++++-------------
+ 2 files changed, 12 insertions(+), 26 deletions(-)
+
+--- a/sound/pci/ctxfi/cthw20k1.c
++++ b/sound/pci/ctxfi/cthw20k1.c
+@@ -27,12 +27,6 @@
+ #include "cthw20k1.h"
+ #include "ct20k1reg.h"
+
+-#if BITS_PER_LONG == 32
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
+-#else
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
+-#endif
+-
+ struct hw20k1 {
+ struct hw hw;
+ spinlock_t reg_20k1_lock;
+@@ -1904,19 +1898,18 @@ static int hw_card_start(struct hw *hw)
+ {
+ int err;
+ struct pci_dev *pci = hw->pci;
++ const unsigned int dma_bits = BITS_PER_LONG;
+
+ err = pci_enable_device(pci);
+ if (err < 0)
+ return err;
+
+ /* Set DMA transfer mask */
+- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 ||
+- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) {
+- dev_err(hw->card->dev,
+- "architecture does not support PCI busmaster DMA with mask 0x%llx\n",
+- CT_XFI_DMA_MASK);
+- err = -ENXIO;
+- goto error1;
++ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
++ } else {
++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
+ }
+
+ if (!hw->io_base) {
+--- a/sound/pci/ctxfi/cthw20k2.c
++++ b/sound/pci/ctxfi/cthw20k2.c
+@@ -26,12 +26,6 @@
+ #include "cthw20k2.h"
+ #include "ct20k2reg.h"
+
+-#if BITS_PER_LONG == 32
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
+-#else
+-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
+-#endif
+-
+ struct hw20k2 {
+ struct hw hw;
+ /* for i2c */
+@@ -2029,19 +2023,18 @@ static int hw_card_start(struct hw *hw)
+ int err = 0;
+ struct pci_dev *pci = hw->pci;
+ unsigned int gctl;
++ const unsigned int dma_bits = BITS_PER_LONG;
+
+ err = pci_enable_device(pci);
+ if (err < 0)
+ return err;
+
+ /* Set DMA transfer mask */
+- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 ||
+- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) {
+- dev_err(hw->card->dev,
+- "architecture does not support PCI busmaster DMA with mask 0x%llx\n",
+- CT_XFI_DMA_MASK);
+- err = -ENXIO;
+- goto error1;
++ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
++ } else {
++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
+ }
+
+ if (!hw->io_base) {
--- /dev/null
+From 493de342748cc6f52938096f5480cf291da58a0b Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 17:27:57 +0100
+Subject: ALSA: hda - Add subwoofer support for Dell Inspiron 17 7000 Gaming
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 493de342748cc6f52938096f5480cf291da58a0b upstream.
+
+Dell Inspiron 17 7000 Gaming laptop needs a similar quirk like
+Inspiron 7599 to support its subwoofer speaker.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=194191
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5560,6 +5560,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
++ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From e7480b34ad1ab84a63540b2c884cb92c0764ab74 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 15 Feb 2017 17:09:42 +0100
+Subject: ALSA: hda - fix Lewisburg audio issue
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit e7480b34ad1ab84a63540b2c884cb92c0764ab74 upstream.
+
+Like for Sunrise Point, the total stream number of Lewisburg's
+input and output stream exceeds 15 (GCAP is 0x9701), which will
+cause some streams do not work because of the overflow on
+SDxCTL.STRM field if using the legacy stream tag allocation method.
+
+Fixes: 5cf92c8b3dc5 ("ALSA: hda - Add Intel Lewisburg device IDs Audio")
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2208,9 +2208,9 @@ static const struct pci_device_id azx_id
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+ /* Lewisburg */
+ { PCI_DEVICE(0x8086, 0xa1f0),
+- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+ { PCI_DEVICE(0x8086, 0xa270),
+- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+ /* Lynx Point-LP */
+ { PCI_DEVICE(0x8086, 0x9c20),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
--- /dev/null
+From 29693efcea0f38cf40d0055d2401490a4f9bf8be Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 27 Feb 2017 10:11:47 +0800
+Subject: ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 29693efcea0f38cf40d0055d2401490a4f9bf8be upstream.
+
+On this machine, the micmute button is connected to Line2 of the
+codec and the micmute led is connected to GPIO2 of the codec.
+
+After applying this quirk, both hotkey and led work well.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5675,6 +5675,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
--- /dev/null
+From 9f1bc2c4c58fcb2d86e0e26437dc8f3a18ac3276 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 16 Feb 2017 15:26:54 +0800
+Subject: ALSA: hda/realtek - Cannot adjust speaker's volume on a Dell AIO
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 9f1bc2c4c58fcb2d86e0e26437dc8f3a18ac3276 upstream.
+
+The issue is the same as "dd9aa335c880 ALSA: hda/realtek - Can't adjust
+speaker's volume on a Dell AIO", the output requires to connect to a node
+with Amp-out capability.
+
+Applying the same fixup "ALC298_FIXUP_SPK_VOLUME" can fix the issue.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6047,6 +6047,12 @@ static const struct snd_hda_pin_quirk al
+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_STANDARD_PINS,
+ {0x17, 0x90170150}),
++ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_SPK_VOLUME,
++ {0x12, 0xb7a60140},
++ {0x13, 0xb7a60150},
++ {0x17, 0x90170110},
++ {0x1a, 0x03011020},
++ {0x21, 0x03211030}),
+ {}
+ };
+
--- /dev/null
+From f3ac9f737603da80c2da3e84b89e74429836bb6d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 22:15:51 +0100
+Subject: ALSA: seq: Fix link corruption by event error handling
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f3ac9f737603da80c2da3e84b89e74429836bb6d upstream.
+
+The sequencer FIFO management has a bug that may lead to a corruption
+(shortage) of the cell linked list. When a sequencer client faces an
+error at the event delivery, it tries to put back the dequeued cell.
+When the first queue was put back, this forgot the tail pointer
+tracking, and the link will be screwed up.
+
+Although there is no memory corruption, the sequencer client may stall
+forever at exit while flushing the pending FIFO cells in
+snd_seq_pool_done(), as spotted by syzkaller.
+
+This patch addresses the missing tail pointer tracking at
+snd_seq_fifo_cell_putback(). Also the patch makes sure to clear the
+cell->enxt pointer at snd_seq_fifo_event_in() for avoiding a similar
+mess-up of the FIFO linked list.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_fifo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -135,6 +135,7 @@ int snd_seq_fifo_event_in(struct snd_seq
+ f->tail = cell;
+ if (f->head == NULL)
+ f->head = cell;
++ cell->next = NULL;
+ f->cells++;
+ spin_unlock_irqrestore(&f->lock, flags);
+
+@@ -214,6 +215,8 @@ void snd_seq_fifo_cell_putback(struct sn
+ spin_lock_irqsave(&f->lock, flags);
+ cell->next = f->head;
+ f->head = cell;
++ if (!f->tail)
++ f->tail = cell;
+ f->cells++;
+ spin_unlock_irqrestore(&f->lock, flags);
+ }
--- /dev/null
+From 71321eb3f2d0df4e6c327e0b936eec4458a12054 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Feb 2017 14:49:07 +0100
+Subject: ALSA: timer: Reject user params with too small ticks
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 71321eb3f2d0df4e6c327e0b936eec4458a12054 upstream.
+
+When a user sets a too small ticks with a fine-grained timer like
+hrtimer, the kernel tries to fire up the timer irq too frequently.
+This may lead to the condensed locks, eventually the kernel spinlock
+lockup with warnings.
+
+For avoiding such a situation, we define a lower limit of the
+resolution, namely 1ms. When the user passes a too small tick value
+that results in less than that, the kernel returns -EINVAL now.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/timer.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1700,9 +1700,21 @@ static int snd_timer_user_params(struct
+ return -EBADFD;
+ if (copy_from_user(¶ms, _params, sizeof(params)))
+ return -EFAULT;
+- if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) {
+- err = -EINVAL;
+- goto _end;
++ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
++ u64 resolution;
++
++ if (params.ticks < 1) {
++ err = -EINVAL;
++ goto _end;
++ }
++
++ /* Don't allow resolution less than 1ms */
++ resolution = snd_timer_resolution(tu->timeri);
++ resolution *= params.ticks;
++ if (resolution < 1000000) {
++ err = -EINVAL;
++ goto _end;
++ }
+ }
+ if (params.queue_size > 0 &&
+ (params.queue_size < 32 || params.queue_size > 1024)) {
--- /dev/null
+From e3f0a4017c2143b4b813df6a93e8cf79e3f76936 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Tue, 25 Oct 2016 11:37:58 +0200
+Subject: ARM: at91: define LPDDR types
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit e3f0a4017c2143b4b813df6a93e8cf79e3f76936 upstream.
+
+The Atmel MPDDR controller support LPDDR2 and LPDDR3 memories, add their
+types.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/soc/at91/at91sam9_ddrsdr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/soc/at91/at91sam9_ddrsdr.h
++++ b/include/soc/at91/at91sam9_ddrsdr.h
+@@ -81,6 +81,7 @@
+ #define AT91_DDRSDRC_LPCB_POWER_DOWN 2
+ #define AT91_DDRSDRC_LPCB_DEEP_POWER_DOWN 3
+ #define AT91_DDRSDRC_CLKFR (1 << 2) /* Clock Frozen */
++#define AT91_DDRSDRC_LPDDR2_PWOFF (1 << 3) /* LPDDR Power Off */
+ #define AT91_DDRSDRC_PASR (7 << 4) /* Partial Array Self Refresh */
+ #define AT91_DDRSDRC_TCSR (3 << 8) /* Temperature Compensated Self Refresh */
+ #define AT91_DDRSDRC_DS (3 << 10) /* Drive Strength */
+@@ -96,7 +97,9 @@
+ #define AT91_DDRSDRC_MD_SDR 0
+ #define AT91_DDRSDRC_MD_LOW_POWER_SDR 1
+ #define AT91_DDRSDRC_MD_LOW_POWER_DDR 3
++#define AT91_DDRSDRC_MD_LPDDR3 5
+ #define AT91_DDRSDRC_MD_DDR2 6 /* [SAM9 Only] */
++#define AT91_DDRSDRC_MD_LPDDR2 7
+ #define AT91_DDRSDRC_DBW (1 << 4) /* Data Bus Width */
+ #define AT91_DDRSDRC_DBW_32BITS (0 << 4)
+ #define AT91_DDRSDRC_DBW_16BITS (1 << 4)
--- /dev/null
+From 78162d48466d23c45a784034630c5928af631e3d Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 19 Jan 2017 23:05:39 +0100
+Subject: ARM: dts: at91: Enable DMA on sama5d2_xplained console
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit 78162d48466d23c45a784034630c5928af631e3d upstream.
+
+Enable DMA on uart1 to get a more reliable console.
+
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d2_xplained.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+@@ -122,6 +122,8 @@
+ uart1: serial@f8020000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_uart1_default>;
++ atmel,use-dma-rx;
++ atmel,use-dma-tx;
+ status = "okay";
+ };
+
--- /dev/null
+From ef8d02d4a2c36f7a93e74c95a9c419353b310117 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 19 Jan 2017 01:46:58 +0100
+Subject: ARM: dts: at91: Enable DMA on sama5d4_xplained console
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit ef8d02d4a2c36f7a93e74c95a9c419353b310117 upstream.
+
+Enable DMA on usart3 to get a more reliable console. This is especially
+useful for automation and kernelci were a kernel with PROVE_LOCKING enabled
+is quite susceptible to character loss, resulting in tests failure.
+
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -110,6 +110,8 @@
+ };
+
+ usart3: serial@fc00c000 {
++ atmel,use-dma-rx;
++ atmel,use-dma-tx;
+ status = "okay";
+ };
+
--- /dev/null
+From 9c25702cee1405099f982894c865c163de7909a8 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <pshilov@microsoft.com>
+Date: Thu, 19 Jan 2017 13:53:15 -0800
+Subject: CIFS: Fix splice read for non-cached files
+
+From: Pavel Shilovsky <pshilov@microsoft.com>
+
+commit 9c25702cee1405099f982894c865c163de7909a8 upstream.
+
+Currently we call copy_page_to_iter() for uncached reading into a pipe.
+This is wrong because it treats pages as VFS cache pages and copies references
+rather than actual data. When we are trying to read from the pipe we end up
+calling page_cache_pipe_buf_confirm() which returns -ENODATA. This error
+is translated into 0 which is returned to a user.
+
+This issue is reproduced by running xfs-tests suite (generic test #249)
+against mount points with "cache=none". Fix it by mapping pages manually
+and calling copy_to_iter() that copies data into the pipe.
+
+Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2840,7 +2840,15 @@ cifs_readdata_to_iov(struct cifs_readdat
+ for (i = 0; i < rdata->nr_pages; i++) {
+ struct page *page = rdata->pages[i];
+ size_t copy = min_t(size_t, remaining, PAGE_SIZE);
+- size_t written = copy_page_to_iter(page, 0, copy, iter);
++ size_t written;
++
++ if (unlikely(iter->type & ITER_PIPE)) {
++ void *addr = kmap_atomic(page);
++
++ written = copy_to_iter(addr, copy, iter);
++ kunmap_atomic(addr);
++ } else
++ written = copy_page_to_iter(page, 0, copy, iter);
+ remaining -= written;
+ if (written < copy && iov_iter_count(iter) > 0)
+ break;
--- /dev/null
+From aaa59306b0b7e0ca4ba92cc04c5db101cbb1c096 Mon Sep 17 00:00:00 2001
+From: CQ Tang <cq.tang@intel.com>
+Date: Mon, 30 Jan 2017 09:39:52 -0800
+Subject: iommu/vt-d: Fix some macros that are incorrectly specified in intel-iommu
+
+From: CQ Tang <cq.tang@intel.com>
+
+commit aaa59306b0b7e0ca4ba92cc04c5db101cbb1c096 upstream.
+
+Some of the macros are incorrect with wrong bit-shifts resulting in picking
+the incorrect invalidation granularity. Incorrect Source-ID in extended
+devtlb invalidation caused device side errors.
+
+To: Joerg Roedel <joro@8bytes.org>
+To: David Woodhouse <dwmw2@infradead.org>
+Cc: iommu@lists.linux-foundation.org
+Cc: linux-kernel@vger.kernel.org
+Cc: CQ Tang <cq.tang@intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+
+Fixes: 2f26e0a9 ("iommu/vt-d: Add basic SVM PASID support")
+Signed-off-by: CQ Tang <cq.tang@intel.com>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Tested-by: CQ Tang <cq.tang@intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/intel-iommu.h | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -153,8 +153,8 @@ static inline void dmar_writeq(void __io
+ #define DMA_TLB_GLOBAL_FLUSH (((u64)1) << 60)
+ #define DMA_TLB_DSI_FLUSH (((u64)2) << 60)
+ #define DMA_TLB_PSI_FLUSH (((u64)3) << 60)
+-#define DMA_TLB_IIRG(type) ((type >> 60) & 7)
+-#define DMA_TLB_IAIG(val) (((val) >> 57) & 7)
++#define DMA_TLB_IIRG(type) ((type >> 60) & 3)
++#define DMA_TLB_IAIG(val) (((val) >> 57) & 3)
+ #define DMA_TLB_READ_DRAIN (((u64)1) << 49)
+ #define DMA_TLB_WRITE_DRAIN (((u64)1) << 48)
+ #define DMA_TLB_DID(id) (((u64)((id) & 0xffff)) << 32)
+@@ -164,9 +164,9 @@ static inline void dmar_writeq(void __io
+
+ /* INVALID_DESC */
+ #define DMA_CCMD_INVL_GRANU_OFFSET 61
+-#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 3)
+-#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 3)
+-#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 3)
++#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 4)
++#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 4)
++#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 4)
+ #define DMA_ID_TLB_READ_DRAIN (((u64)1) << 7)
+ #define DMA_ID_TLB_WRITE_DRAIN (((u64)1) << 6)
+ #define DMA_ID_TLB_DID(id) (((u64)((id & 0xffff) << 16)))
+@@ -316,8 +316,8 @@ enum {
+ #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11)
+ #define QI_DEV_EIOTLB_GLOB(g) ((u64)g)
+ #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
+-#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32)
+-#define QI_DEV_EIOTLB_QDEP(qd) (((qd) & 0x1f) << 16)
++#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
++#define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+ #define QI_DEV_EIOTLB_MAX_INVS 32
+
+ #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55)
--- /dev/null
+From 21e722c4c8377b5bc82ad058fed12165af739c1b Mon Sep 17 00:00:00 2001
+From: Ashok Raj <ashok.raj@intel.com>
+Date: Mon, 30 Jan 2017 09:39:53 -0800
+Subject: iommu/vt-d: Tylersburg isoch identity map check is done too late.
+
+From: Ashok Raj <ashok.raj@intel.com>
+
+commit 21e722c4c8377b5bc82ad058fed12165af739c1b upstream.
+
+The check to set identity map for tylersburg is done too late. It needs
+to be done before the check for identity_map domain is done.
+
+To: Joerg Roedel <joro@8bytes.org>
+To: David Woodhouse <dwmw2@infradead.org>
+Cc: iommu@lists.linux-foundation.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Ashok Raj <ashok.raj@intel.com>
+
+Fixes: 86080ccc22 ("iommu/vt-d: Allocate si_domain in init_dmars()")
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Reported-by: Yunhong Jiang <yunhong.jiang@intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3238,13 +3238,14 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_GFX;
+ #endif
+
++ check_tylersburg_isoch();
++
+ if (iommu_identity_mapping) {
+ ret = si_domain_init(hw_pass_through);
+ if (ret)
+ goto free_iommu;
+ }
+
+- check_tylersburg_isoch();
+
+ /*
+ * If we copied translations from a previous kernel in the kdump
--- /dev/null
+From e42a46b6f52473661ad192f76a128a68fe301df4 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Tue, 14 Feb 2017 17:31:03 +0200
+Subject: regulator: Fix regulator_summary for deviceless consumers
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit e42a46b6f52473661ad192f76a128a68fe301df4 upstream.
+
+It is allowed to call regulator_get with a NULL dev argument
+(_regulator_get explicitly checks for it) but this causes an error later
+when printing /sys/kernel/debug/regulator_summary.
+
+Fix this by explicitly handling "deviceless" consumers in the debugfs code.
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4273,12 +4273,13 @@ static void regulator_summary_show_subtr
+ seq_puts(s, "\n");
+
+ list_for_each_entry(consumer, &rdev->consumer_list, list) {
+- if (consumer->dev->class == ®ulator_class)
++ if (consumer->dev && consumer->dev->class == ®ulator_class)
+ continue;
+
+ seq_printf(s, "%*s%-*s ",
+ (level + 1) * 3 + 1, "",
+- 30 - (level + 1) * 3, dev_name(consumer->dev));
++ 30 - (level + 1) * 3,
++ consumer->dev ? dev_name(consumer->dev) : "deviceless");
+
+ switch (rdev->desc->type) {
+ case REGULATOR_VOLTAGE:
am437x-vpfe-always-assign-bpp-variable.patch
uvcvideo-fix-a-wrong-macro.patch
media-fix-dm1105.c-build-error.patch
+arm-at91-define-lpddr-types.patch
+arm-dts-at91-enable-dma-on-sama5d4_xplained-console.patch
+arm-dts-at91-enable-dma-on-sama5d2_xplained-console.patch
+alsa-hda-realtek-cannot-adjust-speaker-s-volume-on-a-dell-aio.patch
+alsa-hda-fix-lewisburg-audio-issue.patch
+alsa-timer-reject-user-params-with-too-small-ticks.patch
+alsa-ctxfi-fallback-dma-mask-to-32bit.patch
+alsa-seq-fix-link-corruption-by-event-error-handling.patch
+alsa-hda-add-subwoofer-support-for-dell-inspiron-17-7000-gaming.patch
+alsa-hda-fix-micmute-hotkey-problem-for-a-lenovo-aio-machine.patch
+staging-rtl-fix-possible-null-pointer-dereference.patch
+regulator-fix-regulator_summary-for-deviceless-consumers.patch
+iommu-vt-d-fix-some-macros-that-are-incorrectly-specified-in-intel-iommu.patch
+iommu-vt-d-tylersburg-isoch-identity-map-check-is-done-too-late.patch
+cifs-fix-splice-read-for-non-cached-files.patch
--- /dev/null
+From 6e017006022abfea5d2466cad936065f45763ad1 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 11 Jan 2017 15:53:08 +0100
+Subject: staging: rtl: fix possible NULL pointer dereference
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6e017006022abfea5d2466cad936065f45763ad1 upstream.
+
+gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
+a destination argument that an earlier function call may have set to NULL:
+
+staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
+staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
+staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
+staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]
+
+I'm fixing this by adding a NULL pointer check and returning failure
+from the function, which is hopefully already handled properly.
+
+This seems to date back to when the drivers were originally added,
+so backporting the fix to stable seems appropriate. There are other
+related realtek drivers in the kernel, but none of them contain a
+function with a similar name or produce this warning.
+
+Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
+Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/core/rtw_recv.c | 3 +++
+ drivers/staging/rtl8712/rtl871x_recv.c | 7 ++++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
+@@ -1405,6 +1405,9 @@ static int wlanhdr_to_ethhdr(struct recv
+ ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+ }
+
++ if (!ptr)
++ return _FAIL;
++
+ memcpy(ptr, pattrib->dst, ETH_ALEN);
+ memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+--- a/drivers/staging/rtl8712/rtl871x_recv.c
++++ b/drivers/staging/rtl8712/rtl871x_recv.c
+@@ -641,11 +641,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_
+ /* append rx status for mp test packets */
+ ptr = recvframe_pull(precvframe, (rmv_len -
+ sizeof(struct ethhdr) + 2) - 24);
++ if (!ptr)
++ return _FAIL;
+ memcpy(ptr, get_rxmem(precvframe), 24);
+ ptr += 24;
+- } else
++ } else {
+ ptr = recvframe_pull(precvframe, (rmv_len -
+ sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
++ if (!ptr)
++ return _FAIL;
++ }
+
+ memcpy(ptr, pattrib->dst, ETH_ALEN);
+ memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
projects / thirdparty / kernel / stable-queue.git / commitdiff
