--- /dev/null
+From 83a9efb5b8170b7cffef4f62656656e1d8ad2ccd Mon Sep 17 00:00:00 2001
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Date: Wed, 23 Mar 2016 13:32:33 +0200
+Subject: ALSA: hda - Apply fix for white noise on Asus N550JV, too
+
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+
+commit 83a9efb5b8170b7cffef4f62656656e1d8ad2ccd upstream.
+
+Apply the new fixup that is used for ASUS N750JV to another similar
+model, N500JV, too, for reducing the headphone noise.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
+Signed-off-by: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6675,7 +6675,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
++ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
--- /dev/null
+From 70cf2cbd685e218c3ffd105d9fb6cf0f8d767481 Mon Sep 17 00:00:00 2001
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Date: Wed, 23 Mar 2016 13:23:55 +0200
+Subject: ALSA: hda - Asus N750JV external subwoofer fixup
+
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+
+commit 70cf2cbd685e218c3ffd105d9fb6cf0f8d767481 upstream.
+
+ASUS N750JV needs the same fixup as N550 for enabling its subwoofer.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
+Signed-off-by: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6670,6 +6670,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
++ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
--- /dev/null
+From e549d190f7b5f94e9ab36bd965028112914d010d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 1 Apr 2016 11:00:15 +0800
+Subject: ALSA: hda - fix front mic problem for a HP desktop
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit e549d190f7b5f94e9ab36bd965028112914d010d upstream.
+
+The front mic jack (pink color) can't detect any plug or unplug. After
+applying this fix, both detecting function and recording function
+work well.
+
+BugLink: https://bugs.launchpad.net/bugs/1564712
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4759,6 +4759,7 @@ enum {
+ ALC255_FIXUP_DELL_SPK_NOISE,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC280_FIXUP_HP_HEADSET_MIC,
++ ALC221_FIXUP_HP_FRONT_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5401,6 +5402,13 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC,
+ },
++ [ALC221_FIXUP_HP_FRONT_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x02a19020 }, /* Front Mic */
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5506,6 +5514,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From 9d4dc5840f93bcb002fa311693349deae7702bc5 Mon Sep 17 00:00:00 2001
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Date: Wed, 23 Mar 2016 13:26:11 +0200
+Subject: ALSA: hda - Fix white noise on Asus N750JV headphone
+
+From: Bobi Mihalca <bobbymihalca@touchtech.ro>
+
+commit 9d4dc5840f93bcb002fa311693349deae7702bc5 upstream.
+
+For reducing the noise from the headphone output on ASUS N750JV,
+call the existing fixup, alc_fixup_auto_mute_via_amp(), additionally.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
+Signed-off-by: Bobi Mihalca <bobbymihalca@touchtech.ro>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6406,6 +6406,7 @@ enum {
+ ALC668_FIXUP_AUTO_MUTE,
+ ALC668_FIXUP_DELL_DISABLE_AAMIX,
+ ALC668_FIXUP_DELL_XPS13,
++ ALC662_FIXUP_ASUS_Nx50,
+ };
+
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -6646,6 +6647,12 @@ static const struct hda_fixup alc662_fix
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_bass_chmap,
+ },
++ [ALC662_FIXUP_ASUS_Nx50] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_auto_mute_via_amp,
++ .chained = true,
++ .chain_id = ALC662_FIXUP_BASS_1A
++ },
+ };
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -6670,7 +6677,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+- SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
++ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
--- /dev/null
+From 4a07083ed613644c96c34a7dd2853dc5d7c70902 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 1 Apr 2016 12:28:16 +0200
+Subject: ALSA: timer: Use mod_timer() for rearming the system timer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.
+
+ALSA system timer backend stops the timer via del_timer() without sync
+and leaves del_timer_sync() at the close instead. This is because of
+the restriction by the design of ALSA timer: namely, the stop callback
+may be called from the timer handler, and calling the sync shall lead
+to a hangup. However, this also triggers a kernel BUG() when the
+timer is rearmed immediately after stopping without sync:
+ kernel BUG at kernel/time/timer.c:966!
+ Call Trace:
+ <IRQ>
+ [<ffffffff8239c94e>] snd_timer_s_start+0x13e/0x1a0
+ [<ffffffff8239e1f4>] snd_timer_interrupt+0x504/0xec0
+ [<ffffffff8122fca0>] ? debug_check_no_locks_freed+0x290/0x290
+ [<ffffffff8239ec64>] snd_timer_s_function+0xb4/0x120
+ [<ffffffff81296b72>] call_timer_fn+0x162/0x520
+ [<ffffffff81296add>] ? call_timer_fn+0xcd/0x520
+ [<ffffffff8239ebb0>] ? snd_timer_interrupt+0xec0/0xec0
+ ....
+
+It's the place where add_timer() checks the pending timer. It's clear
+that this may happen after the immediate restart without sync in our
+cases.
+
+So, the workaround here is just to use mod_timer() instead of
+add_timer(). This looks like a band-aid fix, but it's a right move,
+as snd_timer_interrupt() takes care of the continuous rearm of timer.
+
+Reported-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/timer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1041,8 +1041,8 @@ static int snd_timer_s_start(struct snd_
+ njiff += timer->sticks - priv->correction;
+ priv->correction = 0;
+ }
+- priv->last_expires = priv->tlist.expires = njiff;
+- add_timer(&priv->tlist);
++ priv->last_expires = njiff;
++ mod_timer(&priv->tlist, njiff);
+ return 0;
+ }
+
--- /dev/null
+From a6002ec5a8c68e69706b2efd6db6d682d0ab672c Mon Sep 17 00:00:00 2001
+From: James Morse <james.morse@arm.com>
+Date: Thu, 24 Mar 2016 16:54:34 +0000
+Subject: arm64: opcodes.h: Add arm big-endian config options before including arm header
+
+From: James Morse <james.morse@arm.com>
+
+commit a6002ec5a8c68e69706b2efd6db6d682d0ab672c upstream.
+
+arm and arm64 use different config options to specify big endian. This
+needs taking into account when including code/headers between the two
+architectures.
+
+A case in point is PAN, which uses the __instr_arm() macro to output
+instructions. The macro comes from opcodes.h, which lives under arch/arm.
+On a big-endian build the mismatched config options mean the instruction
+isn't byte swapped correctly, resulting in undefined instruction exceptions
+during boot:
+
+| alternatives: patching kernel code
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc0004505b4
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c
+| Internal error: Oops - undefined instruction: 0 [#1] SMP
+| Modules linked in:
+| CPU: 0 PID: 87 Comm: kdevtmpfs Not tainted 4.1.16+ #5
+| Hardware name: Hisilicon PhosphorHi1382 EVB (DT)
+| task: ffffffc336591700 ti: ffffffc3365a4000 task.ti: ffffffc3365a4000
+| PC is at dump_instr+0x68/0x100
+| LR is at do_undefinstr+0x1d4/0x2a4
+| pc : [<ffffffc00076231c>] lr : [<ffffffc0000811d4>] pstate: 604001c5
+| sp : ffffffc3365a6450
+
+Reported-by: Hanjun Guo <guohanjun@huawei.com>
+Tested-by: Xuefeng Wang <wxf.wang@hisilicon.com>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/opcodes.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/include/asm/opcodes.h
++++ b/arch/arm64/include/asm/opcodes.h
+@@ -1 +1,5 @@
++#ifdef CONFIG_CPU_BIG_ENDIAN
++#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN
++#endif
++
+ #include <../../arm/include/asm/opcodes.h>
--- /dev/null
+From 95272c29378ee7dc15f43fa2758cb28a5913a06d Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 31 Mar 2016 09:38:51 +0200
+Subject: compiler-gcc: disable -ftracer for __noclone functions
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 95272c29378ee7dc15f43fa2758cb28a5913a06d upstream.
+
+-ftracer can duplicate asm blocks causing compilation to fail in
+noclone functions. For example, KVM declares a global variable
+in an asm like
+
+ asm("2: ... \n
+ .pushsection data \n
+ .global vmx_return \n
+ vmx_return: .long 2b");
+
+and -ftracer causes a double declaration.
+
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michal Marek <mmarek@suse.cz>
+Cc: kvm@vger.kernel.org
+Reported-by: Linda Walsh <lkml@tlinx.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/compiler-gcc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -199,7 +199,7 @@
+ #define unreachable() __builtin_unreachable()
+
+ /* Mark a function definition as prohibited from being cloned. */
+-#define __noclone __attribute__((__noclone__))
++#define __noclone __attribute__((__noclone__, __optimize__("no-tracer")))
+
+ #endif /* GCC_VERSION >= 40500 */
+
--- /dev/null
+From 3c2e2266a5bd2d1cef258e6e54dca1d99946379f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 26 Mar 2016 12:28:05 -0700
+Subject: hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 3c2e2266a5bd2d1cef258e6e54dca1d99946379f upstream.
+
+arm:pxa_defconfig can result in the following crash if the max1111 driver
+is not instantiated.
+
+Unhandled fault: page domain fault (0x01b) at 0x00000000
+pgd = c0004000
+[00000000] *pgd=00000000
+Internal error: : 1b [#1] PREEMPT ARM
+Modules linked in:
+CPU: 0 PID: 300 Comm: kworker/0:1 Not tainted 4.5.0-01301-g1701f680407c #10
+Hardware name: SHARP Akita
+Workqueue: events sharpsl_charge_toggle
+task: c390a000 ti: c391e000 task.ti: c391e000
+PC is at max1111_read_channel+0x20/0x30
+LR is at sharpsl_pm_pxa_read_max1111+0x2c/0x3c
+pc : [<c03aaab0>] lr : [<c0024b50>] psr: 20000013
+...
+[<c03aaab0>] (max1111_read_channel) from [<c0024b50>]
+ (sharpsl_pm_pxa_read_max1111+0x2c/0x3c)
+[<c0024b50>] (sharpsl_pm_pxa_read_max1111) from [<c00262e0>]
+ (spitzpm_read_devdata+0x5c/0xc4)
+[<c00262e0>] (spitzpm_read_devdata) from [<c0024094>]
+ (sharpsl_check_battery_temp+0x78/0x110)
+[<c0024094>] (sharpsl_check_battery_temp) from [<c0024f9c>]
+ (sharpsl_charge_toggle+0x48/0x110)
+[<c0024f9c>] (sharpsl_charge_toggle) from [<c004429c>]
+ (process_one_work+0x14c/0x48c)
+[<c004429c>] (process_one_work) from [<c0044618>] (worker_thread+0x3c/0x5d4)
+[<c0044618>] (worker_thread) from [<c004a238>] (kthread+0xd0/0xec)
+[<c004a238>] (kthread) from [<c000a670>] (ret_from_fork+0x14/0x24)
+
+This can occur because the SPI controller driver (SPI_PXA2XX) is built as
+module and thus not necessarily loaded. While building SPI_PXA2XX into the
+kernel would make the problem disappear, it appears prudent to ensure that
+the driver is instantiated before accessing its data structures.
+
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/max1111.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hwmon/max1111.c
++++ b/drivers/hwmon/max1111.c
+@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;
+
+ int max1111_read_channel(int channel)
+ {
++ if (!the_max1111 || !the_max1111->spi)
++ return -ENODEV;
++
+ return max1111_read(&the_max1111->spi->dev, channel);
+ }
+ EXPORT_SYMBOL(max1111_read_channel);
+@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_dev
+ {
+ struct max1111_data *data = spi_get_drvdata(spi);
+
++#ifdef CONFIG_SHARPSL_PM
++ the_max1111 = NULL;
++#endif
+ hwmon_device_unregister(data->hwmon_dev);
+ sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group);
+ sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
--- /dev/null
+From 211291126698c8f047617565b2e2e7f822f86354 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 7 Apr 2016 19:58:44 -0700
+Subject: libnvdimm: fix smart data retrieval
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 211291126698c8f047617565b2e2e7f822f86354 upstream.
+
+It appears that smart data retrieval has been broken the since the
+initial implementation. Fix the payload size to be 128-bytes per the
+specification.
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd
+ [ND_CMD_IMPLEMENTED] = { },
+ [ND_CMD_SMART] = {
+ .out_num = 2,
+- .out_sizes = { 4, 8, },
++ .out_sizes = { 4, 128, },
+ },
+ [ND_CMD_SMART_THRESHOLD] = {
+ .out_num = 2,
--- /dev/null
+From e5670563f588ed1c0603819350c0f02cec23f5c5 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 7 Apr 2016 19:59:27 -0700
+Subject: libnvdimm, pfn: fix uuid validation
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit e5670563f588ed1c0603819350c0f02cec23f5c5 upstream.
+
+If we detect a namespace has a stale info block in the init path, we
+should overwrite with the latest configuration. In fact, we already
+return -ENODEV when the parent uuid is invalid, the same should be done
+for the 'self' uuid. Otherwise we can get into a condition where
+userspace is unable to reconfigure the pfn-device without directly /
+manually invalidating the info block.
+
+Reported-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/pfn_devs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -315,7 +315,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pf
+ } else {
+ /* from init we validate */
+ if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
+- return -EINVAL;
++ return -ENODEV;
+ }
+
+ if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) {
--- /dev/null
+From 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 Mon Sep 17 00:00:00 2001
+From: Xishi Qiu <qiuxishi@huawei.com>
+Date: Fri, 1 Apr 2016 14:31:20 -0700
+Subject: mm: fix invalid node in alloc_migrate_target()
+
+From: Xishi Qiu <qiuxishi@huawei.com>
+
+commit 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 upstream.
+
+It is incorrect to use next_node to find a target node, it will return
+MAX_NUMNODES or invalid node. This will lead to crash in buddy system
+allocation.
+
+Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
+Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Joonsoo Kim <js1304@gmail.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: "Laura Abbott" <lauraa@codeaurora.org>
+Cc: Hui Zhu <zhuhui@xiaomi.com>
+Cc: Wang Xiaoqiang <wangxq10@lzu.edu.cn>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_isolation.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -289,11 +289,11 @@ struct page *alloc_migrate_target(struct
+ * now as a simple work-around, we use the next node for destination.
+ */
+ if (PageHuge(page)) {
+- nodemask_t src = nodemask_of_node(page_to_nid(page));
+- nodemask_t dst;
+- nodes_complement(dst, src);
++ int node = next_online_node(page_to_nid(page));
++ if (node == MAX_NUMNODES)
++ node = first_online_node;
+ return alloc_huge_page_node(page_hstate(compound_head(page)),
+- next_node(page_to_nid(page), dst));
++ node);
+ }
+
+ if (PageHighMem(page))
--- /dev/null
+From e3893027a300927049efc1572f852201eb785142 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 8 Apr 2016 18:11:33 +0200
+Subject: parisc: Avoid function pointers for kernel exception routines
+
+From: Helge Deller <deller@gmx.de>
+
+commit e3893027a300927049efc1572f852201eb785142 upstream.
+
+We want to avoid the kernel module loader to create function pointers
+for the kernel fixup routines of get_user() and put_user(). Changing
+the external reference from function type to int type fixes this.
+
+This unbreaks exception handling for get_user() and put_user() when
+called from a kernel module.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/parisc_ksyms.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64);
+ EXPORT_SYMBOL(lclear_user);
+ EXPORT_SYMBOL(lstrnlen_user);
+
+-/* Global fixups */
+-extern void fixup_get_user_skip_1(void);
+-extern void fixup_get_user_skip_2(void);
+-extern void fixup_put_user_skip_1(void);
+-extern void fixup_put_user_skip_2(void);
++/* Global fixups - defined as int to avoid creation of function pointers */
++extern int fixup_get_user_skip_1;
++extern int fixup_get_user_skip_2;
++extern int fixup_put_user_skip_1;
++extern int fixup_put_user_skip_2;
+ EXPORT_SYMBOL(fixup_get_user_skip_1);
+ EXPORT_SYMBOL(fixup_get_user_skip_2);
+ EXPORT_SYMBOL(fixup_put_user_skip_1);
--- /dev/null
+From 910cd32e552ea09caa89cdbe328e468979b030dd Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 30 Mar 2016 14:14:31 +0200
+Subject: parisc: Fix and enable seccomp filter support
+
+From: Helge Deller <deller@gmx.de>
+
+commit 910cd32e552ea09caa89cdbe328e468979b030dd upstream.
+
+The seccomp filter support requires careful handling of task registers. This
+includes reloading of the return value (%r28) and proper syscall exit if
+secure_computing() returned -1.
+
+Additionally we need to sign-extend the syscall number from signed 32bit to
+signed 64bit in do_syscall_trace_enter() since the ptrace interface only allows
+storing 32bit values in compat mode.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Kconfig | 1 +
+ arch/parisc/include/asm/syscall.h | 13 +++++++++++++
+ arch/parisc/kernel/ptrace.c | 9 +++++++--
+ arch/parisc/kernel/syscall.S | 2 ++
+ 4 files changed, 23 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -29,6 +29,7 @@ config PARISC
+ select TTY # Needed for pdc_cons.c
+ select HAVE_DEBUG_STACKOVERFLOW
+ select HAVE_ARCH_AUDITSYSCALL
++ select HAVE_ARCH_SECCOMP_FILTER
+ select ARCH_NO_COHERENT_DMA_MMAP
+
+ help
+--- a/arch/parisc/include/asm/syscall.h
++++ b/arch/parisc/include/asm/syscall.h
+@@ -39,6 +39,19 @@ static inline void syscall_get_arguments
+ }
+ }
+
++static inline void syscall_set_return_value(struct task_struct *task,
++ struct pt_regs *regs,
++ int error, long val)
++{
++ regs->gr[28] = error ? error : val;
++}
++
++static inline void syscall_rollback(struct task_struct *task,
++ struct pt_regs *regs)
++{
++ /* do nothing */
++}
++
+ static inline int syscall_get_arch(void)
+ {
+ int arch = AUDIT_ARCH_PARISC;
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -270,7 +270,8 @@ long compat_arch_ptrace(struct task_stru
+ long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+ /* Do the secure computing check first. */
+- secure_computing_strict(regs->gr[20]);
++ if (secure_computing() == -1)
++ return -1;
+
+ if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+ tracehook_report_syscall_entry(regs)) {
+@@ -296,7 +297,11 @@ long do_syscall_trace_enter(struct pt_re
+ regs->gr[23] & 0xffffffff);
+
+ out:
+- return regs->gr[20];
++ /*
++ * Sign extend the syscall number to 64bit since it may have been
++ * modified by a compat ptrace call
++ */
++ return (int) ((u32) regs->gr[20]);
+ }
+
+ void do_syscall_trace_exit(struct pt_regs *regs)
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -329,6 +329,7 @@ tracesys_next:
+
+ ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
+ LDREG TI_TASK(%r1), %r1
++ LDREG TASK_PT_GR28(%r1), %r28 /* Restore return value */
+ LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */
+ LDREG TASK_PT_GR25(%r1), %r25
+ LDREG TASK_PT_GR24(%r1), %r24
+@@ -342,6 +343,7 @@ tracesys_next:
+ stw %r21, -56(%r30) /* 6th argument */
+ #endif
+
++ cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */
+ comiclr,>>= __NR_Linux_syscalls, %r20, %r0
+ b,n .Ltracesys_nosys
+
--- /dev/null
+From ef72f3110d8b19f4c098a0bff7ed7d11945e70c6 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 8 Apr 2016 18:18:48 +0200
+Subject: parisc: Fix kernel crash with reversed copy_from_user()
+
+From: Helge Deller <deller@gmx.de>
+
+commit ef72f3110d8b19f4c098a0bff7ed7d11945e70c6 upstream.
+
+The kernel module testcase (lib/test_user_copy.c) exhibited a kernel
+crash on parisc if the parameters for copy_from_user were reversed
+("illegal reversed copy_to_user" testcase).
+
+Fix this potential crash by checking the fault handler if the faulting
+address is in the exception table.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/traps.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -798,6 +798,9 @@ void notrace handle_interruption(int cod
+
+ if (fault_space == 0 && !faulthandler_disabled())
+ {
++ /* Clean up and return if in exception table. */
++ if (fixup_exception(regs))
++ return;
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
+ parisc_terminate("Kernel Fault", regs, code, fault_address);
+ }
--- /dev/null
+From 4f4acc9472e54ce702f1d85fc9e6d57767dec91f Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 30 Mar 2016 14:11:50 +0200
+Subject: parisc: Fix SIGSYS signals in compat case
+
+From: Helge Deller <deller@gmx.de>
+
+commit 4f4acc9472e54ce702f1d85fc9e6d57767dec91f upstream.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/compat.h | 7 +++++++
+ arch/parisc/kernel/signal32.c | 5 +++++
+ 2 files changed, 12 insertions(+)
+
+--- a/arch/parisc/include/asm/compat.h
++++ b/arch/parisc/include/asm/compat.h
+@@ -183,6 +183,13 @@ typedef struct compat_siginfo {
+ int _band; /* POLL_IN, POLL_OUT, POLL_MSG */
+ int _fd;
+ } _sigpoll;
++
++ /* SIGSYS */
++ struct {
++ compat_uptr_t _call_addr; /* calling user insn */
++ int _syscall; /* triggering system call number */
++ compat_uint_t _arch; /* AUDIT_ARCH_* of syscall */
++ } _sigsys;
+ } _sifields;
+ } compat_siginfo_t;
+
+--- a/arch/parisc/kernel/signal32.c
++++ b/arch/parisc/kernel/signal32.c
+@@ -371,6 +371,11 @@ copy_siginfo_to_user32 (compat_siginfo_t
+ val = (compat_int_t)from->si_int;
+ err |= __put_user(val, &to->si_int);
+ break;
++ case __SI_SYS >> 16:
++ err |= __put_user(ptr_to_compat(from->si_call_addr), &to->si_call_addr);
++ err |= __put_user(from->si_syscall, &to->si_syscall);
++ err |= __put_user(from->si_arch, &to->si_arch);
++ break;
+ }
+ }
+ return err;
--- /dev/null
+From 2ef4dfd9d9f288943e249b78365a69e3ea3ec072 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 8 Apr 2016 18:32:52 +0200
+Subject: parisc: Unbreak handling exceptions from kernel modules
+
+From: Helge Deller <deller@gmx.de>
+
+commit 2ef4dfd9d9f288943e249b78365a69e3ea3ec072 upstream.
+
+Handling exceptions from modules never worked on parisc.
+It was just masked by the fact that exceptions from modules
+don't happen during normal use.
+
+When a module triggers an exception in get_user() we need to load the
+main kernel dp value before accessing the exception_data structure, and
+afterwards restore the original dp value of the module on exit.
+
+Noticed-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/uaccess.h | 1 +
+ arch/parisc/kernel/asm-offsets.c | 1 +
+ arch/parisc/lib/fixup.S | 6 ++++++
+ arch/parisc/mm/fault.c | 1 +
+ 4 files changed, 9 insertions(+)
+
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -76,6 +76,7 @@ struct exception_table_entry {
+ */
+ struct exception_data {
+ unsigned long fault_ip;
++ unsigned long fault_gp;
+ unsigned long fault_space;
+ unsigned long fault_addr;
+ };
+--- a/arch/parisc/kernel/asm-offsets.c
++++ b/arch/parisc/kernel/asm-offsets.c
+@@ -299,6 +299,7 @@ int main(void)
+ #endif
+ BLANK();
+ DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
++ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp));
+ DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
+ DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
+ BLANK();
+--- a/arch/parisc/lib/fixup.S
++++ b/arch/parisc/lib/fixup.S
+@@ -26,6 +26,7 @@
+
+ #ifdef CONFIG_SMP
+ .macro get_fault_ip t1 t2
++ loadgp
+ addil LT%__per_cpu_offset,%r27
+ LDREG RT%__per_cpu_offset(%r1),\t1
+ /* t2 = smp_processor_id() */
+@@ -40,14 +41,19 @@
+ LDREG RT%exception_data(%r1),\t1
+ /* t1 = this_cpu_ptr(&exception_data) */
+ add,l \t1,\t2,\t1
++ /* %r27 = t1->fault_gp - restore gp */
++ LDREG EXCDATA_GP(\t1), %r27
+ /* t1 = t1->fault_ip */
+ LDREG EXCDATA_IP(\t1), \t1
+ .endm
+ #else
+ .macro get_fault_ip t1 t2
++ loadgp
+ /* t1 = this_cpu_ptr(&exception_data) */
+ addil LT%exception_data,%r27
+ LDREG RT%exception_data(%r1),\t2
++ /* %r27 = t2->fault_gp - restore gp */
++ LDREG EXCDATA_GP(\t2), %r27
+ /* t1 = t2->fault_ip */
+ LDREG EXCDATA_IP(\t2), \t1
+ .endm
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs
+ struct exception_data *d;
+ d = this_cpu_ptr(&exception_data);
+ d->fault_ip = regs->iaoq[0];
++ d->fault_gp = regs->gr[27];
+ d->fault_space = regs->isr;
+ d->fault_addr = regs->ior;
+
--- /dev/null
+From e54358915d0a00399c11c2c23ae1be674cba188a Mon Sep 17 00:00:00 2001
+From: Nicolai Stange <nicstange@gmail.com>
+Date: Sun, 20 Mar 2016 23:23:46 +0100
+Subject: PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
+
+From: Nicolai Stange <nicstange@gmail.com>
+
+commit e54358915d0a00399c11c2c23ae1be674cba188a upstream.
+
+Despite what the DocBook comment to pkcs7_validate_trust() says, the
+*_trusted argument is never set to false.
+
+pkcs7_validate_trust() only positively sets *_trusted upon encountering
+a trusted PKCS#7 SignedInfo block.
+
+This is quite unfortunate since its callers, system_verify_data() for
+example, depend on pkcs7_validate_trust() clearing *_trusted on non-trust.
+
+Indeed, UBSAN splats when attempting to load the uninitialized local
+variable 'trusted' from system_verify_data() in pkcs7_validate_trust():
+
+ UBSAN: Undefined behaviour in crypto/asymmetric_keys/pkcs7_trust.c:194:14
+ load of value 82 is not a valid value for type '_Bool'
+ [...]
+ Call Trace:
+ [<ffffffff818c4d35>] dump_stack+0xbc/0x117
+ [<ffffffff818c4c79>] ? _atomic_dec_and_lock+0x169/0x169
+ [<ffffffff8194113b>] ubsan_epilogue+0xd/0x4e
+ [<ffffffff819419fa>] __ubsan_handle_load_invalid_value+0x111/0x158
+ [<ffffffff819418e9>] ? val_to_string.constprop.12+0xcf/0xcf
+ [<ffffffff818334a4>] ? x509_request_asymmetric_key+0x114/0x370
+ [<ffffffff814b83f0>] ? kfree+0x220/0x370
+ [<ffffffff818312c2>] ? public_key_verify_signature_2+0x32/0x50
+ [<ffffffff81835e04>] pkcs7_validate_trust+0x524/0x5f0
+ [<ffffffff813c391a>] system_verify_data+0xca/0x170
+ [<ffffffff813c3850>] ? top_trace_array+0x9b/0x9b
+ [<ffffffff81510b29>] ? __vfs_read+0x279/0x3d0
+ [<ffffffff8129372f>] mod_verify_sig+0x1ff/0x290
+ [...]
+
+The implication is that pkcs7_validate_trust() effectively grants trust
+when it really shouldn't have.
+
+Fix this by explicitly setting *_trusted to false at the very beginning
+of pkcs7_validate_trust().
+
+Signed-off-by: Nicolai Stange <nicstange@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/asymmetric_keys/pkcs7_trust.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/crypto/asymmetric_keys/pkcs7_trust.c
++++ b/crypto/asymmetric_keys/pkcs7_trust.c
+@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_me
+ int cached_ret = -ENOKEY;
+ int ret;
+
++ *_trusted = false;
++
+ for (p = pkcs7->certs; p; p = p->next)
+ p->seen = false;
+
--- /dev/null
+From 08a5bb2921e490939f78f38fd0d02858bb709942 Mon Sep 17 00:00:00 2001
+From: Sebastian Siewior <bigeasy@linutronix.de>
+Date: Tue, 8 Mar 2016 10:03:56 +0100
+Subject: powerpc/mm: Fixup preempt underflow with huge pages
+
+From: Sebastian Siewior <bigeasy@linutronix.de>
+
+commit 08a5bb2921e490939f78f38fd0d02858bb709942 upstream.
+
+hugepd_free() used __get_cpu_var() once. Nothing ensured that the code
+accessing the variable did not migrate from one CPU to another and soon
+this was noticed by Tiejun Chen in 94b09d755462 ("powerpc/hugetlb:
+Replace __get_cpu_var with get_cpu_var"). So we had it fixed.
+
+Christoph Lameter was doing his __get_cpu_var() replaces and forgot
+PowerPC. Then he noticed this and sent his fixed up batch again which
+got applied as 69111bac42f5 ("powerpc: Replace __get_cpu_var uses").
+
+The careful reader will noticed one little detail: get_cpu_var() got
+replaced with this_cpu_ptr(). So now we have a put_cpu_var() which does
+a preempt_enable() and nothing that does preempt_disable() so we
+underflow the preempt counter.
+
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Christoph Lameter <cl@linux.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/hugetlbpage.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -414,13 +414,13 @@ static void hugepd_free(struct mmu_gathe
+ {
+ struct hugepd_freelist **batchp;
+
+- batchp = this_cpu_ptr(&hugepd_freelist_cur);
++ batchp = &get_cpu_var(hugepd_freelist_cur);
+
+ if (atomic_read(&tlb->mm->mm_users) < 2 ||
+ cpumask_equal(mm_cpumask(tlb->mm),
+ cpumask_of(smp_processor_id()))) {
+ kmem_cache_free(hugepte_cache, hugepte);
+- put_cpu_var(hugepd_freelist_cur);
++ put_cpu_var(hugepd_freelist_cur);
+ return;
+ }
+
--- /dev/null
+From 01d7c2a2de47890934faba91a71d183795e4348d Mon Sep 17 00:00:00 2001
+From: Oliver O'Halloran <oohall@gmail.com>
+Date: Tue, 8 Mar 2016 09:08:47 +1100
+Subject: powerpc/process: Fix altivec SPR not being saved
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+commit 01d7c2a2de47890934faba91a71d183795e4348d upstream.
+
+In save_sprs() in process.c contains the following test:
+
+ if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC)))
+ t->vrsave = mfspr(SPRN_VRSAVE);
+
+CPU feature with the mask 0x1 is CPU_FTR_COHERENT_ICACHE so the test
+is equivilent to:
+
+ if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
+ cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
+
+On CPUs without support for both (i.e G5) this results in vrsave not
+being saved between context switches. The vector register save/restore
+code doesn't use VRSAVE to determine which registers to save/restore,
+but the value of VRSAVE is used to determine if altivec is being used
+in several code paths.
+
+Fixes: 152d523e6307 ("powerpc: Create context switch helpers save_sprs() and restore_sprs()")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -854,7 +854,7 @@ void restore_tm_state(struct pt_regs *re
+ static inline void save_sprs(struct thread_struct *t)
+ {
+ #ifdef CONFIG_ALTIVEC
+- if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC)))
++ if (cpu_has_feature(CPU_FTR_ALTIVEC))
+ t->vrsave = mfspr(SPRN_VRSAVE);
+ #endif
+ #ifdef CONFIG_PPC_BOOK3S_64
--- /dev/null
+From fc897c95e91451271cd707ee0f71022b9b201ce9 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Thu, 17 Mar 2016 15:00:04 +0100
+Subject: s390/mm: handle PTE-mapped tail pages in fast gup
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+commit fc897c95e91451271cd707ee0f71022b9b201ce9 upstream.
+
+With the THP refcounting rework it is possible to see THP compound tail
+pages mapped with PTEs during a THP split. This needs to be considered
+when using page_cache_get_speculative(), which will always fail on tail
+pages because ->_count is always zero. commit 7aef4172 "mm: handle
+PTE-mapped tail pages in gerneric fast gup implementaiton" fixed it for
+the generic fast gup code by using compound_head(page) instead of page,
+but not for s390.
+
+This patch is a 1:1 adaption of commit 7aef4172 for the s390 fast gup
+code. Without this fix, gup will fall back to the slow path or fail
+in the unlikely scenario that we hit a THP under splitting in-between
+the page table split and the compound page split.
+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/mm/gup.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/s390/mm/gup.c
++++ b/arch/s390/mm/gup.c
+@@ -20,9 +20,9 @@
+ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
+ unsigned long end, int write, struct page **pages, int *nr)
+ {
++ struct page *head, *page;
+ unsigned long mask;
+ pte_t *ptep, pte;
+- struct page *page;
+
+ mask = (write ? _PAGE_PROTECT : 0) | _PAGE_INVALID | _PAGE_SPECIAL;
+
+@@ -37,12 +37,14 @@ static inline int gup_pte_range(pmd_t *p
+ return 0;
+ VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+ page = pte_page(pte);
+- if (!page_cache_get_speculative(page))
++ head = compound_head(page);
++ if (!page_cache_get_speculative(head))
+ return 0;
+ if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+- put_page(page);
++ put_page(head);
+ return 0;
+ }
++ VM_BUG_ON_PAGE(compound_head(page) != head, page);
+ pages[*nr] = page;
+ (*nr)++;
+
hwmon-max1111-return-enodev-from-max1111_read_channel-if-not-instantiated.patch
pkcs-7-pkcs7_validate_trust-initialize-the-_trusted-output-argument.patch
+parisc-fix-sigsys-signals-in-compat-case.patch
+parisc-fix-and-enable-seccomp-filter-support.patch
+parisc-avoid-function-pointers-for-kernel-exception-routines.patch
+parisc-fix-kernel-crash-with-reversed-copy_from_user.patch
+parisc-unbreak-handling-exceptions-from-kernel-modules.patch
+alsa-timer-use-mod_timer-for-rearming-the-system-timer.patch
+alsa-hda-asus-n750jv-external-subwoofer-fixup.patch
+alsa-hda-fix-white-noise-on-asus-n750jv-headphone.patch
+alsa-hda-apply-fix-for-white-noise-on-asus-n550jv-too.patch
+alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch
+mm-fix-invalid-node-in-alloc_migrate_target.patch
+powerpc-mm-fixup-preempt-underflow-with-huge-pages.patch
+s390-mm-handle-pte-mapped-tail-pages-in-fast-gup.patch
+libnvdimm-fix-smart-data-retrieval.patch
+libnvdimm-pfn-fix-uuid-validation.patch
+powerpc-process-fix-altivec-spr-not-being-saved.patch
+compiler-gcc-disable-ftracer-for-__noclone-functions.patch
+arm64-opcodes.h-add-arm-big-endian-config-options-before-including-arm-header.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
